1/* $KAME: key_debug.c,v 1.26 2001/06/27 10:46:50 sakane Exp $ */ 2 3/*- 4 * SPDX-License-Identifier: BSD-3-Clause 5 * 6 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 3. Neither the name of the project nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34#ifdef _KERNEL 35#include "opt_inet.h" 36#include "opt_inet6.h" 37#include "opt_ipsec.h" 38#endif 39 40#include <sys/param.h> 41#ifdef _KERNEL 42#include <sys/systm.h> 43#include <sys/lock.h> 44#include <sys/malloc.h> 45#include <sys/mbuf.h> 46#include <sys/mutex.h> 47#include <sys/queue.h> 48#endif 49#include <sys/socket.h> 50 51#include <net/vnet.h> 52 53#include <netipsec/key_var.h> 54#include <netipsec/key_debug.h> 55 56#include <netinet/in.h> 57#include <netipsec/ipsec.h> 58#ifdef _KERNEL 59#include <netipsec/keydb.h> 60#include <netipsec/xform.h> 61#endif 62 63#ifndef _KERNEL 64#include <ctype.h> 65#include <stdio.h> 66#include <stdlib.h> 67#include <arpa/inet.h> 68#endif /* !_KERNEL */ 69 70static void kdebug_sadb_prop(struct sadb_ext *); 71static void kdebug_sadb_identity(struct sadb_ext *); 72static void kdebug_sadb_supported(struct sadb_ext *); 73static void kdebug_sadb_lifetime(struct sadb_ext *); 74static void kdebug_sadb_sa(struct sadb_ext *); 75static void kdebug_sadb_address(struct sadb_ext *); 76static void kdebug_sadb_key(struct sadb_ext *); 77static void kdebug_sadb_x_sa2(struct sadb_ext *); 78static void kdebug_sadb_x_sa_replay(struct sadb_ext *); 79static void kdebug_sadb_x_natt(struct sadb_ext *); 80 81#ifndef _KERNEL 82#define panic(fmt, ...) { printf(fmt, ## __VA_ARGS__); exit(-1); } 83#endif 84 85/* NOTE: host byte order */ 86 87static const char* 88kdebug_sadb_type(uint8_t type) 89{ 90#define SADB_NAME(n) case SADB_ ## n: return (#n) 91 92 switch (type) { 93 SADB_NAME(RESERVED); 94 SADB_NAME(GETSPI); 95 SADB_NAME(UPDATE); 96 SADB_NAME(ADD); 97 SADB_NAME(DELETE); 98 SADB_NAME(GET); 99 SADB_NAME(ACQUIRE); 100 SADB_NAME(REGISTER); 101 SADB_NAME(EXPIRE); 102 SADB_NAME(FLUSH); 103 SADB_NAME(DUMP); 104 SADB_NAME(X_PROMISC); 105 SADB_NAME(X_PCHANGE); 106 SADB_NAME(X_SPDUPDATE); 107 SADB_NAME(X_SPDADD); 108 SADB_NAME(X_SPDDELETE); 109 SADB_NAME(X_SPDGET); 110 SADB_NAME(X_SPDACQUIRE); 111 SADB_NAME(X_SPDDUMP); 112 SADB_NAME(X_SPDFLUSH); 113 SADB_NAME(X_SPDSETIDX); 114 SADB_NAME(X_SPDEXPIRE); 115 SADB_NAME(X_SPDDELETE2); 116 default: 117 return ("UNKNOWN"); 118 } 119#undef SADB_NAME 120} 121 122static const char* 123kdebug_sadb_exttype(uint16_t type) 124{ 125#define EXT_NAME(n) case SADB_EXT_ ## n: return (#n) 126#define X_NAME(n) case SADB_X_EXT_ ## n: return (#n) 127 128 switch (type) { 129 EXT_NAME(RESERVED); 130 EXT_NAME(SA); 131 EXT_NAME(LIFETIME_CURRENT); 132 EXT_NAME(LIFETIME_HARD); 133 EXT_NAME(LIFETIME_SOFT); 134 EXT_NAME(ADDRESS_SRC); 135 EXT_NAME(ADDRESS_DST); 136 EXT_NAME(ADDRESS_PROXY); 137 EXT_NAME(KEY_AUTH); 138 EXT_NAME(KEY_ENCRYPT); 139 EXT_NAME(IDENTITY_SRC); 140 EXT_NAME(IDENTITY_DST); 141 EXT_NAME(SENSITIVITY); 142 EXT_NAME(PROPOSAL); 143 EXT_NAME(SUPPORTED_AUTH); 144 EXT_NAME(SUPPORTED_ENCRYPT); 145 EXT_NAME(SPIRANGE); 146 X_NAME(KMPRIVATE); 147 X_NAME(POLICY); 148 X_NAME(SA2); 149 X_NAME(NAT_T_TYPE); 150 X_NAME(NAT_T_SPORT); 151 X_NAME(NAT_T_DPORT); 152 X_NAME(NAT_T_OAI); 153 X_NAME(NAT_T_OAR); 154 X_NAME(NAT_T_FRAG); 155 X_NAME(SA_REPLAY); 156 X_NAME(NEW_ADDRESS_SRC); 157 X_NAME(NEW_ADDRESS_DST); 158 default: 159 return ("UNKNOWN"); 160 }; 161#undef EXT_NAME 162#undef X_NAME 163} 164 165/* %%%: about struct sadb_msg */ 166void 167kdebug_sadb(struct sadb_msg *base) 168{ 169 struct sadb_ext *ext; 170 int tlen, extlen; 171 172 /* sanity check */ 173 if (base == NULL) 174 panic("%s: NULL pointer was passed.