This file is indexed.

/usr/lib/ipsec/look is in libreswan 3.23-4.

This file is owned by root:root, with mode 0o755.

The actual contents of the file can be viewed below.

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
#! /bin/sh
# quick look at current connections and related information
# Copyright (C) 1998, 1999  Henry Spencer.
# Copyright (C) 2012  Paul Wouters
# Copyright (C) 2015 Tuomo Soini <tis@foobar.fi>
#
# This program is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by the
# Free Software Foundation; either version 2 of the License, or (at your
# option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
#
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
# or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
# for more details.
#

LC_ALL=C
export LC_ALL

me="ipsec look"

case "$1" in
    --help)
	echo "Usage: ipsec look"
	exit 0
	;;
    --version)
	echo "$me $IPSEC_VERSION"
	exit 0
	;;
esac

# label it just to be sure
echo "$(hostname) $(date)"

# combine spigrp and eroute
for file in /proc/net/ipsec_spigrp /proc/net/ipsec_eroute ; do
    [ -f ${file} ] && cat ${file}
done | awk '
		function pad(subnet) {
			sub("/:", "..", subnet)
			split(subnet, d, ".")
			return sprintf("%03s%03s%03s%03s%03s%04s", d[1], d[2],
							d[3], d[4], d[5], d[6])
		}
		$2 == "->" {
			printf "%s~%-18s -> %-18s => %s\n",
				(pad($1) pad($3)),
				$1, $3, (($5 in tun) ? tun[$5] : $5)
			next
		}
		$3 == "->" {
			printf "%s~%-18s -> %-18s => %s (%s)\n",
				(pad($2) pad($4)),
				$2, $4, (($6 in tun) ? tun[$6] : $6), $1
			next
		}
		{ tun[$1] = $0 }
	' | sort | sed 's/^[^~]*~//'

# tncfg (mostly as a divider line)
if [ -f /proc/net/ipsec_tncfg ]; then
    egrep -v 'NULL[ \t]+mtu=0\(0\)[ \t]+->[ \t]+0' /proc/net/ipsec_tncfg | \
	paste -d % | sed 's/%/   /g' | sed 's/ -> /->/g'
fi

# SAs
if [ -f /proc/net/ipsec_spi ]; then
    sort /proc/net/ipsec_spi
fi

# xfrm for netkey
if [ -f /proc/net/pfkey ]; then
    echo "XFRM state:"
    ip xfrm state
    echo "XFRM policy:"
    ip -o xfrm policy |grep -v "socket" | sort | tr '\\' '\012' | sed '/^\s*$/d'
    echo "XFRM done"
fi

echo IPSEC mangle TABLES
if grep -q ^mangle /proc/net/ip_tables_names 2>/dev/null; then
    iptables -n -t mangle -L IPSEC
fi
if grep -q ^mangle /proc/net/ip6_tables_names 2>/dev/null; then
    ip6tables -n -t mangle -L IPSEC
fi

echo NEW_IPSEC_CONN mangle TABLES
if grep -q ^mangle /proc/net/ip_tables_names 2>/dev/null; then
	iptables -n -t mangle -L NEW_IPSEC_CONN
fi
if grep -q ^mangle /proc/net/ip6_tables_names 2>/dev/null; then
	ip6tables -n -t mangle -L NEW_IPSEC_CONN
fi

echo ROUTING TABLES
ip -4 route
ip -6 route

if [ -f /var/lib/ipsec/nss/cert9.db ]; then
    echo NSS_CERTIFICATES
    certutil -L -d sql:/var/lib/ipsec/nss | head -4
    certutil -L -d sql:/var/lib/ipsec/nss | \
	egrep -v '^NSS_CERTIFICATES|^$|Trust Attributes|MIME,' | LC_ALL=C sort
elif [ -f /var/lib/ipsec/nss/cert8.db ]; then
    echo NSS_CERTIFICATES
    certutil -L -d /var/lib/ipsec/nss | head -4
    certutil -L -d /var/lib/ipsec/nss | \
	egrep -v '^NSS_CERTIFICATES|^$|Trust Attributes|MIME,' | LC_ALL=C sort
fi