#include <sys/socket.h>
#include <sys/time.h>
#include <sys/sysctl.h>
#include <sys/queue.h>
#include <net/pfkeyv2.h>
#include <netinet/ip_ipsp.h>
#include <netdb.h>
#include <string.h>
#include <unistd.h>
#include <stdlib.h>
#include <stdio.h>
#include <err.h>
#include <errno.h>
#include "ipsecctl.h"
#include "pfkey.h"
static void print_proto(struct sadb_ext *, struct sadb_msg *, int);
static void print_flow(struct sadb_ext *, struct sadb_msg *, int);
static void print_supp(struct sadb_ext *, struct sadb_msg *, int);
static void print_prop(struct sadb_ext *, struct sadb_msg *, int);
static void print_sens(struct sadb_ext *, struct sadb_msg *, int);
static void print_spir(struct sadb_ext *, struct sadb_msg *, int);
static void print_policy(struct sadb_ext *, struct sadb_msg *, int);
static void print_sa(struct sadb_ext *, struct sadb_msg *, int);
static void print_addr(struct sadb_ext *, struct sadb_msg *, int);
static void print_key(struct sadb_ext *, struct sadb_msg *, int);
static void print_life(struct sadb_ext *, struct sadb_msg *, int);
static void print_ident(struct sadb_ext *, struct sadb_msg *, int);
static void print_udpenc(struct sadb_ext *, struct sadb_msg *, int);
static void print_tag(struct sadb_ext *, struct sadb_msg *, int);
static void print_rdomain(struct sadb_ext *, struct sadb_msg *, int);
static void print_replay(struct sadb_ext *, struct sadb_msg *, int);
static void print_mtu(struct sadb_ext *, struct sadb_msg *, int);
static void print_tap(struct sadb_ext *, struct sadb_msg *, int);
static void print_satype(struct sadb_ext *, struct sadb_msg *, int);
static void print_counter(struct sadb_ext *, struct sadb_msg *, int);
static void print_iface(struct sadb_ext *, struct sadb_msg *, int);
static struct idname *lookup(struct idname *, u_int32_t);
static char *lookup_name(struct idname *, u_int32_t);
static void print_ext(struct sadb_ext *, struct sadb_msg *, int);
void pfkey_print_raw(u_int8_t *, ssize_t);
static char *print_flags(uint32_t);
struct sadb_ext *extensions[SADB_EXT_MAX + 1];
struct idname {
u_int32_t id;
char *name;
void (*func)(struct sadb_ext *, struct sadb_msg *, int);
};
struct idname ext_types[] = {
{ SADB_EXT_RESERVED, "reserved", NULL },
{ SADB_EXT_SA, "sa", print_sa },
{ SADB_EXT_LIFETIME_CURRENT, "lifetime_cur", print_life },
{ SADB_EXT_LIFETIME_HARD, "lifetime_hard", print_life },
{ SADB_EXT_LIFETIME_SOFT, "lifetime_soft", print_life },
{ SADB_EXT_ADDRESS_SRC, "address_src", print_addr },
{ SADB_EXT_ADDRESS_DST, "address_dst", print_addr },
{ SADB_EXT_ADDRESS_PROXY, "address_proxy", print_addr },
{ SADB_EXT_KEY_AUTH, "key_auth", print_key },
{ SADB_EXT_KEY_ENCRYPT, "key_encrypt", print_key },
{ SADB_EXT_IDENTITY_SRC, "identity_src", print_ident },
{ SADB_EXT_IDENTITY_DST, "identity_dst", print_ident },
{ SADB_EXT_SENSITIVITY, "sensitivity", print_sens },
{ SADB_EXT_PROPOSAL, "proposal", print_prop },
{ SADB_EXT_SUPPORTED_AUTH, "supported_auth", print_supp },
