[apple/network_cmds.git] / netstat.tproj / ipsec.c

/*
 * Copyright (c) 2008-2012 Apple Inc. All rights reserved.
 *
 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
 *
 * This file contains Original Code and/or Modifications of Original Code
 * as defined in and that are subject to the Apple Public Source License
 * Version 2.0 (the 'License'). You may not use this file except in
 * compliance with the License. The rights granted to you under the License
 * may not be used to create, or enable the creation or redistribution of,
 * unlawful or unlicensed copies of an Apple operating system, or to
 * circumvent, violate, or enable the circumvention or violation of, any
 * terms of an Apple operating system software license agreement.
 *
 * Please obtain a copy of the License at
 * http://www.opensource.apple.com/apsl/ and read it before using this file.
 *
 * The Original Code and all software distributed under the License are
 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
 * Please see the License for the specific language governing rights and
 * limitations under the License.
 *
 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
 */
/*	$FreeBSD: src/usr.bin/netstat/ipsec.c,v 1.1.2.3 2001/08/10 09:07:09 ru Exp $	*/
/*	$NetBSD: inet.c,v 1.35.2.1 1999/04/29 14:57:08 perry Exp $	*/
/*	$KAME: ipsec.c,v 1.25 2001/03/12 09:04:39 itojun Exp $	*/

/*
 * Copyright (C) 1995, 1996, 1997, 1998, and 1999 WIDE Project.
 * All rights reserved.
 * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. Neither the name of the project nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 * 
 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

/*
 * Copyright (c) 1983, 1988, 1993
 *	The Regents of the University of California.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. All advertising materials mentioning features or use of this software
 *    must display the following acknowledgement:
 *	This product includes software developed by the University of
 *	California, Berkeley and its contributors.
 * 4. Neither the name of the University nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

#include <sys/param.h>
#include <sys/queue.h>
#include <sys/socket.h>
#include <sys/sysctl.h>

#include <netinet/in.h>

#ifdef IPSEC
#include <netinet6/ipsec.h>
#include <netkey/keysock.h>
#endif

#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include "netstat.h"

#if defined(__APPLE__) && !defined(__unused)
#define __unused
#endif
/*
 * portability issues:
 * - bsdi[34] uses PLURAL(), not plural().
 * - freebsd2 can't print "unsigned long long" properly.
 */
/*
 * XXX see PORTABILITY for the twist
 */
#define LLU	"%llu"
#define CAST	unsigned long long

#ifdef IPSEC 
struct val2str {
	int val;
	const char *str;
};

static struct val2str ipsec_ahnames[] = {
	{ SADB_AALG_NONE, "none", },
	{ SADB_AALG_MD5HMAC, "hmac-md5", },
	{ SADB_AALG_SHA1HMAC, "hmac-sha1", },
	{ SADB_X_AALG_MD5, "md5", },
	{ SADB_X_AALG_SHA, "sha", },
	{ SADB_X_AALG_NULL, "null", },
#ifdef SADB_X_AALG_SHA2_256
	{ SADB_X_AALG_SHA2_256, "hmac-sha2-256", },
#endif
#ifdef SADB_X_AALG_SHA2_384
	{ SADB_X_AALG_SHA2_384, "hmac-sha2-384", },
#endif
#ifdef SADB_X_AALG_SHA2_512
	{ SADB_X_AALG_SHA2_512, "hmac-sha2-512", },
#endif
	{ -1, NULL },
};

static struct val2str ipsec_espnames[] = {
	{ SADB_EALG_NONE, "none", },
	{ SADB_EALG_DESCBC, "des-cbc", },
	{ SADB_EALG_3DESCBC, "3des-cbc", },
	{ SADB_EALG_NULL, "null", },
#ifdef SADB_X_EALG_RC5CBC
	{ SADB_X_EALG_RC5CBC, "rc5-cbc", },
#endif
	{ SADB_X_EALG_CAST128CBC, "cast128-cbc", },
	{ SADB_X_EALG_BLOWFISHCBC, "blowfish-cbc", },
#ifdef SADB_X_EALG_RIJNDAELCBC
	{ SADB_X_EALG_RIJNDAELCBC, "rijndael-cbc", },
#endif
	{ -1, NULL },
};

