1 /* $FreeBSD: src/lib/libipsec/ipsec_dump_policy.c,v 1.1.2.1 2000/07/15 07:24:04 kris Exp $ */
2 /* $DragonFly: src/lib/libipsec/ipsec_dump_policy.c,v 1.3 2003/11/12 20:21:30 eirikn Exp $ */
3 /* $KAME: ipsec_dump_policy.c,v 1.11 2000/05/07 05:29:47 itojun Exp $ */
6 * Copyright (C) 1995, 1996, 1997, 1998, and 1999 WIDE Project.
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the project nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 #include <sys/types.h>
35 #include <sys/param.h>
36 #include <sys/socket.h>
38 #include <netkey/key_var.h>
39 #include <netinet/in.h>
40 #include <netinet6/ipsec.h>
42 #include <arpa/inet.h>
49 #include "ipsec_strerror.h"
51 static const char *ipsp_dir_strs
[] = {
55 static const char *ipsp_policy_strs
[] = {
56 "discard", "none", "ipsec", "entrust", "bypass",
59 static char *ipsec_dump_ipsecrequest (char *, size_t,
60 struct sadb_x_ipsecrequest
*, size_t);
61 static int set_addresses (char *, size_t, struct sockaddr
*,
63 static char *set_address (char *, size_t, struct sockaddr
*);
66 * policy is sadb_x_policy buffer.
67 * Must call free() later.
68 * When delimiter == NULL, alternatively ' '(space) is applied.
71 ipsec_dump_policy(policy
, delimiter
)
75 struct sadb_x_policy
*xpl
= (struct sadb_x_policy
*)policy
;
76 struct sadb_x_ipsecrequest
*xisr
;
85 if (xpl
->sadb_x_policy_exttype
!= SADB_X_EXT_POLICY
) {
86 __ipsec_errcode
= EIPSEC_INVAL_EXTTYPE
;
91 if (delimiter
== NULL
)
94 switch (xpl
->sadb_x_policy_dir
) {
96 case IPSEC_DIR_INBOUND
:
97 case IPSEC_DIR_OUTBOUND
:
100 __ipsec_errcode
= EIPSEC_INVAL_DIR
;
104 switch (xpl
->sadb_x_policy_type
) {
105 case IPSEC_POLICY_DISCARD
:
106 case IPSEC_POLICY_NONE
:
107 case IPSEC_POLICY_IPSEC
:
108 case IPSEC_POLICY_BYPASS
:
109 case IPSEC_POLICY_ENTRUST
:
112 __ipsec_errcode
= EIPSEC_INVAL_POLICY
;
116 buflen
= strlen(ipsp_dir_strs
[xpl
->sadb_x_policy_dir
])
118 + strlen(ipsp_policy_strs
[xpl
->sadb_x_policy_type
])
121 if ((buf
= malloc(buflen
)) == NULL
) {
122 __ipsec_errcode
= EIPSEC_NO_BUFS
;
125 snprintf(buf
, buflen
, "%s %s", ipsp_dir_strs
[xpl
->sadb_x_policy_dir
],
126 ipsp_policy_strs
[xpl
->sadb_x_policy_type
]);
128 if (xpl
->sadb_x_policy_type
!= IPSEC_POLICY_IPSEC
) {
129 __ipsec_errcode
= EIPSEC_NO_ERROR
;
133 /* count length of buffer for use */
135 while (off
< PFKEY_EXTLEN(xpl
)) {
136 xisr
= (struct sadb_x_ipsecrequest
*)((caddr_t
)xpl
+ off
);
137 off
+= xisr
->sadb_x_ipsecrequest_len
;
141 if (off
!= PFKEY_EXTLEN(xpl
)) {
142 __ipsec_errcode
= EIPSEC_INVAL_SADBMSG
;
148 while (off
< PFKEY_EXTLEN(xpl
)) {
149 xisr
