xref: /freebsd/sys/netipsec/key_debug.c (revision ab00ac327a66a53edaac95b536b209db3ae2cd9f)
1 /*	$FreeBSD$	*/
2 /*	$KAME: key_debug.c,v 1.26 2001/06/27 10:46:50 sakane Exp $	*/
3 
4 /*-
5  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the project nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  */
32 
33 #ifdef _KERNEL
34 #include "opt_inet.h"
35 #include "opt_inet6.h"
36 #include "opt_ipsec.h"
37 #endif
38 
39 #include <sys/param.h>
40 #ifdef _KERNEL
41 #include <sys/systm.h>
42 #include <sys/lock.h>
43 #include <sys/malloc.h>
44 #include <sys/mbuf.h>
45 #include <sys/mutex.h>
46 #include <sys/queue.h>
47 #endif
48 #include <sys/socket.h>
49 
50 #include <net/vnet.h>
51 
52 #include <netipsec/key_var.h>
53 #include <netipsec/key_debug.h>
54 
55 #include <netinet/in.h>
56 #include <netipsec/ipsec.h>
57 #ifdef _KERNEL
58 #include <netipsec/keydb.h>
59 #include <netipsec/xform.h>
60 #endif
61 
62 #ifndef _KERNEL
63 #include <ctype.h>
64 #include <stdio.h>
65 #include <stdlib.h>
66 #include <arpa/inet.h>
67 #endif /* !_KERNEL */
68 
69 static void kdebug_sadb_prop(struct sadb_ext *);
70 static void kdebug_sadb_identity(struct sadb_ext *);
71 static void kdebug_sadb_supported(struct sadb_ext *);
72 static void kdebug_sadb_lifetime(struct sadb_ext *);
73 static void kdebug_sadb_sa(struct sadb_ext *);
74 static void kdebug_sadb_address(struct sadb_ext *);
75 static void kdebug_sadb_key(struct sadb_ext *);
76 static void kdebug_sadb_x_sa2(struct sadb_ext *);
77 static void kdebug_sadb_x_sa_replay(struct sadb_ext *);
78 static void kdebug_sadb_x_natt(struct sadb_ext *);
79 
80 #ifdef _KERNEL
81 static void kdebug_secreplay(struct secreplay *);
82 #endif
83 
84 #ifndef _KERNEL
85 #define panic(fmt, ...)	{ printf(fmt, ## __VA_ARGS__); exit(-1); }
86 #endif
87 
88 /* NOTE: host byte order */
89 
90 /* %%%: about struct sadb_msg */
91 void
92 kdebug_sadb(struct sadb_msg *base)
93 {
94 	struct sadb_ext *ext;
95 	int tlen, extlen;
96 
97 	/* sanity check */
98 	if (base == NULL)
99 		panic("%s: NULL pointer was passed.\n", __func__);
100 
101 	printf("sadb_msg{ version=%u type=%u errno=%u satype=%u\n",
102 	    base->sadb_msg_version, base->sadb_msg_type,
103 	    base->sadb_msg_errno, base->sadb_msg_satype);
104 	printf("  len=%u reserved=%u seq=%u pid=%u\n",
105 	    base->sadb_msg_len, base->sadb_msg_reserved,
106 	    base->sadb_msg_seq, base->sadb_msg_pid);
107 
108 	tlen = PFKEY_UNUNIT64(base->sadb_msg_len) - sizeof(struct sadb_msg);
109 	ext = (struct sadb_ext *)((caddr_t)base + sizeof(struct sadb_msg));
110 
111 	while (tlen > 0) {
112 		printf("sadb_ext{ len=%u type=%u }\n",
113 		    ext->sadb_ext_len, ext->sadb_ext_type);
114 
115 		if (ext->sadb_ext_len == 0) {
116 			printf("%s: invalid ext_len=0 was passed.\n", __func__);
117 			return;
118 		}
119 		if (ext->sadb_ext_len > tlen) {
120 			printf("%s: ext_len too big (%u > %u).\n",
121 				__func__, ext->sadb_ext_len, tlen);
122 			return;
123 		}
124 
125 		switch (ext->sadb_ext_type) {
126 		case SADB_EXT_SA:
127 			kdebug_sadb_sa(ext);
128 			break;
129 		case SADB_EXT_LIFETIME_CURRENT:
130 		case SADB_EXT_LIFETIME_HARD:
131 		case SADB_EXT_LIFETIME_SOFT:
132 			kdebug_sadb_lifetime(ext);
133 			break;
134 		case SADB_EXT_ADDRESS_SRC:
135 		case SADB_EXT_ADDRESS_DST:
136 		case SADB_EXT_ADDRESS_PROXY:
137 		case SADB_X_EXT_NAT_T_OAI:
138 		case SADB_X_EXT_NAT_T_OAR:
139 		case SADB_X_EXT_NEW_ADDRESS_SRC:
140 		case SADB_X_EXT_NEW_ADDRESS_DST:
141 			kdebug_sadb_address(ext);
142 			break;
143 		case SADB_EXT_KEY_AUTH:
144 		case SADB_EXT_KEY_ENCRYPT:
145 			kdebug_sadb_key(ext);
146 			break;
147 		case SADB_EXT_IDENTITY_SRC:
148 		case SADB_EXT_IDENTITY_DST:
149 			kdebug_sadb_identity(ext);
150 			break;
151 		case SADB_EXT_SENSITIVITY:
152 			break;
153 		case SADB_EXT_PROPOSAL:
154 			kdebug_sadb_prop(ext);
155 			break;
156 		case SADB_EXT_SUPPORTED_AUTH:
157 		case SADB_EXT_SUPPORTED_ENCRYPT:
158 			kdebug_sadb_supported(ext);
159 			break;
160 		case SADB_EXT_SPIRANGE:
161 		case SADB_X_EXT_KMPRIVATE:
162 			break;
163 		case SADB_X_EXT_POLICY:
164 			kdebug_sadb_x_policy(ext);
165 			break;
166 		case SADB_X_EXT_SA2:
167 			kdebug_sadb_x_sa2(ext);
168 			break;
169 		case SADB_X_EXT_SA_REPLAY:
170 			kdebug_sadb_x_sa_replay(ext);
171 			break;
172 		case SADB_X_EXT_NAT_T_TYPE:
173 		case SADB_X_EXT_NAT_T_SPORT:
174 		case SADB_X_EXT_NAT_T_DPORT:
175 			kdebug_sadb_x_natt(ext);
176 			break;
177 		default:
178 			printf("%s: invalid ext_type %u\n", __func__,
179 			    ext->sadb_ext_type);
180 			return;
181 		}
182 
183 		extlen = PFKEY_UNUNIT64(ext->sadb_ext_len);
184 		tlen -= extlen;
185 		ext = (struct sadb_ext *)((caddr_t)ext + extlen);
186 	}
187 
188 	return;
189 }
190 
191 static void
192 kdebug_sadb_prop(struct sadb_ext *ext)
193 {
194 	struct sadb_prop *prop = (struct sadb_prop *)ext;
195 	struct sadb_comb *comb;
196 	int len;
197 
198 	/* sanity check */
199 	if (ext == NULL)
200 		panic("%s: NULL pointer was passed.\n", __func__);
201 
202 	len = (PFKEY_UNUNIT64(prop->sadb_prop_len) - sizeof(*prop))
203 		/ sizeof(*comb);
204 	comb = (struct sadb_comb *)(prop + 1);
205 	printf("sadb_prop{ replay=%u\n", prop->sadb_prop_replay);
206 
207 	while (len--) {
208 		printf("sadb_comb{ auth=%u encrypt=%u "
209 			"flags=0x%04x reserved=0x%08x\n",
210 			comb->sadb_comb_auth, comb->sadb_comb_encrypt,
211 			comb->sadb_comb_flags, comb->sadb_comb_reserved);
212 
213 		printf("  auth_minbits=%u auth_maxbits=%u "
214 			"encrypt_minbits=%u encrypt_maxbits=%u\n",
215 			comb->sadb_comb_auth_minbits,
216 			comb->sadb_comb_auth_maxbits,
217 			comb->sadb_comb_encrypt_minbits,
218 			comb->sadb_comb_encrypt_maxbits);
219 
220 		printf("  soft_alloc=%u hard_alloc=%u "
221 			"soft_bytes=%lu hard_bytes=%lu\n",
222 			comb->sadb_comb_soft_allocations,
223 			comb->sadb_comb_hard_allocations,
224 			(unsigned long)comb->sadb_comb_soft_bytes,
225 			(unsigned long)comb->sadb_comb_hard_bytes);
226 
227 		printf("  soft_alloc=%lu hard_alloc=%lu "
228 			"soft_bytes=%lu hard_bytes=%lu }\n",
229 			(unsigned long)comb->sadb_comb_soft_addtime,
230 			(unsigned long)comb->sadb_comb_hard_addtime,
231 			(unsigned long)comb->sadb_comb_soft_usetime,
232 			(unsigned long)comb->sadb_comb_hard_usetime);
233 		comb++;
