xref: /freebsd/lib/libipsec/pfkey_dump.c (revision 81ad626541db97eb356e2c1d4a20eb2a26a766ab)
1 /*	$KAME: pfkey_dump.c,v 1.45 2003/09/08 10:14:56 itojun Exp $	*/
2 
3 /*-
4  * SPDX-License-Identifier: BSD-3-Clause
5  *
6  * Copyright (C) 1995, 1996, 1997, 1998, and 1999 WIDE Project.
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  * 3. Neither the name of the project nor the names of its contributors
18  *    may be used to endorse or promote products derived from this software
19  *    without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  */
33 
34 #include <sys/cdefs.h>
35 __FBSDID("$FreeBSD$");
36 
37 #include <sys/types.h>
38 #include <sys/param.h>
39 #include <sys/socket.h>
40 #include <net/if.h>
41 #include <net/pfkeyv2.h>
42 #include <netipsec/ipsec.h>
43 #include <netipsec/key_var.h>
44 #include <netipsec/key_debug.h>
45 
46 #include <netinet/in.h>
47 #include <arpa/inet.h>
48 
49 #include <stdlib.h>
50 #include <unistd.h>
51 #include <stdio.h>
52 #include <string.h>
53 #include <time.h>
54 #include <netdb.h>
55 
56 #include "ipsec_strerror.h"
57 #include "libpfkey.h"
58 
59 /* cope with old kame headers - ugly */
60 #ifndef SADB_X_AALG_NULL
61 #define SADB_X_AALG_NULL	SADB_AALG_NULL
62 #endif
63 
64 #ifndef SADB_X_EALG_RC5CBC
65 #ifdef SADB_EALG_RC5CBC
66 #define SADB_X_EALG_RC5CBC	SADB_EALG_RC5CBC
67 #endif
68 #endif
69 
70 #define GETMSGSTR(str, num) \
71 do { \
72 	if (sizeof((str)[0]) == 0 \
73 	 || num >= sizeof(str)/sizeof((str)[0])) \
74 		printf("%u ", (num)); \
75 	else if (strlen((str)[(num)]) == 0) \
76 		printf("%u ", (num)); \
77 	else \
78 		printf("%s ", (str)[(num)]); \
79 } while (0)
80 
81 #define GETMSGV2S(v2s, num) \
82 do { \
83 	struct val2str *p;  \
84 	for (p = (v2s); p && p->str; p++) { \
85 		if (p->val == (num)) \
86 			break; \
87 	} \
88 	if (p && p->str) \
89 		printf("%s ", p->str); \
90 	else \
91 		printf("%u ", (num)); \
92 } while (0)
93 
94 static char *str_ipaddr(struct sockaddr *);
95 static char *str_prefport(u_int, u_int, u_int, u_int);
96 static void str_upperspec(u_int, u_int, u_int);
97 static char *str_time(time_t);
98 static void str_lifetime_byte(struct sadb_lifetime *, char *);
99 
100 struct val2str {
101 	int val;
102 	const char *str;
103 };
104 
105 /*
106  * Must to be re-written about following strings.
