3384154590
This work was based on kame-20010528-freebsd43-snap.tgz and some
critical problem after the snap was out were fixed.
There are many many changes since last KAME merge.
TODO:
- The definitions of SADB_* in sys/net/pfkeyv2.h are still different
from RFC2407/IANA assignment because of binary compatibility
issue. It should be fixed under 5-CURRENT.
- ip6po_m member of struct ip6_pktopts is no longer used. But, it
is still there because of binary compatibility issue. It should
be removed under 5-CURRENT.
Reviewed by: itojun
Obtained from: KAME
MFC after: 3 weeks
57 lines
1.2 KiB
Perl
57 lines
1.2 KiB
Perl
#! @LOCALPREFIX@/bin/perl
|
|
# $FreeBSD$
|
|
|
|
if ($< != 0) {
|
|
print STDERR "must be root to invoke this\n";
|
|
exit 1;
|
|
}
|
|
|
|
$mode = 'add';
|
|
while ($i = shift @ARGV) {
|
|
if ($i eq '-d') {
|
|
$mode = 'delete';
|
|
} else {
|
|
print STDERR "usage: scriptdump [-d]\n";
|
|
exit 1;
|
|
}
|
|
}
|
|
|
|
open(IN, "setkey -D |") || die;
|
|
foreach $_ (<IN>) {
|
|
if (/^[^\t]/) {
|
|
($src, $dst) = split(/\s+/, $_);
|
|
} elsif (/^\t(esp|ah) mode=(\S+) spi=(\d+).*reqid=(\d+)/) {
|
|
($proto, $ipsecmode, $spi, $reqid) = ($1, $2, $3, $4);
|
|
} elsif (/^\tE: (\S+) (.*)/) {
|
|
$ealgo = $1;
|
|
$ekey = $2;
|
|
$ekey =~ s/\s//g;
|
|
$ekey =~ s/^/0x/g;
|
|
} elsif (/^\tA: (\S+) (.*)/) {
|
|
$aalgo = $1;
|
|
$akey = $2;
|
|
$akey =~ s/\s//g;
|
|
$akey =~ s/^/0x/g;
|
|
} elsif (/^\treplay=(\d+) flags=(0x\d+) state=/) {
|
|
print "$mode $src $dst $proto $spi";
|
|
$replay = $1;
|
|
print " -u $reqid" if $reqid;
|
|
if ($mode eq 'add') {
|
|
print " -m $ipsecmode -r $replay" if $replay;
|
|
if ($proto eq 'esp') {
|
|
print " -E $ealgo $ekey" if $ealgo;
|
|
print " -A $aalgo $akey" if $aalgo;
|
|
} elsif ($proto eq 'ah') {
|
|
print " -A $aalgo $akey" if $aalgo;
|
|
}
|
|
}
|
|
print ";\n";
|
|
|
|
$src = $dst = $upper = $proxy = '';
|
|
$ealgo = $ekey = $aalgo = $akey = '';
|
|
}
|
|
}
|
|
close(IN);
|
|
|
|
exit 0;
|