Moving netstat from kvm snooping to retrieving the routing tables via

sysctl. Most code is stolen from route -- which was stolen from netstat.
kvm snooping code is still in and useable. Put it in deraadt@ henning@

8 files changed, 1048 insertions, 674 deletions

diff --git a/usr.bin/netstat/Makefile b/usr.bin/netstat/Makefile
index 548e1614531..37cc08f4828 100644
--- a/usr.bin/netstat/Makefile
+++ b/usr.bin/netstat/Makefile
@@ -1,8 +1,8 @@
-#	$OpenBSD: Makefile,v 1.16 2005/06/08 04:47:03 henning Exp $
+#	$OpenBSD: Makefile,v 1.17 2006/05/27 19:16:37 claudio Exp $
 
 PROG=	netstat
 SRCS=	if.c inet.c inet6.c ipx.c main.c mbuf.c mroute.c route.c \
-	unix.c atalk.c mroute6.c net80211.c
+	unix.c atalk.c mroute6.c net80211.c show.c
 BINGRP=	kmem
 BINMODE=2555
 LDADD=	-lkvm
diff --git a/usr.bin/netstat/if.c b/usr.bin/netstat/if.c
index b3ec560d8ea..10bc7c18516 100644
--- a/usr.bin/netstat/if.c
+++ b/usr.bin/netstat/if.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if.c,v 1.46 2005/12/11 17:25:03 deraadt Exp $	*/
+/*	$OpenBSD: if.c,v 1.47 2006/05/27 19:16:37 claudio Exp $	*/
 /*	$NetBSD: if.c,v 1.16.4.2 1996/06/07 21:46:46 thorpej Exp $	*/
 
 /*
@@ -34,7 +34,7 @@
 #if 0
 static char sccsid[] = "from: @(#)if.c	8.2 (Berkeley) 2/21/94";
 #else
-static char *rcsid = "$OpenBSD: if.c,v 1.46 2005/12/11 17:25:03 deraadt Exp $";
+static char *rcsid = "$OpenBSD: if.c,v 1.47 2006/05/27 19:16:37 claudio Exp $";
 #endif
 #endif /* not lint */
 
@@ -183,10 +183,10 @@ intpr(int interval, u_long ifnetaddr)
 				 */
 				in = inet_makeaddr(ifaddr.in.ia_subnet,
 				    INADDR_ANY);
-				cp = netname(in.s_addr,
+				cp = netname4(in.s_addr,
 				    ifaddr.in.ia_subnetmask);
 #else
-				cp = netname(ifaddr.in.ia_subnet,
+				cp = netname4(ifaddr.in.ia_subnet,
 				    ifaddr.in.ia_subnetmask);
 #endif
 				if (vflag)
@@ -194,7 +194,7 @@ intpr(int interval, u_long ifnetaddr)
 				else
 					n = 11;
 				printf("%-*.*s ", n, n, cp);
-				cp = routename(sin->sin_addr.s_addr);
+				cp = routename4(sin->sin_addr.s_addr);
 				if (vflag)
 					n = strlen(cp) < 17 ? 17 : strlen(cp);
 				else
@@ -209,7 +209,7 @@ intpr(int interval, u_long ifnetaddr)
 					while (multiaddr != 0) {
 						kread(multiaddr, &inm, sizeof inm);
 						printf("\n%25s %-17.17s ", "",
-						    routename(inm.inm_addr.s_addr));
+						    routename4(inm.inm_addr.s_addr));
 						multiaddr = (u_long)LIST_NEXT(&inm, inm_list);
 					}
 				}
@@ -227,7 +227,7 @@ intpr(int interval, u_long ifnetaddr)
 				}
 #endif
 				cp = netname6(&ifaddr.in6.ia_addr,
-				    &ifaddr.in6.ia_prefixmask.sin6_addr);
+				    &ifaddr.in6.ia_prefixmask);
 				if (vflag)
 					n = strlen(cp) < 11 ? 11 : strlen(cp);
 				else
@@ -551,3 +551,40 @@ catchalarm(int signo)
 {
 	signalled = YES;
 }
+
+void
+upHex(char *p0)
+{
+	char *p = p0;
+
+	for (; *p; p++)
+		switch (*p) {
+		case 'a':
+		case 'b':
+		case 'c':
+		case 'd':
+		case 'e':
+		case 'f':
+			*p += ('A' - 'a');
+			break;
+	}
+}
+
+char *
+ipx_phost(struct sockaddr *sa)
+{
+	struct sockaddr_ipx *sipx = (struct sockaddr_ipx *)sa;
+	struct sockaddr_ipx work;
+	static union ipx_net ipx_zeronet;
+	char *p;
+
+	work = *sipx;
+	work.sipx_addr.ipx_port = 0;
+	work.sipx_addr.ipx_net = ipx_zeronet;
+
+	p = ipx_print((struct sockaddr *)&work);
+	if (strncmp("0H.", p, 3) == 0)
+		p += 3;
+	return(p);
+}
+
diff --git a/usr.bin/netstat/ipx.c b/usr.bin/netstat/ipx.c
index 6c5e1b57d06..dd622f9ff18 100644
--- a/usr.bin/netstat/ipx.c
+++ b/usr.bin/netstat/ipx.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ipx.c,v 1.18 2005/10/17 19:09:36 otto Exp $	*/
+/*	$OpenBSD: ipx.c,v 1.19 2006/05/27 19:16:37 claudio Exp $	*/
 
 /*
  * Copyright (c) 1996 Michael Shalayeff
@@ -34,7 +34,7 @@
 #if 0
 static char sccsid[] = "from: @(#)ns.c	8.1 (Berkeley) 6/6/93";
 #else
-static char *rcsid = "$OpenBSD: ipx.c,v 1.18 2005/10/17 19:09:36 otto Exp $";
+static char *rcsid = "$OpenBSD: ipx.c,v 1.19 2006/05/27 19:16:37 claudio Exp $";
 #endif
 #endif /* not lint */
 
@@ -66,6 +66,7 @@ static char *rcsid = "$OpenBSD: ipx.c,v 1.18 2005/10/17 19:09:36 otto Exp $";
 #include <errno.h>
 #include <stdio.h>
 #include <string.h>
+
 #include "netstat.h"
 
 struct	ipxpcb ipxpcb;
diff --git a/usr.bin/netstat/main.c b/usr.bin/netstat/main.c
index bc69a48afa4..d743d41c3b6 100644
--- a/usr.bin/netstat/main.c
+++ b/usr.bin/netstat/main.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: main.c,v 1.61 2005/07/04 01:54:10 djm Exp $	*/
+/*	$OpenBSD: main.c,v 1.62 2006/05/27 19:16:37 claudio Exp $	*/
 /*	$NetBSD: main.c,v 1.9 1996/05/07 02:55:02 thorpej Exp $	*/
 
 /*
@@ -40,7 +40,7 @@ char copyright[] =
 #if 0
 static char sccsid[] = "from: @(#)main.c	8.4 (Berkeley) 3/1/94";
 #else
-static char *rcsid = "$OpenBSD: main.c,v 1.61 2005/07/04 01:54:10 djm Exp $";
+static char *rcsid = "$OpenBSD: main.c,v 1.62 2006/05/27 19:16:37 claudio Exp $";
 #endif
 #endif /* not lint */
 
@@ -396,7 +396,16 @@ main(int argc, char *argv[])
 	if (nlistf != NULL || memf != NULL || Pflag)
 		if (setresgid(gid, gid, gid) == -1)
 			err(1, "setresgid");
-
+	if (nlistf == NULL && memf == NULL && rflag && !Aflag) {
+		/* printing the routing table no longer needs kvm */
+		if (setresgid(gid, gid, gid) == -1)
+			err(1, "setresgid");
+		if (sflag)
+			rt_stats(1, 0);
+		else
+			p_rttables(af);
+		exit(0);
+	}
 	if ((kvmd = kvm_openfiles(nlistf, memf, NULL, O_RDONLY,
 	    buf)) == NULL) {
 		fprintf(stderr, "%s: kvm_open: %s\n", __progname, buf);
@@ -466,7 +475,7 @@ main(int argc, char *argv[])
 	}
 	if (rflag) {
 		if (sflag)
-			rt_stats(nl[N_RTSTAT].n_value);
+			rt_stats(0, nl[N_RTSTAT].n_value);
 		else
 			routepr(nl[N_RTREE].n_value);
 		exit(0);
diff --git a/usr.bin/netstat/mroute.c b/usr.bin/netstat/mroute.c
index bd60dd9bc32..200d70cacb2 100644
--- a/usr.bin/netstat/mroute.c
+++ b/usr.bin/netstat/mroute.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: mroute.c,v 1.15 2005/10/17 19:09:36 otto Exp $	*/
+/*	$OpenBSD: mroute.c,v 1.16 2006/05/27 19:16:37 claudio Exp $	*/
 /*	$NetBSD: mroute.c,v 1.10 1996/05/11 13:51:27 mycroft Exp $	*/
 
