ipsec-tools/Common/pfkey_dump.c

   1 /*      $KAME: pfkey_dump.c,v 1.45 2003/09/08 10:14:56 itojun Exp $     */
   2
   3 /*
   4  * Copyright (C) 1995, 1996, 1997, 1998, and 1999 WIDE Project.
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  * 3. Neither the name of the project nor the names of its contributors
  16  *    may be used to endorse or promote products derived from this software
  17  *    without specific prior written permission.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  29  * SUCH DAMAGE.
  30  */
  31
  32 #ifdef HAVE_CONFIG_H
  33 #include "config.h"
  34 #endif
  35
  36 #include <sys/types.h>
  37 #include <sys/param.h>
  38 #include <sys/socket.h>
  39 #ifdef HAVE_NETINET6_IPSEC
  40 #  include <netinet6/ipsec.h>
  41 #else
  42 #  include <netinet/ipsec.h>
  43 #endif
  44
  45 #include <net/pfkeyv2.h>
  46
  47 #include <netinet/in.h>
  48 #include <arpa/inet.h>
  49
  50 #include <stdlib.h>
  51 #include <unistd.h>
  52 #include <stdio.h>
  53 #include <string.h>
  54 #include <time.h>
  55 #include <netdb.h>
  56
  57 #include "ipsec_strerror.h"
  58 #include "libpfkey.h"
  59
  60 /* cope with old kame headers - ugly */
  61 #ifndef SADB_X_AALG_MD5
  62 #define SADB_X_AALG_MD5         SADB_AALG_MD5
  63 #endif
  64 #ifndef SADB_X_AALG_SHA
  65 #define SADB_X_AALG_SHA         SADB_AALG_SHA
  66 #endif
  67 #ifndef SADB_X_AALG_NULL
  68 #define SADB_X_AALG_NULL        SADB_AALG_NULL
  69 #endif
  70
  71 #ifndef SADB_X_EALG_BLOWFISHCBC
  72 #define SADB_X_EALG_BLOWFISHCBC SADB_EALG_BLOWFISHCBC
  73 #endif
  74 #ifndef SADB_X_EALG_CAST128CBC
  75 #define SADB_X_EALG_CAST128CBC  SADB_EALG_CAST128CBC
  76 #endif
  77 #ifndef SADB_X_EALG_RC5CBC
  78 #ifdef SADB_EALG_RC5CBC
  79 #define SADB_X_EALG_RC5CBC      SADB_EALG_RC5CBC
  80 #endif
  81 #endif
  82
  83 #define GETMSGSTR(str, num) \
  84 do { \
  85         /*CONSTCOND*/ \
  86         if (sizeof((str)[0]) == 0 \
  87          || num >= sizeof(str)/sizeof((str)[0])) \
  88                 printf("%u ", (num)); \
  89         else if (strlen((str)[(num)]) == 0) \
  90                 printf("%u ", (num)); \
  91         else \
  92                 printf("%s ", (str)[(num)]); \
  93 } while (/*CONSTCOND*/0)
  94
  95 #define GETMSGV2S(v2s, num) \
  96 do { \
  97         struct val2str *p;  \
  98         for (p = (v2s); p && p->str; p++) { \
  99                 if (p->val == (num)) \
 100                         break; \
 101         } \
 102         if (p && p->str) \
 103                 printf("%s ", p->str); \
 104         else \
 105                 printf("%u ", (num)); \
 106 } while (/*CONSTCOND*/0)
 107
 108 static char *str_ipaddr (struct sockaddr *);
 109 static char *str_ipport (struct sockaddr *);
 110 static char *str_prefport (u_int, u_int, u_int, u_int);
 111 static void str_upperspec (u_int, u_int, u_int);
 112 static char *str_time (time_t);
 113 static void str_lifetime_byte (struct sadb_lifetime *, char *);
 114 static void pfkey_sadump1 (struct sadb_msg *, int);
 115 static void pfkey_spdump1 (struct sadb_msg *, int);
 116
 117 struct val2str {
 118         int val;
 119         const char *str;
 120 };
 121
 122 /*
 123  * Must to be re-written about following strings.