234 	}
235 	printf("}\n");
236 
237 	return;
238 }
239 
240 static void
241 kdebug_sadb_identity(struct sadb_ext *ext)
242 {
243 	struct sadb_ident *id = (struct sadb_ident *)ext;
244 	int len;
245 
246 	/* sanity check */
247 	if (ext == NULL)
248 		panic("%s: NULL pointer was passed.\n", __func__);
249 
250 	len = PFKEY_UNUNIT64(id->sadb_ident_len) - sizeof(*id);
251 	printf("sadb_ident_%s{",
252 	    id->sadb_ident_exttype == SADB_EXT_IDENTITY_SRC ? "src" : "dst");
253 	switch (id->sadb_ident_type) {
254 	default:
255 		printf(" type=%d id=%lu",
256 			id->sadb_ident_type, (u_long)id->sadb_ident_id);
257 		if (len) {
258 #ifdef _KERNEL
259 			ipsec_hexdump((caddr_t)(id + 1), len); /*XXX cast ?*/
260 #else
261 			char *p, *ep;
262 			printf("\n  str=\"");
263 			p = (char *)(id + 1);
264 			ep = p + len;
265 			for (/*nothing*/; *p && p < ep; p++) {
266 				if (isprint(*p))
267 					printf("%c", *p & 0xff);
268 				else
269 					printf("\\%03o", *p & 0xff);
270 			}
271 #endif
272 			printf("\"");
273 		}
274 		break;
275 	}
276 
277 	printf(" }\n");
278 
279 	return;
280 }
281 
282 static void
283 kdebug_sadb_supported(struct sadb_ext *ext)
284 {
285 	struct sadb_supported *sup = (struct sadb_supported *)ext;
286 	struct sadb_alg *alg;
287 	int len;
288 
289 	/* sanity check */
290 	if (ext == NULL)
291 		panic("%s: NULL pointer was passed.\n", __func__);
292 
293 	len = (PFKEY_UNUNIT64(sup->sadb_supported_len) - sizeof(*sup))
294 		/ sizeof(*alg);
295 	alg = (struct sadb_alg *)(sup + 1);
296 	printf("sadb_sup{\n");
297 	while (len--) {
298 		printf("  { id=%d ivlen=%d min=%d max=%d }\n",
299 			alg->sadb_alg_id, alg->sadb_alg_ivlen,
300 			alg->sadb_alg_minbits, alg->sadb_alg_maxbits);
301 		alg++;
302 	}
303 	printf("}\n");
304 
305 	return;
306 }
307 
308 static void
309 kdebug_sadb_lifetime(struct sadb_ext *ext)
310 {
311 	struct sadb_lifetime *lft = (struct sadb_lifetime *)ext;
312 
313 	/* sanity check */
314 	if (ext == NULL)
315 		panic("%s: NULL pointer was passed.\n", __func__);
316 
317 	printf("sadb_lifetime{ alloc=%u, bytes=%u\n",
318 		lft->sadb_lifetime_allocations,
319 		(u_int32_t)lft->sadb_lifetime_bytes);
320 	printf("  addtime=%u, usetime=%u }\n",
321 		(u_int32_t)lft->sadb_lifetime_addtime,
322 		(u_int32_t)lft->sadb_lifetime_usetime);
323 
324 	return;
325 }
326 
327 static void
328 kdebug_sadb_sa(struct sadb_ext *ext)
329 {
330 	struct sadb_sa *sa = (struct sadb_sa *)ext;
331 
332 	/* sanity check */
333 	if (ext == NULL)
334 		panic("%s: NULL pointer was passed.\n", __func__);
335 
336 	printf("sadb_sa{ spi=%u replay=%u state=%u\n",
337 	    (u_int32_t)ntohl(sa->sadb_sa_spi), sa->sadb_sa_replay,
338 	    sa->sadb_sa_state);
339 	printf("  auth=%u encrypt=%u flags=0x%08x }\n",
340 	    sa->sadb_sa_auth, sa->sadb_sa_encrypt, sa->sadb_sa_flags);
341 
342 	return;
343 }
344 
345 static void
346 kdebug_sadb_address(struct sadb_ext *ext)
347 {
348 	struct sadb_address *addr = (struct sadb_address *)ext;
349 
350 	/* sanity check */
351 	if (ext == NULL)
352 		panic("%s: NULL pointer was passed.\n", __func__);
353 
354 	printf("sadb_address{ proto=%u prefixlen=%u reserved=0x%02x%02x }\n",