 /*
@@ -151,9 +151,9 @@ mroutepr(u_long mrpaddr, u_long mfchashtbladdr, u_long mfchashaddr, u_long vifad
 
 		printf(" %3u     %3u  %5u  %-15.15s",
 		    vifi, v->v_threshold, v->v_rate_limit,
-		    routename(v->v_lcl_addr.s_addr));
+		    routename4(v->v_lcl_addr.s_addr));
 		printf("  %-15.15s  %6lu  %7lu\n", (v->v_flags & VIFF_TUNNEL) ?
-		    routename(v->v_rmt_addr.s_addr) : "",
+		    routename4(v->v_rmt_addr.s_addr) : "",
 		    v->v_pkt_in, v->v_pkt_out);
 	}
 	if (!banner_printed)
@@ -178,9 +178,9 @@ mroutepr(u_long mrpaddr, u_long mfchashtbladdr, u_long mfchashaddr, u_long vifad
 
 				kread((u_long)mfcp, &mfc, sizeof(mfc));
 				printf("  %3u  %-15.15s",
-				    i, routename(mfc.mfc_origin.s_addr));
+				    i, routename4(mfc.mfc_origin.s_addr));
 				printf("  %-15.15s  %7s     %3u ",
-				    routename(mfc.mfc_mcastgrp.s_addr),
+				    routename4(mfc.mfc_mcastgrp.s_addr),
 				    pktscale(mfc.mfc_pkt_cnt), mfc.mfc_parent);
 				for (vifi = 0; vifi <= numvifs; ++vifi)
 					if (mfc.mfc_ttls[vifi])
diff --git a/usr.bin/netstat/netstat.h b/usr.bin/netstat/netstat.h
index a3d3f5c7351..7a1c370737c 100644
--- a/usr.bin/netstat/netstat.h
+++ b/usr.bin/netstat/netstat.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: netstat.h,v 1.35 2005/06/15 10:53:23 markus Exp $	*/
+/*	$OpenBSD: netstat.h,v 1.36 2006/05/27 19:16:37 claudio Exp $	*/
 /*	$NetBSD: netstat.h,v 1.6 1996/05/07 02:55:05 thorpej Exp $	*/
 
 /*
@@ -96,10 +96,10 @@ void	impstats(u_long, u_long);
 
 void	intpr(int, u_long);
 
-void	pr_rthdr(int);
+void	rt_stats(int, u_long);
+void	pr_rthdr(int, int);
 void	pr_encaphdr(void);
 void	pr_family(int);
-void	rt_stats(u_long);
 char	*ns_phost(struct sockaddr *);
 char	*ipx_phost(struct sockaddr *);
 void	upHex(char *);
@@ -117,12 +117,18 @@ void	rip6_stats(u_long, char *);
 void	mroute6pr(u_long, u_long, u_long);
 void	mrt6_stats(u_long, u_long);
 char	*routename6(struct sockaddr_in6 *);
-char	*netname6(struct sockaddr_in6 *, struct in6_addr *);
+char	*netname6(struct sockaddr_in6 *, struct sockaddr_in6 *);
 #endif /*INET6*/
 
-char	*routename(in_addr_t);
-char	*netname(in_addr_t, in_addr_t);
-char	*ns_print(struct sockaddr *);
+void	p_rttables(int);
+void	p_flags(int, char *);
+void	p_addr(struct sockaddr *, struct sockaddr *, int);
+void	p_gwaddr(struct sockaddr *, int);
+void	p_sockaddr(struct sockaddr *, struct sockaddr *, int, int);
+char	*routename(struct sockaddr *);
+char	*routename4(in_addr_t);
+char	*netname(struct sockaddr *, struct sockaddr *);
+char	*netname4(in_addr_t, in_addr_t);
 char	*ipx_print(struct sockaddr *);
 void	routepr(u_long);
 
diff --git a/usr.bin/netstat/route.c b/usr.bin/netstat/route.c
index 07515b1434a..86072fd2756 100644
--- a/usr.bin/netstat/route.c
+++ b/usr.bin/netstat/route.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: route.c,v 1.71 2006/04/12 09:24:44 hshoexer Exp $	*/
+/*	$OpenBSD: route.c,v 1.72 2006/05/27 19:16:37 claudio Exp $	*/
 /*	$NetBSD: route.c,v 1.15 1996/05/07 02:55:06 thorpej Exp $	*/
 
 /*
@@ -34,7 +34,7 @@
 #if 0
 static char sccsid[] = "from: @(#)route.c	8.3 (Berkeley) 3/9/94";
 #else
-static char *rcsid = "$OpenBSD: route.c,v 1.71 2006/04/12 09:24:44 hshoexer Exp $";
+static char *rcsid = "$OpenBSD: route.c,v 1.72 2006/05/27 19:16:37 claudio Exp $";
 #endif
 #endif /* not lint */
 
@@ -52,14 +52,8 @@ static char *rcsid = "$OpenBSD: route.c,v 1.71 2006/04/12 09:24:44 hshoexer Exp
 #include <netinet/in.h>
 #include <arpa/inet.h>
 
-#include <netipx/ipx.h>
-
-#include <netatalk/at.h>
-
 #include <sys/sysctl.h>
 
-#include <arpa/inet.h>
-
 #include <err.h>
 #include <limits.h>
 #include <netdb.h>
@@ -84,33 +78,6 @@ static char *rcsid = "$OpenBSD: route.c,v 1.71 2006/04/12 09:24:44 hshoexer Exp
 
 struct radix_node_head *rt_tables[AF_MAX+1];
 
-/*
- * Definitions for showing gateway flags.
- */
-struct bits {
-	int	b_mask;
-	char	b_val;
-} bits[] = {
-	{ RTF_UP,	'U' },
-	{ RTF_GATEWAY,	'G' },
-	{ RTF_HOST,	'H' },
-	{ RTF_REJECT,	'R' },
-	{ RTF_BLACKHOLE, 'B' },
-	{ RTF_DYNAMIC,	'D' },
-	{ RTF_MODIFIED,	'M' },
-	{ RTF_DONE,	'd' }, /* Completed -- for routing messages only */
-	{ RTF_MASK,	'm' }, /* Mask Present -- for routing messages only */
-	{ RTF_CLONING,	'C' },
-	{ RTF_XRESOLVE,	'X' },
-	{ RTF_LLINFO,	'L' },
-	{ RTF_STATIC,	'S' },
-	{ RTF_PROTO1,	'1' },
-	{ RTF_PROTO2,	'2' },
-	{ RTF_PROTO3,	'3' },
-	{ RTF_CLONED,	'c' },
-	{ 0 }
-};
-
 static union {
 	struct		sockaddr u_sa;
 	u_int32_t	u_data[64];
@@ -122,17 +89,11 @@ struct	rtentry rtentry;
 struct	radix_node rnode;
 struct	radix_mask rmask;
 
-int	NewTree = 0;
-
 static struct sockaddr *kgetsa(struct sockaddr *);
 static void p_tree(struct radix_node *);
 static void p_rtnode(void);
 static void p_rtflags(u_char);
-static void ntreestuff(void);
-static void np_rtentry(struct rt_msghdr *);
-static void p_sockaddr(struct sockaddr *, struct sockaddr *, int, int);
-static void p_flags(int, char *);
-static void p_rtentry(struct rtentry *);
+static void p_krtentry(struct rtentry *);
 static void encap_print(struct rtentry *);
 
 /*
@@ -146,118 +107,30 @@ routepr(u_long rtree)
 
 	printf("Routing tables\n");
 
-	if (Aflag == 0 && NewTree)
-		ntreestuff();
-	else {
-		if (rtree == 0) {
-			printf("rt_tables: symbol not in namelist\n");
-			return;
-		}
+	if (rtree == 0) {
+		printf("rt_tables: symbol not in namelist\n");
+		return;
+	}
 
-		kget(rtree, rt_tables);
-		for (i = 0; i <= AF_MAX; i++) {
-			if ((rnh = rt_tables[i]) == 0)
-				continue;
-			kget(rnh, head);
-			if (i == AF_UNSPEC) {
-				if (Aflag && af == 0) {
-					printf("Netmasks:\n");
-					p_tree(head.rnh_treetop);
-				}
-			} else if (af == AF_UNSPEC || af == i) {
-				pr_family(i);
-				do_rtent = 1;
-				if (i != PF_KEY)
-					pr_rthdr(i);
-				else
-					pr_encaphdr();
+	kget(rtree, rt_tables);
+	for (i = 0; i <= AF_MAX; i++) {
+		if ((rnh = rt_tables[i]) == 0)
+			continue;
+		kget(rnh, head);
+		if (i == AF_UNSPEC) {
+			if (Aflag && (af == 0 || af == 0xff)) {
+				printf("Netmasks:\n");
 				p_tree(head.rnh_treetop);
 			}
+		} else if (af == AF_UNSPEC || af == i) {
+			pr_family(i);
+			do_rtent = 1;
+			pr_rthdr(i, Aflag);
+			p_tree(head.rnh_treetop);
 		}
 	}
 }
 