{ SADB_EXT_SUPPORTED_ENCRYPT, "supported_encrypt", print_supp },
{ SADB_EXT_SPIRANGE, "spirange", print_spir },
{ SADB_X_EXT_SRC_MASK, "src_mask", print_addr },
{ SADB_X_EXT_DST_MASK, "dst_mask", print_addr },
{ SADB_X_EXT_PROTOCOL, "protocol", print_proto },
{ SADB_X_EXT_FLOW_TYPE, "flow_type", print_flow },
{ SADB_X_EXT_SRC_FLOW, "src_flow", print_addr },
{ SADB_X_EXT_DST_FLOW, "dst_flow", print_addr },
{ SADB_X_EXT_SA2, "sa2", print_sa },
{ SADB_X_EXT_DST2, "dst2", print_addr },
{ SADB_X_EXT_POLICY, "policy", print_policy },
{ SADB_X_EXT_SUPPORTED_COMP, "supported_comp", print_supp },
{ SADB_X_EXT_UDPENCAP, "udpencap", print_udpenc },
{ SADB_X_EXT_LIFETIME_LASTUSE, "lifetime_lastuse", print_life },
{ SADB_X_EXT_TAG, "tag", print_tag },
{ SADB_X_EXT_RDOMAIN, "rdomain", print_rdomain },
{ SADB_X_EXT_REPLAY, "replay", print_replay },
{ SADB_X_EXT_MTU, "mtu", print_mtu },
{ SADB_X_EXT_TAP, "tap", print_tap },
{ SADB_X_EXT_SATYPE2, "satype2", print_satype },
{ SADB_X_EXT_COUNTER, "counter", print_counter },
{ SADB_X_EXT_IFACE, "interface", print_iface },
{ 0, NULL, NULL }
};
struct idname msg_types[] = {
{ SADB_ACQUIRE, "sadb_acquire", NULL },
{ SADB_ADD, "sadb_add", NULL },
{ SADB_DELETE, "sadb_delete", NULL },
{ SADB_DUMP, "sadb_dump", NULL },
{ SADB_EXPIRE, "sadb_expire", NULL },
{ SADB_FLUSH, "sadb_flush", NULL },
{ SADB_GET, "sadb_get", NULL },
{ SADB_GETSPI, "sadb_getspi", NULL },
{ SADB_REGISTER, "sadb_register", NULL },
{ SADB_UPDATE, "sadb_update", NULL },
{ SADB_X_ADDFLOW, "sadb_addflow", NULL },
{ SADB_X_ASKPOLICY, "sadb_askpolicy", NULL },
{ SADB_X_DELFLOW, "sadb_delflow", NULL },
{ SADB_X_GRPSPIS, "sadb_grpspis", NULL },
{ SADB_X_PROMISC, "sadb_promisc", NULL },
{ 0, NULL, NULL },
};
struct idname sa_types[] = {
{ SADB_SATYPE_UNSPEC, "unspec", NULL },
{ SADB_SATYPE_AH, "ah", NULL },
{ SADB_SATYPE_ESP, "esp", NULL },
{ SADB_SATYPE_RSVP, "rsvp", NULL },
{ SADB_SATYPE_OSPFV2, "ospfv2", NULL },
{ SADB_SATYPE_RIPV2, "ripv2", NULL },
{ SADB_SATYPE_MIP, "mip", NULL },
{ SADB_X_SATYPE_IPIP, "ipip", NULL },
{ SADB_X_SATYPE_TCPSIGNATURE, "tcpmd5", NULL },
{ SADB_X_SATYPE_IPCOMP, "ipcomp", NULL },
{ 0, NULL, NULL }
};
struct idname auth_types[] = {
{ SADB_AALG_NONE, "none", NULL },
{ SADB_AALG_MD5HMAC, "hmac-md5", NULL },
{ SADB_X_AALG_RIPEMD160HMAC, "hmac-ripemd160", NULL },
{ SADB_AALG_SHA1HMAC, "hmac-sha1", NULL },
{ SADB_X_AALG_SHA2_256, "hmac-sha2-256", NULL },
{ SADB_X_AALG_SHA2_384, "hmac-sha2-384", NULL },
{ SADB_X_AALG_SHA2_512, "hmac-sha2-512", NULL },
{ SADB_X_AALG_AES128GMAC, "gmac-aes-128", NULL },
{ SADB_X_AALG_AES192GMAC, "gmac-aes-192", NULL },
{ SADB_X_AALG_AES256GMAC, "gmac-aes-256", NULL },
{ SADB_X_AALG_CHACHA20POLY1305, "chacha20-poly1305", NULL },
{ 0, NULL, NULL }
};
struct idname enc_types[] = {
{ SADB_EALG_NONE, "none", NULL },
{ SADB_EALG_3DESCBC, "3des-cbc", NULL },
{ SADB_X_EALG_AES, "aes", NULL },
{ SADB_X_EALG_AESCTR, "aesctr", NULL },
{ SADB_X_EALG_AESGCM16, "aes-gcm", NULL },
{ SADB_X_EALG_AESGMAC, "aes-gmac", NULL },