107  */
108 static char *str_satype[] = {
109 	"unspec",
110 	"unknown",
111 	"ah",
112 	"esp",
113 	"unknown",
114 	"rsvp",
115 	"ospfv2",
116 	"ripv2",
117 	"mip",
118 	"ipcomp",
119 	"policy",
120 	"tcp"
121 };
122 
123 static char *str_mode[] = {
124 	"any",
125 	"transport",
126 	"tunnel",
127 };
128 
129 static char *str_state[] = {
130 	"larval",
131 	"mature",
132 	"dying",
133 	"dead",
134 };
135 
136 static struct val2str str_alg_auth[] = {
137 	{ SADB_AALG_NONE, "none", },
138 	{ SADB_AALG_SHA1HMAC, "hmac-sha1", },
139 	{ SADB_X_AALG_NULL, "null", },
140 	{ SADB_X_AALG_TCP_MD5, "tcp-md5", },
141 #ifdef SADB_X_AALG_SHA2_256
142 	{ SADB_X_AALG_SHA2_256, "hmac-sha2-256", },
143 #endif
144 #ifdef SADB_X_AALG_SHA2_384
145 	{ SADB_X_AALG_SHA2_384, "hmac-sha2-384", },
146 #endif
147 #ifdef SADB_X_AALG_SHA2_512
148 	{ SADB_X_AALG_SHA2_512, "hmac-sha2-512", },
149 #endif
150 #ifdef SADB_X_AALG_AES_XCBC_MAC
151 	{ SADB_X_AALG_AES_XCBC_MAC, "aes-xcbc-mac", },
152 #endif
153 #ifdef SADB_X_AALG_CHACHA20POLY1305
154 	{ SADB_X_AALG_CHACHA20POLY1305, "chacha20-poly1305", },
155 #endif
156 	{ -1, NULL, },
157 };
158 
159 static struct val2str str_alg_enc[] = {
160 	{ SADB_EALG_NONE, "none", },
161 	{ SADB_EALG_NULL, "null", },
162 #ifdef SADB_X_EALG_RC5CBC
163 	{ SADB_X_EALG_RC5CBC, "rc5-cbc", },
164 #endif
165 #ifdef SADB_X_EALG_AESCBC
166 	{ SADB_X_EALG_AESCBC, "aes-cbc", },
167 #endif
168 #ifdef SADB_X_EALG_TWOFISHCBC
169 	{ SADB_X_EALG_TWOFISHCBC, "twofish-cbc", },
170 #endif
171 #ifdef SADB_X_EALG_AESCTR
172 	{ SADB_X_EALG_AESCTR, "aes-ctr", },
173 #endif
174 #ifdef SADB_X_EALG_AESGCM16
175 	{ SADB_X_EALG_AESGCM16, "aes-gcm-16", },
176 #endif
177 #ifdef SADB_X_EALG_CHACHA20POLY1305
178 	{ SADB_X_EALG_CHACHA20POLY1305, "chacha20-poly1305", },
179 #endif
180 	{ -1, NULL, },
181 };
182 
183 static struct val2str str_alg_comp[] = {
184 	{ SADB_X_CALG_NONE, "none", },
185 	{ SADB_X_CALG_OUI, "oui", },
186 	{ SADB_X_CALG_DEFLATE, "deflate", },
187 	{ SADB_X_CALG_LZS, "lzs", },
188 	{ -1, NULL, },
189 };
190 
191 static struct val2str str_sp_scope[] = {
192 	{ IPSEC_POLICYSCOPE_GLOBAL, "global" },
193 	{ IPSEC_POLICYSCOPE_IFNET, "ifnet" },
194 	{ IPSEC_POLICYSCOPE_PCB, "pcb"},
195 	{ -1, NULL },
196 };
197 
198 /*
199  * dump SADB_MSG formatted.  For debugging, you should use kdebug_sadb().
200  */
201 void
202 pfkey_sadump(m)
203 	struct sadb_msg *m;
204 {
205 	caddr_t mhp[SADB_EXT_MAX + 1];
206 	struct sadb_sa *m_sa;
207 	struct sadb_x_sa2 *m_sa2;
208 	struct sadb_lifetime *m_lftc, *m_lfth, *m_lfts;
209 	struct sadb_address *m_saddr, *m_daddr, *m_paddr;
210 	struct sadb_key *m_auth, *m_enc;
211 	struct sadb_ident *m_sid, *m_did;
212 	struct sadb_sens *m_sens;
213 	struct sadb_x_sa_replay *m_sa_replay;
214 	struct sadb_x_nat_t_type *natt_type;