 124  */
 125 static char *str_satype[] = {
 126         "unspec",
 127         "unknown",
 128         "ah",
 129         "esp",
 130         "unknown",
 131         "rsvp",
 132         "ospfv2",
 133         "ripv2",
 134         "mip",
 135         "ipcomp",
 136         "policy",
 137         "tcp",
 138 };
 139
 140 static char *str_mode[] = {
 141         "any",
 142         "transport",
 143         "tunnel",
 144 };
 145
 146 static char *str_state[] = {
 147         "larval",
 148         "mature",
 149         "dying",
 150         "dead",
 151 };
 152
 153 static struct val2str str_alg_auth[] = {
 154         { SADB_AALG_NONE, "none", },
 155         { SADB_AALG_MD5HMAC, "hmac-md5", },
 156         { SADB_AALG_SHA1HMAC, "hmac-sha1", },
 157         { SADB_X_AALG_MD5, "md5", },
 158         { SADB_X_AALG_SHA, "sha", },
 159         { SADB_X_AALG_NULL, "null", },
 160 #ifdef SADB_X_AALG_TCP_MD5
 161         { SADB_X_AALG_TCP_MD5, "tcp-md5", },
 162 #endif
 163 #ifdef SADB_X_AALG_SHA2_256
 164         { SADB_X_AALG_SHA2_256, "hmac-sha256", },
 165 #endif
 166 #ifdef SADB_X_AALG_SHA2_384
 167         { SADB_X_AALG_SHA2_384, "hmac-sha384", },
 168 #endif
 169 #ifdef SADB_X_AALG_SHA2_512
 170         { SADB_X_AALG_SHA2_512, "hmac-sha512", },
 171 #endif
 172 #ifdef SADB_X_AALG_RIPEMD160HMAC
 173         { SADB_X_AALG_RIPEMD160HMAC, "hmac-ripemd160", },
 174 #endif
 175 #ifdef SADB_X_AALG_AES_XCBC_MAC
 176         { SADB_X_AALG_AES_XCBC_MAC, "aes-xcbc-mac", },
 177 #endif
 178         { -1, NULL, },
 179 };
 180
 181 static struct val2str str_alg_enc[] = {
 182         { SADB_EALG_NONE, "none", },
 183         { SADB_EALG_DESCBC, "des-cbc", },
 184         { SADB_EALG_3DESCBC, "3des-cbc", },
 185         { SADB_EALG_NULL, "null", },
 186 #ifdef SADB_X_EALG_RC5CBC
 187         { SADB_X_EALG_RC5CBC, "rc5-cbc", },
 188 #endif
 189         { SADB_X_EALG_CAST128CBC, "cast128-cbc", },
 190         { SADB_X_EALG_BLOWFISHCBC, "blowfish-cbc", },
 191 #ifdef SADB_X_EALG_AESCBC
 192         { SADB_X_EALG_AESCBC, "aes-cbc", },
 193 #endif
 194 #ifdef SADB_X_EALG_TWOFISHCBC
 195         { SADB_X_EALG_TWOFISHCBC, "twofish-cbc", },
 196 #endif
 197 #ifdef SADB_X_EALG_AESCTR
 198         { SADB_X_EALG_AESCTR, "aes-ctr", },
 199 #endif
 200         { -1, NULL, },
 201 };
 202
 203 static struct val2str str_alg_comp[] = {
 204         { SADB_X_CALG_NONE, "none", },
 205         { SADB_X_CALG_OUI, "oui", },
 206         { SADB_X_CALG_DEFLATE, "deflate", },
 207         { SADB_X_CALG_LZS, "lzs", },
 208         { -1, NULL, },
 209 };
 210
 211 /*
 212  * dump SADB_MSG formated.  For debugging, you should use kdebug_sadb().