355 	    addr->sadb_address_proto, addr->sadb_address_prefixlen,
356 	    ((u_char *)&addr->sadb_address_reserved)[0],
357 	    ((u_char *)&addr->sadb_address_reserved)[1]);
358 
359 	kdebug_sockaddr((struct sockaddr *)((caddr_t)ext + sizeof(*addr)));
360 }
361 
362 static void
363 kdebug_sadb_key(struct sadb_ext *ext)
364 {
365 	struct sadb_key *key = (struct sadb_key *)ext;
366 
367 	/* sanity check */
368 	if (ext == NULL)
369 		panic("%s: NULL pointer was passed.\n", __func__);
370 
371 	printf("sadb_key{ bits=%u reserved=%u\n",
372 	    key->sadb_key_bits, key->sadb_key_reserved);
373 	printf("  key=");
374 
375 	/* sanity check 2 */
376 	if ((key->sadb_key_bits >> 3) >
377 		(PFKEY_UNUNIT64(key->sadb_key_len) - sizeof(struct sadb_key))) {
378 		printf("%s: key length mismatch, bit:%d len:%ld.\n",
379 			__func__,
380 			key->sadb_key_bits >> 3,
381 			(long)PFKEY_UNUNIT64(key->sadb_key_len) - sizeof(struct sadb_key));
382 	}
383 
384 	ipsec_hexdump((caddr_t)key + sizeof(struct sadb_key),
385 	              key->sadb_key_bits >> 3);
386 	printf(" }\n");
387 	return;
388 }
389 
390 static void
391 kdebug_sadb_x_sa2(struct sadb_ext *ext)
392 {
393 	struct sadb_x_sa2 *sa2 = (struct sadb_x_sa2 *)ext;
394 
395 	/* sanity check */
396 	if (ext == NULL)
397 		panic("%s: NULL pointer was passed.\n", __func__);
398 
399 	printf("sadb_x_sa2{ mode=%u reqid=%u\n",
400 	    sa2->sadb_x_sa2_mode, sa2->sadb_x_sa2_reqid);
401 	printf("  reserved1=%u reserved2=%u sequence=%u }\n",
402 	    sa2->sadb_x_sa2_reserved1, sa2->sadb_x_sa2_reserved2,
403 	    sa2->sadb_x_sa2_sequence);
404 
405 	return;
406 }
407 
408 static void
409 kdebug_sadb_x_sa_replay(struct sadb_ext *ext)
410 {
411 	struct sadb_x_sa_replay *replay;
412 
413 	/* sanity check */
414 	if (ext == NULL)
415 		panic("%s: NULL pointer was passed.\n", __func__);
416 
417 	replay = (struct sadb_x_sa_replay *)ext;
418 	printf("sadb_x_sa_replay{ replay=%u }\n",
419 	    replay->sadb_x_sa_replay_replay);
420 }
421 
422 static void
423 kdebug_sadb_x_natt(struct sadb_ext *ext)
424 {
425 	struct sadb_x_nat_t_type *type;
426 	struct sadb_x_nat_t_port *port;
427 
428 	/* sanity check */
429 	if (ext == NULL)
430 		panic("%s: NULL pointer was passed.\n", __func__);
431 
432 	if (ext->sadb_ext_type == SADB_X_EXT_NAT_T_TYPE) {
433 		type = (struct sadb_x_nat_t_type *)ext;
434 		printf("sadb_x_nat_t_type{ type=%u }\n",
435 		    type->sadb_x_nat_t_type_type);
436 	} else {
437 		port = (struct sadb_x_nat_t_port *)ext;
438 		printf("sadb_x_nat_t_port{ port=%u }\n",
439 		    ntohs(port->sadb_x_nat_t_port_port));
440 	}
441 }
442 
443 void
444 kdebug_sadb_x_policy(struct sadb_ext *ext)
445 {
446 	struct sadb_x_policy *xpl = (struct sadb_x_policy *)ext;
447 	struct sockaddr *addr;
448 
449 	/* sanity check */
450 	if (ext == NULL)
451 		panic("%s: NULL pointer was passed.\n", __func__);
452 
453 	printf("sadb_x_policy{ type=%u dir=%u id=%x scope=%u %s=%u }\n",
454 		xpl->sadb_x_policy_type, xpl->sadb_x_policy_dir,
455 		xpl->sadb_x_policy_id, xpl->sadb_x_policy_scope,
456 		xpl->sadb_x_policy_scope == IPSEC_POLICYSCOPE_IFNET ?