-/*
- * Print address family header before a section of the routing table.
- */
-void
-pr_family(int af)
-{
-	char *afname;
-
-	switch (af) {
-	case AF_INET:
-		afname = "Internet";
-		break;
-#ifdef INET6
-	case AF_INET6:
-		afname = "Internet6";
-		break;
-#endif
-	case AF_IPX:
-		afname = "IPX";
-		break;
-	case PF_KEY:
-		afname = "Encap";
-		break;
-	case AF_APPLETALK:
-		afname = "AppleTalk";
-		break;
-	default:
-		afname = NULL;
-		break;
-	}
-	if (afname)
-		printf("\n%s:\n", afname);
-	else
-		printf("\nProtocol Family %d:\n", af);
-}
-
-/* column widths; each followed by one space */
-#ifndef INET6
-#define	WID_DST(af)	18	/* width of destination column */
-#define	WID_GW(af)	18	/* width of gateway column */
-#else
-/* width of destination/gateway column */
-#if 1
-/* strlen("fe80::aaaa:bbbb:cccc:dddd@gif0") == 30, strlen("/128") == 4 */
-#define	WID_DST(af)	((af) == AF_INET6 ? (nflag ? 34 : 18) : 18)
-#define	WID_GW(af)	((af) == AF_INET6 ? (nflag ? 30 : 18) : 18)
-#else
-/* strlen("fe80::aaaa:bbbb:cccc:dddd") == 25, strlen("/128") == 4 */
-#define	WID_DST(af)	((af) == AF_INET6 ? (nflag ? 29 : 18) : 18)
-#define	WID_GW(af)	((af) == AF_INET6 ? (nflag ? 25 : 18) : 18)
-#endif
-#endif /* INET6 */
-
-/*
- * Print header for routing table columns.
- */
-void
-pr_rthdr(int af)
-{
-
-	if (Aflag)
-		printf("%-*.*s ", PLEN, PLEN, "Address");
-	printf("%-*.*s %-*.*s %-6.6s  %6.6s  %6.6s %6.6s  %s\n",
-	    WID_DST(af), WID_DST(af), "Destination",
-	    WID_GW(af), WID_GW(af), "Gateway",
-	    "Flags", "Refs", "Use", "Mtu", "Interface");
-}
-
-/*
- * Print header for PF_KEY entries.
- */
-void
-pr_encaphdr(void)
-{
-	if (Aflag)
-		printf("%-*s ", PLEN, "Address");
-	printf("%-18s %-5s %-18s %-5s %-5s %-22s\n",
-	    "Source", "Port", "Destination",
-	    "Port", "Proto", "SA(Address/Proto/Type/Direction)");
-}
-
 static struct sockaddr *
 kgetsa(struct sockaddr *dst)
 {
@@ -283,7 +156,7 @@ again:
 				    rnode.rn_dupedkey ? " =>\n" : "\n");
 		} else if (do_rtent) {
 			kget(rn, rtentry);
-			p_rtentry(&rtentry);
+			p_krtentry(&rtentry);
 			if (Aflag)
 				p_rtnode();
 		} else {
@@ -367,230 +240,7 @@ p_rtnode(void)
 }
 
 static void
-ntreestuff(void)
-{
-	size_t needed;
-	int mib[6];
-	char *buf, *next, *lim;
-	struct rt_msghdr *rtm;
-
-	mib[0] = CTL_NET;
-	mib[1] = PF_ROUTE;
-	mib[2] = 0;
-	mib[3] = 0;
-	mib[4] = NET_RT_DUMP;
-	mib[5] = 0;
-	if (sysctl(mib, 6, NULL, &needed, NULL, 0) < 0) {
-		perror("route-sysctl-estimate");
-		exit(1);
-	}
-	if ((buf = malloc(needed)) == NULL)
-		err(1, NULL);
-	if (sysctl(mib, 6, buf, &needed, NULL, 0) < 0) {
-		perror("sysctl of routing table");
-		exit(1);
-	}
-	lim = buf + needed;
-	for (next = buf; next < lim; next += rtm->rtm_msglen) {
-		rtm = (struct rt_msghdr *)next;
-		np_rtentry(rtm);
-	}
-	free(buf);
-}
-
-static void
-np_rtentry(struct rt_msghdr *rtm)
-{
-	struct sockaddr *sa = (struct sockaddr *)(rtm + 1);
-#ifdef notdef
-	static int masks_done, banner_printed;
-#endif
-	static int old_af;
-	int af = 0, interesting = RTF_UP | RTF_GATEWAY | RTF_HOST;
-
-#ifdef notdef
-	/* for the moment, netmasks are skipped over */
-	if (!banner_printed) {
-		printf("Netmasks:\n");
-		banner_printed = 1;
-	}
-	if (masks_done == 0) {
-		if (rtm->rtm_addrs != RTA_DST ) {
-			masks_done = 1;
-			af = sa->sa_family;
-		}
-	} else
-#endif
-		af = sa->sa_family;
-	if (af != old_af) {
-		pr_family(af);
-		old_af = af;
-	}
-	if (rtm->rtm_addrs == RTA_DST)
-		p_sockaddr(sa, 0, 0, 36);
-	else {
-		p_sockaddr(sa, 0, rtm->rtm_flags, 16);
-		sa = (struct sockaddr *)(ROUNDUP(sa->sa_len) + (char *)sa);
-		p_sockaddr(sa, 0, 0, 18);
-	}
-	p_flags(rtm->rtm_flags & interesting, "%-6.6s ");
-	putchar('\n');
-}
-
-static void
-p_sockaddr(struct sockaddr *sa, struct sockaddr *mask, int flags, int width)
-{
-	char workbuf[128], *cplim;
-	char *cp = workbuf;
-	size_t n;
-
-	switch (sa->sa_family) {
-	case AF_INET:
-	    {
-		struct sockaddr_in *sin = (struct sockaddr_in *)sa;
-		struct sockaddr_in *msin = (struct sockaddr_in *)mask;
-
-		cp = (sin->sin_addr.s_addr == 0 && mask &&
-		    msin->sin_addr.s_addr == 0) ? "default" :
-		    (mask == NULL || msin->sin_addr.s_addr == (in_addr_t)-1 ?
-		    routename(sin->sin_addr.s_addr) :
-		    netname(sin->sin_addr.s_addr, msin->sin_addr.s_addr));
-
-		break;
-	    }
-
-#ifdef INET6
-	case AF_INET6:
-	    {
-		struct sockaddr_in6 *sa6 = (struct sockaddr_in6 *)sa;
-#ifdef __KAME__
-		struct in6_addr *in6 = &sa6->sin6_addr;
-
-		/*
-		 * XXX: This is a special workaround for KAME kernels.
-		 * sin6_scope_id field of SA should be set in the future.
-		 */
-		if (IN6_IS_ADDR_LINKLOCAL(in6) ||
-		    IN6_IS_ADDR_MC_LINKLOCAL(in6)) {
-			/* XXX: override is ok? */
-			sa6->sin6_scope_id = (u_int32_t)ntohs(*(u_short *)
-			    &in6->s6_addr[2]);
-			*(u_short *)&in6->s6_addr[2] = 0;
-		}
-#endif
-		if (flags & RTF_HOST)
-			cp = routename6(sa6);
-		else if (mask) {
-			cp = netname6(sa6,
-			    &((struct sockaddr_in6 *)mask)->sin6_addr);
-		} else
-			cp = netname6(sa6, NULL);
-		break;
-	    }
-#endif
-
-	case AF_IPX:
-		cp = ipx_print(sa);
-		break;
-
-	case AF_LINK:
-	    {
-		struct sockaddr_dl *sdl = (struct sockaddr_dl *)sa;
-
-		if (sdl->sdl_nlen == 0 && sdl->sdl_alen == 0 &&
-		    sdl->sdl_slen == 0)
-			(void) snprintf(workbuf, sizeof workbuf,
-			    "link#%d", sdl->sdl_index);
-		else switch (sdl->sdl_type) {
-		case IFT_ETHER:
-		    {
-			int i;
-			u_char *lla = (u_char *)sdl->sdl_data +
-			    sdl->sdl_nlen;
-
-			cplim = "";
-			for (i = 0; i < sdl->sdl_alen; i++, lla++) {
-				n = snprintf(cp,
-				    workbuf + sizeof (workbuf) - cp,
-				    "%s%x", cplim, *lla);
-				cplim = ":";
-				if (n < 0)	/* What else to do ? */
-					continue;
-				if (n >= workbuf + sizeof (workbuf) - cp)
-					n = workbuf + sizeof (workbuf) - cp - 1;
-				cp += n;
-			}
-			cp = workbuf;
-			break;
-		    }
-		default:
-			cp = link_ntoa(sdl);
-			break;
-		}
-		break;
-	    }
-
-	case AF_APPLETALK:
-	    {
-		/* XXX could do better */
-		cp = atalk_print(sa,11);
-		break;
-	    }
-	default:
-	    {
-		u_char *s = (u_char *)sa->sa_data, *slim;
-
-		slim = sa->sa_len + (u_char *) sa;
-		cplim = cp + sizeof(workbuf) - 6;
-		if ((n = snprintf(cp, cplim - cp, "(%d)", sa->sa_family)) >=
-		    cplim - cp)
-			n = cplim - cp - 1;
-		if (n > 0)
-			cp += n;
-		while (s < slim && cp < cplim) {
-			if ((n = snprintf(cp, workbuf + sizeof (workbuf) - cp,
-			    " %02x", *s++)) >= workbuf + sizeof (workbuf) - cp)
-				n = workbuf + sizeof (workbuf) - cp - 1;
-			if (n > 0)
-				cp += n;
-			if (s < slim) {
-				if ((n = snprintf(cp,
-				    workbuf + sizeof (workbuf) - cp,
-				    "%02x", *s++)) >=
-				    workbuf + sizeof (workbuf) - cp)
-					n = workbuf + sizeof (workbuf) - cp - 1;
-				if (n > 0)
-					cp += n;
-			}
-		}
-		cp = workbuf;
-	    }
-	}
-	if (width < 0 )
-		printf("%s ", cp);
-	else {
-		if (nflag)
-			printf("%-*s ", width, cp);
-		else
-			printf("%-*.*s ", width, width, cp);
-	}
-}
-
-static void
-p_flags(int f, char *format)
-{
-	char name[33], *flags;
-	struct bits *p = bits;
-
-	for (flags = name; p->b_mask; p++)
-		if (p->b_mask & f)
-			*flags++ = p->b_val;
-	*flags = '\0';
-	printf(format, name);
-}
-
-static void
-p_rtentry(struct rtentry *rt)
+p_krtentry(struct rtentry *rt)
 {
 	static struct ifnet ifnet, *lastif;
 	struct sockaddr_storage sock1, sock2;
@@ -613,8 +263,8 @@ p_rtentry(struct rtentry *rt)
 	} else
 		mask = 0;
 