 213  */
 214
 215 void
 216 pfkey_sadump(m)
 217         struct sadb_msg *m;
 218 {
 219         pfkey_sadump1(m, 0);
 220 }
 221
 222 void
 223 pfkey_sadump_withports(m)
 224         struct sadb_msg *m;
 225 {
 226         pfkey_sadump1(m, 1);
 227 }
 228
 229 void
 230 pfkey_sadump1(m, withports)
 231         struct sadb_msg *m;
 232         int withports;
 233 {
 234         caddr_t mhp[SADB_EXT_MAX + 1];
 235         struct sadb_sa *m_sa;
 236         struct sadb_x_sa2 *m_sa2;
 237         struct sadb_lifetime *m_lftc, *m_lfth, *m_lfts;
 238         struct sadb_address *m_saddr, *m_daddr;
 239 #ifdef notdef
 240         struct sadb_address *m_paddr;
 241 #endif
 242         struct sadb_key *m_auth, *m_enc;
 243 #ifdef notdef
 244         struct sadb_ident *m_sid, *m_did;
 245         struct sadb_sens *m_sens;
 246 #endif
 247 #ifdef SADB_X_EXT_NAT_T_TYPE
 248         struct sadb_x_nat_t_type *natt_type;
 249         struct sadb_x_nat_t_port *natt_sport, *natt_dport;
 250         struct sadb_address *natt_oa;
 251
 252         int use_natt = 0;
 253 #endif
 254         struct sockaddr *sa;
 255
 256         /* check pfkey message. */
 257         if (pfkey_align(m, mhp)) {
 258                 printf("%s\n", ipsec_strerror());
 259                 return;
 260         }
 261         if (pfkey_check(mhp)) {
 262                 printf("%s\n", ipsec_strerror());
 263                 return;
 264         }
 265
 266         m_sa = (void *)mhp[SADB_EXT_SA];
 267         m_sa2 = (void *)mhp[SADB_X_EXT_SA2];
 268         m_lftc = (void *)mhp[SADB_EXT_LIFETIME_CURRENT];
 269         m_lfth = (void *)mhp[SADB_EXT_LIFETIME_HARD];
 270         m_lfts = (void *)mhp[SADB_EXT_LIFETIME_SOFT];
 271         m_saddr = (void *)mhp[SADB_EXT_ADDRESS_SRC];
 272         m_daddr = (void *)mhp[SADB_EXT_ADDRESS_DST];
 273 #ifdef notdef
 274         m_paddr = (void *)mhp[SADB_EXT_ADDRESS_PROXY];
 275 #endif
 276         m_auth = (void *)mhp[SADB_EXT_KEY_AUTH];
 277         m_enc = (void *)mhp[SADB_EXT_KEY_ENCRYPT];
 278 #ifdef notdef
 279         m_sid = (void *)mhp[SADB_EXT_IDENTITY_SRC];
 280         m_did = (void *)mhp[SADB_EXT_IDENTITY_DST];
 281         m_sens = (void *)mhp[SADB_EXT_SENSITIVITY];
 282 #endif
 283 #ifdef SADB_X_EXT_NAT_T_TYPE
 284         natt_type = (void *)mhp[SADB_X_EXT_NAT_T_TYPE];
 285         natt_sport = (void *)mhp[SADB_X_EXT_NAT_T_SPORT];
 286         natt_dport = (void *)mhp[SADB_X_EXT_NAT_T_DPORT];
 287         natt_oa = (void *)mhp[SADB_X_EXT_NAT_T_OA];
 288
 289         if (natt_type && natt_type->sadb_x_nat_t_type_type)
 290                 use_natt = 1;
 291 #endif
 292         /* source address */
 293         if (m_saddr == NULL) {
 294                 printf("no ADDRESS_SRC extension.\n");
 295                 return;
 296         }
 297         sa = (void *)(m_saddr + 1);
 298         if (withports)
 299                 printf("%s[%s]", str_ipaddr(sa), str_ipport(sa));
 300         else
 301                 printf("%s", str_ipaddr(sa));
 302 #ifdef SADB_X_EXT_NAT_T_TYPE
 303         if (use_natt && natt_sport)
 304                 printf("[%u]", ntohs(natt_sport->sadb_x_nat_t_port_port));
 305 #endif
 306         printf(" ");
 307
 308         /* destination address */
 309         if (m_daddr == NULL) {
 310                 printf(" no ADDRESS_DST extension.\n");
 311                 return;
 312         }
 313         sa = (void *)(m_daddr + 1);
 314         if (withports)