457 		"ifindex": "priority", xpl->sadb_x_policy_priority);
458 
459 	if (xpl->sadb_x_policy_type == IPSEC_POLICY_IPSEC) {
460 		int tlen;
461 		struct sadb_x_ipsecrequest *xisr;
462 
463 		tlen = PFKEY_UNUNIT64(xpl->sadb_x_policy_len) - sizeof(*xpl);
464 		xisr = (struct sadb_x_ipsecrequest *)(xpl + 1);
465 
466 		while (tlen > 0) {
467 			printf(" { len=%u proto=%u mode=%u level=%u reqid=%u\n",
468 				xisr->sadb_x_ipsecrequest_len,
469 				xisr->sadb_x_ipsecrequest_proto,
470 				xisr->sadb_x_ipsecrequest_mode,
471 				xisr->sadb_x_ipsecrequest_level,
472 				xisr->sadb_x_ipsecrequest_reqid);
473 
474 			if (xisr->sadb_x_ipsecrequest_len > sizeof(*xisr)) {
475 				addr = (struct sockaddr *)(xisr + 1);
476 				kdebug_sockaddr(addr);
477 				addr = (struct sockaddr *)((caddr_t)addr
478 							+ addr->sa_len);
479 				kdebug_sockaddr(addr);
480 			}
481 
482 			printf(" }\n");
483 
484 			/* prevent infinite loop */
485 			if (xisr->sadb_x_ipsecrequest_len <= 0) {
486 				printf("%s: wrong policy struct.\n", __func__);
487 				return;
488 			}
489 			/* prevent overflow */
490 			if (xisr->sadb_x_ipsecrequest_len > tlen) {
491 				printf("%s: invalid ipsec policy length "
492 					"(%u > %u)\n", __func__,
493 					xisr->sadb_x_ipsecrequest_len, tlen);
494 				return;
495 			}
496 
497 			tlen -= xisr->sadb_x_ipsecrequest_len;
498 
499 			xisr = (struct sadb_x_ipsecrequest *)((caddr_t)xisr
500 			                + xisr->sadb_x_ipsecrequest_len);
501 		}
502 
503 		if (tlen != 0)
504 			panic("%s: wrong policy struct.\n", __func__);
505 	}
506 
507 	return;
508 }
509 
510 #ifdef _KERNEL
511 /* %%%: about SPD and SAD */
512 const char*
513 kdebug_secpolicy_state(u_int state)
514 {
515 
516 	switch (state) {
517 	case IPSEC_SPSTATE_DEAD:
518 		return ("dead");
519 	case IPSEC_SPSTATE_LARVAL:
520 		return ("larval");
521 	case IPSEC_SPSTATE_ALIVE:
522 		return ("alive");
523 	case IPSEC_SPSTATE_PCB:
524 		return ("pcb");
525 	case IPSEC_SPSTATE_IFNET:
526 		return ("ifnet");
527 	}
528 	return ("unknown");
529 }
530 
531 const char*
532 kdebug_secpolicy_policy(u_int policy)
533 {
534 
535 	switch (policy) {
536 	case IPSEC_POLICY_DISCARD:
537 		return ("discard");
538 	case IPSEC_POLICY_NONE:
539 		return ("none");
540 	case IPSEC_POLICY_IPSEC:
541 		return ("ipsec");
542 	case IPSEC_POLICY_ENTRUST:
543 		return ("entrust");
544 	case IPSEC_POLICY_BYPASS:
545 		return ("bypass");
546 	}
547 	return ("unknown");
548 }
549 
550 const char*
551 kdebug_secpolicyindex_dir(u_int dir)
552 {
553 
554 	switch (dir) {
555 	case IPSEC_DIR_ANY:
556 		return ("any");
557 	case IPSEC_DIR_INBOUND:
558 		return ("in");
559 	case IPSEC_DIR_OUTBOUND:
560 		return ("out");
561 	}
562 	return ("unknown");
563 }
564 
565 const char*
566 kdebug_ipsecrequest_level(u_int level)
567 {
568 
569 	switch (level) {
570 	case IPSEC_LEVEL_DEFAULT:
571 		return ("default");
572 	case IPSEC_LEVEL_USE:
573 		return ("use");
574 	case IPSEC_LEVEL_REQUIRE:
575 		return ("require");
576 	case IPSEC_LEVEL_UNIQUE:
577 		return ("unique");
578 	}
579 	return ("unknown");
580 }
581 
582 const char*
583 kdebug_secasindex_mode(u_int mode)
584 {
585 
586 	switch (mode) {
587 	case IPSEC_MODE_ANY:
588 		return ("any");
589 	case IPSEC_MODE_TRANSPORT:
590 		return ("transport");
591 	case IPSEC_MODE_TUNNEL:
592 		return ("tunnel");
593 	case IPSEC_MODE_TCPMD5:
594 		return ("tcp-md5");
595 	}
