[apple/network_cmds.git] / netstat.tproj / ipsec.c

/*
 * Copyright (c) 2008-2012, 2021 Apple Inc. All rights reserved.
 *
 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
 *
 * This file contains Original Code and/or Modifications of Original Code
 * as defined in and that are subject to the Apple Public Source License
 * Version 2.0 (the 'License'). You may not use this file except in
 * compliance with the License. The rights granted to you under the License
 * may not be used to create, or enable the creation or redistribution of,
 * unlawful or unlicensed copies of an Apple operating system, or to
 * circumvent, violate, or enable the circumvention or violation of, any
 * terms of an Apple operating system software license agreement.
 *
 * Please obtain a copy of the License at
 * http://www.opensource.apple.com/apsl/ and read it before using this file.
 *
 * The Original Code and all software distributed under the License are
 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
 * Please see the License for the specific language governing rights and
 * limitations under the License.
 *
 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
 */
/*	$FreeBSD: src/usr.bin/netstat/ipsec.c,v 1.1.2.3 2001/08/10 09:07:09 ru Exp $	*/
/*	$NetBSD: inet.c,v 1.35.2.1 1999/04/29 14:57:08 perry Exp $	*/
/*	$KAME: ipsec.c,v 1.25 2001/03/12 09:04:39 itojun Exp $	*/

/*
 * Copyright (C) 1995, 1996, 1997, 1998, and 1999 WIDE Project.
 * All rights reserved.
 * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. Neither the name of the project nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 * 
 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

/*
 * Copyright (c) 1983, 1988, 1993
 *	The Regents of the University of California.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. All advertising materials mentioning features or use of this software
 *    must display the following acknowledgement:
 *	This product includes software developed by the University of
 *	California, Berkeley and its contributors.
 * 4. Neither the name of the University nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

#include <sys/param.h>
#include <sys/queue.h>
#include <sys/socket.h>
#include <sys/sysctl.h>

#include <netinet/in.h>

#ifdef IPSEC
#include <netinet6/ipsec.h>
#include <netkey/keysock.h>
#endif

#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include "netstat.h"

#if defined(__APPLE__) && !defined(__unused)
#define __unused
#endif
/*
 * portability issues:
 * - bsdi[34] uses PLURAL(), not plural().
 * - freebsd2 can't print "unsigned long long" properly.
 */
/*
 * XXX see PORTABILITY for the twist
 */
#define LLU	"%llu"
#define CAST	unsigned long long

#ifdef IPSEC 
struct val2str {
	int val;
	const char *str;
};

static struct val2str ipsec_ahnames[] = {
	{ SADB_AALG_NONE, "none", },
	{ SADB_AALG_MD5HMAC, "hmac-md5", },
	{ SADB_AALG_SHA1HMAC, "hmac-sha1", },
	{ SADB_X_AALG_MD5, "md5", },
	{ SADB_X_AALG_SHA, "sha", },
	{ SADB_X_AALG_NULL, "null", },
#ifdef SADB_X_AALG_SHA2_256
	{ SADB_X_AALG_SHA2_256, "hmac-sha2-256", },
#endif
#ifdef SADB_X_AALG_SHA2_384
	{ SADB_X_AALG_SHA2_384, "hmac-sha2-384", },
#endif
#ifdef SADB_X_AALG_SHA2_512
	{ SADB_X_AALG_SHA2_512, "hmac-sha2-512", },
#endif
	{ -1, NULL },
};