-	p_sockaddr(sa, mask, rt->rt_flags, WID_DST(sa->sa_family));
-	p_sockaddr(kgetsa(rt->rt_gateway), 0, RTF_HOST, WID_GW(sa->sa_family));
+	p_addr(sa, mask, rt->rt_flags);
+	p_gwaddr(kgetsa(rt->rt_gateway), sa->sa_family);
 	p_flags(rt->rt_flags, "%-6.6s ");
 	printf("%6d %8ld ", rt->rt_refcnt, rt->rt_use);
 	if (rt->rt_rmx.rmx_mtu)
@@ -622,6 +272,7 @@ p_rtentry(struct rtentry *rt)
 	else
 		printf("%6s ", "-");
 	putchar((rt->rt_rmx.rmx_locks & RTV_MTU) ? 'L' : ' ');
+
 	if (rt->rt_ifp) {
 		if (rt->rt_ifp != lastif) {
 			kget(rt->rt_ifp, ifnet);
@@ -637,199 +288,35 @@ p_rtentry(struct rtentry *rt)
 		    (rt->rt_rmx.rmx_locks & RTV_EXPIRE) ? 'L' : ' ');
 }
 
-char *
-routename(in_addr_t in)
-{
-	char *cp;
-	static char line[MAXHOSTNAMELEN];
-	struct hostent *hp;
-	static char domain[MAXHOSTNAMELEN];
-	static int first = 1;
-
-	if (first) {
-		first = 0;
-		if (gethostname(domain, sizeof domain) == 0 &&
-		    (cp = strchr(domain, '.')))
-			(void) strlcpy(domain, cp + 1, sizeof domain);
-		else
-			domain[0] = '\0';
-	}
-	cp = NULL;
-	if (!nflag) {
-		hp = gethostbyaddr((char *)&in, sizeof (struct in_addr),
-		    AF_INET);
-		if (hp) {
-			if ((cp = strchr(hp->h_name, '.')) &&
-			    !strcmp(cp + 1, domain))
-				*cp = '\0';
-			cp = hp->h_name;
-		}
-	}
-	if (cp) {
-		strlcpy(line, cp, sizeof(line));
-	} else {
-#define C(x)	((x) & 0xff)
-		in = ntohl(in);
-		snprintf(line, sizeof line, "%u.%u.%u.%u",
-		    C(in >> 24), C(in >> 16), C(in >> 8), C(in));
-	}
-	return (line);
-}
-
-/*
- * Return the name of the network whose address is given.
- * The address is assumed to be that of a net or subnet, not a host.
- */
-char *
-netname(in_addr_t in, in_addr_t mask)
-{
-	char *cp = NULL;
-	static char line[MAXHOSTNAMELEN];
-	struct netent *np = NULL;
-	int mbits;
-
-	in = ntohl(in);
-	mask = ntohl(mask);
-	if (!nflag && in != INADDR_ANY) {
-		if ((np = getnetbyaddr(in, AF_INET)) != NULL)
-			cp = np->n_name;
-	}
-	mbits = mask ? 33 - ffs(mask) : 0;
-	if (cp) {
-		strlcpy(line, cp, sizeof(line));
-	} else if (mbits < 9)
-		snprintf(line, sizeof line, "%u/%d", C(in >> 24), mbits);
-	else if (mbits < 17)
-		snprintf(line, sizeof line, "%u.%u/%d",
-		    C(in >> 24) , C(in >> 16), mbits);
-	else if (mbits < 25)
-		snprintf(line, sizeof line, "%u.%u.%u/%d",
-		    C(in >> 24), C(in >> 16), C(in >> 8), mbits);
-	else
-		snprintf(line, sizeof line, "%u.%u.%u.%u/%d", C(in >> 24),
-		    C(in >> 16), C(in >> 8), C(in), mbits);
-	return (line);
-}
-
-#ifdef INET6
-char *
-netname6(struct sockaddr_in6 *sa6, struct in6_addr *mask)
-{
-	static char line[MAXHOSTNAMELEN + 1];
-	struct sockaddr_in6 sin6;
-	u_char *p;
-	u_char *lim;
-	int masklen, final = 0, illegal = 0;
-	int i;
-	char hbuf[NI_MAXHOST];
-	int flag = 0;
-	int error;
-
-	sin6 = *sa6;
-
-	masklen = 0;
-	lim = (u_char *)(mask + 1);
-	i = 0;
-	if (mask) {
-		for (p = (u_char *)mask; p < lim; p++) {
-			if (final && *p) {
-				illegal++;
-				sin6.sin6_addr.s6_addr[i++] = 0x00;
-				continue;
-			}
-
-			switch (*p & 0xff) {
-			case 0xff:
-				masklen += 8;
-				break;
-			case 0xfe:
-				masklen += 7;
-				final++;
-				break;
-			case 0xfc:
-				masklen += 6;
-				final++;
-				break;
-			case 0xf8:
-				masklen += 5;
-				final++;
-				break;
-			case 0xf0:
-				masklen += 4;
-				final++;
-				break;
-			case 0xe0:
-				masklen += 3;
-				final++;
-				break;
-			case 0xc0:
-				masklen += 2;
-				final++;
-				break;
-			case 0x80:
-				masklen += 1;
-				final++;
-				break;
-			case 0x00:
-				final++;
-				break;
-			default:
-				final++;
-				illegal++;
-				break;
-			}
-
-			if (!illegal)
-				sin6.sin6_addr.s6_addr[i++] &= *p;
-			else
-				sin6.sin6_addr.s6_addr[i++] = 0x00;
-		}
-	} else
-		masklen = 128;
-
-	if (masklen == 0 && IN6_IS_ADDR_UNSPECIFIED(&sin6.sin6_addr))
-		return("default");
-
-	if (illegal)
-		fprintf(stderr, "illegal prefixlen\n");
-
-	if (nflag)
-		flag |= NI_NUMERICHOST;
-	error = getnameinfo((struct sockaddr *)&sin6, sin6.sin6_len,
-	    hbuf, sizeof(hbuf), NULL, 0, flag);
-	if (error)
-		snprintf(hbuf, sizeof(hbuf), "invalid");
-
-	snprintf(line, sizeof(line), "%s/%d", hbuf, masklen);
-	return line;
-}
-
-char *
-routename6(struct sockaddr_in6 *sa6)
-{
-	static char line[NI_MAXHOST];
-	const int niflag = NI_NUMERICHOST;
-
-	if (getnameinfo((struct sockaddr *)sa6, sa6->sin6_len,
-	    line, sizeof(line), NULL, 0, niflag) != 0)
-		strlcpy(line, "", sizeof line);
-	return line;
-}
-#endif /*INET6*/
-
 /*
  * Print routing statistics
  */
 void
-rt_stats(u_long off)
+rt_stats(int usesysctl, u_long off)
 {
 	struct rtstat rtstat;
-
-	if (off == 0) {
+	int mib[6];
+	size_t size;
+ 
+	if (usesysctl) {
+		mib[0] = CTL_NET;
+		mib[1] = PF_ROUTE;
+		mib[2] = 0;
+		mib[3] = 0;
+		mib[4] = NET_RT_STATS;
+		mib[5] = 0;
+		size = sizeof (rtstat);
+
+		if (sysctl(mib, 6, &rtstat, &size, NULL, 0) < 0) {
+			perror("sysctl of routing table statistics");
+			exit(1);
+		}
+	} else if (off == 0) {
 		printf("rtstat: symbol not in namelist\n");
 		return;
-	}
-	kread(off, &rtstat, sizeof (rtstat));
+	} else
+		kread(off, &rtstat, sizeof (rtstat));
+
 	printf("routing:\n");
 	printf("\t%u bad routing redirect%s\n",
 	    rtstat.rts_badredirect, plural(rtstat.rts_badredirect));
@@ -843,72 +330,6 @@ rt_stats(u_long off)
 	    rtstat.rts_wildcard, plural(rtstat.rts_wildcard));
 }
 