596 	return ("unknown");
597 }
598 
599 const char*
600 kdebug_secasv_state(u_int state)
601 {
602 
603 	switch (state) {
604 	case SADB_SASTATE_LARVAL:
605 		return ("larval");
606 	case SADB_SASTATE_MATURE:
607 		return ("mature");
608 	case SADB_SASTATE_DYING:
609 		return ("dying");
610 	case SADB_SASTATE_DEAD:
611 		return ("dead");
612 	}
613 	return ("unknown");
614 }
615 
616 static char*
617 kdebug_port2str(const struct sockaddr *sa, char *buf, size_t len)
618 {
619 	uint16_t port;
620 
621 	IPSEC_ASSERT(sa != NULL, ("null sa"));
622 	switch (sa->sa_family) {
623 #ifdef INET
624 	case AF_INET:
625 		port = ntohs(((const struct sockaddr_in *)sa)->sin_port);
626 		break;
627 #endif
628 #ifdef INET6
629 	case AF_INET6:
630 		port = ntohs(((const struct sockaddr_in6 *)sa)->sin6_port);
631 		break;
632 #endif
633 	default:
634 		port = 0;
635 	}
636 	if (port == 0)
637 		return ("*");
638 	snprintf(buf, len, "%u", port);
639 	return (buf);
640 }
641 
642 void
643 kdebug_secpolicy(struct secpolicy *sp)
644 {
645 	u_int idx;
646 
647 	IPSEC_ASSERT(sp != NULL, ("null sp"));
648 	printf("SP { refcnt=%u id=%u priority=%u state=%s policy=%s\n",
649 	    sp->refcnt, sp->id, sp->priority,
650 	    kdebug_secpolicy_state(sp->state),
651 	    kdebug_secpolicy_policy(sp->policy));
652 	kdebug_secpolicyindex(&sp->spidx, "  ");
653 	for (idx = 0; idx < sp->tcount; idx++) {
654 		printf("  req[%u]{ level=%s ", idx,
655 		    kdebug_ipsecrequest_level(sp->req[idx]->level));
656 		kdebug_secasindex(&sp->req[idx]->saidx, NULL);
657 		printf("  }\n");
658 	}
659 	printf("}\n");
660 }
661 
662 void
663 kdebug_secpolicyindex(struct secpolicyindex *spidx, const char *indent)
664 {
665 	char buf[IPSEC_ADDRSTRLEN];
666 
667 	IPSEC_ASSERT(spidx != NULL, ("null spidx"));
668 	if (indent != NULL)
669 		printf("%s", indent);
670 	printf("spidx { dir=%s ul_proto=",
671 	    kdebug_secpolicyindex_dir(spidx->dir));
672 	if (spidx->ul_proto == IPSEC_ULPROTO_ANY)
673 		printf("* ");
674 	else
675 		printf("%u ", spidx->ul_proto);
676 	printf("%s/%u -> ", ipsec_address(&spidx->src, buf, sizeof(buf)),
677 	    spidx->prefs);
678 	printf("%s/%u }\n", ipsec_address(&spidx->dst, buf, sizeof(buf)),
679 	    spidx->prefd);
680 }
681 
682 void
683 kdebug_secasindex(const struct secasindex *saidx, const char *indent)
684 {
685 	char buf[IPSEC_ADDRSTRLEN], port[6];
686 
687 	IPSEC_ASSERT(saidx != NULL, ("null saidx"));
688 	if (indent != NULL)
689 		printf("%s", indent);
690 	printf("saidx { mode=%s proto=%u reqid=%u ",
691 	    kdebug_secasindex_mode(saidx->mode), saidx->proto, saidx->reqid);
692 	printf("%s:%s -> ", ipsec_address(&saidx->src, buf, sizeof(buf)),
693 	    kdebug_port2str(&saidx->src.sa, port, sizeof(port)));
694 	printf("%s:%s }\n", ipsec_address(&saidx->dst, buf, sizeof(buf)),
695 	    kdebug_port2str(&saidx->dst.sa, port, sizeof(port)));
696 }
697 
698 static void
699 kdebug_sec_lifetime(struct seclifetime *lft, const char *indent)
700 {
701 
702 	IPSEC_ASSERT(lft != NULL, ("null lft"));
703 	if (indent != NULL)
704 		printf("%s", indent);
705 	printf("lifetime { alloc=%u, bytes=%ju addtime=%ju usetime=%ju }\n",
706 	    lft->allocations, (uintmax_t)lft->bytes, (uintmax_t)lft->addtime,
707 	    (uintmax_t)lft->usetime);
708 }
709 
710 void
711 kdebug_secash(struct secashead *sah, const char *indent)
712 {
713 
714 	IPSEC_ASSERT(sah != NULL, ("null sah"));