static struct val2str ipsec_espnames[] = {
	{ SADB_EALG_NONE, "none", },
	{ SADB_EALG_DESCBC, "des-cbc", },
	{ SADB_EALG_3DESCBC, "3des-cbc", },
	{ SADB_EALG_NULL, "null", },
#ifdef SADB_X_EALG_RC5CBC
	{ SADB_X_EALG_RC5CBC, "rc5-cbc", },
#endif
	{ SADB_X_EALG_CAST128CBC, "cast128-cbc", },
	{ SADB_X_EALG_BLOWFISHCBC, "blowfish-cbc", },
#ifdef SADB_X_EALG_RIJNDAELCBC
	{ SADB_X_EALG_RIJNDAELCBC, "rijndael-cbc", },
#endif
#ifdef SADB_X_EALG_AES_GCM
	{ SADB_X_EALG_AES_GCM, "aes-gcm", },
#endif
#ifdef SADB_X_EALG_CHACHA20POLY1305
	{ SADB_X_EALG_CHACHA20POLY1305, "chacha20-poly1305", },
#endif
	{ -1, NULL },
};

static struct val2str ipsec_compnames[] = {
	{ SADB_X_CALG_NONE, "none", },
	{ SADB_X_CALG_OUI, "oui", },
	{ SADB_X_CALG_DEFLATE, "deflate", },
	{ SADB_X_CALG_LZS, "lzs", },
	{ -1, NULL },
};

static const char *pfkey_msgtypenames[] = {
	"reserved", "getspi", "update", "add", "delete",
	"get", "acquire", "register", "expire", "flush",
	"dump", "x_promisc", "x_pchange", "x_spdupdate", "x_spdadd",
	"x_spddelete", "x_spdget", "x_spdacquire", "x_spddump", "x_spdflush",
	"x_spdsetidx", "x_spdexpire", "x_spddelete2"
};

static struct ipsecstat pipsecstat;
static struct ipsecstat ipsecstat;

static void print_ipsecstats (void);
static const char *pfkey_msgtype_names (int);
static void ipsec_hist (const u_quad_t *, const u_quad_t *, size_t,
    const struct val2str *, const char *);

/*
 * Dump IPSEC statistics structure.
 */
static void
ipsec_hist(const u_quad_t *hist,
	   const u_quad_t *phist,
	   size_t histmax,
	   const struct val2str *name,
	   const char *title)
{
	int first;
	size_t proto;
	const struct val2str *p;

	first = 1;
	for (proto = 0; proto < histmax; proto++) {
		if ((hist[proto] - phist[proto]) <= 0)
			continue;
		if (first) {
			printf("\t%s histogram:\n", title);
			first = 0;
		}
		for (p = name; p && p->str; p++) {
			if (p->val == (int)proto)
				break;
		}
		if (p && p->str) {
			printf("\t\t%s: " LLU "\n", p->str,
			    (CAST)hist[proto] - (CAST)phist[proto]);
		} else {
			printf("\t\t#%ld: " LLU "\n", (long)proto,
			    (CAST)hist[proto] - (CAST)phist[proto]);
		}
	}
}

static void
print_ipsecstats(void)
{
#define	IPSECDIFF(f) (ipsecstat.f - pipsecstat.f)
#define	p(f, m) if (IPSECDIFF(f) || sflag <= 1) \
    printf(m, (CAST)IPSECDIFF(f), plural(IPSECDIFF(f)))
#define hist(f, n, t) \
    ipsec_hist(ipsecstat.f, pipsecstat.f, \
        sizeof(ipsecstat.f)/sizeof(ipsecstat.f[0]), (n), (t));

    if (interval && vflag > 0)
        print_time();

	p(in_success, "\t" LLU " inbound packet%s processed successfully\n");
	p(in_polvio, "\t" LLU " inbound packet%s violated process security "
		"policy\n");
	p(in_nosa, "\t" LLU " inbound packet%s with no SA available\n");
	p(in_inval, "\t" LLU " invalid inbound packet%s\n");
	p(in_nomem, "\t" LLU " inbound packet%s failed due to insufficient memory\n");
	p(in_badspi, "\t" LLU " inbound packet%s failed getting SPI\n");
	p(in_ahreplay, "\t" LLU " inbound packet%s failed on AH replay check\n");
	p(in_espreplay, "\t" LLU " inbound packet%s failed on ESP replay check\n");
	p(in_ahauthsucc, "\t" LLU " inbound packet%s considered authentic\n");
	p(in_ahauthfail, "\t" LLU " inbound packet%s failed on authentication\n");
	hist(in_ahhist, ipsec_ahnames, "AH input");
	hist(in_esphist, ipsec_espnames, "ESP input");
	hist(in_comphist, ipsec_compnames, "IPComp input");

