1 /* $KAME: ipsec.c,v 1.33 2003/07/25 09:54:32 itojun Exp $ */
2
3 /*-
4 * SPDX-License-Identifier: BSD-3-Clause
5 *
6 * Copyright (c) 2005 NTT Multimedia Communications Laboratories, Inc.
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 *
18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 * SUCH DAMAGE.
29 */
30 /*-
31 * Copyright (C) 1995, 1996, 1997, 1998, and 1999 WIDE Project.
32 * All rights reserved.
33 *
34 * Redistribution and use in source and binary forms, with or without
35 * modification, are permitted provided that the following conditions
36 * are met:
37 * 1. Redistributions of source code must retain the above copyright
38 * notice, this list of conditions and the following disclaimer.
39 * 2. Redistributions in binary form must reproduce the above copyright
40 * notice, this list of conditions and the following disclaimer in the
41 * documentation and/or other materials provided with the distribution.
42 * 3. Neither the name of the project nor the names of its contributors
43 * may be used to endorse or promote products derived from this software
44 * without specific prior written permission.
45 *
46 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
47 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
48 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
49 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
50 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
51 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
52 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
53 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
54 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
55 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
56 * SUCH DAMAGE.
57 */
58 /*-
59 * Copyright (c) 1983, 1988, 1993
60 * The Regents of the University of California. All rights reserved.
61 *
62 * Redistribution and use in source and binary forms, with or without
63 * modification, are permitted provided that the following conditions
64 * are met:
65 * 1. Redistributions of source code must retain the above copyright
66 * notice, this list of conditions and the following disclaimer.
67 * 2. Redistributions in binary form must reproduce the above copyright
68 * notice, this list of conditions and the following disclaimer in the
69 * documentation and/or other materials provided with the distribution.
70 * 3. Neither the name of the University nor the names of its contributors
71 * may be used to endorse or promote products derived from this software
72 * without specific prior written permission.
73 *
74 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
75 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
76 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
77 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
78 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
79 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
80 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
81 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
82 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
83 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
84 * SUCH DAMAGE.
85 */
86
87 #if 0
88 #ifndef lint
89 static char sccsid[] = "@(#)inet.c 8.5 (Berkeley) 5/24/95";
90 #endif /* not lint */
91 #endif
92
93 #include <sys/cdefs.h>
94 #include <sys/param.h>
95 #include <sys/queue.h>
96 #include <sys/socket.h>
97 #include <sys/socketvar.h>
98
99 #include <netinet/in.h>
100
101 #ifdef IPSEC
102 #include <netipsec/ipsec.h>
103 #include <netipsec/ah_var.h>
104 #include <netipsec/esp_var.h>
105 #include <netipsec/ipcomp_var.h>
106 #endif
107
108 #include <stdint.h>
109 #include <stdio.h>
110 #include <stdbool.h>
111 #include <string.h>
112 #include <unistd.h>
113 #include <libxo/xo.h>
114 #include "netstat.h"
115
116 #ifdef IPSEC
117 struct val2str {
118 int val;
119 const char *str;
120 };