715 	if (indent != NULL)
716 		printf("%s", indent);
717 	printf("SAH { refcnt=%u state=%s\n", sah->refcnt,
718 	    kdebug_secasv_state(sah->state));
719 	if (indent != NULL)
720 		printf("%s", indent);
721 	kdebug_secasindex(&sah->saidx, indent);
722 	if (indent != NULL)
723 		printf("%s", indent);
724 	printf("}\n");
725 }
726 
727 static void
728 kdebug_secreplay(struct secreplay *rpl)
729 {
730 	int len, l;
731 
732 	IPSEC_ASSERT(rpl != NULL, ("null rpl"));
733 	printf(" secreplay{ count=%u bitmap_size=%u wsize=%u seq=%u lastseq=%u",
734 	    rpl->count, rpl->bitmap_size, rpl->wsize, rpl->seq, rpl->lastseq);
735 
736 	if (rpl->bitmap == NULL) {
737 		printf("  }\n");
738 		return;
739 	}
740 
741 	printf("\n    bitmap { ");
742 	for (len = 0; len < rpl->bitmap_size*4; len++) {
743 		for (l = 7; l >= 0; l--)
744 			printf("%u", (((rpl->bitmap)[len] >> l) & 1) ? 1 : 0);
745 	}
746 	printf("    }\n");
747 }
748 
749 static void
750 kdebug_secnatt(struct secnatt *natt)
751 {
752 	char buf[IPSEC_ADDRSTRLEN];
753 
754 	IPSEC_ASSERT(natt != NULL, ("null natt"));
755 	printf("  natt{ sport=%u dport=%u ", ntohs(natt->sport),
756 	    ntohs(natt->dport));
757 	if (natt->flags & IPSEC_NATT_F_OAI)
758 		printf("oai=%s ", ipsec_address(&natt->oai, buf, sizeof(buf)));
759 	if (natt->flags & IPSEC_NATT_F_OAR)
760 		printf("oar=%s ", ipsec_address(&natt->oar, buf, sizeof(buf)));
761 	printf("}\n");
762 }
763 
764 void
765 kdebug_secasv(struct secasvar *sav)
766 {
767 	struct seclifetime lft_c;
768 
769 	IPSEC_ASSERT(sav != NULL, ("null sav"));
770 
771 	printf("SA { refcnt=%u spi=%u seq=%u pid=%u flags=0x%x state=%s\n",
772 	    sav->refcnt, ntohl(sav->spi), sav->seq, (uint32_t)sav->pid,
773 	    sav->flags, kdebug_secasv_state(sav->state));
774 	kdebug_secash(sav->sah, "  ");
775 
776 	lft_c.addtime = sav->created;
777 	lft_c.allocations = (uint32_t)counter_u64_fetch(
778 	    sav->lft_c_allocations);
779 	lft_c.bytes = counter_u64_fetch(sav->lft_c_bytes);
780 	lft_c.usetime = sav->firstused;
781 	kdebug_sec_lifetime(&lft_c, "  c_");
782 	if (sav->lft_h != NULL)
783 		kdebug_sec_lifetime(sav->lft_h, "  h_");
784 	if (sav->lft_s != NULL)
785 		kdebug_sec_lifetime(sav->lft_s, "  s_");
786 
787 	if (sav->tdb_authalgxform != NULL)
788 		printf("  alg_auth=%s\n", sav->tdb_authalgxform->name);
789 	if (sav->key_auth != NULL)
790 		KEYDBG(DUMP,
791 		    kdebug_sadb_key((struct sadb_ext *)sav->key_auth));
792 	if (sav->tdb_encalgxform != NULL)
793 		printf("  alg_enc=%s\n", sav->tdb_encalgxform->name);
794 	if (sav->key_enc != NULL)
795 		KEYDBG(DUMP,
796 		    kdebug_sadb_key((struct sadb_ext *)sav->key_enc));
797 	if (sav->natt != NULL)
798 		kdebug_secnatt(sav->natt);
799 	if (sav->replay != NULL) {
800 		KEYDBG(DUMP,
801 		    SECASVAR_LOCK(sav);
802 		    kdebug_secreplay(sav->replay);
803 		    SECASVAR_UNLOCK(sav));
804 	}
805 	printf("}\n");
806 }
807 
808 void
809 kdebug_mbufhdr(const struct mbuf *m)
810 {
811 	/* sanity check */
812 	if (m == NULL)
813 		return;
814 
815 	printf("mbuf(%p){ m_next:%p m_nextpkt:%p m_data:%p "
816 	       "m_len:%d m_type:0x%02x m_flags:0x%02x }\n",
817 		m, m->m_next, m->m_nextpkt, m->m_data,
818 		m->m_len, m->m_type, m->m_flags);
819 
820 	if (m->m_flags & M_PKTHDR) {
821 		printf("  m_pkthdr{ len:%d rcvif:%p }\n",
822 		    m->m_pkthdr.len, m->m_pkthdr.rcvif);
823 	}
824 
825 	if (m->m_flags & M_EXT) {
826 		printf("  m_ext{ ext_buf:%p ext_free:%p "