	p(out_success, "\t" LLU " outbound packet%s processed successfully\n");
	p(out_polvio, "\t" LLU " outbound packet%s violated process security "
		"policy\n");
	p(out_nosa, "\t" LLU " outbound packet%s with no SA available\n");
	p(out_inval, "\t" LLU " invalid outbound packet%s\n");
	p(out_nomem, "\t" LLU " outbound packet%s failed due to insufficient memory\n");
	p(out_noroute, "\t" LLU " outbound packet%s with no route\n");
	hist(out_ahhist, ipsec_ahnames, "AH output");
	hist(out_esphist, ipsec_espnames, "ESP output");
	hist(out_comphist, ipsec_compnames, "IPComp output");
#undef IPSECDIFF
#undef p
#undef hist
}

void
ipsec_stats(uint32_t off __unused, char *name, int af __unused)
{
	size_t len;
	
	len = sizeof(struct ipsecstat);
	if (strcmp(name, "ipsec") == 0) {
		if (sysctlbyname("net.inet.ipsec.stats", &ipsecstat, &len, 0, 0) == -1)
			return;
	} else if (strcmp(name, "ipsec6") == 0) {
		if (sysctlbyname("net.inet6.ipsec6.stats", &ipsecstat, &len, 0, 0) == -1)
			return;
	} else
		return;
	printf ("%s:\n", name);

	print_ipsecstats();

	if (interval > 0)
		bcopy(&ipsecstat, &pipsecstat, len);
}

static const char *
pfkey_msgtype_names(int x)
{
	const int max =
	    sizeof(pfkey_msgtypenames)/sizeof(pfkey_msgtypenames[0]);
	static char buf[10];

	if (x < max && pfkey_msgtypenames[x])
		return pfkey_msgtypenames[x];
	snprintf(buf, sizeof(buf), "#%d", x);
	return buf;
}

void
pfkey_stats(uint32_t off __unused, char *name, int af __unused)
{
	static struct pfkeystat ppfkeystat;
	struct pfkeystat pfkeystat;
	unsigned first, type;
	size_t len;
	
	len = sizeof(struct pfkeystat);
	if (sysctlbyname("net.key.pfkeystat", &pfkeystat, &len, 0, 0) == -1)
		return;
    if (interval && vflag > 0)
        print_time();
	printf ("%s:\n", name);

#define	PFKEYDIFF(f) (pfkeystat.f - ppfkeystat.f)
#define	p(f, m) if (PFKEYDIFF(f) || sflag <= 1) \
    printf(m, (CAST)PFKEYDIFF(f), plural(PFKEYDIFF(f)))

	/* kernel -> userland */
	p(out_total, "\t" LLU " request%s sent to userland\n");
	p(out_bytes, "\t" LLU " byte%s sent to userland\n");
	for (first = 1, type = 0;
	     type < sizeof(pfkeystat.out_msgtype)/sizeof(pfkeystat.out_msgtype[0]);
	     type++) {
		if (PFKEYDIFF(out_msgtype[type]) <= 0)
			continue;
		if (first) {
			printf("\thistogram by message type:\n");
			first = 0;
		}
		printf("\t\t%s: " LLU "\n", pfkey_msgtype_names(type),
			(CAST)PFKEYDIFF(out_msgtype[type]));
	}
	p(out_invlen, "\t" LLU " message%s with invalid length field\n");
	p(out_invver, "\t" LLU " message%s with invalid version field\n");
	p(out_invmsgtype, "\t" LLU " message%s with invalid message type field\n");
	p(out_tooshort, "\t" LLU " message%s too short\n");
	p(out_nomem, "\t" LLU " message%s with memory allocation failure\n");
	p(out_dupext, "\t" LLU " message%s with duplicate extension\n");
	p(out_invexttype, "\t" LLU " message%s with invalid extension type\n");
	p(out_invsatype, "\t" LLU " message%s with invalid sa type\n");
	p(out_invaddr, "\t" LLU " message%s with invalid address extension\n");