215 	struct sadb_x_nat_t_port *natt_sport, *natt_dport;
216 	struct sadb_address *natt_oai, *natt_oar;
217 
218 	/* check pfkey message. */
219 	if (pfkey_align(m, mhp)) {
220 		printf("%s\n", ipsec_strerror());
221 		return;
222 	}
223 	if (pfkey_check(mhp)) {
224 		printf("%s\n", ipsec_strerror());
225 		return;
226 	}
227 
228 	m_sa = (struct sadb_sa *)mhp[SADB_EXT_SA];
229 	m_sa2 = (struct sadb_x_sa2 *)mhp[SADB_X_EXT_SA2];
230 	m_lftc = (struct sadb_lifetime *)mhp[SADB_EXT_LIFETIME_CURRENT];
231 	m_lfth = (struct sadb_lifetime *)mhp[SADB_EXT_LIFETIME_HARD];
232 	m_lfts = (struct sadb_lifetime *)mhp[SADB_EXT_LIFETIME_SOFT];
233 	m_saddr = (struct sadb_address *)mhp[SADB_EXT_ADDRESS_SRC];
234 	m_daddr = (struct sadb_address *)mhp[SADB_EXT_ADDRESS_DST];
235 	m_paddr = (struct sadb_address *)mhp[SADB_EXT_ADDRESS_PROXY];
236 	m_auth = (struct sadb_key *)mhp[SADB_EXT_KEY_AUTH];
237 	m_enc = (struct sadb_key *)mhp[SADB_EXT_KEY_ENCRYPT];
238 	m_sid = (struct sadb_ident *)mhp[SADB_EXT_IDENTITY_SRC];
239 	m_did = (struct sadb_ident *)mhp[SADB_EXT_IDENTITY_DST];
240 	m_sens = (struct sadb_sens *)mhp[SADB_EXT_SENSITIVITY];
241 	m_sa_replay = (struct sadb_x_sa_replay *)mhp[SADB_X_EXT_SA_REPLAY];
242 	natt_type = (struct sadb_x_nat_t_type *)mhp[SADB_X_EXT_NAT_T_TYPE];
243 	natt_sport = (struct sadb_x_nat_t_port *)mhp[SADB_X_EXT_NAT_T_SPORT];
244 	natt_dport = (struct sadb_x_nat_t_port *)mhp[SADB_X_EXT_NAT_T_DPORT];
245 	natt_oai = (struct sadb_address *)mhp[SADB_X_EXT_NAT_T_OAI];
246 	natt_oar = (struct sadb_address *)mhp[SADB_X_EXT_NAT_T_OAR];
247 
248 
249 	/* source address */
250 	if (m_saddr == NULL) {
251 		printf("no ADDRESS_SRC extension.\n");
252 		return;
253 	}
254 	printf("%s", str_ipaddr((struct sockaddr *)(m_saddr + 1)));
255 	if (natt_type != NULL && natt_sport != NULL)
256 		printf("[%u]", ntohs(natt_sport->sadb_x_nat_t_port_port));
257 
258 	/* destination address */
259 	if (m_daddr == NULL) {
260 		printf("\nno ADDRESS_DST extension.\n");
261 		return;
262 	}
263 	printf(" %s", str_ipaddr((struct sockaddr *)(m_daddr + 1)));
264 	if (natt_type != NULL && natt_dport != NULL)
265 		printf("[%u]", ntohs(natt_dport->sadb_x_nat_t_port_port));
266 
267 	/* SA type */
268 	if (m_sa == NULL) {
269 		printf("\nno SA extension.\n");
270 		return;
271 	}
272 	if (m_sa2 == NULL) {
273 		printf("\nno SA2 extension.\n");
274 		return;
275 	}
276 	printf("\n\t");
277 
278 	if (m->sadb_msg_satype == SADB_SATYPE_ESP && natt_type != NULL)
279 		printf("esp-udp ");
280 	else
281 		GETMSGSTR(str_satype, m->sadb_msg_satype);
282 
283 	printf("mode=");
284 	GETMSGSTR(str_mode, m_sa2->sadb_x_sa2_mode);
285 
286 	printf("spi=%u(0x%08x) reqid=%u(0x%08x)\n",
287 		(u_int32_t)ntohl(m_sa->sadb_sa_spi),
288 		(u_int32_t)ntohl(m_sa->sadb_sa_spi),
289 		(u_int32_t)m_sa2->sadb_x_sa2_reqid,