{ SADB_X_EALG_BLF, "blowfish", NULL },
{ SADB_X_EALG_CAST, "cast128", NULL },
{ SADB_EALG_NULL, "null", NULL },
{ SADB_X_EALG_CHACHA20POLY1305, "chacha20-poly1305", NULL },
{ 0, NULL, NULL }
};
struct idname comp_types[] = {
{ SADB_X_CALG_NONE, "none", NULL },
{ SADB_X_CALG_OUI, "oui", NULL },
{ SADB_X_CALG_DEFLATE, "deflate", NULL },
{ 0, NULL, NULL }
};
struct idname flag_types[] = {
{ SADB_SAFLAGS_PFS, "pfs", NULL },
{ SADB_X_SAFLAGS_TUNNEL, "tunnel", NULL },
{ SADB_X_SAFLAGS_CHAINDEL, "chaindel", NULL },
{ SADB_X_SAFLAGS_UDPENCAP, "udpencap", NULL },
{ SADB_X_SAFLAGS_ESN, "esn", NULL },
{ 0, NULL, NULL }
};
struct idname identity_types[] = {
{ SADB_IDENTTYPE_RESERVED, "reserved", NULL },
{ SADB_IDENTTYPE_PREFIX, "prefix", NULL },
{ SADB_IDENTTYPE_FQDN, "fqdn", NULL },
{ SADB_IDENTTYPE_USERFQDN, "ufqdn", NULL },
{ SADB_IDENTTYPE_ASN1_DN, "asn1_dn", NULL },
{ 0, NULL, NULL }
};
struct idname flow_types[] = {
{ SADB_X_FLOW_TYPE_USE, "use", NULL },
{ SADB_X_FLOW_TYPE_ACQUIRE, "acquire", NULL },
{ SADB_X_FLOW_TYPE_REQUIRE, "require", NULL },
{ SADB_X_FLOW_TYPE_BYPASS, "bypass", NULL },
{ SADB_X_FLOW_TYPE_DENY, "deny", NULL },
{ SADB_X_FLOW_TYPE_DONTACQ, "dontacq", NULL },
{ 0, NULL, NULL }
};
struct idname states[] = {
{ SADB_SASTATE_LARVAL, "larval", NULL },
{ SADB_SASTATE_MATURE, "mature", NULL },
{ SADB_SASTATE_DYING, "dying", NULL },
{ SADB_SASTATE_DEAD, "dead", NULL },
{ 0, NULL, NULL }
};
static struct idname *
lookup(struct idname *tab, u_int32_t id)
{
struct idname *entry;
for (entry = tab; entry->name; entry++)
if (entry->id == id)
return (entry);
return (NULL);
}
static char *
lookup_name(struct idname *tab, u_int32_t id)
{
struct idname *entry;
entry = lookup(tab, id);
return (entry ? entry->name : "unknown");
}
static void
print_ext(struct sadb_ext *ext, struct sadb_msg *msg, int opts)
{
struct idname *entry;
if ((entry = lookup(ext_types, ext->sadb_ext_type)) == NULL) {
printf("unknown ext: type %u len %u\n",
ext->sadb_ext_type, ext->sadb_ext_len);
return;
}
printf("\t%s: ", entry->name);
if (entry->func != NULL)
(*entry->func)(ext, msg, opts);
else
printf("type %u len %u",
ext->sadb_ext_type, ext->sadb_ext_len);
printf("\n");
}
static char *
print_flags(uint32_t flags)
{
static char fstr[80];
struct idname *entry;
int len;
int i, comma = 0, n;
len = snprintf(fstr, sizeof(fstr), "%#x<", flags);
if (len < 0 || (size_t)len >= sizeof(fstr))
return (NULL);
for (i = 0; i < 32; i++) {
if ((flags & (1 << i)) == 0 ||
(entry = lookup(flag_types, 1 << i)) == NULL)
continue;
n = snprintf(fstr + len, sizeof(fstr) - len - 1,
comma ? ",%s" : "%s", entry->name);
if (n < 0 || (size_t)n >= sizeof(fstr) - len - 1)
return (NULL);
len += n;
comma = 1;
}
strlcat(fstr, ">", sizeof(fstr));
return (fstr);
}
static void
print_sa(struct sadb_ext *ext, struct sadb_msg *msg, int opts)
{
struct sadb_sa *sa = (struct sadb_sa *)ext;
if (msg->sadb_msg_satype == SADB_X_SATYPE_IPCOMP)
printf("cpi 0x%8.8x comp %s\n",
ntohl(sa->sadb_sa_spi),