	/* userland -> kernel */
	p(in_total, "\t" LLU " request%s sent from userland\n");
	p(in_bytes, "\t" LLU " byte%s sent from userland\n");
	for (first = 1, type = 0;
	     type < sizeof(pfkeystat.in_msgtype)/sizeof(pfkeystat.in_msgtype[0]);
	     type++) {
		if (PFKEYDIFF(in_msgtype[type]) <= 0)
			continue;
		if (first) {
			printf("\thistogram by message type:\n");
			first = 0;
		}
		printf("\t\t%s: " LLU "\n", pfkey_msgtype_names(type),
			(CAST)PFKEYDIFF(in_msgtype[type]));
	}
	p(in_msgtarget[KEY_SENDUP_ONE],
	    "\t" LLU " message%s toward single socket\n");
	p(in_msgtarget[KEY_SENDUP_ALL],
	    "\t" LLU " message%s toward all sockets\n");
	p(in_msgtarget[KEY_SENDUP_REGISTERED],
	    "\t" LLU " message%s toward registered sockets\n");
	p(in_nomem, "\t" LLU " message%s with memory allocation failure\n");

	if (interval > 0)
		bcopy(&pfkeystat, &ppfkeystat, len);
#undef PFKEYDIFF
#undef p
}
#endif /*IPSEC*/
Commit	Line	Data
9c859447	1	/*
ee37ac02	2	* Copyright (c) 2008-2012, 2021 Apple Inc. All rights reserved.
9c859447 A	3	*
	4	* @APPLE_OSREFERENCE_LICENSE_HEADER_START@
	5	*
	6	* This file contains Original Code and/or Modifications of Original Code
	7	* as defined in and that are subject to the Apple Public Source License
	8	* Version 2.0 (the 'License'). You may not use this file except in
	9	* compliance with the License. The rights granted to you under the License
	10	* may not be used to create, or enable the creation or redistribution of,
	11	* unlawful or unlicensed copies of an Apple operating system, or to
	12	* circumvent, violate, or enable the circumvention or violation of, any
	13	* terms of an Apple operating system software license agreement.
	14	*
	15	* Please obtain a copy of the License at
	16	* http://www.opensource.apple.com/apsl/ and read it before using this file.
	17	*
	18	* The Original Code and all software distributed under the License are
	19	* distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
	20	* EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
	21	* INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
	22	* FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
	23	* Please see the License for the specific language governing rights and
	24	* limitations under the License.
	25	*
	26	* @APPLE_OSREFERENCE_LICENSE_HEADER_END@
	27	*/
7ba0088d A	28	/* $FreeBSD: src/usr.bin/netstat/ipsec.c,v 1.1.2.3 2001/08/10 09:07:09 ru Exp $ */
	29	/* $NetBSD: inet.c,v 1.35.2.1 1999/04/29 14:57:08 perry Exp $ */
	30	/* $KAME: ipsec.c,v 1.25 2001/03/12 09:04:39 itojun Exp $ */
	31
	32	/*
	33	* Copyright (C) 1995, 1996, 1997, 1998, and 1999 WIDE Project.
	34	* All rights reserved.
	35	*
	36	* Redistribution and use in source and binary forms, with or without
	37	* modification, are permitted provided that the following conditions
	38	* are met:
	39	* 1. Redistributions of source code must retain the above copyright
	40	* notice, this list of conditions and the following disclaimer.
	41	* 2. Redistributions in binary form must reproduce the above copyright
	42	* notice, this list of conditions and the following disclaimer in the
	43	* documentation and/or other materials provided with the distribution.
