1 /* $NetBSD: print-ah.c,v 1.4 1996/05/20 00:41:16 fvdl Exp $ */
4 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994
5 * The Regents of the University of California. All rights reserved.
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that: (1) source code distributions
9 * retain the above copyright notice and this paragraph in its entirety, (2)
10 * distributions including binary code include the above copyright notice and
11 * this paragraph in its entirety in the documentation or other materials
12 * provided with the distribution, and (3) all advertising materials mentioning
13 * features or use of this software display the following acknowledgement:
14 * ``This product includes software developed by the University of California,
15 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
16 * the University nor the names of its contributors may be used to endorse
17 * or promote products derived from this software without specific prior
19 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
20 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
21 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
25 static const char rcsid[] =
26 "@(#) $Header: /tcpdump/master/tcpdump/print-esp.c,v 1.20.4.2 2002/02/22 09:26:27 guy Exp $ (LBL)";
34 #include <sys/param.h>
36 #include <sys/types.h>
37 #include <sys/socket.h>
40 #include <netinet/in.h>
43 #include <openssl/des.h>
44 #include <openssl/blowfish.h>
46 #include <openssl/rc5.h>
49 #include <openssl/cast.h>
62 #include "interface.h"
63 #include "addrtoname.h"
65 static struct esp_algorithm *espsecret_xform=NULL; /* cache of decoded alg. */
66 static char *espsecret_key=NULL;
78 struct esp_algorithm {
86 struct esp_algorithm esp_xforms[]={
87 {"none", NONE, 0, 0, 0},
88 {"des-cbc", DESCBC, 8, 0, 0},
89 {"des-cbc-hmac96", DESCBC, 8, 12, 4},
90 {"blowfish-cbc", BLOWFISH,8, 0, 0},
91 {"blowfish-cbc-hmac96", BLOWFISH,8, 12, 4},
92 {"rc5-cbc", RC5, 8, 0, 0},
93 {"rc5-cbc-hmac96", RC5, 8, 12, 4},
94 {"cast128-cbc", CAST128, 8, 0, 0},
95 {"cast128-cbc-hmac96", CAST128, 8, 12, 4},
96 {"3des-cbc-hmac96", DES3CBC, 8, 12, 4},
99 static int hexdigit(char hex)
101 if(hex >= '0' && hex <= '9') {
103 } else if(hex >= 'A' && hex <= 'F') {
104 return (hex - 'A' + 10);
105 } else if(hex >= 'a' && hex <= 'f') {
106 return (hex - 'a' + 10);
108 printf("invalid hex digit %c in espsecret\n", hex);
113 static int hex2byte(char *hexstring)
117 byte = (hexdigit(hexstring[0]) << 4) +
118 hexdigit(hexstring[1]);
123 static void esp_print_decodesecret(void)
127 struct esp_algorithm *xf;
129 if(espsecret == NULL) {
130 /* set to NONE transform */
131 espsecret_xform = esp_xforms;
135 if(espsecret_key != NULL) {
139 colon = strchr(espsecret, ':');
141 printf("failed to decode espsecret: %s\n",
143 /* set to NONE transform */
144 espsecret_xform = esp_xforms;
147 len = colon - espsecret;
149 while(xf->name && strncasecmp(espsecret, xf->name, len)!=0) {
152 if(xf->name == NULL) {
153 printf("failed to find cipher algo %s\n",
155 espsecret_xform = esp_xforms;
158 espsecret_xform = xf;
161 if(colon[0]=='0' && colon[1]=='x') {
162 /* decode some hex! */
164 len = strlen(colon) / 2;
165 espsecret_key = (char *)malloc(len);
166 if(espsecret_key == NULL) {
167 fprintf(stderr, "%s: ran out of memory (%d) to allocate secret key\n",
172 while(colon[0] != '\0' && colon[1]!='\0') {