static struct val2str ipsec_compnames[] = {
	{ SADB_X_CALG_NONE, "none", },
	{ SADB_X_CALG_OUI, "oui", },
	{ SADB_X_CALG_DEFLATE, "deflate", },
	{ SADB_X_CALG_LZS, "lzs", },
	{ -1, NULL },
};

static const char *pfkey_msgtypenames[] = {
	"reserved", "getspi", "update", "add", "delete",
	"get", "acquire", "register", "expire", "flush",
	"dump", "x_promisc", "x_pchange", "x_spdupdate", "x_spdadd",
	"x_spddelete", "x_spdget", "x_spdacquire", "x_spddump", "x_spdflush",
	"x_spdsetidx", "x_spdexpire", "x_spddelete2"
};

static struct ipsecstat pipsecstat;
static struct ipsecstat ipsecstat;

static void print_ipsecstats (void);
static const char *pfkey_msgtype_names (int);
static void ipsec_hist (const u_quad_t *, const u_quad_t *, size_t,
    const struct val2str *, const char *);

/*
 * Dump IPSEC statistics structure.
 */
static void
ipsec_hist(const u_quad_t *hist,
	   const u_quad_t *phist,
	   size_t histmax,
	   const struct val2str *name,
	   const char *title)
{
	int first;
	size_t proto;
	const struct val2str *p;

	first = 1;
	for (proto = 0; proto < histmax; proto++) {
		if ((hist[proto] - phist[proto]) <= 0)
			continue;
		if (first) {
			printf("\t%s histogram:\n", title);
			first = 0;
		}
		for (p = name; p && p->str; p++) {
			if (p->val == (int)proto)
				break;
		}
		if (p && p->str) {
			printf("\t\t%s: " LLU "\n", p->str,
			    (CAST)hist[proto] - (CAST)phist[proto]);
		} else {
			printf("\t\t#%ld: " LLU "\n", (long)proto,
			    (CAST)hist[proto] - (CAST)phist[proto]);
		}
	}
}

static void
print_ipsecstats(void)
{
#define	IPSECDIFF(f) (ipsecstat.f - pipsecstat.f)
#define	p(f, m) if (IPSECDIFF(f) || sflag <= 1) \
    printf(m, (CAST)IPSECDIFF(f), plural(IPSECDIFF(f)))
#define hist(f, n, t) \
    ipsec_hist(ipsecstat.f, pipsecstat.f, \
        sizeof(ipsecstat.f)/sizeof(ipsecstat.f[0]), (n), (t));

    if (interval && vflag > 0)
        print_time();

	p(in_success, "\t" LLU " inbound packet%s processed successfully\n");
	p(in_polvio, "\t" LLU " inbound packet%s violated process security "
		"policy\n");
	p(in_nosa, "\t" LLU " inbound packet%s with no SA available\n");
	p(in_inval, "\t" LLU " invalid inbound packet%s\n");
	p(in_nomem, "\t" LLU " inbound packet%s failed due to insufficient memory\n");
	p(in_badspi, "\t" LLU " inbound packet%s failed getting SPI\n");
	p(in_ahreplay, "\t" LLU " inbound packet%s failed on AH replay check\n");
	p(in_espreplay, "\t" LLU " inbound packet%s failed on ESP replay check\n");
	p(in_ahauthsucc, "\t" LLU " inbound packet%s considered authentic\n");
	p(in_ahauthfail, "\t" LLU " inbound packet%s failed on authentication\n");
	hist(in_ahhist, ipsec_ahnames, "AH input");
	hist(in_esphist, ipsec_espnames, "ESP input");
	hist(in_comphist, ipsec_compnames, "IPComp input");