	44	* 3. Neither the name of the project nor the names of its contributors
	45	* may be used to endorse or promote products derived from this software
	46	* without specific prior written permission.
	47	*
	48	* THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
	49	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	50	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	51	* ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
	52	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	53	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	54	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	55	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	56	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	57	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	58	* SUCH DAMAGE.
	59	*/
	60
	61	/*
	62	* Copyright (c) 1983, 1988, 1993
	63	* The Regents of the University of California. All rights reserved.
	64	*
	65	* Redistribution and use in source and binary forms, with or without
	66	* modification, are permitted provided that the following conditions
	67	* are met:
	68	* 1. Redistributions of source code must retain the above copyright
	69	* notice, this list of conditions and the following disclaimer.
	70	* 2. Redistributions in binary form must reproduce the above copyright
	71	* notice, this list of conditions and the following disclaimer in the
	72	* documentation and/or other materials provided with the distribution.
	73	* 3. All advertising materials mentioning features or use of this software
	74	* must display the following acknowledgement:
	75	* This product includes software developed by the University of
	76	* California, Berkeley and its contributors.
	77	* 4. Neither the name of the University nor the names of its contributors
	78	* may be used to endorse or promote products derived from this software
	79	* without specific prior written permission.
	80	*
	81	* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
	82	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	83	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	84	* ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
	85	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	86	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	87	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	88	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	89	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	90	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	91	* SUCH DAMAGE.
92	*/
93
7ba0088d A	94	#include <sys/param.h>
	95	#include <sys/queue.h>
	96	#include <sys/socket.h>
2b484d24	97	#include <sys/sysctl.h>
7ba0088d A	98
	99	#include <netinet/in.h>
	100
	101	#ifdef IPSEC
	102	#include <netinet6/ipsec.h>
	103	#include <netkey/keysock.h>
	104	#endif
	105
	106	#include <stdio.h>
	107	#include <string.h>
	108	#include <unistd.h>
	109	#include "netstat.h"
	110
b8dff150	111	#if defined(__APPLE__) && !defined(__unused)
7ba0088d A	112	#define __unused
	113	#endif
	114	/*
	115	* portability issues:
	116	* - bsdi[34] uses PLURAL(), not plural().
	117	* - freebsd2 can't print "unsigned long long" properly.
	118	*/
	119	/*