290 		(u_int32_t)m_sa2->sadb_x_sa2_reqid);
291 
292 	/* other NAT-T information */
293 	if (natt_type != NULL && (natt_oai != NULL || natt_oar != NULL)) {
294 		printf("\tNAT:");
295 		if (natt_oai != NULL)
296 			printf(" OAI=%s",
297 			    str_ipaddr((struct sockaddr *)(natt_oai + 1)));
298 		if (natt_oar != NULL)
299 			printf(" OAR=%s",
300 			    str_ipaddr((struct sockaddr *)(natt_oar + 1)));
301 		printf("\n");
302 	}
303 
304 	/* encryption key */
305 	if (m->sadb_msg_satype == SADB_X_SATYPE_IPCOMP) {
306 		printf("\tC: ");
307 		GETMSGV2S(str_alg_comp, m_sa->sadb_sa_encrypt);
308 	} else if (m->sadb_msg_satype == SADB_SATYPE_ESP) {
309 		if (m_enc != NULL) {
310 			printf("\tE: ");
311 			GETMSGV2S(str_alg_enc, m_sa->sadb_sa_encrypt);
312 			ipsec_hexdump((caddr_t)m_enc + sizeof(*m_enc),
313 				      m_enc->sadb_key_bits / 8);
314 			printf("\n");
315 		}
316 	}
317 
318 	/* authentication key */
319 	if (m_auth != NULL) {
320 		printf("\tA: ");
321 		GETMSGV2S(str_alg_auth, m_sa->sadb_sa_auth);
322 		ipsec_hexdump((caddr_t)m_auth + sizeof(*m_auth),
323 		              m_auth->sadb_key_bits / 8);
324 		printf("\n");
325 	}
326 
327 	/* replay windoe size & flags */
328 	printf("\tseq=0x%08x replay=%u flags=0x%08x ",
329 		m_sa2->sadb_x_sa2_sequence,
330 		m_sa_replay ? (m_sa_replay->sadb_x_sa_replay_replay >> 3) :
331 			m_sa->sadb_sa_replay,
332 		m_sa->sadb_sa_flags);
333 
334 	/* state */
335 	printf("state=");
336 	GETMSGSTR(str_state, m_sa->sadb_sa_state);
337 	printf("\n");
338 
339 	/* lifetime */
340 	if (m_lftc != NULL) {
341 		time_t tmp_time = time(0);
342 
343 		printf("\tcreated: %s",
344 			str_time(m_lftc->sadb_lifetime_addtime));
345 		printf("\tcurrent: %s\n", str_time(tmp_time));
346 		printf("\tdiff: %lu(s)",
347 			(u_long)(m_lftc->sadb_lifetime_addtime == 0 ?
348 			0 : (tmp_time - m_lftc->sadb_lifetime_addtime)));
349 
350 		printf("\thard: %lu(s)",
351 			(u_long)(m_lfth == NULL ?
352 			0 : m_lfth->sadb_lifetime_addtime));
353 		printf("\tsoft: %lu(s)\n",
354 			(u_long)(m_lfts == NULL ?
355 			0 : m_lfts->sadb_lifetime_addtime));
356 
357 		printf("\tlast: %s",
358 			str_time(m_lftc->sadb_lifetime_usetime));
359 		printf("\thard: %lu(s)",
360 			(u_long)(m_lfth == NULL ?
361 			0 : m_lfth->sadb_lifetime_usetime));
362 		printf("\tsoft: %lu(s)\n",
363 			(u_long)(m_lfts == NULL ?
364 			0 : m_lfts->sadb_lifetime_usetime));
365 
366 		str_lifetime_byte(m_lftc, "current");
367 		str_lifetime_byte(m_lfth, "hard");
368 		str_lifetime_byte(m_lfts, "soft");
369 		printf("\n");
370 
371 		printf("\tallocated: %lu",
372 			(unsigned long)m_lftc->sadb_lifetime_allocations);
373 		printf("\thard: %lu",
374 			(u_long)(m_lfth == NULL ?
375 			0 : m_lfth->sadb_lifetime_allocations));
376 		printf("\tsoft: %lu\n",
377 			(u_long)(m_lfts == NULL ?