lookup_name(comp_types, sa->sadb_sa_encrypt));
else
printf("spi 0x%8.8x auth %s enc %s\n",
ntohl(sa->sadb_sa_spi),
lookup_name(auth_types, sa->sadb_sa_auth),
lookup_name(enc_types, sa->sadb_sa_encrypt));
printf("\t\tstate %s replay %u flags %s",
lookup_name(states, sa->sadb_sa_state),
sa->sadb_sa_replay, print_flags(sa->sadb_sa_flags));
}
static void
print_addr(struct sadb_ext *ext, struct sadb_msg *msg, int opts)
{
struct sadb_address *addr = (struct sadb_address *)ext;
struct sockaddr *sa;
struct sockaddr_in *sin4;
struct sockaddr_in6 *sin6;
char hbuf[NI_MAXHOST];
sa = (struct sockaddr *)(addr + 1);
if (sa->sa_family == 0)
printf("<any>");
else if (getnameinfo(sa, sa->sa_len, hbuf, sizeof(hbuf), NULL, 0,
NI_NUMERICHOST))
printf("<could not get numeric hostname>");
else
printf("%s", hbuf);
switch (sa->sa_family) {
case AF_INET:
sin4 = (struct sockaddr_in *)sa;
if (sin4->sin_port)
printf(" port %u", ntohs(sin4->sin_port));
break;
case AF_INET6:
sin6 = (struct sockaddr_in6 *)sa;
if (sin6->sin6_port)
printf(" port %u", ntohs(sin6->sin6_port));
break;
}
}
static void
print_key(struct sadb_ext *ext, struct sadb_msg *msg, int opts)
{
struct sadb_key *key = (struct sadb_key *)ext;
u_int8_t *data;
int i;
printf("bits %u: ", key->sadb_key_bits);
data = (u_int8_t *)(key + 1);
for (i = 0; i < key->sadb_key_bits / 8; i++) {
printf("%2.2x", data[i]);
data[i] = 0x00;
}
}
static void
print_life(struct sadb_ext *ext, struct sadb_msg *msg, int opts)
{
struct sadb_lifetime *life = (struct sadb_lifetime *)ext;
printf("alloc %u bytes %llu add %llu first %llu",
life->sadb_lifetime_allocations,
life->sadb_lifetime_bytes,
life->sadb_lifetime_addtime,
life->sadb_lifetime_usetime);
}
static void
print_proto(struct sadb_ext *ext, struct sadb_msg *msg, int opts)
{
struct sadb_protocol *proto = (struct sadb_protocol *)ext;
if (msg->sadb_msg_type == SADB_X_GRPSPIS)
printf("satype %s flags %x",
lookup_name(sa_types, proto->sadb_protocol_proto),
proto->sadb_protocol_flags);
else
printf("proto %u flags %x",
proto->sadb_protocol_proto, proto->sadb_protocol_flags);
}
static void
print_flow(struct sadb_ext *ext, struct sadb_msg *msg, int opts)
{
struct sadb_protocol *proto = (struct sadb_protocol *)ext;
char *dir = "unknown";
switch (proto->sadb_protocol_direction) {
case IPSP_DIRECTION_IN:
dir = "in";
break;
case IPSP_DIRECTION_OUT:
dir = "out";
break;
}
printf("type %s direction %s",
lookup_name(flow_types, proto->sadb_protocol_proto), dir);
}
static void
print_tag(struct sadb_ext *ext, struct sadb_msg *msg, int opts)
{
struct sadb_x_tag *stag = (struct sadb_x_tag *)ext;
char *p;
int plen;
p = (char *)(stag + 1);
plen = stag->sadb_x_tag_len * 8 - sizeof(*stag);
printf("%.*s", plen, p);
}
static void
print_replay(struct sadb_ext *ext, struct sadb_msg *msg, int opts)
{
struct sadb_x_replay *sreplay = (struct sadb_x_replay *)ext;
printf("rpl %llu", sreplay->sadb_x_replay_count);
}
static void
print_mtu(struct sadb_ext *ext, struct sadb_msg *msg, int opts)
{