 315                 printf("%s[%s]", str_ipaddr(sa), str_ipport(sa));
 316         else
 317                 printf("%s", str_ipaddr(sa));
 318 #ifdef SADB_X_EXT_NAT_T_TYPE
 319         if (use_natt && natt_dport)
 320                 printf("[%u]", ntohs(natt_dport->sadb_x_nat_t_port_port));
 321 #endif
 322         printf(" ");
 323
 324         /* SA type */
 325         if (m_sa == NULL) {
 326                 printf("no SA extension.\n");
 327                 return;
 328         }
 329         if (m_sa2 == NULL) {
 330                 printf("no SA2 extension.\n");
 331                 return;
 332         }
 333         printf("\n\t");
 334
 335 #ifdef SADB_X_EXT_NAT_T_TYPE
 336         if (use_natt && m->sadb_msg_satype == SADB_SATYPE_ESP)
 337                 printf("esp-udp ");
 338         else if (use_natt)
 339                 printf("natt+");
 340
 341         if (!use_natt || m->sadb_msg_satype != SADB_SATYPE_ESP)
 342 #endif
 343         GETMSGSTR(str_satype, m->sadb_msg_satype);
 344
 345         printf("mode=");
 346         GETMSGSTR(str_mode, m_sa2->sadb_x_sa2_mode);
 347
 348         printf("spi=%u(0x%08x) reqid=%u(0x%08x)\n",
 349                 (u_int32_t)ntohl(m_sa->sadb_sa_spi),
 350                 (u_int32_t)ntohl(m_sa->sadb_sa_spi),
 351                 (u_int32_t)m_sa2->sadb_x_sa2_reqid,
 352                 (u_int32_t)m_sa2->sadb_x_sa2_reqid);
 353
 354 #ifdef SADB_X_EXT_NAT_T_TYPE
 355         /* other NAT-T information */
 356         if (use_natt && natt_oa)
 357                 printf("\tNAT OA=%s\n",
 358                        str_ipaddr((void *)(natt_oa + 1)));
 359 #endif
 360
 361         /* encryption key */
 362         if (m->sadb_msg_satype == SADB_X_SATYPE_IPCOMP) {
 363                 printf("\tC: ");
 364                 GETMSGV2S(str_alg_comp, m_sa->sadb_sa_encrypt);
 365         } else if (m->sadb_msg_satype == SADB_SATYPE_ESP) {
 366                 if (m_enc != NULL) {
 367                         printf("\tE: ");
 368                         GETMSGV2S(str_alg_enc, m_sa->sadb_sa_encrypt);
 369                         ipsec_hexdump((caddr_t)(void *)m_enc + sizeof(*m_enc),
 370                                       m_enc->sadb_key_bits / 8);
 371                         printf("\n");
 372                 }
 373         }
 374
 375         /* authentication key */
 376         if (m_auth != NULL) {
 377                 printf("\tA: ");
 378                 GETMSGV2S(str_alg_auth, m_sa->sadb_sa_auth);
 379                 ipsec_hexdump((caddr_t)(void *)m_auth + sizeof(*m_auth),
 380                               m_auth->sadb_key_bits / 8);
 381                 printf("\n");
 382         }
 383
 384         /* replay windoe size & flags */
 385         printf("\tseq=0x%08x replay=%u flags=0x%08x ",
 386                 m_sa2->sadb_x_sa2_sequence,
 387                 m_sa->sadb_sa_replay,
 388                 m_sa->sadb_sa_flags);
 389
 390         /* state */
 391         printf("state=");
 392         GETMSGSTR(str_state, m_sa->sadb_sa_state);
 393         printf("\n");
 394
 395         /* lifetime */
 396         if (m_lftc != NULL) {
 397                 time_t tmp_time = time(0);
 398
 399                 printf("\tcreated: %s",
 400                         str_time((long)m_lftc->sadb_lifetime_addtime));
 401                 printf("\tcurrent: %s\n", str_time(tmp_time));
 402                 printf("\tdiff: %lu(s)",
 403                         (u_long)(m_lftc->sadb_lifetime_addtime == 0 ?