378 			0 : m_lfts->sadb_lifetime_allocations));
379 	}
380 
381 	printf("\tsadb_seq=%lu pid=%lu ",
382 		(u_long)m->sadb_msg_seq,
383 		(u_long)m->sadb_msg_pid);
384 
385 	/* XXX DEBUG */
386 	printf("refcnt=%u\n", m->sadb_msg_reserved);
387 
388 	return;
389 }
390 
391 void
392 pfkey_spdump(struct sadb_msg *m)
393 {
394 	char pbuf[NI_MAXSERV];
395 	caddr_t mhp[SADB_EXT_MAX + 1];
396 	struct sadb_address *m_saddr, *m_daddr;
397 	struct sadb_x_policy *m_xpl;
398 	struct sadb_lifetime *m_lftc = NULL, *m_lfth = NULL;
399 	struct sockaddr *sa;
400 	u_int16_t sport = 0, dport = 0;
401 
402 	/* check pfkey message. */
403 	if (pfkey_align(m, mhp)) {
404 		printf("%s\n", ipsec_strerror());
405 		return;
406 	}
407 	if (pfkey_check(mhp)) {
408 		printf("%s\n", ipsec_strerror());
409 		return;
410 	}
411 
412 	m_saddr = (struct sadb_address *)mhp[SADB_EXT_ADDRESS_SRC];
413 	m_daddr = (struct sadb_address *)mhp[SADB_EXT_ADDRESS_DST];
414 	m_xpl = (struct sadb_x_policy *)mhp[SADB_X_EXT_POLICY];
415 	m_lftc = (struct sadb_lifetime *)mhp[SADB_EXT_LIFETIME_CURRENT];
416 	m_lfth = (struct sadb_lifetime *)mhp[SADB_EXT_LIFETIME_HARD];
417 
418 	if (m_saddr && m_daddr) {
419 		/* source address */
420 		sa = (struct sockaddr *)(m_saddr + 1);
421 		switch (sa->sa_family) {
422 		case AF_INET:
423 		case AF_INET6:
424 			if (getnameinfo(sa, sa->sa_len, NULL, 0,
425 			    pbuf, sizeof(pbuf), NI_NUMERICSERV) != 0)
426 				sport = 0;	/*XXX*/
427 			else
428 				sport = atoi(pbuf);
429 			printf("%s%s ", str_ipaddr(sa),
430 				str_prefport(sa->sa_family,
431 				    m_saddr->sadb_address_prefixlen, sport,
432 				    m_saddr->sadb_address_proto));
433 			break;
434 		default:
435 			printf("unknown-af ");
436 			break;
437 		}
438 
439 		/* destination address */
440 		sa = (struct sockaddr *)(m_daddr + 1);
441 		switch (sa->sa_family) {
442 		case AF_INET:
443 		case AF_INET6:
444 			if (getnameinfo(sa, sa->sa_len, NULL, 0,
445 			    pbuf, sizeof(pbuf), NI_NUMERICSERV) != 0)
446 				dport = 0;	/*XXX*/
447 			else
448 				dport = atoi(pbuf);
449 			printf("%s%s ", str_ipaddr(sa),
450 				str_prefport(sa->sa_family,
451 				    m_daddr->sadb_address_prefixlen, dport,
452 				    m_saddr->sadb_address_proto));
453 			break;
454 		default:
455 			printf("unknown-af ");
456 			break;
457 		}
458 
459 		/* upper layer protocol */
460 		if (m_saddr->sadb_address_proto !=
461 		    m_daddr->sadb_address_proto) {
462 			printf("upper layer protocol mismatched.\n");
463 			return;
464 		}
465 		str_upperspec(m_saddr->sadb_address_proto, sport, dport);
466 	}
467 	else
468 		printf("(no selector, probably per-socket policy) ");
469 
470 	/* policy */
471     {
472 	char *d_xpl;
473 
474 	if (m_xpl == NULL) {
475 		printf("no X_POLICY extension.\n");
476 		return;
477 	}
478 	d_xpl = ipsec_dump_policy((char *)m_xpl, "\n\t");
479 
480 	/* dump SPD */
481 	printf("\n\t%s\n", d_xpl);
482 	free(d_xpl);
483     }
484 
485 	/* lifetime */
486 	if (m_lftc) {
487 		printf("\tcreated: %s  ",
488 			str_time(m_lftc->sadb_lifetime_addtime));
489 		printf("lastused: %s\n",
490 			str_time(m_lftc->sadb_lifetime_usetime));
491 	}
492 	if (m_lfth) {
493 		printf("\tlifetime: %lu(s) ",
494 			(u_long)m_lfth->sadb_lifetime_addtime);
495 		printf("validtime: %lu(s)\n",
496 			(u_long)m_lfth->sadb_lifetime_usetime);
497 	}
498 
499 
500 	printf("\tspid=%ld seq=%ld pid=%ld scope=",
501 		(u_long)m_xpl->sadb_x_policy_id,
502 		(u_long)m->sadb_msg_seq,
503 		(u_long)m->sadb_msg_pid);
504 	GETMSGV2S(str_sp_scope, m_xpl->sadb_x_policy_scope);
505 	if (m_xpl->sadb_x_policy_scope == IPSEC_POLICYSCOPE_IFNET &&
506 	    if_indextoname(m_xpl->sadb_x_policy_ifindex, pbuf) != NULL)
507 		printf("ifname=%s", pbuf);
508 	printf("\n");
509 
510 	/* XXX TEST */
511 	printf("\trefcnt=%u\n", m->sadb_msg_reserved);
512 
513 	return;
514 }
515 
516 /*
517  * set "ipaddress" to buffer.