\n", __func__); 175 176 printf("sadb_msg{ version=%u type=%u(%s) errno=%u satype=%u\n", 177 base->sadb_msg_version, base->sadb_msg_type, 178 kdebug_sadb_type(base->sadb_msg_type), 179 base->sadb_msg_errno, base->sadb_msg_satype); 180 printf(" len=%u reserved=%u seq=%u pid=%u\n", 181 base->sadb_msg_len, base->sadb_msg_reserved, 182 base->sadb_msg_seq, base->sadb_msg_pid); 183 184 tlen = PFKEY_UNUNIT64(base->sadb_msg_len) - sizeof(struct sadb_msg); 185 ext = (struct sadb_ext *)((caddr_t)base + sizeof(struct sadb_msg)); 186 187 while (tlen > 0) { 188 printf("sadb_ext{ len=%u type=%u(%s) }\n", 189 ext->sadb_ext_len, ext->sadb_ext_type, 190 kdebug_sadb_exttype(ext->sadb_ext_type)); 191 192 if (ext->sadb_ext_len == 0) { 193 printf("%s: invalid ext_len=0 was passed.\n", __func__); 194 return; 195 } 196 if (ext->sadb_ext_len > tlen) { 197 printf("%s: ext_len too big (%u > %u).\n", 198 __func__, ext->sadb_ext_len, tlen); 199 return; 200 } 201 202 switch (ext->sadb_ext_type) { 203 case SADB_EXT_SA: 204 kdebug_sadb_sa(ext); 205 break; 206 case SADB_EXT_LIFETIME_CURRENT: 207 case SADB_EXT_LIFETIME_HARD: 208 case SADB_EXT_LIFETIME_SOFT: 209 kdebug_sadb_lifetime(ext); 210 break; 211 case SADB_EXT_ADDRESS_SRC: 212 case SADB_EXT_ADDRESS_DST: 213 case SADB_EXT_ADDRESS_PROXY: 214 case SADB_X_EXT_NAT_T_OAI: 215 case SADB_X_EXT_NAT_T_OAR: 216 case SADB_X_EXT_NEW_ADDRESS_SRC: 217 case SADB_X_EXT_NEW_ADDRESS_DST: 218 kdebug_sadb_address(ext); 219 break; 220 case SADB_EXT_KEY_AUTH: 221 case SADB_EXT_KEY_ENCRYPT: 222 kdebug_sadb_key(ext); 223 break; 224 case SADB_EXT_IDENTITY_SRC: 225 case SADB_EXT_IDENTITY_DST: 226 kdebug_sadb_identity(ext); 227 break; 228 case SADB_EXT_SENSITIVITY: 229 break; 230 case SADB_EXT_PROPOSAL: 231 kdebug_sadb_prop(ext); 232 break; 233 case SADB_EXT_SUPPORTED_AUTH: 234 case SADB_EXT_SUPPORTED_ENCRYPT: 235 kdebug_sadb_supported(ext); 236 break; 237 case SADB_EXT_SPIRANGE: 238 case SADB_X_EXT_KMPRIVATE: 239 break; 240 case SADB_X_EXT_POLICY: 241 kdebug_sadb_x_policy(ext); 242 break; 243 case SADB_X_EXT_SA2: 244 kdebug_sadb_x_sa2(ext); 245 break; 246 case SADB_X_EXT_SA_REPLAY: 247 kdebug_sadb_x_sa_replay(ext); 248 break; 249 case SADB_X_EXT_NAT_T_TYPE: 250 case SADB_X_EXT_NAT_T_SPORT: 251 case SADB_X_EXT_NAT_T_DPORT: 252 kdebug_sadb_x_natt(ext); 253 break; 254 default: 255 printf("%s: invalid ext_type %u\n", __func__, 256 ext->sadb_ext_type); 257 return; 258 } 259 260 extlen = PFKEY_UNUNIT64(ext->sadb_ext_len); 261 tlen -= extlen; 262 ext = (struct sadb_ext *)((caddr_t)ext + extlen); 263 } 264 265 return; 266} 267 268static void 269kdebug_sadb_prop(struct sadb_ext *ext) 270{ 271 struct sadb_prop *prop = (struct sadb_prop *)ext; 272 struct sadb_comb *comb; 273 int len; 274 275 /* sanity check */ 276 if (ext == NULL) 277 panic("%s: NULL pointer was passed.