struct sadb_x_mtu *smtu = (struct sadb_x_mtu *)ext;
printf("mtu %u", smtu->sadb_x_mtu_mtu);
}
static void
print_tap(struct sadb_ext *ext, struct sadb_msg *msg, int opts)
{
struct sadb_x_tap *stap = (struct sadb_x_tap *)ext;
printf("enc%u", stap->sadb_x_tap_unit);
}
static void
print_satype(struct sadb_ext *ext, struct sadb_msg *msg, int opts)
{
struct sadb_protocol *proto = (struct sadb_protocol *)ext;
printf("type %s", lookup_name(sa_types, proto->sadb_protocol_proto));
}
static void
print_counter(struct sadb_ext *ext, struct sadb_msg *msg, int opts)
{
struct sadb_x_counter *scnt = (struct sadb_x_counter *)ext;
printf("\n");
#define plural(n) ((n) != 1 ? "s" : "")
#define p(f, m) if (scnt->f || opts & IPSECCTL_OPT_VERBOSE2) \
printf(m, scnt->f, plural(scnt->f))
p(sadb_x_counter_ipackets, "\t\t%llu input packet%s\n");
p(sadb_x_counter_opackets, "\t\t%llu output packet%s\n");
p(sadb_x_counter_ibytes, "\t\t%llu input byte%s\n");
p(sadb_x_counter_obytes, "\t\t%llu output byte%s\n");
p(sadb_x_counter_idecompbytes, "\t\t%llu input byte%s, decompressed\n");
p(sadb_x_counter_ouncompbytes,"\t\t%llu output byte%s, uncompressed\n");
p(sadb_x_counter_idrops, "\t\t%llu packet%s dropped on input\n");
p(sadb_x_counter_odrops, "\t\t%llu packet%s dropped on output\n");
#undef p
#undef plural
}
static void
print_iface(struct sadb_ext *ext, struct sadb_msg *msg, int opts)
{
struct sadb_x_iface *siface = (struct sadb_x_iface *)ext;
const char *dir = "unknown";
switch (siface->sadb_x_iface_direction) {
case IPSP_DIRECTION_IN:
dir = "in";
break;
case IPSP_DIRECTION_OUT:
dir = "out";
break;
}
printf("sec%u direction %s", siface->sadb_x_iface_unit, dir);
}
static char *
alg_by_ext(u_int8_t ext_type, u_int8_t id)
{
switch (ext_type) {
case SADB_EXT_SUPPORTED_ENCRYPT:
return lookup_name(enc_types, id);
case SADB_EXT_SUPPORTED_AUTH:
return lookup_name(auth_types, id);
case SADB_X_EXT_SUPPORTED_COMP:
return lookup_name(comp_types, id);
default:
return "unknown";
}
}
static void
print_alg(struct sadb_alg *alg, u_int8_t ext_type)
{
printf("\t\t%s iv %u min %u max %u",
alg_by_ext(ext_type, alg->sadb_alg_id), alg->sadb_alg_ivlen,
alg->sadb_alg_minbits, alg->sadb_alg_maxbits);
}
static void
print_supp(struct sadb_ext *ext, struct sadb_msg *msg, int opts)
{
struct sadb_supported *supported = (struct sadb_supported *)ext;
struct sadb_alg *alg;
printf("\n");
for (alg = (struct sadb_alg *)(supported + 1);
(size_t)((u_int8_t *)alg - (u_int8_t *)ext) <
ext->sadb_ext_len * PFKEYV2_CHUNK;
alg++) {
struct sadb_alg *next = alg + 1;
print_alg(alg, ext->sadb_ext_type);
if ((size_t)((u_int8_t *)next - (u_int8_t *)ext) <
ext->sadb_ext_len * PFKEYV2_CHUNK)
printf("\n");
}
}
static void
print_comb(struct sadb_comb *comb, struct sadb_msg *msg, int opts)
{
printf("\t\tauth %s min %u max %u\n"
"\t\tenc %s min %u max %u\n"
"\t\taddtime hard %llu soft %llu\n"
"\t\tusetime hard %llu soft %llu",
lookup_name(auth_types, comb->sadb_comb_auth),
comb->sadb_comb_auth_minbits,
comb->sadb_comb_auth_maxbits,