-u_short ipx_nullh[] = {0,0,0};
-u_short ipx_bh[] = {0xffff,0xffff,0xffff};
-
-char *
-ipx_print(struct sockaddr *sa)
-{
-	struct sockaddr_ipx *sipx = (struct sockaddr_ipx*)sa;
-	struct ipx_addr work;
-	union { union ipx_net net_e; u_long long_e; } net;
-	in_port_t port;
-	static char mybuf[50], cport[10], chost[25];
-	char *host = "";
-	char *q;
-
-	work = sipx->sipx_addr;
-	port = ntohs(work.ipx_port);
-	work.ipx_port = 0;
-	net.net_e = work.ipx_net;
-	if (ipx_nullhost(work) && net.long_e == 0) {
-		if (port != 0) {
-			snprintf(mybuf, sizeof mybuf, "*.%xH", port);
-			upHex(mybuf);
-		} else
-			snprintf(mybuf, sizeof mybuf, "*.*");
-		return (mybuf);
-	}
-
-	if (bcmp(ipx_bh, work.ipx_host.c_host, 6) == 0) {
-		host = "any";
-	} else if (bcmp(ipx_nullh, work.ipx_host.c_host, 6) == 0) {
-		host = "*";
-	} else {
-		q = work.ipx_host.c_host;
-		snprintf(chost, sizeof chost, "%02x:%02x:%02x:%02x:%02x:%02x",
-		    q[0], q[1], q[2], q[3], q[4], q[5]);
-		host = chost;
-	}
-	if (port)
-		snprintf(cport, sizeof cport, ".%xH", htons(port));
-	else
-		*cport = 0;
-
-	snprintf(mybuf, sizeof mybuf, "%xH.%s%s", ntohl(net.long_e),
-	    host, cport);
-	upHex(mybuf);
-	return(mybuf);
-}
-
-char *
-ipx_phost(struct sockaddr *sa)
-{
-	struct sockaddr_ipx *sipx = (struct sockaddr_ipx *)sa;
-	struct sockaddr_ipx work;
-	static union ipx_net ipx_zeronet;
-	char *p;
-
-	work = *sipx;
-	work.sipx_addr.ipx_port = 0;
-	work.sipx_addr.ipx_net = ipx_zeronet;
-
-	p = ipx_print((struct sockaddr *)&work);
-	if (strncmp("0H.", p, 3) == 0)
-		p += 3;
-	return(p);
-}
-
 static void
 encap_print(struct rtentry *rt)
 {
@@ -924,9 +345,9 @@ encap_print(struct rtentry *rt)
 	bcopy(kgetsa(rt->rt_gateway), &sen3, sizeof(sen3));
 
 	if (sen1.sen_type == SENT_IP4) {
-		printf("%-18s %-5u ", netname(sen1.sen_ip_src.s_addr,
+		printf("%-18s %-5u ", netname4(sen1.sen_ip_src.s_addr,
 		    sen2.sen_ip_src.s_addr), ntohs(sen1.sen_sport));
-		printf("%-18s %-5u %-5u ", netname(sen1.sen_ip_dst.s_addr,
+		printf("%-18s %-5u %-5u ", netname4(sen1.sen_ip_dst.s_addr,
 		    sen2.sen_ip_dst.s_addr),
 		    ntohs(sen1.sen_dport), sen1.sen_proto);
 	}
@@ -958,7 +379,7 @@ encap_print(struct rtentry *rt)
 		}
 #endif
 
-		printf("%-42s %-5u ", netname6(&s61, &s62.sin6_addr),
+		printf("%-42s %-5u ", netname6(&s61, &s62),
 		    ntohs(sen1.sen_ip6_sport));
 
 		bzero(&s61, sizeof(s61));
@@ -986,7 +407,7 @@ encap_print(struct rtentry *rt)
 		}
 #endif
 