\n", __func__); 278 279 len = (PFKEY_UNUNIT64(prop->sadb_prop_len) - sizeof(*prop)) 280 / sizeof(*comb); 281 comb = (struct sadb_comb *)(prop + 1); 282 printf("sadb_prop{ replay=%u\n", prop->sadb_prop_replay); 283 284 while (len--) { 285 printf("sadb_comb{ auth=%u encrypt=%u " 286 "flags=0x%04x reserved=0x%08x\n", 287 comb->sadb_comb_auth, comb->sadb_comb_encrypt, 288 comb->sadb_comb_flags, comb->sadb_comb_reserved); 289 290 printf(" auth_minbits=%u auth_maxbits=%u " 291 "encrypt_minbits=%u encrypt_maxbits=%u\n", 292 comb->sadb_comb_auth_minbits, 293 comb->sadb_comb_auth_maxbits, 294 comb->sadb_comb_encrypt_minbits, 295 comb->sadb_comb_encrypt_maxbits); 296 297 printf(" soft_alloc=%u hard_alloc=%u " 298 "soft_bytes=%lu hard_bytes=%lu\n", 299 comb->sadb_comb_soft_allocations, 300 comb->sadb_comb_hard_allocations, 301 (unsigned long)comb->sadb_comb_soft_bytes, 302 (unsigned long)comb->sadb_comb_hard_bytes); 303 304 printf(" soft_alloc=%lu hard_alloc=%lu " 305 "soft_bytes=%lu hard_bytes=%lu }\n", 306 (unsigned long)comb->sadb_comb_soft_addtime, 307 (unsigned long)comb->sadb_comb_hard_addtime, 308 (unsigned long)comb->sadb_comb_soft_usetime, 309 (unsigned long)comb->sadb_comb_hard_usetime); 310 comb++; 311 } 312 printf("}\n"); 313 314 return; 315} 316 317static void 318kdebug_sadb_identity(struct sadb_ext *ext) 319{ 320 struct sadb_ident *id = (struct sadb_ident *)ext; 321 int len; 322 323 /* sanity check */ 324 if (ext == NULL) 325 panic("%s: NULL pointer was passed.\n", __func__); 326 327 len = PFKEY_UNUNIT64(id->sadb_ident_len) - sizeof(*id); 328 printf("sadb_ident_%s{", 329 id->sadb_ident_exttype == SADB_EXT_IDENTITY_SRC ? "src" : "dst"); 330 switch (id->sadb_ident_type) { 331 default: 332 printf(" type=%d id=%lu", 333 id->sadb_ident_type, (u_long)id->sadb_ident_id); 334 if (len) { 335#ifdef _KERNEL 336 ipsec_hexdump((caddr_t)(id + 1), len); /*XXX cast ?*/ 337#else 338 char *p, *ep; 339 printf("\n str=\""); 340 p = (char *)(id + 1); 341 ep = p + len; 342 for (/*nothing*/; *p && p < ep; p++) { 343 if (isprint(*p)) 344 printf("%c", *p & 0xff); 345 else 346 printf("\\%03o", *p & 0xff); 347 } 348#endif 349 printf("\""); 350 } 351 break; 352 } 353 354 printf(" }\n"); 355 356 return; 357} 358 359static void 360kdebug_sadb_supported(struct sadb_ext *ext) 361{ 362 struct sadb_supported *sup = (struct sadb_supported *)ext; 363 struct sadb_alg *alg; 364 int len; 365 366 /* sanity check */ 367 if (ext == NULL) 368 panic("%s: NULL pointer was passed.\n", __func__); 369 370 len = (PFKEY_UNUNIT64(sup->sadb_supported_len) - sizeof(*sup)) 371 / sizeof(*alg); 372 alg = (struct sadb_alg *)(sup + 1); 373 printf("sadb_sup{\n"); 374 while (len--) { 375 printf(" { id=%d ivlen=%d min=%d max=%d }\n", 376 alg->sadb_alg_id, alg->sadb_alg_ivlen, 377 alg->sadb_alg_minbits, alg->sadb_alg_maxbits); 378 alg++; 379 } 380 printf("}\n"); 381 382 return; 383} 384 385static void 386kdebug_sadb_lifetime(struct sadb_ext *ext) 387{ 388 struct sadb_lifetime *lft = (struct sadb_lifetime *)ext; 389 390 /* sanity check */ 391 if (ext == NULL) 392 panic("%s: NULL pointer was passed.\n", __func__); 393 394 printf("sadb_lifetime{ alloc=%u, bytes=%u\n", 395 lft->sadb_lifetime_allocations, 396 (u_int32_t)lft->sadb_lifetime_bytes); 397 printf(" addtime=%u, usetime=%u }\n", 398 (u_int32_t)lft->sadb_lifetime_addtime, 399 (u_int32_t)lft->sadb_lifetime_usetime); 400 401 return; 402} 403 404static void 405kdebug_sadb_sa(struct sadb_ext *ext) 406{ 407 struct sadb_sa *sa = (struct sadb_sa *)ext; 408 409 /* sanity check */ 410 if (ext == NULL) 411 panic("%s: NULL pointer was passed.