827 		       "ext_size:%u ext_cnt:%p }\n",
828 			m->m_ext.ext_buf, m->m_ext.ext_free,
829 			m->m_ext.ext_size, m->m_ext.ext_cnt);
830 	}
831 
832 	return;
833 }
834 
835 void
836 kdebug_mbuf(const struct mbuf *m0)
837 {
838 	const struct mbuf *m = m0;
839 	int i, j;
840 
841 	for (j = 0; m; m = m->m_next) {
842 		kdebug_mbufhdr(m);
843 		printf("  m_data:\n");
844 		for (i = 0; i < m->m_len; i++) {
845 			if (i && i % 32 == 0)
846 				printf("\n");
847 			if (i % 4 == 0)
848 				printf(" ");
849 			printf("%02x", mtod(m, const u_char *)[i]);
850 			j++;
851 		}
852 		printf("\n");
853 	}
854 
855 	return;
856 }
857 
858 /* Return a printable string for the address. */
859 char *
860 ipsec_address(const union sockaddr_union* sa, char *buf, socklen_t size)
861 {
862 
863 	switch (sa->sa.sa_family) {
864 #ifdef INET
865 	case AF_INET:
866 		return (inet_ntop(AF_INET, &sa->sin.sin_addr, buf, size));
867 #endif /* INET */
868 #ifdef INET6
869 	case AF_INET6:
870 		if (IN6_IS_SCOPE_LINKLOCAL(&sa->sin6.sin6_addr)) {
871 			snprintf(buf, size, "%s%%%u", inet_ntop(AF_INET6,
872 			    &sa->sin6.sin6_addr, buf, size),
873 			    sa->sin6.sin6_scope_id);
874 			return (buf);
875 		} else
876 			return (inet_ntop(AF_INET6, &sa->sin6.sin6_addr,
877 			    buf, size));
878 #endif /* INET6 */
879 	case 0:
880 		return ("*");
881 	default:
882 		return ("(unknown address family)");
883 	}
884 }
885 
886 char *
887 ipsec_sa2str(struct secasvar *sav, char *buf, size_t size)
888 {
889 	char sbuf[IPSEC_ADDRSTRLEN], dbuf[IPSEC_ADDRSTRLEN];
890 
891 	snprintf(buf, size, "SA(SPI=%08lx src=%s dst=%s)",
892 	    (u_long)ntohl(sav->spi),
893 	    ipsec_address(&sav->sah->saidx.src, sbuf, sizeof(sbuf)),
894 	    ipsec_address(&sav->sah->saidx.dst, dbuf, sizeof(dbuf)));
895 	return (buf);
896 }
897 
898 #endif /* _KERNEL */
899 
900 void
901 kdebug_sockaddr(struct sockaddr *addr)
902 {
903 	char buf[IPSEC_ADDRSTRLEN];
904 
905 	/* sanity check */
906 	if (addr == NULL)
907 		panic("%s: NULL pointer was passed.\n", __func__);
908 
909 	switch (addr->sa_family) {
910 #ifdef INET
911 	case AF_INET: {
912 		struct sockaddr_in *sin;
913 
914 		sin = (struct sockaddr_in *)addr;
915 		inet_ntop(AF_INET, &sin->sin_addr, buf, sizeof(buf));
916 		break;
917 	}
918 #endif
919 #ifdef INET6
920 	case AF_INET6: {
921 		struct sockaddr_in6 *sin6;
922 
923 		sin6 = (struct sockaddr_in6 *)addr;
924 		if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
925 			snprintf(buf, sizeof(buf), "%s%%%u",
926 			    inet_ntop(AF_INET6, &sin6->sin6_addr, buf,
927 			    sizeof(buf)), sin6->sin6_scope_id);
928 		} else
929 			inet_ntop(AF_INET6, &sin6->sin6_addr, buf,
930 			    sizeof(buf));
931 		break;
932 	}
933 #endif
934 	default:
935 		sprintf(buf, "unknown");
936 	}
937 	printf("sockaddr{ len=%u family=%u addr=%s }\n", addr->sa_len,
938 	    addr->sa_family, buf);
939 }
940 
941 void
942 ipsec_bindump(caddr_t buf, int len)
943 {
944 	int i;
945 
946 	for (i = 0; i < len; i++)
947 		printf("%c", (unsigned char)buf[i]);
948 
949 	return;
950 }
951 
952 
953 void
954 ipsec_hexdump(caddr_t buf, int len)
955 {
956 	int i;
957 
958 	for (i = 0; i < len; i++) {
959 		if (i != 0 && i % 32 == 0) printf("\n");
960 		if (i % 4 == 0) printf(" ");
961 		printf("%02x", (unsigned char)buf[i]);
962 	}
963 #if 0
964 	if (i % 32 != 0) printf("\n");
965 #endif
966 
967 	return;
968 }
969