	p(out_success, "\t" LLU " outbound packet%s processed successfully\n");
	p(out_polvio, "\t" LLU " outbound packet%s violated process security "
		"policy\n");
	p(out_nosa, "\t" LLU " outbound packet%s with no SA available\n");
	p(out_inval, "\t" LLU " invalid outbound packet%s\n");
	p(out_nomem, "\t" LLU " outbound packet%s failed due to insufficient memory\n");
	p(out_noroute, "\t" LLU " outbound packet%s with no route\n");
	hist(out_ahhist, ipsec_ahnames, "AH output");
	hist(out_esphist, ipsec_espnames, "ESP output");
	hist(out_comphist, ipsec_compnames, "IPComp output");
#undef IPSECDIFF
#undef p
#undef hist
}

void
ipsec_stats(uint32_t off __unused, char *name, int af __unused)
{
	size_t len;
	
	len = sizeof(struct ipsecstat);
	if (strcmp(name, "ipsec") == 0) {
		if (sysctlbyname("net.inet.ipsec.stats", &ipsecstat, &len, 0, 0) == -1)
			return;
	} else if (strcmp(name, "ipsec6") == 0) {
		if (sysctlbyname("net.inet6.ipsec6.stats", &ipsecstat, &len, 0, 0) == -1)
			return;
	} else
		return;
	printf ("%s:\n", name);

	print_ipsecstats();

	if (interval > 0)
		bcopy(&ipsecstat, &pipsecstat, len);
}

static const char *
pfkey_msgtype_names(int x)
{
	const int max =
	    sizeof(pfkey_msgtypenames)/sizeof(pfkey_msgtypenames[0]);
	static char buf[10];

	if (x < max && pfkey_msgtypenames[x])
		return pfkey_msgtypenames[x];
	snprintf(buf, sizeof(buf), "#%d", x);
	return buf;
}

void
pfkey_stats(uint32_t off __unused, char *name, int af __unused)
{
	static struct pfkeystat ppfkeystat;
	struct pfkeystat pfkeystat;
	unsigned first, type;
	size_t len;
	
	len = sizeof(struct pfkeystat);
	if (sysctlbyname("net.key.pfkeystat", &pfkeystat, &len, 0, 0) == -1)
		return;
    if (interval && vflag > 0)
        print_time();
	printf ("%s:\n", name);

#define	PFKEYDIFF(f) (pfkeystat.f - ppfkeystat.f)
#define	p(f, m) if (PFKEYDIFF(f) || sflag <= 1) \
    printf(m, (CAST)PFKEYDIFF(f), plural(PFKEYDIFF(f)))

	/* kernel -> userland */
	p(out_total, "\t" LLU " request%s sent to userland\n");
	p(out_bytes, "\t" LLU " byte%s sent to userland\n");
	for (first = 1, type = 0;
	     type < sizeof(pfkeystat.out_msgtype)/sizeof(pfkeystat.out_msgtype[0]);
	     type++) {
		if (PFKEYDIFF(out_msgtype[type]) <= 0)
			continue;
		if (first) {
			printf("\thistogram by message type:\n");
			first = 0;
		}
		printf("\t\t%s: " LLU "\n", pfkey_msgtype_names(type),
			(CAST)PFKEYDIFF(out_msgtype[type]));
	}
	p(out_invlen, "\t" LLU " message%s with invalid length field\n");
	p(out_invver, "\t" LLU " message%s with invalid version field\n");
	p(out_invmsgtype, "\t" LLU " message%s with invalid message type field\n");
	p(out_tooshort, "\t" LLU " message%s too short\n");
	p(out_nomem, "\t" LLU " message%s with memory allocation failure\n");
	p(out_dupext, "\t" LLU " message%s with duplicate extension\n");
	p(out_invexttype, "\t" LLU " message%s with invalid extension type\n");
	p(out_invsatype, "\t" LLU " message%s with invalid sa type\n");
	p(out_invaddr, "\t" LLU " message%s with invalid address extension\n");