\n", __func__); 412 413 printf("sadb_sa{ spi=%u replay=%u state=%u\n", 414 (u_int32_t)ntohl(sa->sadb_sa_spi), sa->sadb_sa_replay, 415 sa->sadb_sa_state); 416 printf(" auth=%u encrypt=%u flags=0x%08x }\n", 417 sa->sadb_sa_auth, sa->sadb_sa_encrypt, sa->sadb_sa_flags); 418 419 return; 420} 421 422static void 423kdebug_sadb_address(struct sadb_ext *ext) 424{ 425 struct sadb_address *addr = (struct sadb_address *)ext; 426 427 /* sanity check */ 428 if (ext == NULL) 429 panic("%s: NULL pointer was passed.\n", __func__); 430 431 printf("sadb_address{ proto=%u prefixlen=%u reserved=0x%02x%02x }\n", 432 addr->sadb_address_proto, addr->sadb_address_prefixlen, 433 ((u_char *)&addr->sadb_address_reserved)[0], 434 ((u_char *)&addr->sadb_address_reserved)[1]); 435 436 kdebug_sockaddr((struct sockaddr *)((caddr_t)ext + sizeof(*addr))); 437} 438 439static void 440kdebug_sadb_key(struct sadb_ext *ext) 441{ 442 struct sadb_key *key = (struct sadb_key *)ext; 443 444 /* sanity check */ 445 if (ext == NULL) 446 panic("%s: NULL pointer was passed.\n", __func__); 447 448 printf("sadb_key{ bits=%u reserved=%u\n", 449 key->sadb_key_bits, key->sadb_key_reserved); 450 printf(" key="); 451 452 /* sanity check 2 */ 453 if ((key->sadb_key_bits >> 3) > 454 (PFKEY_UNUNIT64(key->sadb_key_len) - sizeof(struct sadb_key))) { 455 printf("%s: key length mismatch, bit:%d len:%ld.\n", 456 __func__, 457 key->sadb_key_bits >> 3, 458 (long)PFKEY_UNUNIT64(key->sadb_key_len) - sizeof(struct sadb_key)); 459 } 460 461 ipsec_hexdump((caddr_t)key + sizeof(struct sadb_key), 462 key->sadb_key_bits >> 3); 463 printf(" }\n"); 464 return; 465} 466 467static void 468kdebug_sadb_x_sa2(struct sadb_ext *ext) 469{ 470 struct sadb_x_sa2 *sa2 = (struct sadb_x_sa2 *)ext; 471 472 /* sanity check */ 473 if (ext == NULL) 474 panic("%s: NULL pointer was passed.\n", __func__); 475 476 printf("sadb_x_sa2{ mode=%u reqid=%u\n", 477 sa2->sadb_x_sa2_mode, sa2->sadb_x_sa2_reqid); 478 printf(" reserved1=%u reserved2=%u sequence=%u }\n", 479 sa2->sadb_x_sa2_reserved1, sa2->sadb_x_sa2_reserved2, 480 sa2->sadb_x_sa2_sequence); 481 482 return; 483} 484 485static void 486kdebug_sadb_x_sa_replay(struct sadb_ext *ext) 487{ 488 struct sadb_x_sa_replay *replay; 489 490 /* sanity check */ 491 if (ext == NULL) 492 panic("%s: NULL pointer was passed.\n", __func__); 493 494 replay = (struct sadb_x_sa_replay *)ext; 495 printf("sadb_x_sa_replay{ replay=%u }\n", 496 replay->sadb_x_sa_replay_replay); 497} 498 499static void 500kdebug_sadb_x_natt(struct sadb_ext *ext) 501{ 502 struct sadb_x_nat_t_type *type; 503 struct sadb_x_nat_t_port *port; 504 505 /* sanity check */ 506 if (ext == NULL) 507 panic("%s: NULL pointer was passed.\n", __func__); 508 509 if (ext->sadb_ext_type == SADB_X_EXT_NAT_T_TYPE) { 510 type = (struct sadb_x_nat_t_type *)ext; 511 printf("sadb_x_nat_t_type{ type=%u }\n", 512 type->sadb_x_nat_t_type_type); 513 } else { 514 port = (struct sadb_x_nat_t_port *)ext; 515 printf("sadb_x_nat_t_port{ port=%u }\n", 516 ntohs(port->sadb_x_nat_t_port_port)); 517 } 518} 519 520void 521kdebug_sadb_x_policy(struct sadb_ext *ext) 522{ 523 struct sadb_x_policy *xpl = (struct sadb_x_policy *)ext; 524 struct sockaddr *addr; 525 526 /* sanity check */ 527 if (ext == NULL) 528 panic("%s: NULL pointer was passed.