	120	* XXX see PORTABILITY for the twist
	121	*/
	122	#define LLU "%llu"
	123	#define CAST unsigned long long
	124
	125	#ifdef IPSEC
	126	struct val2str {
	127	int val;
	128	const char *str;
	129	};
	130
	131	static struct val2str ipsec_ahnames[] = {
	132	{ SADB_AALG_NONE, "none", },
	133	{ SADB_AALG_MD5HMAC, "hmac-md5", },
	134	{ SADB_AALG_SHA1HMAC, "hmac-sha1", },
	135	{ SADB_X_AALG_MD5, "md5", },
	136	{ SADB_X_AALG_SHA, "sha", },
	137	{ SADB_X_AALG_NULL, "null", },
	138	#ifdef SADB_X_AALG_SHA2_256
	139	{ SADB_X_AALG_SHA2_256, "hmac-sha2-256", },
	140	#endif
	141	#ifdef SADB_X_AALG_SHA2_384
	142	{ SADB_X_AALG_SHA2_384, "hmac-sha2-384", },
	143	#endif
	144	#ifdef SADB_X_AALG_SHA2_512
	145	{ SADB_X_AALG_SHA2_512, "hmac-sha2-512", },
	146	#endif
	147	{ -1, NULL },
	148	};
	149
	150	static struct val2str ipsec_espnames[] = {
	151	{ SADB_EALG_NONE, "none", },
	152	{ SADB_EALG_DESCBC, "des-cbc", },
	153	{ SADB_EALG_3DESCBC, "3des-cbc", },
	154	{ SADB_EALG_NULL, "null", },
	155	#ifdef SADB_X_EALG_RC5CBC
	156	{ SADB_X_EALG_RC5CBC, "rc5-cbc", },
	157	#endif
	158	{ SADB_X_EALG_CAST128CBC, "cast128-cbc", },
	159	{ SADB_X_EALG_BLOWFISHCBC, "blowfish-cbc", },
	160	#ifdef SADB_X_EALG_RIJNDAELCBC
	161	{ SADB_X_EALG_RIJNDAELCBC, "rijndael-cbc", },
ee37ac02 A	162	#endif
	163	#ifdef SADB_X_EALG_AES_GCM
	164	{ SADB_X_EALG_AES_GCM, "aes-gcm", },
	165	#endif
	166	#ifdef SADB_X_EALG_CHACHA20POLY1305
	167	{ SADB_X_EALG_CHACHA20POLY1305, "chacha20-poly1305", },
7ba0088d A	168	#endif
	169	{ -1, NULL },
	170	};
	171
	172	static struct val2str ipsec_compnames[] = {
	173	{ SADB_X_CALG_NONE, "none", },
	174	{ SADB_X_CALG_OUI, "oui", },
	175	{ SADB_X_CALG_DEFLATE, "deflate", },
	176	{ SADB_X_CALG_LZS, "lzs", },
	177	{ -1, NULL },
	178	};
	179
	180	static const char *pfkey_msgtypenames[] = {
	181	"reserved", "getspi", "update", "add", "delete",
	182	"get", "acquire", "register", "expire", "flush",
	183	"dump", "x_promisc", "x_pchange", "x_spdupdate", "x_spdadd",
	184	"x_spddelete", "x_spdget", "x_spdacquire", "x_spddump", "x_spdflush",
	185	"x_spdsetidx", "x_spdexpire", "x_spddelete2"
	186	};
	187
b8dff150	188	static struct ipsecstat pipsecstat;
7ba0088d A	189	static struct ipsecstat ipsecstat;
	190
	191	static void print_ipsecstats (void);
	192	static const char *pfkey_msgtype_names (int);
b8dff150 A	193	static void ipsec_hist (const u_quad_t , const u_quad_t , size_t,
b8dff150 A	194	const struct val2str , const char );
7ba0088d A	195
	196	/*
	197	* Dump IPSEC statistics structure.
	198	*/
	199	static void
	200	ipsec_hist(const u_quad_t *hist,
b8dff150	201	const u_quad_t *phist,
7ba0088d A	202	size_t histmax,
	203	const struct val2str *name,
	204	const char *title)
	205	{
	206	int first;
	207	size_t proto;
	208	const struct val2str *p;
	209
	210	first = 1;
	211	for (proto = 0; proto < histmax; proto++) {
b8dff150	212	if ((hist[proto] - phist[proto]) <= 0)
7ba0088d A	213	continue;
	214	if (first) {
	215	printf("\t%s histogram:\n", title);
	216	first = 0;
	217	}
	218	for (p = name; p && p->str; p++) {
	219	if (p->val == (int)proto)
	220	break;
	221	}
	222	if (p && p->str) {
b8dff150 A	223	printf("\t\t%s: " LLU "\n", p->str,
b8dff150 A	224	(CAST)hist[proto] - (CAST)phist[proto]);