= (struct sadb_x_ipsecrequest
*)((caddr_t
)xpl
+ off
);
151 if (ipsec_dump_ipsecrequest(isrbuf
, sizeof(isrbuf
), xisr
,
152 PFKEY_EXTLEN(xpl
) - off
) == NULL
) {
157 buflen
= strlen(buf
) + strlen(delimiter
) + strlen(isrbuf
) + 1;
158 newbuf
= (char *)realloc(buf
, buflen
);
159 if (newbuf
== NULL
) {
160 __ipsec_errcode
= EIPSEC_NO_BUFS
;
165 snprintf(buf
, buflen
, "%s%s%s", buf
, delimiter
, isrbuf
);
167 off
+= xisr
->sadb_x_ipsecrequest_len
;
170 __ipsec_errcode
= EIPSEC_NO_ERROR
;
175 ipsec_dump_ipsecrequest(buf
, len
, xisr
, bound
)
178 struct sadb_x_ipsecrequest
*xisr
;
179 size_t bound
; /* boundary */
181 const char *proto
, *mode
, *level
;
182 char abuf
[NI_MAXHOST
* 2 + 2];
184 if (xisr
->sadb_x_ipsecrequest_len
> bound
) {
185 __ipsec_errcode
= EIPSEC_INVAL_PROTO
;
189 switch (xisr
->sadb_x_ipsecrequest_proto
) {
200 __ipsec_errcode
= EIPSEC_INVAL_PROTO
;
204 switch (xisr
->sadb_x_ipsecrequest_mode
) {
208 case IPSEC_MODE_TRANSPORT
:
211 case IPSEC_MODE_TUNNEL
:
215 __ipsec_errcode
= EIPSEC_INVAL_MODE
;
220 if (xisr
->sadb_x_ipsecrequest_len
> sizeof(*xisr
)) {
221 struct sockaddr
*sa1
, *sa2
;
224 p
= (caddr_t
)(xisr
+ 1);
225 sa1
= (struct sockaddr
*)p
;
226 sa2
= (struct sockaddr
*)(p
+ sa1
->sa_len
);
227 if (sizeof(*xisr
) + sa1
->sa_len
+ sa2
->sa_len
!=
228 xisr
->sadb_x_ipsecrequest_len
) {
229 __ipsec_errcode
= EIPSEC_INVAL_ADDRESS
;
232 if (set_addresses(abuf
, sizeof(abuf
), sa1
, sa2
) != 0) {
233 __ipsec_errcode
= EIPSEC_INVAL_ADDRESS
;
238 switch (xisr
->sadb_x_ipsecrequest_level
) {
239 case IPSEC_LEVEL_DEFAULT
:
242 case IPSEC_LEVEL_USE
:
245 case IPSEC_LEVEL_REQUIRE
:
248 case IPSEC_LEVEL_UNIQUE
:
252 __ipsec_errcode
= EIPSEC_INVAL_LEVEL
;
256 if (xisr
->sadb_x_ipsecrequest_reqid
== 0)
257 snprintf(buf
, len
, "%s/%s/%s/%s", proto
, mode
, abuf
, level
);
261 if (xisr
->sadb_x_ipsecrequest_reqid
> IPSEC_MANUAL_REQID_MAX
)
265 snprintf(buf
, len
, "%s/%s/%s/%s%c%d", proto
, mode
, abuf
, level
,
266 ch
, xisr
->sadb_x_ipsecrequest_reqid
);
273 set_addresses(buf
, len
, sa1
, sa2
)
276 struct sockaddr
*sa1
;
277 struct sockaddr
*sa2
;
279 char tmp1
[NI_MAXHOST
], tmp2
[NI_MAXHOST
];
281 if (set_address(tmp1
, sizeof(tmp1
), sa1
) == NULL
||
282 set_address(tmp2
, sizeof(tmp2
), sa2
) == NULL
)
284 if (strlen(tmp1
) + 1 + strlen(tmp2
) + 1 > len
)
286 snprintf(buf
, len
, "%s-%s", tmp1
, tmp2
);
291 set_address(buf
, len
, sa
)
296 #ifdef NI_WITHSCOPEID
297 const int niflags
= NI_NUMERICHOST
| NI_WITHSCOPEID
;
299 const int niflags
= NI_NUMERICHOST
;
305 if (getnameinfo(sa
, sa
->sa_len
, buf
, len
, NULL
, 0, niflags
) != 0)