	/* userland -> kernel */
	p(in_total, "\t" LLU " request%s sent from userland\n");
	p(in_bytes, "\t" LLU " byte%s sent from userland\n");
	for (first = 1, type = 0;
	     type < sizeof(pfkeystat.in_msgtype)/sizeof(pfkeystat.in_msgtype[0]);
	     type++) {
		if (PFKEYDIFF(in_msgtype[type]) <= 0)
			continue;
		if (first) {
			printf("\thistogram by message type:\n");
			first = 0;
		}
		printf("\t\t%s: " LLU "\n", pfkey_msgtype_names(type),
			(CAST)PFKEYDIFF(in_msgtype[type]));
	}
	p(in_msgtarget[KEY_SENDUP_ONE],
	    "\t" LLU " message%s toward single socket\n");
	p(in_msgtarget[KEY_SENDUP_ALL],
	    "\t" LLU " message%s toward all sockets\n");
	p(in_msgtarget[KEY_SENDUP_REGISTERED],
	    "\t" LLU " message%s toward registered sockets\n");
	p(in_nomem, "\t" LLU " message%s with memory allocation failure\n");

	if (interval > 0)
		bcopy(&pfkeystat, &ppfkeystat, len);
#undef PFKEYDIFF
#undef p
}
#endif /*IPSEC*/
Commit	Line	Data
9c859447	1	/*
9dc66a05	2	* Copyright (c) 2008-2012 Apple Inc. All rights reserved.
9c859447 A	3	*
	4	* @APPLE_OSREFERENCE_LICENSE_HEADER_START@
	5	*
	6	* This file contains Original Code and/or Modifications of Original Code
	7	* as defined in and that are subject to the Apple Public Source License
	8	* Version 2.0 (the 'License'). You may not use this file except in
	9	* compliance with the License. The rights granted to you under the License
	10	* may not be used to create, or enable the creation or redistribution of,
	11	* unlawful or unlicensed copies of an Apple operating system, or to
	12	* circumvent, violate, or enable the circumvention or violation of, any
	13	* terms of an Apple operating system software license agreement.
	14	*
	15	* Please obtain a copy of the License at
	16	* http://www.opensource.apple.com/apsl/ and read it before using this file.
	17	*
	18	* The Original Code and all software distributed under the License are
	19	* distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
	20	* EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
	21	* INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
	22	* FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
	23	* Please see the License for the specific language governing rights and
	24	* limitations under the License.
	25	*
	26	* @APPLE_OSREFERENCE_LICENSE_HEADER_END@
	27	*/
7ba0088d A	28	/* $FreeBSD: src/usr.bin/netstat/ipsec.c,v 1.1.2.3 2001/08/10 09:07:09 ru Exp $ */
	29	/* $NetBSD: inet.c,v 1.35.2.1 1999/04/29 14:57:08 perry Exp $ */
	30	/* $KAME: ipsec.c,v 1.25 2001/03/12 09:04:39 itojun Exp $ */
	31
	32	/*
	33	* Copyright (C) 1995, 1996, 1997, 1998, and 1999 WIDE Project.
	34	* All rights reserved.
	35	*
	36	* Redistribution and use in source and binary forms, with or without
	37	* modification, are permitted provided that the following conditions
	38	* are met:
	39	* 1. Redistributions of source code must retain the above copyright
	40	* notice, this list of conditions and the following disclaimer.
	41	* 2. Redistributions in binary form must reproduce the above copyright
	42	* notice, this list of conditions and the following disclaimer in the