7ba0088d A	225	} else {
7ba0088d A	226	printf("\t\t#%ld: " LLU "\n", (long)proto,
b8dff150	227	(CAST)hist[proto] - (CAST)phist[proto]);
7ba0088d A	228	}
	229	}
	230	}
	231
	232	static void
	233	print_ipsecstats(void)
	234	{
b8dff150 A	235	#define IPSECDIFF(f) (ipsecstat.f - pipsecstat.f)
	236	#define p(f, m) if (IPSECDIFF(f) \|\| sflag <= 1) \
	237	printf(m, (CAST)IPSECDIFF(f), plural(IPSECDIFF(f)))
7ba0088d	238	#define hist(f, n, t) \
b8dff150 A	239	ipsec_hist(ipsecstat.f, pipsecstat.f, \
b8dff150 A	240	sizeof(ipsecstat.f)/sizeof(ipsecstat.f[0]), (n), (t));
7ba0088d	241
9dc66a05 A	242	if (interval && vflag > 0)
	243	print_time();
	244
7ba0088d A	245	p(in_success, "\t" LLU " inbound packet%s processed successfully\n");
	246	p(in_polvio, "\t" LLU " inbound packet%s violated process security "
	247	"policy\n");
	248	p(in_nosa, "\t" LLU " inbound packet%s with no SA available\n");
	249	p(in_inval, "\t" LLU " invalid inbound packet%s\n");
	250	p(in_nomem, "\t" LLU " inbound packet%s failed due to insufficient memory\n");
	251	p(in_badspi, "\t" LLU " inbound packet%s failed getting SPI\n");
	252	p(in_ahreplay, "\t" LLU " inbound packet%s failed on AH replay check\n");
	253	p(in_espreplay, "\t" LLU " inbound packet%s failed on ESP replay check\n");
	254	p(in_ahauthsucc, "\t" LLU " inbound packet%s considered authentic\n");
	255	p(in_ahauthfail, "\t" LLU " inbound packet%s failed on authentication\n");
b8dff150 A	256	hist(in_ahhist, ipsec_ahnames, "AH input");
	257	hist(in_esphist, ipsec_espnames, "ESP input");
	258	hist(in_comphist, ipsec_compnames, "IPComp input");
7ba0088d A	259
	260	p(out_success, "\t" LLU " outbound packet%s processed successfully\n");
	261	p(out_polvio, "\t" LLU " outbound packet%s violated process security "
	262	"policy\n");
	263	p(out_nosa, "\t" LLU " outbound packet%s with no SA available\n");
	264	p(out_inval, "\t" LLU " invalid outbound packet%s\n");
	265	p(out_nomem, "\t" LLU " outbound packet%s failed due to insufficient memory\n");
	266	p(out_noroute, "\t" LLU " outbound packet%s with no route\n");
b8dff150 A	267	hist(out_ahhist, ipsec_ahnames, "AH output");
	268	hist(out_esphist, ipsec_espnames, "ESP output");
	269	hist(out_comphist, ipsec_compnames, "IPComp output");
	270	#undef IPSECDIFF
7ba0088d A	271	#undef p
	272	#undef hist
	273	}
	274
	275	void
9c859447	276	ipsec_stats(uint32_t off __unused, char *name, int af __unused)
7ba0088d	277	{
2b484d24 A	278	size_t len;
	279
	280	len = sizeof(struct ipsecstat);
b8dff150	281	if (strcmp(name, "ipsec") == 0) {
2b484d24 A	282	if (sysctlbyname("net.inet.ipsec.stats", &ipsecstat, &len, 0, 0) == -1)
2b484d24 A	283	return;
b8dff150	284	} else if (strcmp(name, "ipsec6") == 0) {
2b484d24 A	285	if (sysctlbyname("net.inet6.ipsec6.stats", &ipsecstat, &len, 0, 0) == -1)
2b484d24 A	286	return;
b8dff150	287	} else
7ba0088d A	288	return;
7ba0088d A	289	printf ("%s:\n", name);
7ba0088d A	290
7ba0088d A	291	print_ipsecstats();
b8dff150 A	292
	293	if (interval > 0)
	294	bcopy(&ipsecstat, &pipsecstat, len);
7ba0088d A	295	}
	296
	297	static const char *
	298	pfkey_msgtype_names(int x)
	299	{
	300	const int max =
	301	sizeof(pfkey_msgtypenames)/sizeof(pfkey_msgtypenames[0]);