173 espsecret_key[i]=hex2byte(colon);
178 espsecret_key = colon;
183 esp_print(register const u_char *bp, register const u_char *bp2,
184 int *nhdr, int *padlen)
186 register const struct esp *esp;
187 register const u_char *ep;
189 struct ip *ip = NULL;
191 struct ip6_hdr *ip6 = NULL;
200 esp = (struct esp *)bp;
201 spi = (u_int32_t)ntohl(esp->esp_spi);
205 /* keep secret out of a register */
206 p = (u_char *)&secret;
209 /* 'ep' points to the end of available data. */
212 if ((u_char *)(esp + 1) >= ep - sizeof(struct esp)) {
213 fputs("[|ESP]", stdout);
216 printf("ESP(spi=0x%08x", spi);
217 printf(",seq=0x%x", (u_int32_t)ntohl(*(u_int32_t *)(esp + 1)));
220 /* if we don't have decryption key, we can't decrypt this packet. */
224 if(!espsecret_xform) {
225 esp_print_decodesecret();
227 if(espsecret_xform->algo == NONE) {
231 ip = (struct ip *)bp2;
235 ip6 = (struct ip6_hdr *)bp2;
237 /* we do not attempt to decrypt jumbograms */
238 if (!ntohs(ip6->ip6_plen))
240 /* if we can't get nexthdr, we do not need to decrypt it */
241 len = sizeof(struct ip6_hdr) + ntohs(ip6->ip6_plen);
245 /* nexthdr & padding are in the last fragment */
246 if (ntohs(ip->ip_off) & IP_MF)
251 len = ntohs(ip->ip_len);
257 /* if we can't get nexthdr, we do not need to decrypt it */
261 ivoff = (u_char *)(esp + 1) + espsecret_xform->replaysize;
262 ivlen = espsecret_xform->ivlen;
263 secret = espsecret_key;
265 switch (espsecret_xform->algo) {
267 #ifdef HAVE_LIBCRYPTO
270 des_key_schedule schedule;
274 memcpy(iv, ivoff, 4);
275 memcpy(&iv[4], ivoff, 4);
283 memcpy(iv, ivoff, 8);
290 des_set_key((void *)secret, schedule);
293 des_cbc_encrypt((void *)p, (void *)p,
294 (long)(ep - p), schedule, (void *)iv,
296 advance = ivoff - (u_char *)esp + ivlen;
301 #endif /*HAVE_LIBCRYPTO*/
304 #ifdef HAVE_LIBCRYPTO
308 BF_set_key(&schedule, strlen(secret), secret);
311 BF_cbc_encrypt(p, p, (long)(ep - p), &schedule, ivoff,
313 advance = ivoff - (u_char *)esp + ivlen;
318 #endif /*HAVE_LIBCRYPTO*/
321 #if defined(HAVE_LIBCRYPTO) && defined(HAVE_RC5_H)
325 RC5_32_set_key(&schedule, strlen(secret), secret,
329 RC5_32_cbc_encrypt(p, p, (long)(ep - p), &schedule, ivoff,
331 advance = ivoff - (u_char *)esp + ivlen;
336 #endif /*HAVE_LIBCRYPTO*/
339 #if defined(HAVE_LIBCRYPTO) && defined(HAVE_CAST_H) && !defined(HAVE_BUGGY_CAST128)
343 CAST_set_key(&schedule, strlen(secret), secret);
346 CAST_cbc_encrypt(p, p, (long)(ep - p), &schedule, ivoff,
348 advance = ivoff - (u_char *)esp + ivlen;
353 #endif /*HAVE_LIBCRYPTO*/
356 #if defined(HAVE_LIBCRYPTO)
358 des_key_schedule s1, s2, s3;
361 des_set_odd_parity((void *)secret);
362 des_set_odd_parity((void *)(secret + 8));
363 des_set_odd_parity((void *)(secret + 16));
364 if(des_set_key((void *)secret, s1) != 0) {
365 printf("failed to schedule key 1\n");
367 if(des_set_key((void *)(secret + 8), s2)!=0) {
368 printf("failed to schedule key 2\n");
370 if(des_set_key((void *)(secret + 16), s3)!=0) {
371 printf("failed to schedule key 3\n");
375 des_ede3_cbc_encrypt((void *)p, (void *)p,
378 (void *)ivoff, DES_DECRYPT);
379 advance = ivoff - (u_char *)esp + ivlen;
384 #endif /*HAVE_LIBCRYPTO*/
388 advance = sizeof(struct esp) + espsecret_xform->replaysize;
392 ep = ep - espsecret_xform->authlen;
393 /* sanity check for pad length */
394 if (ep - bp < *(ep - 2))
398 *padlen = *(ep - 2) + 2;