	43	* documentation and/or other materials provided with the distribution.
	44	* 3. Neither the name of the project nor the names of its contributors
	45	* may be used to endorse or promote products derived from this software
	46	* without specific prior written permission.
	47	*
	48	* THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
	49	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	50	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	51	* ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
	52	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	53	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	54	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	55	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	56	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	57	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	58	* SUCH DAMAGE.
	59	*/
	60
	61	/*
	62	* Copyright (c) 1983, 1988, 1993
	63	* The Regents of the University of California. All rights reserved.
	64	*
	65	* Redistribution and use in source and binary forms, with or without
	66	* modification, are permitted provided that the following conditions
	67	* are met:
	68	* 1. Redistributions of source code must retain the above copyright
	69	* notice, this list of conditions and the following disclaimer.
	70	* 2. Redistributions in binary form must reproduce the above copyright
	71	* notice, this list of conditions and the following disclaimer in the
	72	* documentation and/or other materials provided with the distribution.
	73	* 3. All advertising materials mentioning features or use of this software
	74	* must display the following acknowledgement:
	75	* This product includes software developed by the University of
	76	* California, Berkeley and its contributors.
	77	* 4. Neither the name of the University nor the names of its contributors
	78	* may be used to endorse or promote products derived from this software
	79	* without specific prior written permission.
	80	*
	81	* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
	82	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	83	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	84	* ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
	85	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	86	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	87	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	88	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	89	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	90	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	91	* SUCH DAMAGE.
92	*/
93
7ba0088d A	94	#include <sys/param.h>
	95	#include <sys/queue.h>
	96	#include <sys/socket.h>
2b484d24	97	#include <sys/sysctl.h>
7ba0088d A	98
	99	#include <netinet/in.h>
	100
	101	#ifdef IPSEC
	102	#include <netinet6/ipsec.h>
	103	#include <netkey/keysock.h>
	104	#endif
	105
	106	#include <stdio.h>
	107	#include <string.h>
	108	#include <unistd.h>
	109	#include "netstat.h"
	110
b8dff150	111	#if defined(__APPLE__) && !defined(__unused)
7ba0088d A	112	#define __unused
	113	#endif
	114	/*
	115	* portability issues:
	116	* - bsdi[34] uses PLURAL(), not plural().