518  */
519 static char *
520 str_ipaddr(sa)
521 	struct sockaddr *sa;
522 {
523 	static char buf[NI_MAXHOST];
524 	const int niflag = NI_NUMERICHOST;
525 
526 	if (sa == NULL)
527 		return "";
528 
529 	if (getnameinfo(sa, sa->sa_len, buf, sizeof(buf), NULL, 0, niflag) == 0)
530 		return buf;
531 	return NULL;
532 }
533 
534 /*
535  * set "/prefix[port number]" to buffer.
536  */
537 static char *
538 str_prefport(family, pref, port, ulp)
539 	u_int family, pref, port, ulp;
540 {
541 	static char buf[128];
542 	char prefbuf[128];
543 	char portbuf[128];
544 	int plen;
545 
546 	switch (family) {
547 	case AF_INET:
548 		plen = sizeof(struct in_addr) << 3;
549 		break;
550 	case AF_INET6:
551 		plen = sizeof(struct in6_addr) << 3;
552 		break;
553 	default:
554 		return "?";
555 	}
556 
557 	if (pref == plen)
558 		prefbuf[0] = '\0';
559 	else
560 		snprintf(prefbuf, sizeof(prefbuf), "/%u", pref);
561 
562 	if (ulp == IPPROTO_ICMPV6)
563 		memset(portbuf, 0, sizeof(portbuf));
564 	else {
565 		if (port == IPSEC_PORT_ANY)
566 			snprintf(portbuf, sizeof(portbuf), "[%s]", "any");
567 		else
568 			snprintf(portbuf, sizeof(portbuf), "[%u]", port);
569 	}
570 
571 	snprintf(buf, sizeof(buf), "%s%s", prefbuf, portbuf);
572 
573 	return buf;
574 }
575 
576 static void
577 str_upperspec(ulp, p1, p2)
578 	u_int ulp, p1, p2;
579 {
580 	if (ulp == IPSEC_ULPROTO_ANY)
581 		printf("any");
582 	else if (ulp == IPPROTO_ICMPV6) {
583 		printf("icmp6");
584 		if (!(p1 == IPSEC_PORT_ANY && p2 == IPSEC_PORT_ANY))
585 			printf(" %u,%u", p1, p2);
586 	} else {
587 		struct protoent *ent;
588 
589 		switch (ulp) {
590 		case IPPROTO_IPV4:
591 			printf("ip4");
592 			break;
593 		default:
594 			ent = getprotobynumber(ulp);
595 			if (ent)
596 				printf("%s", ent->p_name);
597 			else
598 				printf("%u", ulp);
599 
600 			endprotoent();
601 			break;
602 		}
603 	}
604 }
605 
606 /*
607  * set "Mon Day Time Year" to buffer
608  */
609 static char *
610 str_time(t)
611 	time_t t;
612 {
613 	static char buf[128];
614 
615 	if (t == 0) {
616 		int i = 0;
617 		for (;i < 20;) buf[i++] = ' ';
618 	} else {
619 		char *t0;
620 		t0 = ctime(&t);
621 		memcpy(buf, t0 + 4, 20);
622 	}
623 
624 	buf[20] = '\0';
625 
626 	return(buf);
627 }
628 
629 static void
630 str_lifetime_byte(x, str)
631 	struct sadb_lifetime *x;
632 	char *str;
633 {
634 	double y;
635 	char *unit;
636 	int w;
637 
638 	if (x == NULL) {
639 		printf("\t%s: 0(bytes)", str);
640 		return;
641 	}
642 
643 #if 0
644 	if ((x->sadb_lifetime_bytes) / 1024 / 1024) {
645 		y = (x->sadb_lifetime_bytes) * 1.0 / 1024 / 1024;
646 		unit = "M";
647 		w = 1;
648 	} else if ((x->sadb_lifetime_bytes) / 1024) {
649 		y = (x->sadb_lifetime_bytes) * 1.0 / 1024;
650 		unit = "K";
651 		w = 1;
652 	} else {
653 		y = (x->sadb_lifetime_bytes) * 1.0;
654 		unit = "";
655 		w = 0;
656 	}
657 #else
658 	y = (x->sadb_lifetime_bytes) * 1.0;
659 	unit = "";
660 	w = 0;
661 #endif
662 	printf("\t%s: %.*f(%sbytes)", str, w, y, unit);
663 }
664