121
122 static struct val2str ipsec_ahnames[] = {
123 { SADB_AALG_NONE, "none", },
124 { SADB_AALG_SHA1HMAC, "hmac-sha1", },
125 { SADB_X_AALG_NULL, "null", },
126 { SADB_X_AALG_SHA2_256, "hmac-sha2-256", },
127 { SADB_X_AALG_SHA2_384, "hmac-sha2-384", },
128 { SADB_X_AALG_SHA2_512, "hmac-sha2-512", },
129 { SADB_X_AALG_AES_XCBC_MAC, "aes-xcbc-mac", },
130 { SADB_X_AALG_TCP_MD5, "tcp-md5", },
131 { SADB_X_AALG_AES128GMAC, "aes-gmac-128", },
132 { SADB_X_AALG_AES192GMAC, "aes-gmac-192", },
133 { SADB_X_AALG_AES256GMAC, "aes-gmac-256", },
134 { -1, NULL },
135 };
136
137 static struct val2str ipsec_espnames[] = {
138 { SADB_EALG_NONE, "none", },
139 { SADB_EALG_NULL, "null", },
140 { SADB_X_EALG_AESCBC, "aes-cbc", },
141 { SADB_X_EALG_AESCTR, "aes-ctr", },
142 { SADB_X_EALG_AESGCM16, "aes-gcm-16", },
143 { SADB_X_EALG_AESGMAC, "aes-gmac", },
144 { -1, NULL },
145 };
146
147 static struct val2str ipsec_compnames[] = {
148 { SADB_X_CALG_NONE, "none", },
149 { SADB_X_CALG_OUI, "oui", },
150 { SADB_X_CALG_DEFLATE, "deflate", },
151 { SADB_X_CALG_LZS, "lzs", },
152 { -1, NULL },
153 };
154
155 static void
print_ipsecstats(const char * tag,const struct ipsecstat * ipsecstat)156 print_ipsecstats(const char *tag, const struct ipsecstat *ipsecstat)
157 {
158 xo_open_container(tag);
159
160 #define p(f, m) if (ipsecstat->f || sflag <= 1) \
161 xo_emit(m, (uintmax_t)ipsecstat->f, plural(ipsecstat->f))
162 #define p2(f, m) if (ipsecstat->f || sflag <= 1) \
163 xo_emit(m, (uintmax_t)ipsecstat->f, plurales(ipsecstat->f))
164
165 p(ips_in_polvio, "\t{:dropped-policy-violation/%ju} "
166 "{N:/inbound packet%s violated process security policy}\n");
167 p(ips_in_nomem, "\t{:dropped-no-memory/%ju} "
168 "{N:/inbound packet%s failed due to insufficient memory}\n");
169 p(ips_in_inval, "\t{:dropped-invalid/%ju} "
170 "{N:/invalid inbound packet%s}\n");
171 p(ips_out_polvio, "\t{:discarded-policy-violation/%ju} "
172 "{N:/outbound packet%s violated process security policy}\n");
173 p(ips_out_nosa, "\t{:discarded-no-sa/%ju} "
174 "{N:/outbound packet%s with no SA available}\n");
175 p(ips_out_nomem, "\t{:discarded-no-memory/%ju} "
176 "{N:/outbound packet%s failed due to insufficient memory}\n");
177 p(ips_out_noroute, "\t{:discarded-no-route/%ju} "
178 "{N:/outbound packet%s with no route available}\n");
179 p(ips_out_inval, "\t{:discarded-invalid/%ju} "
180 "{N:/invalid outbound packet%s}\n");
181 p(ips_out_bundlesa, "\t{:send-bundled-sa/%ju} "
182 "{N:/outbound packet%s with bundled SAs}\n");
183 p(ips_spdcache_hits, "\t{:spdcache-hits/%ju} "
184 "{N:/spd cache hit%s}\n");
185 p2(ips_spdcache_misses, "\t{:spdcache-misses/%ju} "
186 "{N:/spd cache miss%s}\n");
187 p(ips_clcopied, "\t{:clusters-copied-during-clone/%ju} "
188 "{N:/cluster%s copied during clone}\n");
189 p(ips_mbinserted, "\t{:mbufs-inserted/%ju} "
190 "{N:/mbuf%s inserted during makespace}\n");
191 #undef p2
192 #undef p
193 xo_close_container(tag);
194 }
195
196 void
ipsec_stats(u_long off,const char * name,int af1 __unused,int proto __unused)197 ipsec_stats(u_long off, const char *name, int af1 __unused, int proto __unused)
198 {
199 struct ipsecstat ipsecstat;
200 const char *tag;
201
202 if (strcmp(name, "ipsec6") == 0) {
203 if (fetch_stats("net.inet6.ipsec6.ipsecstats", off,&ipsecstat,
204 sizeof(ipsecstat), kread_counters) != 0)
205 return;
206 tag = "ipsec6-statistics";
207 } else {
208 if (fetch_stats("net.inet.ipsec.ipsecstats", off, &ipsecstat,
209 sizeof(ipsecstat), kread_counters) != 0)
210 return;
211 tag = "ipsec-statistics";
212 }
213
214 xo_emit("{T:/%s}:\n", name);
215
216 print_ipsecstats(tag, &ipsecstat);
217 }
218
219
220 static void print_ahstats(const struct ahstat *ahstat);
221 static void print_espstats(const struct espstat *espstat);
222 static void print_ipcompstats(const struct ipcompstat *ipcompstat);
223
224 /*
225 * Dump IPSEC statistics structure.