\n", __func__); 529 530 printf("sadb_x_policy{ type=%u dir=%u id=%x scope=%u %s=%u }\n", 531 xpl->sadb_x_policy_type, xpl->sadb_x_policy_dir, 532 xpl->sadb_x_policy_id, xpl->sadb_x_policy_scope, 533 xpl->sadb_x_policy_scope == IPSEC_POLICYSCOPE_IFNET ? 534 "ifindex": "priority", xpl->sadb_x_policy_priority); 535 536 if (xpl->sadb_x_policy_type == IPSEC_POLICY_IPSEC) { 537 int tlen; 538 struct sadb_x_ipsecrequest *xisr; 539 540 tlen = PFKEY_UNUNIT64(xpl->sadb_x_policy_len) - sizeof(*xpl); 541 xisr = (struct sadb_x_ipsecrequest *)(xpl + 1); 542 543 while (tlen > 0) { 544 printf(" { len=%u proto=%u mode=%u level=%u reqid=%u\n", 545 xisr->sadb_x_ipsecrequest_len, 546 xisr->sadb_x_ipsecrequest_proto, 547 xisr->sadb_x_ipsecrequest_mode, 548 xisr->sadb_x_ipsecrequest_level, 549 xisr->sadb_x_ipsecrequest_reqid); 550 551 if (xisr->sadb_x_ipsecrequest_len > sizeof(*xisr)) { 552 addr = (struct sockaddr *)(xisr + 1); 553 kdebug_sockaddr(addr); 554 addr = (struct sockaddr *)((caddr_t)addr 555 + addr->sa_len); 556 kdebug_sockaddr(addr); 557 } 558 559 printf(" }\n"); 560 561 /* prevent infinite loop */ 562 if (xisr->sadb_x_ipsecrequest_len <= 0) { 563 printf("%s: wrong policy struct.\n", __func__); 564 return; 565 } 566 /* prevent overflow */ 567 if (xisr->sadb_x_ipsecrequest_len > tlen) { 568 printf("%s: invalid ipsec policy length " 569 "(%u > %u)\n", __func__, 570 xisr->sadb_x_ipsecrequest_len, tlen); 571 return; 572 } 573 574 tlen -= xisr->sadb_x_ipsecrequest_len; 575 576 xisr = (struct sadb_x_ipsecrequest *)((caddr_t)xisr 577 + xisr->sadb_x_ipsecrequest_len); 578 } 579 580 if (tlen != 0) 581 panic("%s: wrong policy struct.\n", __func__); 582 } 583 584 return; 585} 586 587#ifdef _KERNEL 588/* %%%: about SPD and SAD */ 589const char* 590kdebug_secpolicy_state(u_int state) 591{ 592 593 switch (state) { 594 case IPSEC_SPSTATE_DEAD: 595 return ("dead"); 596 case IPSEC_SPSTATE_LARVAL: 597 return ("larval"); 598 case IPSEC_SPSTATE_ALIVE: 599 return ("alive"); 600 case IPSEC_SPSTATE_PCB: 601 return ("pcb"); 602 case IPSEC_SPSTATE_IFNET: 603 return ("ifnet"); 604 } 605 return ("unknown"); 606} 607 608const char* 609kdebug_secpolicy_policy(u_int policy) 610{ 611 612 switch (policy) { 613 case IPSEC_POLICY_DISCARD: 614 return ("discard"); 615 case IPSEC_POLICY_NONE: 616 return ("none"); 617 case IPSEC_POLICY_IPSEC: 618 return ("ipsec"); 619 case IPSEC_POLICY_ENTRUST: 620 return ("entrust"); 621 case IPSEC_POLICY_BYPASS: 622 return ("bypass"); 623 } 624 return ("unknown"); 625} 626 627const char* 628kdebug_secpolicyindex_dir(u_int dir) 629{ 630 631 switch (dir) { 632 case IPSEC_DIR_ANY: 633 return ("any"); 634 case IPSEC_DIR_INBOUND: 635 return ("in"); 636 case IPSEC_DIR_OUTBOUND: 637 return ("out"); 638 } 639 return ("unknown"); 640} 641 642const char* 643kdebug_ipsecrequest_level(u_int level) 644{ 645 646 switch (level) { 647 case IPSEC_LEVEL_DEFAULT: 648 return ("default"); 649 case IPSEC_LEVEL_USE: 650 return ("use"); 651 case IPSEC_LEVEL_REQUIRE: 652 return ("require"); 653 case IPSEC_LEVEL_UNIQUE: 654 return ("unique"); 655 } 656 return ("unknown"); 657} 658 659const char* 660kdebug_secasindex_mode(u_int mode) 661{ 662 663 switch (mode) { 664 case IPSEC_MODE_ANY: 665 