 404                         0 : (tmp_time - m_lftc->sadb_lifetime_addtime)));
 405
 406                 printf("\thard: %lu(s)",
 407                         (u_long)(m_lfth == NULL ?
 408                         0 : m_lfth->sadb_lifetime_addtime));
 409                 printf("\tsoft: %lu(s)\n",
 410                         (u_long)(m_lfts == NULL ?
 411                         0 : m_lfts->sadb_lifetime_addtime));
 412
 413                 printf("\tlast: %s",
 414                         str_time((long)m_lftc->sadb_lifetime_usetime));
 415                 printf("\thard: %lu(s)",
 416                         (u_long)(m_lfth == NULL ?
 417                         0 : m_lfth->sadb_lifetime_usetime));
 418                 printf("\tsoft: %lu(s)\n",
 419                         (u_long)(m_lfts == NULL ?
 420                         0 : m_lfts->sadb_lifetime_usetime));
 421
 422                 str_lifetime_byte(m_lftc, "current");
 423                 str_lifetime_byte(m_lfth, "hard");
 424                 str_lifetime_byte(m_lfts, "soft");
 425                 printf("\n");
 426
 427                 printf("\tallocated: %lu",
 428                         (unsigned long)m_lftc->sadb_lifetime_allocations);
 429                 printf("\thard: %lu",
 430                         (u_long)(m_lfth == NULL ?
 431                         0 : m_lfth->sadb_lifetime_allocations));
 432                 printf("\tsoft: %lu\n",
 433                         (u_long)(m_lfts == NULL ?
 434                         0 : m_lfts->sadb_lifetime_allocations));
 435         }
 436
 437         printf("\tsadb_seq=%lu pid=%lu ",
 438                 (u_long)m->sadb_msg_seq,
 439                 (u_long)m->sadb_msg_pid);
 440
 441         /* XXX DEBUG */
 442         printf("refcnt=%u\n", m->sadb_msg_reserved);
 443
 444         return;
 445 }
 446
 447 void
 448 pfkey_spdump(m)
 449         struct sadb_msg *m;
 450 {
 451         pfkey_spdump1(m, 0);
 452 }
 453
 454 void
 455 pfkey_spdump_withports(m)
 456         struct sadb_msg *m;
 457 {
 458         pfkey_spdump1(m, 1);
 459 }
 460
 461 static void
 462 pfkey_dump_single_address (struct sadb_address *addr)
 463 {
 464     u_int16_t port = 0;
 465     char pbuf[NI_MAXSERV];
 466     struct sockaddr *sa;
 467     sa = (void *)(addr + 1);
 468     switch (sa->sa_family) {
 469         case AF_INET:
 470         case AF_INET6:
 471             if (getnameinfo(sa, (socklen_t)sysdep_sa_len((struct sockaddr *)sa), NULL,
 472                             0, pbuf, sizeof(pbuf), NI_NUMERICSERV) != 0)
 473                 port = 0;       /*XXX*/
 474             else
 475                 port = atoi(pbuf);
 476             printf("%s%s", str_ipaddr(sa),
 477                    str_prefport((u_int)sa->sa_family,
 478                                 (u_int)addr->sadb_address_prefixlen,
 479                                 (u_int)port,
 480                                 (u_int)addr->sadb_address_proto));
 481             break;
 482         default:
 483             printf("unknown-af");
 484             break;
 485     }
 486
 487 }
 488
 489 static void
 490 pfkey_spdump1(m, withports)
 491 struct sadb_msg *m;
 492 int withports;
 493 {
 494         char pbuf[NI_MAXSERV];
 495         caddr_t mhp[SADB_EXT_MAX + 1];
 496         struct sadb_address *m_saddr, *m_daddr;
 497     struct sadb_address *m_saddr_s, *m_saddr_e, *m_daddr_s, *m_daddr_e;
 498 #ifdef SADB_X_EXT_TAG
 499         struct sadb_x_tag *m_tag;
 500 #endif
 501         struct sadb_x_policy *m_xpl;
 502         struct sadb_lifetime *m_lftc = NULL, *m_lfth = NULL;
 503     struct sadb_x_ipsecif *m_ipif = NULL;
 504         struct sockaddr *sa;
 505         u_int16_t sport = 0, dport = 0;
 506