-		printf("%-42s %-5u %-5u ", netname6(&s61, &s62.sin6_addr),
+		printf("%-42s %-5u %-5u ", netname6(&s61, &s62),
 		    ntohs(sen1.sen_ip6_dport), sen1.sen_ip6_proto);
 	}
 #endif /* INET6 */
@@ -1041,21 +462,3 @@ encap_print(struct rtentry *rt)
 			printf("/<unknown>\n");
 	}
 }
-
-void
-upHex(char *p0)
-{
-	char *p = p0;
-
-	for (; *p; p++)
-		switch (*p) {
-		case 'a':
-		case 'b':
-		case 'c':
-		case 'd':
-		case 'e':
-		case 'f':
-			*p += ('A' - 'a');
-			break;
-	}
-}
diff --git a/usr.bin/netstat/show.c b/usr.bin/netstat/show.c
new file mode 100644
index 00000000000..cbdd6c97b6c
--- /dev/null
+++ b/usr.bin/netstat/show.c
@@ -0,0 +1,918 @@
+/*	$OpenBSD: show.c,v 1.1 2006/05/27 19:16:37 claudio Exp $	*/
+/*	$NetBSD: show.c,v 1.1 1996/11/15 18:01:41 gwr Exp $	*/
+
+/*
+ * Copyright (c) 1983, 1988, 1993
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/param.h>
+#include <sys/protosw.h>
+#include <sys/socket.h>
+#include <sys/mbuf.h>
+#include <sys/sysctl.h>
+
+#include <net/if.h>
+#include <net/if_dl.h>
+#include <net/if_types.h>
+#include <net/pfkeyv2.h>
+#include <net/route.h>
+#include <netinet/in.h>
+#include <netipx/ipx.h>
+#include <netinet/if_ether.h>
+#include <netinet/ip_ipsp.h>
+#include <arpa/inet.h>
+
+#include <err.h>
+#include <errno.h>
+#include <netdb.h>
+#include <stdio.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include "netstat.h"
+
+char	*any_ntoa(const struct sockaddr *);
+char	*link_print(struct sockaddr *);
+
+#define ROUNDUP(a) \
+	((a) > 0 ? (1 + (((a) - 1) | (sizeof(long) - 1))) : sizeof(long))
+#define ADVANCE(x, n) (x += ROUNDUP((n)->sa_len))
+
+#define PFKEYV2_CHUNK sizeof(u_int64_t)
+
+/*
+ * Definitions for showing gateway flags.
+ */
+struct bits {
+	int	b_mask;
+	char	b_val;
+};
+static const struct bits bits[] = {
+	{ RTF_UP,	'U' },
+	{ RTF_GATEWAY,	'G' },
+	{ RTF_HOST,	'H' },
+	{ RTF_REJECT,	'R' },
+	{ RTF_BLACKHOLE, 'B' },
+	{ RTF_DYNAMIC,	'D' },
+	{ RTF_MODIFIED,	'M' },
+	{ RTF_DONE,	'd' }, /* Completed -- for routing messages only */
+	{ RTF_MASK,	'm' }, /* Mask Present -- for routing messages only */
+	{ RTF_CLONING,	'C' },
+	{ RTF_XRESOLVE,	'X' },
+	{ RTF_LLINFO,	'L' },
+	{ RTF_STATIC,	'S' },
+	{ RTF_PROTO1,	'1' },
+	{ RTF_PROTO2,	'2' },
+	{ RTF_PROTO3,	'3' },
+	{ RTF_CLONED,	'c' },
+	{ RTF_JUMBO,	'J' },
+	{ 0 }
+};
+
+void	 pr_rthdr(int, int);
+void	 p_rtentry(struct rt_msghdr *);
+void	 p_pfkentry(struct sadb_msg *);
+void	 pr_family(int);
+void	 p_encap(struct sockaddr *, struct sockaddr *, int);
+void	 p_protocol(struct sadb_protocol *, struct sockaddr *, struct
+	    sadb_protocol *, int);
+void	 p_sockaddr(struct sockaddr *, struct sockaddr *, int, int);
+void	 p_flags(int, char *);
+char	*routename4(in_addr_t);
+char	*routename6(struct sockaddr_in6 *);
+void	 index_pfk(struct sadb_msg *, void **);
+
+/*
+ * Print routing tables.
+ */
+void
+p_rttables(int af)
+{
+	struct rt_msghdr *rtm;
+	struct sadb_msg *msg;
+	char *buf = NULL, *next, *lim = NULL;
+	size_t needed;
+	int mib[6];
+	struct sockaddr *sa;
+
+	mib[0] = CTL_NET;
+	mib[1] = PF_ROUTE;
+	mib[2] = 0;
+	mib[3] = af;
+	mib[4] = NET_RT_DUMP;
+	mib[5] = 0;
+	if (sysctl(mib, 6, NULL, &needed, NULL, 0) < 0)
+		err(1, "route-sysctl-estimate");
+	if (needed > 0) {
+		if ((buf = malloc(needed)) == 0)
+			err(1, NULL);
+		if (sysctl(mib, 6, buf, &needed, NULL, 0) < 0)
+			err(1, "sysctl of routing table");
+		lim = buf + needed;
+	}
+
+	printf("Routing tables\n");
+
+	if (buf) {
+		for (next = buf; next < lim; next += rtm->rtm_msglen) {
+			rtm = (struct rt_msghdr *)next;
+			sa = (struct sockaddr *)(rtm + 1);
+			if (af != AF_UNSPEC && sa->sa_family != af)
+				continue;
+			p_rtentry(rtm);
+		}
+		free(buf);
+		buf = NULL;
+	}
+
+	if (af != 0 && af != PF_KEY)
+		return;
+
+	mib[0] = CTL_NET;
+	mib[1] = PF_KEY;
+	mib[2] = PF_KEY_V2;
+	mib[3] = NET_KEY_SPD_DUMP;
+	mib[4] = mib[5] = 0;
+
+	if (sysctl(mib, 4, NULL, &needed, NULL, 0) == -1) {
+		if (errno == ENOPROTOOPT)
+			return;
+		err(1, "spd-sysctl-estimate");
+	}
+	if (needed > 0) {
+		if ((buf = malloc(needed)) == 0)
+			err(1, NULL);
+		if (sysctl(mib, 4, buf, &needed, NULL, 0) == -1)
+			err(1,"sysctl of spd");
+		lim = buf + needed;
+	}
+
+	if (buf) {
+		printf("\nEncap:\n");
+
+		for (next = buf; next < lim; next += msg->sadb_msg_len *
+		    PFKEYV2_CHUNK) {
+			msg = (struct sadb_msg *)next;
+			if (msg->sadb_msg_len == 0)
+				break;
+			p_pfkentry(msg);
+		}
+		free(buf);
+		buf = NULL;
+	}
+}
+
+/* 
+ * column widths; each followed by one space
+ * width of destination/gateway column
+ * strlen("fe80::aaaa:bbbb:cccc:dddd@gif0") == 30, strlen("/128") == 4
+ */
+#define	WID_DST(af)	((af) == AF_INET6 ? (nflag ? 34 : 18) : 18)
+#define	WID_GW(af)	((af) == AF_INET6 ? (nflag ? 30 : 18) : 18)
+
+/*
+ * Print header for routing table columns.
+ */
+void
+pr_rthdr(int af, int Aflag)
+{
+	if (Aflag)
+		printf("%-*.*s ", PLEN, PLEN, "Address");
+	if (af != PF_KEY)
+		printf("%-*.*s %-*.*s %-6.6s %6.6s %8.8s %6.6s  %s\n",
+		    WID_DST(af), WID_DST(af), "Destination",
+		    WID_GW(af), WID_GW(af), "Gateway",
+		    "Flags", "Refs", "Use", "Mtu", "Interface");
+	else
+		printf("%-18s %-5s %-18s %-5s %-5s %-22s\n",
+		    "Source", "Port", "Destination",
+		    "Port", "Proto", "SA(Address/Proto/Type/Direction)");
+}
+
+static void
+get_rtaddrs(int addrs, struct sockaddr *sa, struct sockaddr **rti_info)
+{
+	int	i;
+
+	for (i = 0; i < RTAX_MAX; i++) {
+		if (addrs & (1 << i)) {
+			rti_info[i] = sa;
+			sa = (struct sockaddr *)((char *)(sa) +
+			    ROUNDUP(sa->sa_len));
+		} else
+			rti_info[i] = NULL;
+	}
+}
+
+/*
+ * Print a routing table entry.
+ */
+void
+p_rtentry(struct rt_msghdr *rtm)
+{
+	static int	 old_af = -1;
+	struct sockaddr	*sa = (struct sockaddr *)(rtm + 1);
+	struct sockaddr	*mask, *rti_info[RTAX_MAX];
+	char		 ifbuf[IF_NAMESIZE];
+
+
+	if (sa->sa_family == AF_KEY)
+		return;
+
+	if (old_af != sa->sa_family) {
+		old_af = sa->sa_family;
+		pr_family(sa->sa_family);
+		pr_rthdr(sa->sa_family, 0);
+	}
+	get_rtaddrs(rtm->rtm_addrs, sa, rti_info);
+
+	mask = rti_info[RTAX_NETMASK];
+	if ((sa = rti_info[RTAX_DST]) == NULL)
+		return;
+
+	p_sockaddr(sa, mask, rtm->rtm_flags, WID_DST(sa->sa_family));
+	p_sockaddr(rti_info[RTAX_GATEWAY], NULL, RTF_HOST,
+	    WID_GW(sa->sa_family));
+	p_flags(rtm->rtm_flags, "%-6.6s ");
+	printf("%6d %8ld ", (int)rtm->rtm_rmx.rmx_refcnt,
+	    rtm->rtm_rmx.rmx_pksent);
+	if (rtm->rtm_rmx.rmx_mtu)
+		printf("%6ld ", rtm->rtm_rmx.rmx_mtu);
+	else
+		printf("%6s ", "-");
+	putchar((rtm->rtm_rmx.rmx_locks & RTV_MTU) ? 'L' : ' ');
+	printf(" %.16s", if_indextoname(rtm->rtm_index, ifbuf));
+	putchar('\n');
+}
+
+/*
+ * Print a pfkey/encap entry.
+ */
+void
+p_pfkentry(struct sadb_msg *msg)
+{
+	static int	 	 old = 0;
+	struct sadb_ext		*ext;
+	struct sadb_address	*saddr;
+	struct sadb_protocol	*sap, *saft;
+	struct sockaddr		*sa, *mask;
+	void			*headers[SADB_EXT_MAX + 1];
+
+	if (!old) {
+		pr_rthdr(PF_KEY, 0);
+		old++;
