#! /bin/sh
# quick look at current connections and related information
# Copyright (C) 1998, 1999  Henry Spencer.
# Copyright (C) 2012  Paul Wouters
# Copyright (C) 2015 Tuomo Soini <[email protected]>
# Copyright (C) 2018  Andrew Cagney
#
# This program is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by the
# Free Software Foundation; either version 2 of the License, or (at your
# option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
#
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
# or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
# for more details.
#

LC_ALL=C
export LC_ALL

me="ipsec look"

case "$1" in
    --help)
	echo "Usage: ipsec look"
	exit 0
	;;
    --version)
	echo "$me $IPSEC_VERSION"
	exit 0
	;;
esac

# label it just to be sure
echo "$(hostname) $(date)"

# combine spigrp and eroute
for file in /proc/net/ipsec_spigrp /proc/net/ipsec_eroute ; do
    [ -f ${file} ] && cat ${file}
done | awk '
		function pad(subnet) {
			sub("/:", "..", subnet)
			split(subnet, d, ".")
			return sprintf("%03s%03s%03s%03s%03s%04s", d[1], d[2],
							d[3], d[4], d[5], d[6])
		}
		$2 == "->" {
			printf "%s~%-18s -> %-18s => %s\n",
				(pad($1) pad($3)),
				$1, $3, (($5 in tun) ? tun[$5] : $5)
			next
		}
		$3 == "->" {
			printf "%s~%-18s -> %-18s => %s (%s)\n",
				(pad($2) pad($4)),
				$2, $4, (($6 in tun) ? tun[$6] : $6), $1
			next
		}
		{ tun[$1] = $0 }
	' | sort | sed 's/^[^~]*~//'

# tncfg (mostly as a divider line)
if [ -f /proc/net/ipsec_tncfg ]; then
    egrep -v 'NULL[ \t]+mtu=0\(0\)[ \t]+->[ \t]+0' /proc/net/ipsec_tncfg | \
	paste -d % | sed 's/%/   /g' | sed 's/ -> /->/g'
fi

# SAs
if [ -f /proc/net/ipsec_spi ]; then
    sort /proc/net/ipsec_spi
fi

# xfrm for netkey
if [ -f /proc/net/pfkey ]; then
    echo "XFRM state:"
    ip xfrm state
    echo "XFRM policy:"
    # Force the order by feeding sort with lines prefixed by '[46]
    # TYPE PRIORITY |'.
    ip -o xfrm policy | {
	# clean up the input: drop socket lines; strip trailing white
	# space (either end of line or before \\); strip double \\s
	sed -e '/socket/d' \
	    -e 's/\s*\\/\\/g' \
	    -e 's/\\\\/\\/g' \
	    -e 's/[\\]*\s*$//g'
    } | {
	# Build the '<[46]> <type> <priority> |' prefix ready for
	# sorting.  For each field, start with the assumption that the
	# value is unknown (setting it to a default), and then adjust
	# it as necessary.  For instance, for the protocol, start out
	# assuming it is '4' (IPv4) and then if the line contains a
	# ':' switch the prefix to '6' (IPv6).
	sed -e 's/^/| /' \
	    \
	    -e 's/^/0 /' \
	    -e 's/^0 \(.* priority \([0-9][0-9]*\)\)/\2 \1/' \
	    \
	    -e 's/^/0 /' \
	    -e 's/^0 \(.*:.* type \([0-9][0-9]*\)\)/\2 \1/' \
	    \
	    -e 's/^/4 /' \
	    -e 's/^4 \(.*:\)/6 \1/'
    } | {
	# sort by each of the prefixes individually, and then by the
	# rest of the line.  Shorter forms like -n and -k1,3n don't do
	# what is wanted.  XXX: Should add 'V' so .24. is before
	# .200.?
	sort -b -k1,1n -k2,2n -k3,3n -k5
    } | {
	# strip the sort prefixes
	sed -e 's/^.* | //'
    } | {
	# convert \ into line breaks
	tr '\\' '\012'
    }
    echo "XFRM done"
fi

echo IPSEC mangle TABLES
if grep -q ^mangle /proc/net/ip_tables_names 2>/dev/null; then
    iptables -n -t mangle -L IPSEC
fi
if grep -q ^mangle /proc/net/ip6_tables_names 2>/dev/null; then
    ip6tables -n -t mangle -L IPSEC
fi

echo NEW_IPSEC_CONN mangle TABLES
if grep -q ^mangle /proc/net/ip_tables_names 2>/dev/null; then
	iptables -n -t mangle -L NEW_IPSEC_CONN
fi
if grep -q ^mangle /proc/net/ip6_tables_names 2>/dev/null; then
	ip6tables -n -t mangle -L NEW_IPSEC_CONN
fi

echo ROUTING TABLES
ip -4 route
ip -6 route

if [ -f /etc/ipsec.d/cert9.db ]; then
    echo NSS_CERTIFICATES
    certutil -L -d sql:/etc/ipsec.d | head -4
    certutil -L -d sql:/etc/ipsec.d | \
	egrep -v '^NSS_CERTIFICATES|^$|Trust Attributes|MIME,' | LC_ALL=C sort
elif [ -f /etc/ipsec.d/cert8.db ]; then
    echo NSS_CERTIFICATES
    certutil -L -d /etc/ipsec.d | head -4
    certutil -L -d /etc/ipsec.d | \
	egrep -v '^NSS_CERTIFICATES|^$|Trust Attributes|MIME,' | LC_ALL=C sort
fi