1 /* $FreeBSD$ */ 2 /* $KAME: ipsec.c,v 1.33 2003/07/25 09:54:32 itojun Exp $ */ 3 4 /* 5 * Copyright (c) 2005 NTT Multimedia Communications Laboratories, Inc. 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 * SUCH DAMAGE. 28 */ 29 30 /* 31 * Copyright (C) 1995, 1996, 1997, 1998, and 1999 WIDE Project. 32 * All rights reserved. 33 * 34 * Redistribution and use in source and binary forms, with or without 35 * modification, are permitted provided that the following conditions 36 * are met: 37 * 1. Redistributions of source code must retain the above copyright 38 * notice, this list of conditions and the following disclaimer. 39 * 2. Redistributions in binary form must reproduce the above copyright 40 * notice, this list of conditions and the following disclaimer in the 41 * documentation and/or other materials provided with the distribution. 42 * 3. Neither the name of the project nor the names of its contributors 43 * may be used to endorse or promote products derived from this software 44 * without specific prior written permission. 45 * 46 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 47 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 48 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 49 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 50 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 51 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 52 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 53 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 54 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 55 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 56 * SUCH DAMAGE. 57 */ 58 59 /* 60 * Copyright (c) 1983, 1988, 1993 61 * The Regents of the University of California. All rights reserved. 62 * 63 * Redistribution and use in source and binary forms, with or without 64 * modification, are permitted provided that the following conditions 65 * are met: 66 * 1. Redistributions of source code must retain the above copyright 67 * notice, this list of conditions and the following disclaimer. 68 * 2. Redistributions in binary form must reproduce the above copyright 69 * notice, this list of conditions and the following disclaimer in the 70 * documentation and/or other materials provided with the distribution. 71 * 3. All advertising materials mentioning features or use of this software 72 * must display the following acknowledgement: 73 * This product includes software developed by the University of 74 * California, Berkeley and its contributors. 75 * 4. Neither the name of the University nor the names of its contributors 76 * may be used to endorse or promote products derived from this software 77 * without specific prior written permission. 78 * 79 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 80 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 81 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 82 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 83 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 84 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 85 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 86 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 87 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 88 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 89 * SUCH DAMAGE. 