	117	* - freebsd2 can't print "unsigned long long" properly.
	118	*/
	119	/*
	120	* XXX see PORTABILITY for the twist
	121	*/
	122	#define LLU "%llu"
	123	#define CAST unsigned long long
	124
	125	#ifdef IPSEC
	126	struct val2str {
	127	int val;
	128	const char *str;
	129	};
	130
	131	static struct val2str ipsec_ahnames[] = {
	132	{ SADB_AALG_NONE, "none", },
	133	{ SADB_AALG_MD5HMAC, "hmac-md5", },
	134	{ SADB_AALG_SHA1HMAC, "hmac-sha1", },
	135	{ SADB_X_AALG_MD5, "md5", },
	136	{ SADB_X_AALG_SHA, "sha", },
	137	{ SADB_X_AALG_NULL, "null", },
	138	#ifdef SADB_X_AALG_SHA2_256
	139	{ SADB_X_AALG_SHA2_256, "hmac-sha2-256", },
	140	#endif
	141	#ifdef SADB_X_AALG_SHA2_384
	142	{ SADB_X_AALG_SHA2_384, "hmac-sha2-384", },
	143	#endif
	144	#ifdef SADB_X_AALG_SHA2_512
	145	{ SADB_X_AALG_SHA2_512, "hmac-sha2-512", },
	146	#endif
	147	{ -1, NULL },
	148	};
	149
	150	static struct val2str ipsec_espnames[] = {
	151	{ SADB_EALG_NONE, "none", },
	152	{ SADB_EALG_DESCBC, "des-cbc", },
	153	{ SADB_EALG_3DESCBC, "3des-cbc", },
	154	{ SADB_EALG_NULL, "null", },
	155	#ifdef SADB_X_EALG_RC5CBC
	156	{ SADB_X_EALG_RC5CBC, "rc5-cbc", },
	157	#endif
	158	{ SADB_X_EALG_CAST128CBC, "cast128-cbc", },
	159	{ SADB_X_EALG_BLOWFISHCBC, "blowfish-cbc", },
	160	#ifdef SADB_X_EALG_RIJNDAELCBC
	161	{ SADB_X_EALG_RIJNDAELCBC, "rijndael-cbc", },
	162	#endif
	163	{ -1, NULL },
	164	};
	165
	166	static struct val2str ipsec_compnames[] = {
	167	{ SADB_X_CALG_NONE, "none", },
	168	{ SADB_X_CALG_OUI, "oui", },
	169	{ SADB_X_CALG_DEFLATE, "deflate", },
	170	{ SADB_X_CALG_LZS, "lzs", },
	171	{ -1, NULL },
	172	};
	173
	174	static const char *pfkey_msgtypenames[] = {
	175	"reserved", "getspi", "update", "add", "delete",
176	"get", "acquire", "register", "expire", "flush",
177	"dump", "x_promisc", "x_pchange", "x_spdupdate", "x_spdadd",
178	"x_spddelete", "x_spdget", "x_spdacquire", "x_spddump", "x_spdflush",
179	"x_spdsetidx", "x_spdexpire", "x_spddelete2"
180	};
181
b8dff150	182	static struct ipsecstat pipsecstat;
7ba0088d A	183	static struct ipsecstat ipsecstat;
	184
	185	static void print_ipsecstats (void);
	186	static const char *pfkey_msgtype_names (int);
b8dff150 A	187	static void ipsec_hist (const u_quad_t , const u_quad_t , size_t,
b8dff150 A	188	const struct val2str , const char );
7ba0088d A	189
	190	/*
	191	* Dump IPSEC statistics structure.
	192	*/
	193	static void
	194	ipsec_hist(const u_quad_t *hist,
b8dff150	195	const u_quad_t *phist,
7ba0088d A	196	size_t histmax,
	197	const struct val2str *name,
	198	const char *title)
	199	{
	200	int first;
	201	size_t proto;
	202	const struct val2str *p;
	203
	204	first = 1;
	205	for (proto = 0; proto < histmax; proto++) {
b8dff150	206	if ((hist[proto] - phist[proto]) <= 0)
7ba0088d A	207	continue;
	208	if (first) {
	209	printf("\t%s histogram:\n", title);
	210	first = 0;
	211	}
	212	for (p = name; p && p->str; p++) {
	213	if (p->val == (int)proto)
	214	break;
	215	}
	216	if (p && p->str) {
b8dff150 A	217	printf("\t\t%s: " LLU "\n", p->str,
b8dff150 A	218	(CAST)hist[proto] - (CAST)phist[proto]);
7ba0088d A	219	} else {
7ba0088d A	220	printf("\t\t#%ld: " LLU "\n", (long)proto,