+	}
+
+	bzero(headers, sizeof(headers));
+	index_pfk(msg, headers);
+
+	/* These are always set */
+	saddr = headers[SADB_X_EXT_SRC_FLOW];
+	sa = (struct sockaddr *)(saddr + 1);
+	saddr = headers[SADB_X_EXT_SRC_MASK];
+	mask = (struct sockaddr *)(saddr + 1);
+	p_encap(sa, mask, WID_DST(sa->sa_family));
+
+	/* These are always set, too. */
+	saddr = headers[SADB_X_EXT_DST_FLOW];
+	sa = (struct sockaddr *)(saddr + 1);
+	saddr = headers[SADB_X_EXT_DST_MASK];
+	mask = (struct sockaddr *)(saddr + 1);
+	p_encap(sa, mask, WID_DST(sa->sa_family));
+
+	/* Bypass and deny flows do not set SADB_EXT_ADDRESS_DST! */
+	sap = headers[SADB_X_EXT_PROTOCOL];
+	saft = headers[SADB_X_EXT_FLOW_TYPE];
+	saddr = headers[SADB_EXT_ADDRESS_DST];
+	if (saddr)
+		sa = (struct sockaddr *)(saddr + 1);
+	else
+		sa = NULL;
+	p_protocol(sap, sa, saft, msg->sadb_msg_satype);
+
+	printf("\n");
+}
+
+/*
+ * Print address family header before a section of the routing table.
+ */
+void
+pr_family(int af)
+{
+	char *afname;
+
+	switch (af) {
+	case AF_INET:
+		afname = "Internet";
+		break;
+	case AF_INET6:
+		afname = "Internet6";
+		break;
+	case AF_IPX:
+		afname = "IPX";
+		break;
+	case PF_KEY:
+		afname = "Encap";
+		break;
+	case AF_APPLETALK:
+		afname = "AppleTalk";
+		break;
+	default:
+		afname = NULL;
+		break;
+	}
+	if (afname)
+		printf("\n%s:\n", afname);
+	else
+		printf("\nProtocol Family %d:\n", af);
+}
+
+void
+p_addr(struct sockaddr *sa, struct sockaddr *mask, int flags)
+{
+	p_sockaddr(sa, mask, flags, WID_DST(sa->sa_family));
+}
+
+void
+p_gwaddr(struct sockaddr *sa, int af)
+{
+	p_sockaddr(sa, 0, RTF_HOST, WID_GW(af));
+}
+
+void
+p_encap(struct sockaddr *sa, struct sockaddr *mask, int width)
+{
+	char 		*cp;
+	unsigned short	 port;
+
+	switch (sa->sa_family) {
+	case AF_INET6: {
+		break;
+	}
+	default:
+		if (mask)
+			cp = netname(sa, mask);
+		else
+			cp = routename(sa);
+		port = ntohs(((struct sockaddr_in *)sa)->sin_port);
+		break;
+	}
+	if (width < 0)
+		printf("%s", cp);
+	else {
+		if (nflag)
+			printf("%-*s %-5u ", width, cp, port);
+		else
+			printf("%-*.*s %-5u ", width, width, cp, port);
+	}
+}
+
+void
+p_protocol(struct sadb_protocol *sap, struct sockaddr *sa, struct sadb_protocol
+    *saft, int proto)
+{
+	printf("%-6u", sap->sadb_protocol_proto);
+	if (sa)
+		p_sockaddr(sa, NULL, 0, -1);
+	else
+		printf("none");
+
+	switch (proto) {
+	case SADB_SATYPE_ESP:
+		printf("/esp");
+		break;
+	case SADB_SATYPE_AH:
+		printf("/ah");
+		break;
+	case SADB_X_SATYPE_IPCOMP:
+		printf("/ipcomp");
+		break;
+	case SADB_X_SATYPE_IPIP:
+		printf("/ipip");
+		break;
+	default:
+		printf("/<unknown>");
+	}
+
+	switch(saft->sadb_protocol_proto) {
+	case SADB_X_FLOW_TYPE_USE:
+		printf("/use");
+		break;
+	case SADB_X_FLOW_TYPE_REQUIRE:
+		printf("/require");
+		break;
+	case SADB_X_FLOW_TYPE_ACQUIRE:
+		printf("/acquire");
+		break;
+	case SADB_X_FLOW_TYPE_DENY:
+		printf("/deny");
+		break;
+	case SADB_X_FLOW_TYPE_BYPASS:
+		printf("/bypass");
+		break;
+	case SADB_X_FLOW_TYPE_DONTACQ:
+		printf("/dontacq");
+		break;
+	default:
+		printf("/<unknown type>");
+	}
+
+	switch(saft->sadb_protocol_direction) {
+	case IPSP_DIRECTION_IN:
+		printf("/in");
+		break;
+	case IPSP_DIRECTION_OUT:
+		printf("/out");
+		break;
+	default:
+		printf("/<unknown>");
+	}
+}
+
+void
+p_sockaddr(struct sockaddr *sa, struct sockaddr *mask, int flags, int width)
+{
+	char *cp;
+
+	switch (sa->sa_family) {
+	case AF_INET6:
+	    {
+		struct sockaddr_in6 *sa6 = (struct sockaddr_in6 *)sa;
+		struct in6_addr *in6 = &sa6->sin6_addr;
+
+		/*
+		 * XXX: This is a special workaround for KAME kernels.
+		 * sin6_scope_id field of SA should be set in the future.
+		 */
+		if (IN6_IS_ADDR_LINKLOCAL(in6) ||
+		    IN6_IS_ADDR_MC_LINKLOCAL(in6)) {
+			/* XXX: override is ok? */
+			sa6->sin6_scope_id = (u_int32_t)ntohs(*(u_short *)
+			    &in6->s6_addr[2]);
+			*(u_short *)&in6->s6_addr[2] = 0;
+		}
+		if (flags & RTF_HOST)
+			cp = routename((struct sockaddr *)sa6);
+		else
+			cp = netname((struct sockaddr *)sa6, mask);
+		break;
+	    }
+	default:
+		if ((flags & RTF_HOST) || mask == NULL)
+			cp = routename(sa);
+		else
+			cp = netname(sa, mask);
+		break;
+	}
+	if (width < 0)
+		printf("%s", cp);
+	else {
+		if (nflag)
+			printf("%-*s ", width, cp);
+		else
+			printf("%-*.*s ", width, width, cp);
+	}
+}
+
+void
+p_flags(int f, char *format)
+{
+	char name[33], *flags;
+	const struct bits *p = bits;
+
+	for (flags = name; p->b_mask && flags < &name[sizeof(name) - 2]; p++)
+		if (p->b_mask & f)
+			*flags++ = p->b_val;
+	*flags = '\0';
+	printf(format, name);
+}
+
+static char line[MAXHOSTNAMELEN];
+static char domain[MAXHOSTNAMELEN];
+
+char *
+routename(struct sockaddr *sa)
+{
+	char *cp = NULL;
+	static int first = 1;
+
+	if (first) {
+		first = 0;
+		if (gethostname(domain, sizeof(domain)) == 0 &&
+		    (cp = strchr(domain, '.')))
+			(void)strlcpy(domain, cp + 1, sizeof(domain));
+		else
+			domain[0] = '\0';
+		cp = NULL;
+	}
+
+	if (sa->sa_len == 0) {
+		(void)strlcpy(line, "default", sizeof(line));
+		return (line);
+	}
+
+	switch (sa->sa_family) {
+	case AF_INET:
+		return
+		    (routename4(((struct sockaddr_in *)sa)->sin_addr.s_addr));
+
+	case AF_INET6:
+	    {
+		struct sockaddr_in6 sin6;
+
+		memset(&sin6, 0, sizeof(sin6));
+		memcpy(&sin6, sa, sa->sa_len);
+		sin6.sin6_len = sizeof(struct sockaddr_in6);
+		sin6.sin6_family = AF_INET6;
+		if (sa->sa_len == sizeof(struct sockaddr_in6) &&
+		    (IN6_IS_ADDR_LINKLOCAL(&sin6.sin6_addr) ||
+		     IN6_IS_ADDR_MC_LINKLOCAL(&sin6.sin6_addr)) &&
+		    sin6.sin6_scope_id == 0) {
+			sin6.sin6_scope_id =
+			    ntohs(*(u_int16_t *)&sin6.sin6_addr.s6_addr[2]);
+			sin6.sin6_addr.s6_addr[2] = 0;
+			sin6.sin6_addr.s6_addr[3] = 0;
+		}
+		return (routename6(&sin6));
+	    }
+
+	case AF_IPX:
+		return (ipx_print(sa));
+
+	case AF_LINK:
+		return (link_print(sa));
+
+	case AF_UNSPEC:
+		if (sa->sa_len == sizeof(struct sockaddr_rtlabel)) {
+			static char name[RTLABEL_LEN];
+			struct sockaddr_rtlabel *sr;
+
+			sr = (struct sockaddr_rtlabel *)sa;
+			strlcpy(name, sr->sr_label, sizeof(name));
+			return (name);
+		}
+		/* FALLTHROUGH */
+	default:
+		(void)snprintf(line, sizeof(line), "(%d) %s",
+		    sa->sa_family, any_ntoa(sa));
+		break;
+	}
+	return (line);
+}
+
+char *
+routename4(in_addr_t in)
+{
+	char		*cp = NULL;
+	struct in_addr	 ina;
+	struct hostent	*hp;
+
+	if (in == INADDR_ANY)
+		cp = "default";
+	if (!cp && !nflag) {
+		if ((hp = gethostbyaddr((char *)&in,
+		    sizeof(in), AF_INET)) != NULL) {
+			if ((cp = strchr(hp->h_name, '.')) &&
+			    !strcmp(cp + 1, domain))
+				*cp = '\0';
+			cp = hp->h_name;
+		}
+	}
+	ina.s_addr = in;
+	strlcpy(line, cp ? cp : inet_ntoa(ina), sizeof(line));
+
+	return (line);
+}
+
+char *
+routename6(struct sockaddr_in6 *sin6)
+{
+	int	 niflags = 0;
+
+	if (nflag)
+		niflags |= NI_NUMERICHOST;
+	else
+		niflags |= NI_NOFQDN;
+
+	if (getnameinfo((struct sockaddr *)sin6, sin6->sin6_len,