	302	static char buf[10];
	303
	304	if (x < max && pfkey_msgtypenames[x])
	305	return pfkey_msgtypenames[x];
	306	snprintf(buf, sizeof(buf), "#%d", x);
	307	return buf;
	308	}
	309
	310	void
9c859447	311	pfkey_stats(uint32_t off __unused, char *name, int af __unused)
7ba0088d	312	{
b8dff150	313	static struct pfkeystat ppfkeystat;
7ba0088d A	314	struct pfkeystat pfkeystat;
7ba0088d A	315	unsigned first, type;
2b484d24 A	316	size_t len;
	317
	318	len = sizeof(struct pfkeystat);
	319	if (sysctlbyname("net.key.pfkeystat", &pfkeystat, &len, 0, 0) == -1)
7ba0088d	320	return;
9dc66a05 A	321	if (interval && vflag > 0)
9dc66a05 A	322	print_time();
7ba0088d	323	printf ("%s:\n", name);
7ba0088d	324
b8dff150 A	325	#define PFKEYDIFF(f) (pfkeystat.f - ppfkeystat.f)
	326	#define p(f, m) if (PFKEYDIFF(f) \|\| sflag <= 1) \
	327	printf(m, (CAST)PFKEYDIFF(f), plural(PFKEYDIFF(f)))
7ba0088d A	328
	329	/* kernel -> userland */
	330	p(out_total, "\t" LLU " request%s sent to userland\n");
	331	p(out_bytes, "\t" LLU " byte%s sent to userland\n");
	332	for (first = 1, type = 0;
	333	type < sizeof(pfkeystat.out_msgtype)/sizeof(pfkeystat.out_msgtype[0]);
	334	type++) {
b8dff150	335	if (PFKEYDIFF(out_msgtype[type]) <= 0)
7ba0088d A	336	continue;
	337	if (first) {
	338	printf("\thistogram by message type:\n");
	339	first = 0;
	340	}
	341	printf("\t\t%s: " LLU "\n", pfkey_msgtype_names(type),
b8dff150	342	(CAST)PFKEYDIFF(out_msgtype[type]));
7ba0088d A	343	}
	344	p(out_invlen, "\t" LLU " message%s with invalid length field\n");
	345	p(out_invver, "\t" LLU " message%s with invalid version field\n");
	346	p(out_invmsgtype, "\t" LLU " message%s with invalid message type field\n");
	347	p(out_tooshort, "\t" LLU " message%s too short\n");
	348	p(out_nomem, "\t" LLU " message%s with memory allocation failure\n");
	349	p(out_dupext, "\t" LLU " message%s with duplicate extension\n");
	350	p(out_invexttype, "\t" LLU " message%s with invalid extension type\n");
	351	p(out_invsatype, "\t" LLU " message%s with invalid sa type\n");
	352	p(out_invaddr, "\t" LLU " message%s with invalid address extension\n");
	353
	354	/* userland -> kernel */
	355	p(in_total, "\t" LLU " request%s sent from userland\n");
	356	p(in_bytes, "\t" LLU " byte%s sent from userland\n");
	357	for (first = 1, type = 0;
	358	type < sizeof(pfkeystat.in_msgtype)/sizeof(pfkeystat.in_msgtype[0]);
	359	type++) {
b8dff150	360	if (PFKEYDIFF(in_msgtype[type]) <= 0)
7ba0088d A	361	continue;
	362	if (first) {
	363	printf("\thistogram by message type:\n");
	364	first = 0;
	365	}
	366	printf("\t\t%s: " LLU "\n", pfkey_msgtype_names(type),
b8dff150	367	(CAST)PFKEYDIFF(in_msgtype[type]));
7ba0088d A	368	}
	369	p(in_msgtarget[KEY_SENDUP_ONE],
	370	"\t" LLU " message%s toward single socket\n");
	371	p(in_msgtarget[KEY_SENDUP_ALL],
	372	"\t" LLU " message%s toward all sockets\n");
	373	p(in_msgtarget[KEY_SENDUP_REGISTERED],
	374	"\t" LLU " message%s toward registered sockets\n");
	375	p(in_nomem, "\t" LLU " message%s with memory allocation failure\n");
b8dff150 A	376
	377	if (interval > 0)
	378	bcopy(&pfkeystat, &ppfkeystat, len);
	379	#undef PFKEYDIFF
7ba0088d A	380	#undef p
	381	}
	382	#endif /IPSEC/