226 */
227 static void
ipsec_hist_new(const uint64_t * hist,size_t histmax,const struct val2str * name,const char * title,const char * cname)228 ipsec_hist_new(const uint64_t *hist, size_t histmax,
229 const struct val2str *name, const char *title, const char *cname)
230 {
231 int first;
232 size_t proto;
233 const struct val2str *p;
234
235 first = 1;
236 for (proto = 0; proto < histmax; proto++) {
237 if (hist[proto] <= 0)
238 continue;
239 if (first) {
240 xo_open_list(cname);
241 xo_emit("\t{T:/%s histogram}:\n", title);
242 first = 0;
243 }
244 xo_open_instance(cname);
245 for (p = name; p && p->str; p++) {
246 if (p->val == (int)proto)
247 break;
248 }
249 if (p && p->str) {
250 xo_emit("\t\t{k:name}: {:count/%ju}\n", p->str,
251 (uintmax_t)hist[proto]);
252 } else {
253 xo_emit("\t\t#{k:name/%lu}: {:count/%ju}\n",
254 (unsigned long)proto, (uintmax_t)hist[proto]);
255 }
256 xo_close_instance(cname);
257 }
258 if (!first)
259 xo_close_list(cname);
260 }
261
262 static void
print_ahstats(const struct ahstat * ahstat)263 print_ahstats(const struct ahstat *ahstat)
264 {
265 xo_open_container("ah-statictics");
266
267 #define p(f, n, m) if (ahstat->f || sflag <= 1) \
268 xo_emit("\t{:" n "/%ju} {N:/" m "}\n", \
269 (uintmax_t)ahstat->f, plural(ahstat->f))
270 #define hist(f, n, t, c) \
271 ipsec_hist_new((f), sizeof(f)/sizeof(f[0]), (n), (t), (c))
272
273 p(ahs_hdrops, "dropped-short-header",
274 "packet%s shorter than header shows");
275 p(ahs_nopf, "dropped-bad-protocol",
276 "packet%s dropped; protocol family not supported");
277 p(ahs_notdb, "dropped-no-tdb", "packet%s dropped; no TDB");
278 p(ahs_badkcr, "dropped-bad-kcr", "packet%s dropped; bad KCR");
279 p(ahs_qfull, "dropped-queue-full", "packet%s dropped; queue full");
280 p(ahs_noxform, "dropped-no-transform",
281 "packet%s dropped; no transform");
282 p(ahs_wrap, "replay-counter-wraps", "replay counter wrap%s");
283 p(ahs_badauth, "dropped-bad-auth",
284 "packet%s dropped; bad authentication detected");
285 p(ahs_badauthl, "dropped-bad-auth-level",
286 "packet%s dropped; bad authentication length");
287 p(ahs_replay, "possile-replay-detected",
288 "possible replay packet%s detected");
289 p(ahs_input, "received-packets", "packet%s in");
290 p(ahs_output, "send-packets", "packet%s out");
291 p(ahs_invalid, "dropped-bad-tdb", "packet%s dropped; invalid TDB");
292 p(ahs_ibytes, "received-bytes", "byte%s in");
293 p(ahs_obytes, "send-bytes", "byte%s out");
294 p(ahs_toobig, "dropped-too-large",
295 "packet%s dropped; larger than IP_MAXPACKET");
296 p(ahs_pdrops, "dropped-policy-violation",
297 "packet%s blocked due to policy");
298 p(ahs_crypto, "crypto-failures", "crypto processing failure%s");
299 p(ahs_tunnel, "tunnel-failures", "tunnel sanity check failure%s");
300 hist(ahstat->ahs_hist, ipsec_ahnames,
301 "AH output", "ah-output-histogram");
302
303 #undef p
304 #undef hist
305 xo_close_container("ah-statictics");
306 }
307
308 void
ah_stats(u_long off,const char * name,int family __unused,int proto __unused)309 ah_stats(u_long off, const char *name, int family __unused, int proto __unused)
310 {
311 struct ahstat ahstat;
312
313 if (fetch_stats("net.inet.ah.stats", off, &ahstat,
314 sizeof(ahstat), kread_counters) != 0)
315 return;
316
317 xo_emit("{T:/%s}:\n", name);
318
319 print_ahstats(&ahstat);
320 }
321
322 static void
print_espstats(const struct espstat * espstat)323 print_espstats(const struct espstat *espstat)
324 {
325 xo_open_container("esp-statictics");
326 #define p(f, n, m) if (espstat->f || sflag <= 1) \
327 xo_emit("\t{:" n "/%ju} {N:/" m "}\n", \
328 (uintmax_t)espstat->f, plural(espstat->f))
329 #define hist(f, n, t, c) \
330 ipsec_hist_new((f), sizeof(f)/sizeof(f[0]), (n), (t), (c));
331
332 p(esps_hdrops, "dropped-short-header",
333 "packet%s shorter than header shows");
334 p(esps_nopf, "dropped-bad-protocol",
335 "packet%s dropped; protocol family not supported");
336 p(esps_notdb, "dropped-no-tdb", "packet%s dropped; no TDB");
337 p(esps_badkcr, "dropped-bad-kcr", "packet%s dropped; bad KCR");
338 p(esps_qfull, "dropped-queue-full", "packet%s dropped; queue full");