 507         /* check pfkey message. */
 508         if (pfkey_align(m, mhp)) {
 509                 printf("%s\n", ipsec_strerror());
 510                 return;
 511         }
 512         if (pfkey_check(mhp)) {
 513                 printf("%s\n", ipsec_strerror());
 514                 return;
 515         }
 516
 517         m_saddr = (void *)mhp[SADB_EXT_ADDRESS_SRC];
 518         m_daddr = (void *)mhp[SADB_EXT_ADDRESS_DST];
 519     m_saddr_s = (void *)mhp[SADB_X_EXT_ADDR_RANGE_SRC_START];
 520     m_saddr_e = (void *)mhp[SADB_X_EXT_ADDR_RANGE_SRC_END];
 521     m_daddr_s = (void *)mhp[SADB_X_EXT_ADDR_RANGE_DST_START];
 522     m_daddr_e = (void *)mhp[SADB_X_EXT_ADDR_RANGE_DST_END];
 523 #ifdef SADB_X_EXT_TAG
 524         m_tag = (void *)mhp[SADB_X_EXT_TAG];
 525 #endif
 526         m_xpl = (void *)mhp[SADB_X_EXT_POLICY];
 527         m_lftc = (void *)mhp[SADB_EXT_LIFETIME_CURRENT];
 528         m_lfth = (void *)mhp[SADB_EXT_LIFETIME_HARD];
 529     m_ipif = (void *)mhp[SADB_X_EXT_IPSECIF];
 530
 531         if ((m_saddr || (m_saddr_s && m_saddr_e)) && (m_daddr || (m_daddr_s && m_daddr_e))) {
 532                 /* source address */
 533         if (m_saddr_s && m_saddr_e) {
 534             pfkey_dump_single_address(m_saddr_s);
 535             printf("-");
 536             pfkey_dump_single_address(m_saddr_e);
 537             printf(" ");
 538         } else if (m_saddr) {
 539             sa = (void *)(m_saddr + 1);
 540             switch (sa->sa_family) {
 541                 case AF_INET:
 542                 case AF_INET6:
 543                     if (getnameinfo(sa, (socklen_t)sysdep_sa_len((struct sockaddr *)sa), NULL,
 544                                     0, pbuf, sizeof(pbuf), NI_NUMERICSERV) != 0)
 545                         sport = 0;      /*XXX*/
 546                     else
 547                         sport = atoi(pbuf);
 548                     printf("%s%s ", str_ipaddr(sa),
 549                            str_prefport((u_int)sa->sa_family,
 550                                         (u_int)m_saddr->sadb_address_prefixlen,
 551                                         (u_int)sport,
 552                                         (u_int)m_saddr->sadb_address_proto));
 553                     break;
 554                 default:
 555                     printf("unknown-af ");
 556                     break;
 557             }
 558         }
 559
 560                 /* destination address */
 561         if (m_daddr_s && m_daddr_e) {
 562             pfkey_dump_single_address(m_daddr_s);
 563             printf("-");
 564             pfkey_dump_single_address(m_daddr_e);
 565             printf(" ");
 566         } else if (m_daddr) {
 567             sa = (void *)(m_daddr + 1);
 568             switch (sa->sa_family) {
 569                 case AF_INET:
 570                 case AF_INET6:
 571                     if (getnameinfo(sa, (socklen_t)sysdep_sa_len((struct sockaddr *)sa), NULL,
 572                                     0, pbuf, sizeof(pbuf), NI_NUMERICSERV) != 0)
 573                         dport = 0;      /*XXX*/
 574                     else
 575                         dport = atoi(pbuf);
 576                     printf("%s%s ", str_ipaddr(sa),
 577                            str_prefport((u_int)sa->sa_family,
 578                                         (u_int)m_daddr->sadb_address_prefixlen,
 579                                         (u_int)dport,
 580                                         (u_int)m_daddr->sadb_address_proto));
 581                     break;
 582                 default:
 583                     printf("unknown-af ");
 584                     break;
 585             }
 586         }
 587
 588                 /* upper layer protocol */