90 */ 91 92 #if 0 93 #ifndef lint 94 static char sccsid[] = "@(#)inet.c 8.5 (Berkeley) 5/24/95"; 95 #endif /* not lint */ 96 #endif 97 98 #include <sys/cdefs.h> 99 __FBSDID("$FreeBSD$"); 100 101 #include <sys/param.h> 102 #include <sys/queue.h> 103 #include <sys/socket.h> 104 105 #include <netinet/in.h> 106 107 #if defined(IPSEC) && !defined(FAST_IPSEC) 108 #include <netinet6/ipsec.h> 109 #endif 110 111 #ifdef FAST_IPSEC 112 #include <netipsec/ipsec.h> 113 #include <netipsec/ah_var.h> 114 #include <netipsec/esp_var.h> 115 #include <netipsec/ipcomp_var.h> 116 #endif 117 118 #include <stdint.h> 119 #include <stdio.h> 120 #include <string.h> 121 #include <unistd.h> 122 #include "netstat.h" 123 124 #ifdef IPSEC 125 struct val2str { 126 int val; 127 const char *str; 128 }; 129 130 static struct val2str ipsec_ahnames[] = { 131 { SADB_AALG_NONE, "none", }, 132 { SADB_AALG_MD5HMAC, "hmac-md5", }, 133 { SADB_AALG_SHA1HMAC, "hmac-sha1", }, 134 { SADB_X_AALG_MD5, "md5", }, 135 { SADB_X_AALG_SHA, "sha", }, 136 { SADB_X_AALG_NULL, "null", }, 137 #ifdef SADB_X_AALG_SHA2_256 138 { SADB_X_AALG_SHA2_256, "hmac-sha2-256", }, 139 #endif 140 #ifdef SADB_X_AALG_SHA2_384 141 { SADB_X_AALG_SHA2_384, "hmac-sha2-384", }, 142 #endif 143 #ifdef SADB_X_AALG_SHA2_512 144 { SADB_X_AALG_SHA2_512, "hmac-sha2-512", }, 145 #endif 146 #ifdef SADB_X_AALG_RIPEMD160HMAC 147 { SADB_X_AALG_RIPEMD160HMAC, "hmac-ripemd160", }, 148 #endif 149 #ifdef SADB_X_AALG_AES_XCBC_MAC 150 { SADB_X_AALG_AES_XCBC_MAC, "aes-xcbc-mac", }, 151 #endif 152 { -1, NULL }, 153 }; 154 155 static struct val2str ipsec_espnames[] = { 156 { SADB_EALG_NONE, "none", }, 157 { SADB_EALG_DESCBC, "des-cbc", }, 158 { SADB_EALG_3DESCBC, "3des-cbc", }, 159 { SADB_EALG_NULL, "null", }, 160 { SADB_X_EALG_CAST128CBC, "cast128-cbc", }, 161 { SADB_X_EALG_BLOWFISHCBC, "blowfish-cbc", }, 162 #ifdef SADB_X_EALG_RIJNDAELCBC 163 { SADB_X_EALG_RIJNDAELCBC, "rijndael-cbc", }, 164 #endif 165 #ifdef SADB_X_EALG_AESCTR 166 { SADB_X_EALG_AESCTR, "aes-ctr", }, 167 #endif 168 { -1, NULL }, 169 }; 170 171 static struct val2str ipsec_compnames[] = { 172 { SADB_X_CALG_NONE, "none", }, 173 { SADB_X_CALG_OUI, "oui", }, 174 { SADB_X_CALG_DEFLATE, "deflate", }, 175 { SADB_X_CALG_LZS, "lzs", }, 176 { -1, NULL }, 177 }; 178 179 static void ipsec_hist(const u_quad_t *hist, size_t histmax, 180 const struct val2str *name, const char *title); 181 static void print_ipsecstats(const struct ipsecstat *ipsecstat); 182 183 184 /* 185 * Dump IPSEC statistics structure. 186 */ 187 static void 188 ipsec_hist(const u_quad_t *hist, size_t histmax, const struct val2str *name, 189 const char *title) 190 { 191 int first; 192 size_t proto; 193 const struct val2str *p; 194 195 first = 1; 196 for (proto = 0; proto < histmax; proto++) { 197 if (hist[proto] <= 0) 198 continue; 199 if (first) { 200 printf("\t%s histogram:\n", title); 201 first = 0; 202 } 203 for (p = name; p && p->str; p++) { 204 if (p->val == (int)proto) 205 break; 206 } 207 if (p && p->str) { 208 printf("\t\t%s: %ju\n", p->str, (uintmax_t)hist[proto]); 209 } else { 210 printf("\t\t#%ld: %ju\n", (long)proto, 211 (uintmax_t)hist[proto]); 212 } 213 } 214 } 215 216 static void 217 print_ipsecstats(const struct ipsecstat *ipsecstat) 218 { 219 #define p(f, m) if (ipsecstat->f || sflag <= 1) \ 220 printf(m, (uintmax_t)ipsecstat->f, plural(ipsecstat->f)) 221 #define pes(f, m) if (ipsecstat->f || sflag <= 1) \ 222 printf(m, (uintmax_t)ipsecstat->f, plurales(ipsecstat->f)) 223 #define hist(f, n, t) \ 224 ipsec_hist((f), sizeof(f)/sizeof(f[0]), (n), (t)); 225 226 p(in_success, "\t%ju inbound packet%s processed successfully\n"); 227 p(in_polvio, "\t%ju inbound packet%s violated process security " 228 "policy\n"); 229 p(in_nosa, "\t%ju inbound packet%s with no SA available\n"); 230 p(in_inval, "\t%ju invalid inbound packet%s\n"); 231 p(in_nomem, "\t%ju inbound packet%s failed due to insufficient memory\n"); 232 p(in_badspi, "\t%ju inbound packet%s failed getting SPI\n"); 233 p(in_ahreplay, "\t%ju inbound packet%s failed on AH replay check\n"); 234 p(in_espreplay, "\t%ju inbound packet%s failed on ESP replay check\n"); 235 p(in_ahauthsucc, "\t%ju inbound packet%s considered authentic\n"); 236 p(in_ahauthfail, "\t%ju inbound packet%s failed on authentication\n"); 237 hist(ipsecstat->in_ahhist, ipsec_ahnames, "AH input"); 238 hist(ipsecstat->in_esphist, ipsec_espnames, "ESP input"); 239 hist(ipsecstat->in_comphist, ipsec_compnames, "IPComp input"); 240 241 p(out_success, "\t%ju outbound packet%s processed successfully\n"); 242 p(out_polvio, "\t%ju outbound packet%s violated process security " 243 "policy\n"); 244 p(out_nosa, "\t%ju outbound packet%s with no SA available\n"); 245 p(out_inval, "\t%ju invalid outbound packet%s\n"); 246 p(out_nomem, "\t%ju outbound packet%s failed due to insufficient memory\n"); 247 p(out_noroute, "\t%ju outbound packet%s with no route\n"); 248 hist(ipsecstat->out_ahhist, ipsec_ahnames, "AH output"); 249 hist(ipsecstat->out_esphist, ipsec_espnames, "ESP output"); 250 hist(ipsecstat->out_comphist, ipsec_compnames, "IPComp output"); 251 p(spdcachelookup, "\t%ju SPD cache lookup%s\n"); 252 pes(spdcachemiss, "\t%ju SPD cache miss%s\n"); 253 #undef p 254 #undef pes 255 #undef hist 256 } 257 258 void 259 ipsec_stats(u_long off, const char *name, int af1 __unused) 260 { 261 struct ipsecstat ipsecstat; 262 263 if (off == 0) 264 return; 265 printf ("%s:\n", name); 266 kread(off, (char *)&ipsecstat, sizeof(ipsecstat)); 267 268 print_ipsecstats(&ipsecstat); 269 } 270 271 272 #ifdef FAST_IPSEC 273 274 static void ipsec_hist_new(const u_int32_t *hist, size_t histmax, 275 const struct val2str *name, const char *title); 276 static void print_newipsecstats(const struct newipsecstat *newipsecstat); 277 static void print_ahstats(const struct ahstat *ahstat); 278 static void print_espstats(const struct espstat *espstat); 279 static void print_ipcompstats(const struct ipcompstat *ipcompstat); 280 281 /* 282 * Dump IPSEC statistics structure. 283 */ 284 static void 285 ipsec_hist_new(const u_int32_t *hist, size_t histmax, 286 const struct val2str *name, const char *title) 287 { 288 int first; 289 size_t proto; 290 const struct val2str *p; 291 292 first = 1; 293 for (proto = 0; proto < histmax; proto++) { 294 if (hist[proto] <= 0) 295 continue; 296 if (first) { 297 printf("\t%s histogram:\n", title); 298 first = 0; 299 } 300 for (p = name; p && p->str; p++) { 301 if (p->val == (int)proto) 302 break; 303 } 304 if (p && p->str) { 305 printf("\t\t%s: %u\n", p->str, hist[proto]); 306 } else { 307 printf("\t\t#%lu: %u\n", (unsigned long)proto, 308 hist[proto]); 309 } 310 } 311 } 312 313 static void 314 print_newipsecstats(const struct newipsecstat *newipsecstat) 315 { 316 #define p(f, m) if (newipsecstat->f || sflag <= 1) \ 317 printf(m, newipsecstat->f, plural(newipsecstat->f)) 318 319 p(ips_in_polvio, "\t%u inbound packet%s violated process " 320 "security policy\n"); 321 p(ips_out_polvio, "\t%u outbound packet%s violated process " 322 "security policy\n"); 323 p(ips_out_nosa, "\t%u outbound packet%s with no SA available\n"); 324 p(ips_out_nomem, "\t%u outbound packet%s failed due to " 325 "insufficient memory\n"); 326 p(ips_out_noroute, "\t%u outbound packet%s with no route " 327 "available\n"); 328 p(ips_out_inval, "\t%u invalid outbound packet%s\n"); 329 p(ips_out_bundlesa, "\t%u outbound packet%s with bundled SAs\n"); 330 p(ips_mbcoalesced, "\t%u mbuf%s coalesced during clone\n"); 331 p(ips_clcoalesced, "\t%u cluster%s coalesced during clone\n"); 332 p(ips_clcopied, "\t%u cluster%s copied during clone\n"); 333 p(ips_mbinserted, "\t%u mbuf%s inserted during makespace\n"); 334 #undef p 335 } 336 337 void 338 ipsec_stats_new(u_long off, const char *name, int family __unused) 339 { 340 struct newipsecstat newipsecstat; 341 342 if (off == 0) 343 return; 344 printf ("%s:\n", name); 345 kread(off, (char *)&newipsecstat, sizeof(newipsecstat)); 346 347 print_newipsecstats(&newipsecstat); 348 } 349 350 static void 351 print_ahstats(const struct ahstat *ahstat) 352 { 353 #define p32(f, m) if (ahstat->f || sflag <= 1) \ 354 printf("\t%u" m, (unsigned int)ahstat->f, plural(ahstat->f)) 355 #define p64(f, m) if (ahstat->f || sflag <= 1) \ 356 printf("\t%ju" m, (uintmax_t)ahstat->f, plural(ahstat->f)) 357 #define hist(f, n, t) \ 358 ipsec_hist_new((f), sizeof(f)/sizeof(f[0]), (n), (t)); 359 360 p32(ahs_hdrops, " packet%s shorter than header shows\n"); 361 p32(ahs_nopf, " packet%s dropped; protocol family not supported\n"); 362 p32(ahs_notdb, " packet%s dropped; no TDB\n"); 363 p32(ahs_badkcr, " packet%s dropped; bad KCR\n"); 364 p32(ahs_qfull, " packet%s dropped; queue full\n"); 365 p32(ahs_noxform, " packet%s dropped; no transform\n"); 366 p32(ahs_wrap, " replay counter wrap%s\n"); 367 p32(ahs_badauth, " packet%s dropped; bad authentication detected\n"); 368 p32(ahs_badauthl, " packet%s dropped; bad authentication length\n"); 369 p32(ahs_replay, " possible replay packet%s detected\n"); 370 p32(ahs_input, " packet%s in\n"); 371 p32(ahs_output, " packet%s out\n"); 372 p32(ahs_invalid, " packet%s dropped; invalid TDB\n"); 373 p64(ahs_ibytes, " byte%s in\n"); 374 p64(ahs_obytes, " byte%s out\n"); 375 p32(ahs_toobig, " packet%s dropped; larger than IP_MAXPACKET\n"); 376 p32(ahs_pdrops, " packet%s blocked due to policy\n"); 377 p32(ahs_crypto, " crypto processing failure%s\n"); 378 p32(ahs_tunnel, " tunnel sanity check failure%s\n"); 379 hist(ahstat->ahs_hist, ipsec_ahnames, "AH output"); 380 381 #undef p32 382 #undef p64 383 #undef hist 384 } 385 386 void 387 ah_stats(u_long off, const char *name, int family __unused) 388 { 389 struct ahstat ahstat; 390 391 if (off == 0) 392 return; 393 printf ("%s:\n", name); 394 kread(off, (char *)&ahstat, sizeof(ahstat)); 395 396 print_ahstats(&ahstat); 397 } 398 399 static void 400 print_espstats(const struct espstat *espstat) 401 { 402 #define p32(f, m) if (espstat->f || sflag <= 1) \ 403 printf("\t%u" m, (unsigned int)espstat->f, plural(espstat->f)) 404 #define p64(f, m) if (espstat->f || sflag <= 1) \ 405 printf("\t%ju" m, (uintmax_t)espstat->f, plural(espstat->f)) 