lookup_name(enc_types, comb->sadb_comb_encrypt),
comb->sadb_comb_encrypt_minbits,
comb->sadb_comb_encrypt_maxbits,
comb->sadb_comb_soft_addtime,
comb->sadb_comb_hard_addtime,
comb->sadb_comb_soft_usetime,
comb->sadb_comb_hard_usetime);
#if 0
comb->sadb_comb_flags,
comb->sadb_comb_reserved,
comb->sadb_comb_soft_allocations,
comb->sadb_comb_hard_allocations,
comb->sadb_comb_soft_bytes,
comb->sadb_comb_hard_bytes,
#endif
}
static void
print_prop(struct sadb_ext *ext, struct sadb_msg *msg, int opts)
{
struct sadb_prop *prop = (struct sadb_prop *)ext;
struct sadb_comb *comb;
printf("replay %u\n", prop->sadb_prop_replay);
for (comb = (struct sadb_comb *)(prop + 1);
(size_t)((u_int8_t *)comb - (u_int8_t *)ext) <
ext->sadb_ext_len * PFKEYV2_CHUNK;
comb++)
print_comb(comb, msg, opts);
}
static void
print_sens(struct sadb_ext *ext, struct sadb_msg *msg, int opts)
{
struct sadb_sens *sens = (struct sadb_sens *)ext;
printf("dpd %u sens_level %u integ_level %u",
sens->sadb_sens_dpd,
sens->sadb_sens_sens_level,
sens->sadb_sens_integ_level);
}
static void
print_spir(struct sadb_ext *ext, struct sadb_msg *msg, int opts)
{
struct sadb_spirange *spirange = (struct sadb_spirange *)ext;
printf("min 0x%8.8x max 0x%8.8x",
spirange->sadb_spirange_min, spirange->sadb_spirange_max);
}
static void
print_ident(struct sadb_ext *ext, struct sadb_msg *msg, int opts)
{
struct sadb_ident *ident = (struct sadb_ident *)ext;
int ilen;
ilen = ident->sadb_ident_len * 8 - sizeof(*ident);
printf("type %s id %llu: %.*s",
lookup_name(identity_types, ident->sadb_ident_type),
ident->sadb_ident_id, ilen, (char *)(ident + 1));
}
static void
print_policy(struct sadb_ext *ext, struct sadb_msg *msg, int opts)
{
struct sadb_x_policy *x_policy = (struct sadb_x_policy *)ext;
printf("seq %u", x_policy->sadb_x_policy_seq);
}
static void
print_udpenc(struct sadb_ext *ext, struct sadb_msg *msg, int opts)
{
struct sadb_x_udpencap *x_udpencap = (struct sadb_x_udpencap *)ext;
printf("udpencap port %u", ntohs(x_udpencap->sadb_x_udpencap_port));
}
static void
print_rdomain(struct sadb_ext *ext, struct sadb_msg *msg, int opts)
{
struct sadb_x_rdomain *srdomain = (struct sadb_x_rdomain *)ext;
printf("%d/%d", srdomain->sadb_x_rdomain_dom1,
srdomain->sadb_x_rdomain_dom2);
}
static void
setup_extensions(struct sadb_msg *msg)
{
struct sadb_ext *ext;
bzero(extensions, sizeof(extensions));
if (msg->sadb_msg_len == 0)
return;
for (ext = (struct sadb_ext *)(msg + 1);
(size_t)((u_int8_t *)ext - (u_int8_t *)msg) <
msg->sadb_msg_len * PFKEYV2_CHUNK && ext->sadb_ext_len > 0;
ext = (struct sadb_ext *)((u_int8_t *)ext +
ext->sadb_ext_len * PFKEYV2_CHUNK))
extensions[ext->sadb_ext_type] = ext;
}
static void
parse_addr(struct sadb_ext *ext, struct ipsec_addr_wrap *ipa)
{
struct sadb_address *addr = (struct sadb_address *)ext;
struct sockaddr *sa;
if (addr == NULL)
return;
sa = (struct sockaddr *)(addr + 1);
switch (sa->sa_family) {
case AF_INET:
ipa->address.v4 = ((struct sockaddr_in *)sa)->sin_addr;