 589         if (m_saddr && m_daddr) {
 590             if (m_saddr->sadb_address_proto !=
 591                 m_daddr->sadb_address_proto) {
 592                 printf("upper layer protocol mismatched.\n");
 593                 return;
 594             }
 595             str_upperspec((u_int)m_saddr->sadb_address_proto, (u_int)sport,
 596                           (u_int)dport);
 597         }
 598         }
 599 #ifdef SADB_X_EXT_TAG
 600         else if (m_tag)
 601                 printf("tagged \"%s\" ", m_tag->sadb_x_tag_name);
 602 #endif
 603         else
 604                 printf("(no selector, probably per-socket policy) ");
 605
 606         /* policy */
 607     {
 608         char *d_xpl;
 609
 610         if (m_xpl == NULL) {
 611             printf("no X_POLICY extension.\n");
 612             return;
 613         }
 614         if (withports)
 615             d_xpl = ipsec_dump_policy_withports(m_xpl, "\n\t");
 616         else
 617             d_xpl = ipsec_dump_policy((ipsec_policy_t)m_xpl, "\n\t");
 618
 619         if (!d_xpl)
 620             printf("\n\tPolicy:[%s]\n", ipsec_strerror());
 621         else {
 622             /* dump SPD */
 623             printf("\n\t%s\n", d_xpl);
 624             free(d_xpl);
 625         }
 626     }
 627
 628         /* lifetime */
 629         if (m_lftc) {
 630                 printf("\tcreated: %s  ",
 631                str_time((long)m_lftc->sadb_lifetime_addtime));
 632                 printf("lastused: %s\n",
 633                str_time((long)m_lftc->sadb_lifetime_usetime));
 634         }
 635         if (m_lfth) {
 636                 printf("\tlifetime: %lu(s) ",
 637                (u_long)m_lfth->sadb_lifetime_addtime);
 638                 printf("validtime: %lu(s)\n",
 639                (u_long)m_lfth->sadb_lifetime_usetime);
 640         }
 641
 642     if (m_ipif) {
 643         printf("\t");
 644         if (m_ipif->sadb_x_ipsecif_internal_if[0])
 645             printf("Internal interface: %s  ", m_ipif->sadb_x_ipsecif_internal_if);
 646         if (m_ipif->sadb_x_ipsecif_outgoing_if[0])
 647             printf("Outgoing interface: %s  ", m_ipif->sadb_x_ipsecif_outgoing_if);
 648         if (m_ipif->sadb_x_ipsecif_ipsec_if[0])
 649             printf("IPSec interface: %s  ", m_ipif->sadb_x_ipsecif_ipsec_if);
 650         printf("Disabled: %d\n", m_ipif->sadb_x_ipsecif_init_disabled);
 651     }
 652
 653         printf("\tspid=%ld seq=%ld pid=%ld\n",
 654            (u_long)m_xpl->sadb_x_policy_id,
 655            (u_long)m->sadb_msg_seq,
 656            (u_long)m->sadb_msg_pid);
 657
 658         /* XXX TEST */
 659         printf("\trefcnt=%u\n", m->sadb_msg_reserved);
 660
 661         return;
 662 }
 663
 664 /*
 665  * set "ipaddress" to buffer.
 666  */
 667 static char *
 668 str_ipaddr(sa)
 669         struct sockaddr *sa;
 670 {
 671         static char buf[NI_MAXHOST];
 672         const int niflag = NI_NUMERICHOST;
 673
 674         if (sa == NULL)
 675                 return "";
 676
 677         if (getnameinfo(sa, (socklen_t)sysdep_sa_len(sa), buf, sizeof(buf),
 678             NULL, 0, niflag) == 0)
 679                 return buf;
 680         return NULL;
 681 }
 682
 683 /*
 684  * set "port" to buffer.
 685  */
 686 static char *
 687 str_ipport(sa)
 688         struct sockaddr *sa;
 689 {
 690         static char buf[NI_MAXHOST];
 691         const int niflag = NI_NUMERICSERV;
 692
 693         if (sa == NULL)
 694                 return "";
 695
 696         if (getnameinfo(sa, (socklen_t)sysdep_sa_len(sa), NULL, 0,
 697             buf, sizeof(buf), niflag) == 0)
 698                 return buf;
 699         return NULL;
 700 }
 701
 702
 703 /*
 704  * set "/prefix[port number]" to buffer.