406 #define hist(f, n, t) \ 407 ipsec_hist_new((f), sizeof(f)/sizeof(f[0]), (n), (t)); 408 409 p32(esps_hdrops, " packet%s shorter than header shows\n"); 410 p32(esps_nopf, " packet%s dropped; protocol family not supported\n"); 411 p32(esps_notdb, " packet%s dropped; no TDB\n"); 412 p32(esps_badkcr, " packet%s dropped; bad KCR\n"); 413 p32(esps_qfull, " packet%s dropped; queue full\n"); 414 p32(esps_noxform, " packet%s dropped; no transform\n"); 415 p32(esps_badilen, " packet%s dropped; bad ilen\n"); 416 p32(esps_wrap, " replay counter wrap%s\n"); 417 p32(esps_badenc, " packet%s dropped; bad encryption detected\n"); 418 p32(esps_badauth, " packet%s dropped; bad authentication detected\n"); 419 p32(esps_replay, " possible replay packet%s detected\n"); 420 p32(esps_input, " packet%s in\n"); 421 p32(esps_output, " packet%s out\n"); 422 p32(esps_invalid, " packet%s dropped; invalid TDB\n"); 423 p64(esps_ibytes, " byte%s in\n"); 424 p64(esps_obytes, " byte%s out\n"); 425 p32(esps_toobig, " packet%s dropped; larger than IP_MAXPACKET\n"); 426 p32(esps_pdrops, " packet%s blocked due to policy\n"); 427 p32(esps_crypto, " crypto processing failure%s\n"); 428 p32(esps_tunnel, " tunnel sanity check failure%s\n"); 429 hist(espstat->esps_hist, ipsec_espnames, "ESP output"); 430 431 #undef p32 432 #undef p64 433 #undef hist 434 } 435 436 void 437 esp_stats(u_long off, const char *name, int family __unused) 438 { 439 struct espstat espstat; 440 441 if (off == 0) 442 return; 443 printf ("%s:\n", name); 444 kread(off, (char *)&espstat, sizeof(espstat)); 445 446 print_espstats(&espstat); 447 } 448 449 static void 450 print_ipcompstats(const struct ipcompstat *ipcompstat) 451 { 452 #define p32(f, m) if (ipcompstat->f || sflag <= 1) \ 453 printf("\t%u" m, (unsigned int)ipcompstat->f, plural(ipcompstat->f)) 454 #define p64(f, m) if (ipcompstat->f || sflag <= 1) \ 455 printf("\t%ju" m, (uintmax_t)ipcompstat->f, plural(ipcompstat->f)) 456 #define hist(f, n, t) \ 457 ipsec_hist_new((f), sizeof(f)/sizeof(f[0]), (n), (t)); 458 459 p32(ipcomps_hdrops, " packet%s shorter than header shows\n"); 460 p32(ipcomps_nopf, " packet%s dropped; protocol family not supported\n"); 461 p32(ipcomps_notdb, " packet%s dropped; no TDB\n"); 462 p32(ipcomps_badkcr, " packet%s dropped; bad KCR\n"); 463 p32(ipcomps_qfull, " packet%s dropped; queue full\n"); 464 p32(ipcomps_noxform, " packet%s dropped; no transform\n"); 465 p32(ipcomps_wrap, " replay counter wrap%s\n"); 466 p32(ipcomps_input, " packet%s in\n"); 467 p32(ipcomps_output, " packet%s out\n"); 468 p32(ipcomps_invalid, " packet%s dropped; invalid TDB\n"); 469 p64(ipcomps_ibytes, " byte%s in\n"); 470 p64(ipcomps_obytes, " byte%s out\n"); 471 p32(ipcomps_toobig, " packet%s dropped; larger than IP_MAXPACKET\n"); 472 p32(ipcomps_pdrops, " packet%s blocked due to policy\n"); 473 p32(ipcomps_crypto, " crypto processing failure%s\n"); 474 hist(ipcompstat->ipcomps_hist, ipsec_compnames, "COMP output"); 475 476 #undef p32 477 #undef p64 478 #undef hist 479 } 480 481 void 482 ipcomp_stats(u_long off, const char *name, int family __unused) 483 { 484 struct ipcompstat ipcompstat; 485 486 if (off == 0) 487 return; 488 printf ("%s:\n", name); 489 kread(off, (char *)&ipcompstat, sizeof(ipcompstat)); 490 491 print_ipcompstats(&ipcompstat); 492 } 493 494 #endif /* FAST_IPSEC */ 495 #endif /*IPSEC*/ 496