set_ipmask(ipa, 32);
break;
case AF_INET6:
ipa->address.v6 = ((struct sockaddr_in6 *)sa)->sin6_addr;
set_ipmask(ipa, 128);
break;
}
ipa->af = sa->sa_family;
ipa->next = NULL;
ipa->tail = ipa;
}
static void
parse_key(struct sadb_ext *ext, struct ipsec_key *ikey)
{
struct sadb_key *key = (struct sadb_key *)ext;
u_int8_t *data;
if (key == NULL)
return;
data = (u_int8_t *)(key + 1);
ikey->data = data;
ikey->len = key->sadb_key_bits / 8;
}
static void
parse_satype(struct sadb_ext *ext, u_int8_t *satype)
{
struct sadb_protocol *proto = (struct sadb_protocol *)ext;
if (proto == NULL)
return;
switch (proto->sadb_protocol_proto) {
case SADB_SATYPE_ESP:
*satype = IPSEC_ESP;
break;
case SADB_SATYPE_AH:
*satype = IPSEC_AH;
break;
case SADB_X_SATYPE_IPCOMP:
*satype = IPSEC_IPCOMP;
break;
case SADB_X_SATYPE_IPIP:
*satype = IPSEC_IPIP;
break;
default:
return;
}
}
u_int32_t
pfkey_get_spi(struct sadb_msg *msg)
{
struct sadb_sa *sa;
setup_extensions(msg);
sa = (struct sadb_sa *)extensions[SADB_EXT_SA];
return (ntohl(sa->sadb_sa_spi));
}
void
pfkey_print_sa(struct sadb_msg *msg, int opts)
{
int i;
struct ipsec_rule r;
struct ipsec_key enckey, authkey;
struct ipsec_transforms xfs;
struct ipsec_addr_wrap src, dst, dst2;
struct sadb_sa *sa, *sa2;
setup_extensions(msg);
sa = (struct sadb_sa *)extensions[SADB_EXT_SA];
bzero(&r, sizeof r);
r.type |= RULE_SA;
r.tmode = (msg->sadb_msg_satype != SADB_X_SATYPE_TCPSIGNATURE) &&
(sa->sadb_sa_flags & SADB_X_SAFLAGS_TUNNEL) ?
IPSEC_TUNNEL : IPSEC_TRANSPORT;
r.spi = ntohl(sa->sadb_sa_spi);
switch (msg->sadb_msg_satype) {
case SADB_SATYPE_AH:
r.satype = IPSEC_AH;
break;
case SADB_SATYPE_ESP:
r.satype = IPSEC_ESP;
break;
case SADB_X_SATYPE_IPCOMP:
r.satype = IPSEC_IPCOMP;
break;
case SADB_X_SATYPE_TCPSIGNATURE:
r.satype = IPSEC_TCPMD5;
break;
case SADB_X_SATYPE_IPIP:
r.satype = IPSEC_IPIP;
break;
default:
return;
}
bzero(&dst, sizeof dst);
bzero(&src, sizeof src);
parse_addr(extensions[SADB_EXT_ADDRESS_SRC], &src);
parse_addr(extensions[SADB_EXT_ADDRESS_DST], &dst);
r.src = &src;
r.dst = &dst;
if (r.satype == IPSEC_IPCOMP) {
if (sa->sadb_sa_encrypt) {
bzero(&xfs, sizeof xfs);
r.xfs = &xfs;
switch (sa->sadb_sa_encrypt) {
case SADB_X_CALG_DEFLATE:
xfs.compxf = &compxfs[COMPXF_DEFLATE];
break;
}
}
} else if (r.satype == IPSEC_TCPMD5) {
bzero(&authkey, sizeof authkey);
parse_key(extensions[SADB_EXT_KEY_AUTH], &authkey);
r.authkey = &authkey;
} else if (sa->sadb_sa_encrypt || sa->sadb_sa_auth) {
bzero(&xfs, sizeof xfs);
r.xfs = &xfs;
if (sa->sadb_sa_encrypt) {
bzero(&enckey, sizeof enckey);
parse_key(extensions[SADB_EXT_KEY_ENCRYPT], &enckey);
r.enckey = &enckey;
switch (sa->sadb_sa_encrypt) {
case SADB_EALG_3DESCBC:
xfs.encxf = &encxfs[ENCXF_3DES_CBC];
break;
case SADB_X_EALG_AES:
switch (r.enckey->len) {
case 192/8:
xfs.encxf = &encxfs[ENCXF_AES_192];
break;
case 256/8:
xfs.encxf = &encxfs[ENCXF_AES_256];
break;
default:
xfs.encxf = &encxfs[ENCXF_AES];
break;
}
break;
case SADB_X_EALG_AESCTR:
switch (r.enckey->len) {