b8dff150	221	(CAST)hist[proto] - (CAST)phist[proto]);
7ba0088d A	222	}
	223	}
	224	}
	225
	226	static void
	227	print_ipsecstats(void)
	228	{
b8dff150 A	229	#define IPSECDIFF(f) (ipsecstat.f - pipsecstat.f)
	230	#define p(f, m) if (IPSECDIFF(f) \|\| sflag <= 1) \
	231	printf(m, (CAST)IPSECDIFF(f), plural(IPSECDIFF(f)))
7ba0088d	232	#define hist(f, n, t) \
b8dff150 A	233	ipsec_hist(ipsecstat.f, pipsecstat.f, \
b8dff150 A	234	sizeof(ipsecstat.f)/sizeof(ipsecstat.f[0]), (n), (t));
7ba0088d	235
9dc66a05 A	236	if (interval && vflag > 0)
	237	print_time();
	238
7ba0088d A	239	p(in_success, "\t" LLU " inbound packet%s processed successfully\n");
	240	p(in_polvio, "\t" LLU " inbound packet%s violated process security "
	241	"policy\n");
	242	p(in_nosa, "\t" LLU " inbound packet%s with no SA available\n");
	243	p(in_inval, "\t" LLU " invalid inbound packet%s\n");
	244	p(in_nomem, "\t" LLU " inbound packet%s failed due to insufficient memory\n");
	245	p(in_badspi, "\t" LLU " inbound packet%s failed getting SPI\n");
	246	p(in_ahreplay, "\t" LLU " inbound packet%s failed on AH replay check\n");
	247	p(in_espreplay, "\t" LLU " inbound packet%s failed on ESP replay check\n");
	248	p(in_ahauthsucc, "\t" LLU " inbound packet%s considered authentic\n");
	249	p(in_ahauthfail, "\t" LLU " inbound packet%s failed on authentication\n");
b8dff150 A	250	hist(in_ahhist, ipsec_ahnames, "AH input");
	251	hist(in_esphist, ipsec_espnames, "ESP input");
	252	hist(in_comphist, ipsec_compnames, "IPComp input");
7ba0088d A	253
	254	p(out_success, "\t" LLU " outbound packet%s processed successfully\n");
	255	p(out_polvio, "\t" LLU " outbound packet%s violated process security "
	256	"policy\n");
	257	p(out_nosa, "\t" LLU " outbound packet%s with no SA available\n");
	258	p(out_inval, "\t" LLU " invalid outbound packet%s\n");
	259	p(out_nomem, "\t" LLU " outbound packet%s failed due to insufficient memory\n");
	260	p(out_noroute, "\t" LLU " outbound packet%s with no route\n");
b8dff150 A	261	hist(out_ahhist, ipsec_ahnames, "AH output");
	262	hist(out_esphist, ipsec_espnames, "ESP output");
	263	hist(out_comphist, ipsec_compnames, "IPComp output");
	264	#undef IPSECDIFF
7ba0088d A	265	#undef p
	266	#undef hist
	267	}
	268
	269	void
9c859447	270	ipsec_stats(uint32_t off __unused, char *name, int af __unused)
7ba0088d	271	{
2b484d24 A	272	size_t len;
	273
	274	len = sizeof(struct ipsecstat);
b8dff150	275	if (strcmp(name, "ipsec") == 0) {
2b484d24 A	276	if (sysctlbyname("net.inet.ipsec.stats", &ipsecstat, &len, 0, 0) == -1)
2b484d24 A	277	return;
b8dff150	278	} else if (strcmp(name, "ipsec6") == 0) {
2b484d24 A	279	if (sysctlbyname("net.inet6.ipsec6.stats", &ipsecstat, &len, 0, 0) == -1)
2b484d24 A	280	return;
b8dff150	281	} else
7ba0088d A	282	return;
7ba0088d A	283	printf ("%s:\n", name);
7ba0088d A	284
7ba0088d A	285	print_ipsecstats();
b8dff150 A	286
	287	if (interval > 0)
	288	bcopy(&ipsecstat, &pipsecstat, len);
7ba0088d A	289	}
	290
	291	static const char *
	292	pfkey_msgtype_names(int x)
	293	{
	294	const int max =
	295	sizeof(pfkey_msgtypenames)/sizeof(pfkey_msgtypenames[0]);
	296	static char buf[10];
	297