return ("any"); 666 case IPSEC_MODE_TRANSPORT: 667 return ("transport"); 668 case IPSEC_MODE_TUNNEL: 669 return ("tunnel"); 670 case IPSEC_MODE_TCPMD5: 671 return ("tcp-md5"); 672 } 673 return ("unknown"); 674} 675 676const char* 677kdebug_secasv_state(u_int state) 678{ 679 680 switch (state) { 681 case SADB_SASTATE_LARVAL: 682 return ("larval"); 683 case SADB_SASTATE_MATURE: 684 return ("mature"); 685 case SADB_SASTATE_DYING: 686 return ("dying"); 687 case SADB_SASTATE_DEAD: 688 return ("dead"); 689 } 690 return ("unknown"); 691} 692 693static char* 694kdebug_port2str(const struct sockaddr *sa, char *buf, size_t len) 695{ 696 uint16_t port; 697 698 IPSEC_ASSERT(sa != NULL, ("null sa")); 699 switch (sa->sa_family) { 700#ifdef INET 701 case AF_INET: 702 port = ntohs(((const struct sockaddr_in *)sa)->sin_port); 703 break; 704#endif 705#ifdef INET6 706 case AF_INET6: 707 port = ntohs(((const struct sockaddr_in6 *)sa)->sin6_port); 708 break; 709#endif 710 default: 711 port = 0; 712 } 713 if (port == 0) 714 return ("*"); 715 snprintf(buf, len, "%u", port); 716 return (buf); 717} 718 719void 720kdebug_secpolicy(struct secpolicy *sp) 721{ 722 u_int idx; 723 724 IPSEC_ASSERT(sp != NULL, ("null sp")); 725 printf("SP { refcnt=%u id=%u priority=%u state=%s policy=%s\n", 726 sp->refcnt, sp->id, sp->priority, 727 kdebug_secpolicy_state(sp->state), 728 kdebug_secpolicy_policy(sp->policy)); 729 kdebug_secpolicyindex(&sp->spidx, " "); 730 for (idx = 0; idx < sp->tcount; idx++) { 731 printf(" req[%u]{ level=%s ", idx, 732 kdebug_ipsecrequest_level(sp->req[idx]->level)); 733 kdebug_secasindex(&sp->req[idx]->saidx, NULL); 734 printf(" }\n"); 735 } 736 printf("}\n"); 737} 738 739void 740kdebug_secpolicyindex(struct secpolicyindex *spidx, const char *indent) 741{ 742 char buf[IPSEC_ADDRSTRLEN]; 743 744 IPSEC_ASSERT(spidx != NULL, ("null spidx")); 745 if (indent != NULL) 746 printf("%s", indent); 747 printf("spidx { dir=%s ul_proto=", 748 kdebug_secpolicyindex_dir(spidx->dir)); 749 if (spidx->ul_proto == IPSEC_ULPROTO_ANY) 750 printf("* "); 751 else 752 printf("%u ", spidx->ul_proto); 753 printf("%s/%u -> ", ipsec_address(&spidx->src, buf, sizeof(buf)), 754 spidx->prefs); 755 printf("%s/%u }\n", ipsec_address(&spidx->dst, buf, sizeof(buf)), 756 spidx->prefd); 757} 758 759void 760kdebug_secasindex(const struct secasindex *saidx, const char *indent) 761{ 762 char buf[IPSEC_ADDRSTRLEN], port[6]; 763 764 IPSEC_ASSERT(saidx != NULL, ("null saidx")); 765 if (indent != NULL) 766 printf("%s", indent); 767 printf("saidx { mode=%s proto=%u reqid=%u ", 768 kdebug_secasindex_mode(saidx->mode), saidx->proto, saidx->reqid); 769 printf("%s:%s -> ", ipsec_address(&saidx->src, buf, sizeof(buf)), 770 kdebug_port2str(&saidx->src.sa, port, sizeof(port))); 771 printf("%s:%s }\n", ipsec_address(&saidx->dst, buf, sizeof(buf)), 772 kdebug_port2str(&saidx->dst.sa, port, sizeof(port))); 773} 774 775static void 776kdebug_sec_lifetime(struct seclifetime *lft, const char *indent) 777{ 778 779 IPSEC_ASSERT(lft != NULL, ("null lft")); 780 if (indent != NULL) 781 printf("%s", indent); 782 printf("lifetime { alloc=%u, bytes=%ju addtime=%ju usetime=%ju }\n", 783 lft->allocations, (uintmax_t)lft->bytes, (uintmax_t)lft->addtime, 784 (uintmax_t)lft->usetime); 785} 786 787void 788kdebug_secash(struct secashead *sah, const char *indent) 789{ 790 791 IPSEC_ASSERT(sah != NULL, ("null sah")); 792 if (indent != NULL) 793 printf("%s", indent); 794 printf("SAH { refcnt=%u state=%s\n", sah->refcnt, 795 kdebug_secasv_state(sah->state)); 796 if (indent != NULL) 797 printf("%s", indent); 798 kdebug_secasindex(&sah->saidx, indent); 799 if (indent != NULL) 800 printf("%s", indent); 801 printf("}\n"); 802} 803 804#ifdef IPSEC_DEBUG 805static void 806kdebug_secreplay(struct secreplay *rpl) 807{ 808 int len, l; 809 810 SECREPLAY_LOCK(rpl); 811 812 IPSEC_ASSERT(rpl != NULL, ("null rpl")); 813 printf(" secreplay{ count=%lu bitmap_size=%u wsize=%u last=%lu", 814 rpl->count, rpl->bitmap_size, rpl->wsize, rpl->last); 815 816 if (rpl->bitmap == NULL) { 817 printf(" }\n"); 818 SECREPLAY_UNLOCK(rpl); 819 return; 820 } 821 822 printf("\n bitmap { "); 823 for (len = 0; len < rpl->bitmap_size*4; len++) { 824 for (l = 7; l >= 0; l--) 825 printf("%u", (((rpl->bitmap)[len] >> l) & 1) ? 1 : 0); 826 } 827 printf(" }\n"); 828 SECREPLAY_UNLOCK(rpl); 829} 830#endif /* IPSEC_DEBUG */ 831 832static void 833kdebug_secnatt(struct secnatt *natt) 834{ 835 char buf[IPSEC_ADDRSTRLEN]; 836 837 IPSEC_ASSERT(natt != NULL, ("null natt")); 838 printf(" natt{ sport=%u dport=%u ", ntohs(natt->sport), 839 ntohs(natt->dport)); 840 if (natt->flags & IPSEC_NATT_F_OAI) 841 printf("oai=%s ", ipsec_address(&natt->oai, buf, sizeof(buf))); 842 if (natt->flags & IPSEC_NATT_F_OAR) 843 printf("oar=%s ", ipsec_address(&natt->oar, buf, sizeof(buf))); 844 printf("}\n"); 845} 846 847void 848kdebug_secasv(struct secasvar *sav) 849{ 850 struct seclifetime lft_c; 851 852 IPSEC_ASSERT(sav != NULL, ("null sav")); 853 854 printf("SA { refcnt=%u spi=%u seq=%u pid=%u flags=0x%x state=%s\n", 855 sav->refcnt, ntohl(sav->spi), sav->seq, (uint32_t)sav->pid, 856 sav->flags, kdebug_secasv_state(sav->state)); 857 kdebug_secash(sav->sah, " "); 858 859 lft_c.addtime = sav->created; 860 lft_c.allocations = (uint32_t)counter_u64_fetch( 861 sav->lft_c_allocations); 862 lft_c.bytes = counter_u64_fetch(sav->lft_c_bytes); 863 lft_c.usetime = sav->firstused; 864 kdebug_sec_lifetime(&lft_c, " c_"); 865 if (sav->lft_h != NULL) 866 kdebug_sec_lifetime(sav->lft_h, " h_"); 867 if (sav->lft_s != NULL) 868 kdebug_sec_lifetime(sav->lft_s, " s_"); 869 870 if (sav->tdb_authalgxform != NULL) 871 printf(" alg_auth=%s\n", sav->tdb_authalgxform->name); 872 if (sav->key_auth != NULL) 873 KEYDBG(DUMP, 874 kdebug_sadb_key((struct sadb_ext *)sav->key_auth)); 875 if (sav->tdb_encalgxform != NULL) 876 printf(" alg_enc=%s\n", sav->tdb_encalgxform->name); 877 if (sav->key_enc != NULL) 878 KEYDBG(DUMP, 879 kdebug_sadb_key((struct sadb_ext *)sav->key_enc)); 880 if (sav->natt != NULL) 881 kdebug_secnatt(sav->natt); 882 if (sav->replay != NULL) { 883 KEYDBG(DUMP, 884 SECASVAR_RLOCK_TRACKER; 885 886 SECASVAR_RLOCK(sav); 887 kdebug_secreplay(sav->replay); 888 SECASVAR_RUNLOCK(sav)); 889 } 890 printf("}\n"); 891} 892 893void 894kdebug_mbufhdr(const struct mbuf *m) 895{ 896 /* sanity check */ 897 if (m == NULL) 898 return; 899 900 printf("mbuf(%p){ m_next:%p m_nextpkt:%p m_data:%p " 901 "m_len:%d m_type:0x%02x m_flags:0x%02x }\n", 902 m, m->m_next, m->m_nextpkt, m->m_data, 903 m->m_len, m->m_type, m->m_flags); 904 905 if (m->m_flags & M_PKTHDR) { 906 printf(" m_pkthdr{ len:%d rcvif:%p }\n", 907 m->m_pkthdr.len, m->m_pkthdr.rcvif); 908 } 909 910 if (m->m_flags & M_EXT) { 911 printf(" m_ext{ ext_buf:%p ext_free:%p " 912 "ext_size:%u ext_cnt:%p }\n", 913 m->m_ext.ext_buf, m->m_ext.ext_free, 914 m->m_ext.ext_size, m->m_ext.ext_cnt); 915 } 916 917 return; 918} 919 920void 921kdebug_mbuf(const struct mbuf *m0) 922{ 923 const struct mbuf *m = m0; 924 int i; 925 926 for (; m; m = m->m_next) { 927 kdebug_mbufhdr(m); 928 printf(" m_data:\n"); 929 for (i = 0; i < m->m_len; i++) { 930 if (i && i % 32 == 0) 931 printf("\n"); 932 if (i % 4 == 0) 933 printf(" "); 934 printf("%02x", mtod(m, const u_char *)[i]); 935 } 936 printf("\n"); 937 } 938 939 return; 940} 941 942/* Return a printable string for the address. */ 943char * 944ipsec_address(const union sockaddr_union* sa, char *buf, socklen_t size) 945{ 946 947 switch (sa->sa.sa_family) { 948#ifdef INET 949 case AF_INET: 950 return (inet_ntop(AF_INET, &sa->sin.sin_addr, buf, size)); 951#endif /* INET */ 952#ifdef INET6 953 case AF_INET6: 954 if (IN6_IS_SCOPE_LINKLOCAL(&sa->sin6.sin6_addr)) { 955 snprintf(buf, size, "%s%%%u", inet_ntop(AF_INET6, 956 &sa->sin6.sin6_addr, buf, size), 957 sa->sin6.sin6_scope_id); 958 return (buf); 959 } else 960 return (inet_ntop(AF_INET6, &sa->sin6.sin6_addr, 961 buf, size)); 962#endif /* INET6 */ 963 case 0: 964 return ("*"); 965 default: 966 return ("(unknown address family)"); 967 } 968} 969 970char * 971ipsec_sa2str(struct secasvar *sav, char *buf, size_t size) 972{ 973 char sbuf[IPSEC_ADDRSTRLEN], dbuf[IPSEC_ADDRSTRLEN]; 974 975 snprintf(buf, size, "SA(SPI=%08lx src=%s dst=%s)", 976 (u_long)ntohl(sav->spi), 977 ipsec_address(&sav->sah->saidx.src, sbuf, sizeof(sbuf)), 978 ipsec_address(&sav->sah->saidx.dst, dbuf, sizeof(dbuf))); 979 return (buf); 980} 981 982#endif /* _KERNEL */ 983 984void 985kdebug_sockaddr(struct sockaddr *addr) 986{ 987 char buf[IPSEC_ADDRSTRLEN]; 988 989 /* sanity check */ 990 if (addr == NULL) 991 panic("%s: NULL pointer was passed.\n", __func__); 992 993 switch (addr->sa_family) { 994#ifdef INET 995 case AF_INET: { 996 struct sockaddr_in *sin; 997 998 sin = (struct sockaddr_in *)addr; 999 inet_ntop(AF_INET, &sin->sin_addr, buf, sizeof(buf)); 1000 break; 1001 } 1002#endif 1003#ifdef INET6 1004 case AF_INET6: { 1005 struct sockaddr_in6 *sin6; 1006 1007 sin6 = (struct sockaddr_in6 *)addr; 1008 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) { 1009 snprintf(buf, sizeof(buf), "%s%%%u", 1010 inet_ntop(AF_INET6, &sin6->sin6_addr, buf, 1011 sizeof(buf)), sin6->sin6_scope_id); 1012 } else 1013 inet_ntop(AF_INET6, &sin6->sin6_addr, buf, 1014 sizeof(buf)); 1015 break; 1016 } 1017#endif 1018 default: 1019 sprintf(buf, "unknown"); 1020 } 1021 printf("sockaddr{ len=%u family=%u addr=%s }\n", addr->sa_len, 1022 addr->sa_family, buf); 1023} 1024 1025void 1026ipsec_bindump(caddr_t buf, int len) 1027{ 1028 int i; 1029 1030 for (i = 0; i < len; i++) 1031 printf("%c", (unsigned char)buf[i]); 1032 1033 return; 1034} 1035 1036void 1037ipsec_hexdump(caddr_t buf, int len) 1038{ 1039 int i; 1040 1041 for (i = 0; i < len; i++) { 1042 if (i != 0 && i % 32 == 0) printf("\n"); 1043 if (i % 4 == 0) printf(" "); 1044 printf("%02x", (unsigned char)buf[i]); 1045 } 1046#if 0 1047 if (i % 32 != 0) printf("\n"); 1048#endif 1049 1050 return; 1051} 1052