+	    line, sizeof(line), NULL, 0, niflags) != 0)
+		strncpy(line, "invalid", sizeof(line));
+
+	return (line);
+}
+
+/*
+ * Return the name of the network whose address is given.
+ * The address is assumed to be that of a net or subnet, not a host.
+ */
+char *
+netname4(in_addr_t in, in_addr_t mask)
+{
+	char *cp = NULL;
+	struct netent *np = NULL;
+	int mbits;
+
+	in = ntohl(in);
+	mask = ntohl(mask);
+	if (!nflag && in != INADDR_ANY) {
+		if ((np = getnetbyaddr(in, AF_INET)) != NULL)
+			cp = np->n_name;
+	}
+	if (in == INADDR_ANY)
+		cp = "default";
+	mbits = mask ? 33 - ffs(mask) : 0;
+	if (cp)
+		strlcpy(line, cp, sizeof(line));
+#define C(x)	((x) & 0xff)
+	else if (mbits < 9)
+		snprintf(line, sizeof(line), "%u/%d", C(in >> 24), mbits);
+	else if (mbits < 17)
+		snprintf(line, sizeof(line), "%u.%u/%d",
+		    C(in >> 24) , C(in >> 16), mbits);
+	else if (mbits < 25)
+		snprintf(line, sizeof(line), "%u.%u.%u/%d",
+		    C(in >> 24), C(in >> 16), C(in >> 8), mbits);
+	else
+		snprintf(line, sizeof(line), "%u.%u.%u.%u/%d", C(in >> 24),
+		    C(in >> 16), C(in >> 8), C(in), mbits);
+#undef C
+	return (line);
+}
+
+char *
+netname6(struct sockaddr_in6 *sa6, struct sockaddr_in6 *mask)
+{
+	struct sockaddr_in6 sin6;
+	u_char *p;
+	int masklen, final = 0, illegal = 0;
+	int i, lim, flag, error;
+	char hbuf[NI_MAXHOST];
+
+	sin6 = *sa6;
+
+	flag = 0;
+	masklen = 0;
+	if (mask) {
+		lim = mask->sin6_len - offsetof(struct sockaddr_in6, sin6_addr);
+		lim = lim < sizeof(struct in6_addr) ?
+		    lim : sizeof(struct in6_addr);
+		for (p = (u_char *)&mask->sin6_addr, i = 0; i < lim; p++) {
+			if (final && *p) {
+				illegal++;
+				sin6.sin6_addr.s6_addr[i++] = 0x00;
+				continue;
+			}
+
+			switch (*p & 0xff) {
+			case 0xff:
+				masklen += 8;
+				break;
+			case 0xfe:
+				masklen += 7;
+				final++;
+				break;
+			case 0xfc:
+				masklen += 6;
+				final++;
+				break;
+			case 0xf8:
+				masklen += 5;
+				final++;
+				break;
+			case 0xf0:
+				masklen += 4;
+				final++;
+				break;
+			case 0xe0:
+				masklen += 3;
+				final++;
+				break;
+			case 0xc0:
+				masklen += 2;
+				final++;
+				break;
+			case 0x80:
+				masklen += 1;
+				final++;
+				break;
+			case 0x00:
+				final++;
+				break;
+			default:
+				final++;
+				illegal++;
+				break;
+			}
+
+			if (!illegal)
+				sin6.sin6_addr.s6_addr[i++] &= *p;
+			else
+				sin6.sin6_addr.s6_addr[i++] = 0x00;
+		}
+		while (i < sizeof(struct in6_addr))
+			sin6.sin6_addr.s6_addr[i++] = 0x00;
+	} else
+		masklen = 128;
+
+	if (masklen == 0 && IN6_IS_ADDR_UNSPECIFIED(&sin6.sin6_addr))
+		return ("default");
+
+	if (illegal)
+		warnx("illegal prefixlen");
+
+	if (nflag)
+		flag |= NI_NUMERICHOST;
+	error = getnameinfo((struct sockaddr *)&sin6, sin6.sin6_len,
+	    hbuf, sizeof(hbuf), NULL, 0, flag);
+	if (error)
+		snprintf(hbuf, sizeof(hbuf), "invalid");
+
+	snprintf(line, sizeof(line), "%s/%d", hbuf, masklen);
+	return (line);
+}
+
+/*
+ * Return the name of the network whose address is given.
+ * The address is assumed to be that of a net or subnet, not a host.
+ */
+char *
+netname(struct sockaddr *sa, struct sockaddr *mask)
+{
+	switch (sa->sa_family) {
+
+	case AF_INET:
+		return netname4(((struct sockaddr_in *)sa)->sin_addr.s_addr,
+		    ((struct sockaddr_in *)mask)->sin_addr.s_addr);
+	case AF_INET6:
+		return netname6((struct sockaddr_in6 *)sa,
+		    (struct sockaddr_in6 *)mask);
+	case AF_IPX:
+		return (ipx_print(sa));
+	case AF_LINK:
+		return (link_print(sa));
+	default:
+		snprintf(line, sizeof(line), "af %d: %s",
+		    sa->sa_family, any_ntoa(sa));
+		break;
+	}
+	return (line);
+}
+
+static const char hexlist[] = "0123456789abcdef";
+
+char *
+any_ntoa(const struct sockaddr *sa)
+{
+	static char obuf[240];
+	const char *in = sa->sa_data;
+	char *out = obuf;
+	int len = sa->sa_len - offsetof(struct sockaddr, sa_data);
+
+	*out++ = 'Q';
+	do {
+		*out++ = hexlist[(*in >> 4) & 15];
+		*out++ = hexlist[(*in++)    & 15];
+		*out++ = '.';
+	} while (--len > 0 && (out + 3) < &obuf[sizeof(obuf) - 1]);
+	out[-1] = '\0';
+	return (obuf);
+}
+
+short ipx_nullh[] = {0,0,0};
+short ipx_bh[] = {-1,-1,-1};
+
+char *
+ipx_print(struct sockaddr *sa)
+{
+	struct sockaddr_ipx *sipx = (struct sockaddr_ipx *)sa;
+	struct ipx_addr work;
+	union {
+		union ipx_net	net_e;
+		u_int32_t	long_e;
+	} net;
+	u_short port;
+	static char mybuf[50+MAXHOSTNAMELEN], cport[10], chost[25];
+	char *host = "";
+	char *p;
+	u_char *q;
+
+	work = sipx->sipx_addr;
+	port = ntohs(work.ipx_port);
+	work.ipx_port = 0;
+	net.net_e = work.ipx_net;
+	if (ipx_nullhost(work) && net.long_e == 0) {
+		if (!port)
+			return ("*.*");
+		(void)snprintf(mybuf, sizeof(mybuf), "*.0x%XH", port);
+		return (mybuf);
+	}
+
+	if (memcmp(ipx_bh, work.ipx_host.c_host, 6) == 0)
+		host = "any";
+	else if (memcmp(ipx_nullh, work.ipx_host.c_host, 6) == 0)
+		host = "*";
+	else {
+		q = work.ipx_host.c_host;
+		(void)snprintf(chost, sizeof(chost), "%02X%02X%02X%02X%02X%02XH",
+			q[0], q[1], q[2], q[3], q[4], q[5]);
+		for (p = chost; *p == '0' && p < chost + 12; p++)
+			/* void */;
+		host = p;
+	}
+	if (port)
+		(void)snprintf(cport, sizeof(cport), ".%XH", htons(port));
+	else
+		*cport = '\0';
+
+	(void)snprintf(mybuf, sizeof(mybuf), "%XH.%s%s",
+	    ntohl(net.long_e), host, cport);
+	return (mybuf);
+}
+
+char *
+link_print(struct sockaddr *sa)
+{
+	struct sockaddr_dl	*sdl = (struct sockaddr_dl *)sa;
+	u_char			*lla = (u_char *)sdl->sdl_data + sdl->sdl_nlen;
+
+	if (sdl->sdl_nlen == 0 && sdl->sdl_alen == 0 &&
+	    sdl->sdl_slen == 0) {
+		(void)snprintf(line, sizeof(line), "link#%d", sdl->sdl_index);
+		return (line);
+	}
+	switch (sdl->sdl_type) {
+	case IFT_ETHER:
+	case IFT_CARP:
+		return (ether_ntoa((struct ether_addr *)lla));
+	default:
+		return (link_ntoa(sdl));
+	}
+}
+
+void
+index_pfk(struct sadb_msg *msg, void **headers)
+{
+	struct sadb_ext	*ext;
+
+	for (ext = (struct sadb_ext *)(msg + 1);
+	    (size_t)((u_int8_t *)ext - (u_int8_t *)msg) <
+	    msg->sadb_msg_len * PFKEYV2_CHUNK && ext->sadb_ext_len > 0;
+	    ext = (struct sadb_ext *)((u_int8_t *)ext +
+	    ext->sadb_ext_len * PFKEYV2_CHUNK)) {
+		switch (ext->sadb_ext_type) {
+		case SADB_EXT_ADDRESS_SRC:
+			headers[SADB_EXT_ADDRESS_SRC] = (void *)ext;
+			break;
+		case SADB_EXT_ADDRESS_DST:
+			headers[SADB_EXT_ADDRESS_DST] = (void *)ext;
+			break;
+		case SADB_X_EXT_PROTOCOL:
+			headers[SADB_X_EXT_PROTOCOL] = (void *)ext;
+			break;
+		case SADB_X_EXT_SRC_FLOW:
+			headers[SADB_X_EXT_SRC_FLOW] = (void *)ext;
+			break;
+		case SADB_X_EXT_DST_FLOW:
+			headers[SADB_X_EXT_DST_FLOW] = (void *)ext;
+			break;
+		case SADB_X_EXT_SRC_MASK:
+			headers[SADB_X_EXT_SRC_MASK] = (void *)ext;
+			break;
+		case SADB_X_EXT_DST_MASK:
+			headers[SADB_X_EXT_DST_MASK] = (void *)ext;
+			break;
+		case SADB_X_EXT_FLOW_TYPE:
+			headers[SADB_X_EXT_FLOW_TYPE] = (void *)ext;
+		default:
+			/* Ignore. */
+			break;
+		}
+	}
+}