case 28:
xfs.encxf = &encxfs[ENCXF_AES_192_CTR];
break;
case 36:
xfs.encxf = &encxfs[ENCXF_AES_256_CTR];
break;
default:
xfs.encxf = &encxfs[ENCXF_AESCTR];
break;
}
break;
case SADB_X_EALG_AESGCM16:
switch (r.enckey->len) {
case 28:
xfs.encxf = &encxfs[ENCXF_AES_192_GCM];
break;
case 36:
xfs.encxf = &encxfs[ENCXF_AES_256_GCM];
break;
default:
xfs.encxf = &encxfs[ENCXF_AES_128_GCM];
break;
}
break;
case SADB_X_EALG_AESGMAC:
switch (r.enckey->len) {
case 28:
xfs.encxf = &encxfs[ENCXF_AES_192_GMAC];
break;
case 36:
xfs.encxf = &encxfs[ENCXF_AES_256_GMAC];
break;
default:
xfs.encxf = &encxfs[ENCXF_AES_128_GMAC];
break;
}
break;
case SADB_X_EALG_BLF:
xfs.encxf = &encxfs[ENCXF_BLOWFISH];
break;
case SADB_X_EALG_CAST:
xfs.encxf = &encxfs[ENCXF_CAST128];
break;
case SADB_X_EALG_CHACHA20POLY1305:
xfs.encxf = &encxfs[ENCXF_CHACHA20_POLY1305];
break;
case SADB_EALG_NULL:
xfs.encxf = &encxfs[ENCXF_NULL];
break;
}
}
if (sa->sadb_sa_auth) {
bzero(&authkey, sizeof authkey);
parse_key(extensions[SADB_EXT_KEY_AUTH], &authkey);
r.authkey = &authkey;
switch (sa->sadb_sa_auth) {
case SADB_AALG_MD5HMAC:
xfs.authxf = &authxfs[AUTHXF_HMAC_MD5];
break;
case SADB_X_AALG_RIPEMD160HMAC:
xfs.authxf = &authxfs[AUTHXF_HMAC_RIPEMD160];
break;
case SADB_AALG_SHA1HMAC:
xfs.authxf = &authxfs[AUTHXF_HMAC_SHA1];
break;
case SADB_X_AALG_SHA2_256:
xfs.authxf = &authxfs[AUTHXF_HMAC_SHA2_256];
break;
case SADB_X_AALG_SHA2_384:
xfs.authxf = &authxfs[AUTHXF_HMAC_SHA2_384];
break;
case SADB_X_AALG_SHA2_512:
xfs.authxf = &authxfs[AUTHXF_HMAC_SHA2_512];
break;
}
}
}
if (!(opts & IPSECCTL_OPT_SHOWKEY)) {
bzero(&enckey, sizeof enckey);
bzero(&authkey, sizeof authkey);
extensions[SADB_EXT_KEY_AUTH] = NULL;
extensions[SADB_EXT_KEY_ENCRYPT] = NULL;
}
if (extensions[SADB_X_EXT_SA2]) {
r.type |= RULE_BUNDLE;
sa2 = (struct sadb_sa *)extensions[SADB_X_EXT_SA2];
r.spi2 = ntohl(sa2->sadb_sa_spi);
parse_addr(extensions[SADB_X_EXT_DST2], &dst2);
r.dst2 = &dst2;
parse_satype(extensions[SADB_X_EXT_SATYPE2], &r.proto2);
r.proto = r.satype;
}
ipsecctl_print_rule(&r, opts);
if (opts & IPSECCTL_OPT_VERBOSE) {
for (i = 0; i <= SADB_EXT_MAX; i++)
if (extensions[i])
print_ext(extensions[i], msg, opts);
}
fflush(stdout);
}
void
pfkey_monitor_sa(struct sadb_msg *msg, int opts)
{
int i;
setup_extensions(msg);
printf("%s: satype %s vers %u len %u seq %u pid %u\n",
lookup_name(msg_types, msg->sadb_msg_type),
lookup_name(sa_types, msg->sadb_msg_satype),
msg->sadb_msg_version, msg->sadb_msg_len,
msg->sadb_msg_seq,
msg->sadb_msg_pid);
if (msg->sadb_msg_errno)
printf("\terrno %u: %s\n", msg->sadb_msg_errno,
strerror(msg->sadb_msg_errno));
for (i = 0; i <= SADB_EXT_MAX; i++)
if (extensions[i])
print_ext(extensions[i], msg, opts);
fflush(stdout);
}
void
pfkey_print_raw(u_int8_t *data, ssize_t len)
{
int i;
const u_int8_t *sp = (const u_int8_t *)data;
printf("RAW PFKEYV2 MESSAGE:\n");
for (i = 0; i < len; i++) {
if ((i % 8 == 0) && (i != 0))
printf("\n");
printf("%02x ", *sp);
sp++;
}
printf("\n");
}