 705  */
 706 static char *
 707 str_prefport(family, pref, port, ulp)
 708         u_int family, pref, port, ulp;
 709 {
 710         static char buf[128];
 711         char prefbuf[128];
 712         char portbuf[128];
 713         int plen;
 714
 715         switch (family) {
 716         case AF_INET:
 717                 plen = sizeof(struct in_addr) << 3;
 718                 break;
 719         case AF_INET6:
 720                 plen = sizeof(struct in6_addr) << 3;
 721                 break;
 722         default:
 723                 return "?";
 724         }
 725
 726         if (pref == plen)
 727                 prefbuf[0] = '\0';
 728         else
 729                 snprintf(prefbuf, sizeof(prefbuf), "/%u", pref);
 730
 731         if (ulp == IPPROTO_ICMPV6)
 732                 memset(portbuf, 0, sizeof(portbuf));
 733         else {
 734                 if (port == IPSEC_PORT_ANY)
 735                         snprintf(portbuf, sizeof(portbuf), "[%s]", "any");
 736                 else
 737                         snprintf(portbuf, sizeof(portbuf), "[%u]", port);
 738         }
 739
 740         snprintf(buf, sizeof(buf), "%s%s", prefbuf, portbuf);
 741
 742         return buf;
 743 }
 744
 745 static void
 746 str_upperspec(ulp, p1, p2)
 747         u_int ulp, p1, p2;
 748 {
 749         if (ulp == IPSEC_ULPROTO_ANY)
 750                 printf("any");
 751         else if (ulp == IPPROTO_ICMPV6) {
 752                 printf("icmp6");
 753                 if (!(p1 == IPSEC_PORT_ANY && p2 == IPSEC_PORT_ANY))
 754                         printf(" %u,%u", p1, p2);
 755         } else {
 756                 struct protoent *ent;
 757
 758                 switch (ulp) {
 759                 case IPPROTO_IPV4:
 760                         printf("ip4");
 761                         break;
 762                 default:
 763                         ent = getprotobynumber((int)ulp);
 764                         if (ent)
 765                                 printf("%s", ent->p_name);
 766                         else
 767                                 printf("%u", ulp);
 768
 769                         endprotoent();
 770                         break;
 771                 }
 772         }
 773 }
 774
 775 /*
 776  * set "Mon Day Time Year" to buffer
 777  */
 778 static char *
 779 str_time(t)
 780         time_t t;
 781 {
 782         static char buf[128];
 783
 784         if (t == 0) {
 785                 int i = 0;
 786                 for (;i < 20;) buf[i++] = ' ';
 787         } else {
 788                 char *t0;
 789                 t0 = ctime(&t);
 790                 memcpy(buf, t0 + 4, 20);
 791         }
 792
 793         buf[20] = '\0';
 794
 795         return(buf);
 796 }
 797
 798 static void
 799 str_lifetime_byte(x, str)
 800         struct sadb_lifetime *x;
 801         char *str;
 802 {
 803         double y;
 804         char *unit;
 805         int w;
 806
 807         if (x == NULL) {
 808                 printf("\t%s: 0(bytes)", str);
 809                 return;
 810         }
 811
 812 #if 0
 813         if ((x->sadb_lifetime_bytes) / 1024 / 1024) {
 814                 y = (x->sadb_lifetime_bytes) * 1.0 / 1024 / 1024;
 815                 unit = "M";
 816                 w = 1;
 817         } else if ((x->sadb_lifetime_bytes) / 1024) {
 818                 y = (x->sadb_lifetime_bytes) * 1.0 / 1024;
 819                 unit = "K";
 820                 w = 1;
 821         } else {
 822                 y = (x->sadb_lifetime_bytes) * 1.0;
 823                 unit = "";
 824                 w = 0;
 825         }
 826 #else
 827         y = (x->sadb_lifetime_bytes) * 1.0;
 828         unit = "";
 829         w = 0;
 830 #endif
 831         printf("\t%s: %.*f(%sbytes)", str, w, y, unit);
 832 }