From 9d2d8e7bec5a703cba822e5e1e355477ed116584 Mon Sep 17 00:00:00 2001
From: "George V. Neville-Neil" <gnn@FreeBSD.org>
Date: Thu, 17 Dec 2015 02:02:09 +0000
Subject: [PATCH] Switch the IPsec related statistics to using the built in
 sysctl variable set rather than reading from kernel memory. This also makes
 the -z (zero) flag work correctly

MFC after:	1 week
Sponsored by: Rubicon Communications, LLC (Netgate)
Differential Revision:	https://reviews.freebsd.org/D4591
---
 usr.bin/netstat/ipsec.c | 28 +++++++++++++++++++---------
 usr.bin/netstat/main.c  | 10 +++++-----
 2 files changed, 24 insertions(+), 14 deletions(-)

diff --git a/usr.bin/netstat/ipsec.c b/usr.bin/netstat/ipsec.c
index f3309ff13fa..1347a937438 100644
--- a/usr.bin/netstat/ipsec.c
+++ b/usr.bin/netstat/ipsec.c
@@ -216,10 +216,17 @@ ipsec_stats(u_long off, const char *name, int af1 __unused, int proto __unused)
 {
 	struct ipsecstat ipsecstat;
 
-	if (off == 0)
-		return;
+	if (strcmp(name, "ipsec6") == 0) {
+		if (fetch_stats("net.inet6.ipsec6.ipsecstats", off,&ipsecstat,
+				sizeof(ipsecstat), kread_counters) != 0)
+			return;
+	} else {
+		if (fetch_stats("net.inet.ipsec.ipsecstats", off, &ipsecstat,
+				sizeof(ipsecstat), kread_counters) != 0)
+			return;
+	}
+
 	xo_emit("{T:/%s}:\n", name);
-	kread_counters(off, (char *)&ipsecstat, sizeof(ipsecstat));
 
 	print_ipsecstats(&ipsecstat);
 }
@@ -318,10 +325,11 @@ ah_stats(u_long off, const char *name, int family __unused, int proto __unused)
 {
 	struct ahstat ahstat;
 
-	if (off == 0)
+	if (fetch_stats("net.inet.ah.stats", off, &ahstat,
+	    sizeof(ahstat), kread_counters) != 0)
 		return;
+
 	xo_emit("{T:/%s}:\n", name);
-	kread_counters(off, (char *)&ahstat, sizeof(ahstat));
 
 	print_ahstats(&ahstat);
 }
@@ -377,10 +385,11 @@ esp_stats(u_long off, const char *name, int family __unused, int proto __unused)
 {
 	struct espstat espstat;
 
-	if (off == 0)
+	if (fetch_stats("net.inet.esp.stats", off, &espstat,
+	    sizeof(espstat), kread_counters) != 0)
 		return;
+
 	xo_emit("{T:/%s}:\n", name);
-	kread_counters(off, (char *)&espstat, sizeof(espstat));
 
 	print_espstats(&espstat);
 }
@@ -434,10 +443,11 @@ ipcomp_stats(u_long off, const char *name, int family __unused,
 {
 	struct ipcompstat ipcompstat;
 
-	if (off == 0)
+	if (fetch_stats("net.inet.ipcomp.stats", off, &ipcompstat,
+	    sizeof(ipcompstat), kread_counters) != 0)
 		return;
+
 	xo_emit("{T:/%s}:\n", name);
-	kread_counters(off, (char *)&ipcompstat, sizeof(ipcompstat));
 
 	print_ipcompstats(&ipcompstat);
 }
diff --git a/usr.bin/netstat/main.c b/usr.bin/netstat/main.c
index ce9e81aeb76..e8cf914ae50 100644
--- a/usr.bin/netstat/main.c
+++ b/usr.bin/netstat/main.c
@@ -108,13 +108,13 @@ static struct protox {
 	  igmp_stats,	NULL,		"igmp",	1,	IPPROTO_IGMP },
 #ifdef IPSEC
 	{ -1,		N_IPSEC4STAT,	1,	NULL,	/* keep as compat */
-	  ipsec_stats,	NULL,		"ipsec", 0,	0},
+	  ipsec_stats,	NULL,		"ipsec", 1,	0},
 	{ -1,		N_AHSTAT,	1,	NULL,
-	  ah_stats,	NULL,		"ah",	0,	0},
+	  ah_stats,	NULL,		"ah",	1,	0},
 	{ -1,		N_ESPSTAT,	1,	NULL,
-	  esp_stats,	NULL,		"esp",	0,	0},
+	  esp_stats,	NULL,		"esp",	1,	0},
 	{ -1,		N_IPCOMPSTAT,	1,	NULL,
-	  ipcomp_stats,	NULL,		"ipcomp", 0,	0},
+	  ipcomp_stats,	NULL,		"ipcomp", 1,	0},
 #endif
 	{ N_RIPCBINFO,	N_PIMSTAT,	1,	protopr,
 	  pim_stats,	NULL,		"pim",	1,	IPPROTO_PIM },
@@ -146,7 +146,7 @@ static struct protox ip6protox[] = {
 #endif
 #ifdef IPSEC
 	{ -1,		N_IPSEC6STAT,	1,	NULL,
-	  ipsec_stats,	NULL,		"ipsec6", 0,	0 },
+	  ipsec_stats,	NULL,		"ipsec6", 1,	0 },
 #endif
 #ifdef notyet
 	{ -1,		N_PIM6STAT,	1,	NULL,