	298	if (x < max && pfkey_msgtypenames[x])
	299	return pfkey_msgtypenames[x];
	300	snprintf(buf, sizeof(buf), "#%d", x);
	301	return buf;
	302	}
	303
	304	void
9c859447	305	pfkey_stats(uint32_t off __unused, char *name, int af __unused)
7ba0088d	306	{
b8dff150	307	static struct pfkeystat ppfkeystat;
7ba0088d A	308	struct pfkeystat pfkeystat;
7ba0088d A	309	unsigned first, type;
2b484d24 A	310	size_t len;
	311
	312	len = sizeof(struct pfkeystat);
	313	if (sysctlbyname("net.key.pfkeystat", &pfkeystat, &len, 0, 0) == -1)
7ba0088d	314	return;
9dc66a05 A	315	if (interval && vflag > 0)
9dc66a05 A	316	print_time();
7ba0088d	317	printf ("%s:\n", name);
7ba0088d	318
b8dff150 A	319	#define PFKEYDIFF(f) (pfkeystat.f - ppfkeystat.f)
	320	#define p(f, m) if (PFKEYDIFF(f) \|\| sflag <= 1) \
	321	printf(m, (CAST)PFKEYDIFF(f), plural(PFKEYDIFF(f)))
7ba0088d A	322
	323	/* kernel -> userland */
	324	p(out_total, "\t" LLU " request%s sent to userland\n");
	325	p(out_bytes, "\t" LLU " byte%s sent to userland\n");
	326	for (first = 1, type = 0;
	327	type < sizeof(pfkeystat.out_msgtype)/sizeof(pfkeystat.out_msgtype[0]);
	328	type++) {
b8dff150	329	if (PFKEYDIFF(out_msgtype[type]) <= 0)
7ba0088d A	330	continue;
	331	if (first) {
	332	printf("\thistogram by message type:\n");
	333	first = 0;
	334	}
	335	printf("\t\t%s: " LLU "\n", pfkey_msgtype_names(type),
b8dff150	336	(CAST)PFKEYDIFF(out_msgtype[type]));
7ba0088d A	337	}
	338	p(out_invlen, "\t" LLU " message%s with invalid length field\n");
	339	p(out_invver, "\t" LLU " message%s with invalid version field\n");
	340	p(out_invmsgtype, "\t" LLU " message%s with invalid message type field\n");
	341	p(out_tooshort, "\t" LLU " message%s too short\n");
	342	p(out_nomem, "\t" LLU " message%s with memory allocation failure\n");
	343	p(out_dupext, "\t" LLU " message%s with duplicate extension\n");
	344	p(out_invexttype, "\t" LLU " message%s with invalid extension type\n");
	345	p(out_invsatype, "\t" LLU " message%s with invalid sa type\n");
	346	p(out_invaddr, "\t" LLU " message%s with invalid address extension\n");
	347
	348	/* userland -> kernel */
	349	p(in_total, "\t" LLU " request%s sent from userland\n");
	350	p(in_bytes, "\t" LLU " byte%s sent from userland\n");
	351	for (first = 1, type = 0;
	352	type < sizeof(pfkeystat.in_msgtype)/sizeof(pfkeystat.in_msgtype[0]);
	353	type++) {
b8dff150	354	if (PFKEYDIFF(in_msgtype[type]) <= 0)
7ba0088d A	355	continue;
	356	if (first) {
	357	printf("\thistogram by message type:\n");
	358	first = 0;
	359	}
	360	printf("\t\t%s: " LLU "\n", pfkey_msgtype_names(type),
b8dff150	361	(CAST)PFKEYDIFF(in_msgtype[type]));
7ba0088d A	362	}
	363	p(in_msgtarget[KEY_SENDUP_ONE],
	364	"\t" LLU " message%s toward single socket\n");
	365	p(in_msgtarget[KEY_SENDUP_ALL],
	366	"\t" LLU " message%s toward all sockets\n");
	367	p(in_msgtarget[KEY_SENDUP_REGISTERED],
	368	"\t" LLU " message%s toward registered sockets\n");
	369	p(in_nomem, "\t" LLU " message%s with memory allocation failure\n");
b8dff150 A	370
	371	if (interval > 0)
	372	bcopy(&pfkeystat, &ppfkeystat, len);
	373	#undef PFKEYDIFF
7ba0088d A	374	#undef p
	375	}
	376	#endif /IPSEC/