339 p(esps_noxform, "dropped-no-transform",
340 "packet%s dropped; no transform");
341 p(esps_badilen, "dropped-bad-length", "packet%s dropped; bad ilen");
342 p(esps_wrap, "replay-counter-wraps", "replay counter wrap%s");
343 p(esps_badenc, "dropped-bad-crypto",
344 "packet%s dropped; bad encryption detected");
345 p(esps_badauth, "dropped-bad-auth",
346 "packet%s dropped; bad authentication detected");
347 p(esps_replay, "possible-replay-detected",
348 "possible replay packet%s detected");
349 p(esps_input, "received-packets", "packet%s in");
350 p(esps_output, "sent-packets", "packet%s out");
351 p(esps_invalid, "dropped-bad-tdb", "packet%s dropped; invalid TDB");
352 p(esps_ibytes, "receive-bytes", "byte%s in");
353 p(esps_obytes, "sent-bytes", "byte%s out");
354 p(esps_toobig, "dropped-too-large",
355 "packet%s dropped; larger than IP_MAXPACKET");
356 p(esps_pdrops, "dropped-policy-violation",
357 "packet%s blocked due to policy");
358 p(esps_crypto, "crypto-failures", "crypto processing failure%s");
359 p(esps_tunnel, "tunnel-failures", "tunnel sanity check failure%s");
360 hist(espstat->esps_hist, ipsec_espnames,
361 "ESP output", "esp-output-histogram");
362
363 #undef p
364 #undef hist
365 xo_close_container("esp-statictics");
366 }
367
368 void
esp_stats(u_long off,const char * name,int family __unused,int proto __unused)369 esp_stats(u_long off, const char *name, int family __unused, int proto __unused)
370 {
371 struct espstat espstat;
372
373 if (fetch_stats("net.inet.esp.stats", off, &espstat,
374 sizeof(espstat), kread_counters) != 0)
375 return;
376
377 xo_emit("{T:/%s}:\n", name);
378
379 print_espstats(&espstat);
380 }
381
382 static void
print_ipcompstats(const struct ipcompstat * ipcompstat)383 print_ipcompstats(const struct ipcompstat *ipcompstat)
384 {
385 xo_open_container("ipcomp-statictics");
386
387 #define p(f, n, m) if (ipcompstat->f || sflag <= 1) \
388 xo_emit("\t{:" n "/%ju} {N:/" m "}\n", \
389 (uintmax_t)ipcompstat->f, plural(ipcompstat->f))
390 #define hist(f, n, t, c) \
391 ipsec_hist_new((f), sizeof(f)/sizeof(f[0]), (n), (t), (c));
392
393 p(ipcomps_hdrops, "dropped-short-header",
394 "packet%s shorter than header shows");
395 p(ipcomps_nopf, "dropped-bad-protocol",
396 "packet%s dropped; protocol family not supported");
397 p(ipcomps_notdb, "dropped-no-tdb", "packet%s dropped; no TDB");
398 p(ipcomps_badkcr, "dropped-bad-kcr", "packet%s dropped; bad KCR");
399 p(ipcomps_qfull, "dropped-queue-full", "packet%s dropped; queue full");
400 p(ipcomps_noxform, "dropped-no-transform",
401 "packet%s dropped; no transform");
402 p(ipcomps_wrap, "replay-counter-wraps", "replay counter wrap%s");
403 p(ipcomps_input, "receive-packets", "packet%s in");
404 p(ipcomps_output, "sent-packets", "packet%s out");
405 p(ipcomps_invalid, "dropped-bad-tdb", "packet%s dropped; invalid TDB");
406 p(ipcomps_ibytes, "received-bytes", "byte%s in");
407 p(ipcomps_obytes, "sent-bytes", "byte%s out");
408 p(ipcomps_toobig, "dropped-too-large",
409 "packet%s dropped; larger than IP_MAXPACKET");
410 p(ipcomps_pdrops, "dropped-policy-violation",
411 "packet%s blocked due to policy");
412 p(ipcomps_crypto, "crypto-failure", "crypto processing failure%s");
413 hist(ipcompstat->ipcomps_hist, ipsec_compnames,
414 "COMP output", "comp-output-histogram");
415 p(ipcomps_threshold, "sent-uncompressed-small-packets",
416 "packet%s sent uncompressed; size < compr. algo. threshold");
417 p(ipcomps_uncompr, "sent-uncompressed-useless-packets",
418 "packet%s sent uncompressed; compression was useless");
419
420 #undef p
421 #undef hist
422 xo_close_container("ipcomp-statictics");
423 }
424
425 void
ipcomp_stats(u_long off,const char * name,int family __unused,int proto __unused)426 ipcomp_stats(u_long off, const char *name, int family __unused,
427 int proto __unused)
428 {
429 struct ipcompstat ipcompstat;
430
431 if (fetch_stats("net.inet.ipcomp.stats", off, &ipcompstat,
432 sizeof(ipcompstat), kread_counters) != 0)
433 return;
434
435 xo_emit("{T:/%s}:\n", name);
436
437 print_ipcompstats(&ipcompstat);
438 }
439
440 #endif /*IPSEC*/
441