/usr/lib/ipsec/look is in libreswan 3.23-4.
This file is owned by root:root, with mode 0o755.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 | #! /bin/sh
# quick look at current connections and related information
# Copyright (C) 1998, 1999 Henry Spencer.
# Copyright (C) 2012 Paul Wouters
# Copyright (C) 2015 Tuomo Soini <tis@foobar.fi>
#
# This program is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by the
# Free Software Foundation; either version 2 of the License, or (at your
# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
#
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
# for more details.
#
LC_ALL=C
export LC_ALL
me="ipsec look"
case "$1" in
--help)
echo "Usage: ipsec look"
exit 0
;;
--version)
echo "$me $IPSEC_VERSION"
exit 0
;;
esac
# label it just to be sure
echo "$(hostname) $(date)"
# combine spigrp and eroute
for file in /proc/net/ipsec_spigrp /proc/net/ipsec_eroute ; do
[ -f ${file} ] && cat ${file}
done | awk '
function pad(subnet) {
sub("/:", "..", subnet)
split(subnet, d, ".")
return sprintf("%03s%03s%03s%03s%03s%04s", d[1], d[2],
d[3], d[4], d[5], d[6])
}
$2 == "->" {
printf "%s~%-18s -> %-18s => %s\n",
(pad($1) pad($3)),
$1, $3, (($5 in tun) ? tun[$5] : $5)
next
}
$3 == "->" {
printf "%s~%-18s -> %-18s => %s (%s)\n",
(pad($2) pad($4)),
$2, $4, (($6 in tun) ? tun[$6] : $6), $1
next
}
{ tun[$1] = $0 }
' | sort | sed 's/^[^~]*~//'
# tncfg (mostly as a divider line)
if [ -f /proc/net/ipsec_tncfg ]; then
egrep -v 'NULL[ \t]+mtu=0\(0\)[ \t]+->[ \t]+0' /proc/net/ipsec_tncfg | \
paste -d % | sed 's/%/ /g' | sed 's/ -> /->/g'
fi
# SAs
if [ -f /proc/net/ipsec_spi ]; then
sort /proc/net/ipsec_spi
fi
# xfrm for netkey
if [ -f /proc/net/pfkey ]; then
echo "XFRM state:"
ip xfrm state
echo "XFRM policy:"
ip -o xfrm policy |grep -v "socket" | sort | tr '\\' '\012' | sed '/^\s*$/d'
echo "XFRM done"
fi
echo IPSEC mangle TABLES
if grep -q ^mangle /proc/net/ip_tables_names 2>/dev/null; then
iptables -n -t mangle -L IPSEC
fi
if grep -q ^mangle /proc/net/ip6_tables_names 2>/dev/null; then
ip6tables -n -t mangle -L IPSEC
fi
echo NEW_IPSEC_CONN mangle TABLES
if grep -q ^mangle /proc/net/ip_tables_names 2>/dev/null; then
iptables -n -t mangle -L NEW_IPSEC_CONN
fi
if grep -q ^mangle /proc/net/ip6_tables_names 2>/dev/null; then
ip6tables -n -t mangle -L NEW_IPSEC_CONN
fi
echo ROUTING TABLES
ip -4 route
ip -6 route
if [ -f /var/lib/ipsec/nss/cert9.db ]; then
echo NSS_CERTIFICATES
certutil -L -d sql:/var/lib/ipsec/nss | head -4
certutil -L -d sql:/var/lib/ipsec/nss | \
egrep -v '^NSS_CERTIFICATES|^$|Trust Attributes|MIME,' | LC_ALL=C sort
elif [ -f /var/lib/ipsec/nss/cert8.db ]; then
echo NSS_CERTIFICATES
certutil -L -d /var/lib/ipsec/nss | head -4
certutil -L -d /var/lib/ipsec/nss | \
egrep -v '^NSS_CERTIFICATES|^$|Trust Attributes|MIME,' | LC_ALL=C sort
fi
|