1 /* $NetBSD: print-ah.c,v 1.4 1996/05/20 00:41:16 fvdl Exp $ */
4 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994
5 * The Regents of the University of California. All rights reserved.
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that: (1) source code distributions
9 * retain the above copyright notice and this paragraph in its entirety, (2)
10 * distributions including binary code include the above copyright notice and
11 * this paragraph in its entirety in the documentation or other materials
12 * provided with the distribution, and (3) all advertising materials mentioning
13 * features or use of this software display the following acknowledgement:
14 * ``This product includes software developed by the University of California,
15 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
16 * the University nor the names of its contributors may be used to endorse
17 * or promote products derived from this software without specific prior
19 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
20 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
21 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
25 static const char rcsid[] =
26 "@(#) $Header: /tcpdump/master/tcpdump/print-esp.c,v 1.5 1999/12/15 08:10:18 fenner Exp $ (LBL)";
34 #include <sys/param.h>
36 #include <sys/types.h>
37 #include <sys/socket.h>
39 #include <net/route.h>
42 #include <netinet/in.h>
43 #include <netinet/if_ether.h>
44 #include <netinet/in_systm.h>
45 #include <netinet/ip.h>
46 #include <netinet/ip_icmp.h>
47 #include <netinet/ip_var.h>
48 #include <netinet/udp.h>
49 #include <netinet/udp_var.h>
50 #include <netinet/tcp.h>
66 #include <netinet/ip6.h>
69 /* there's no standard definition so we are on our own */
71 u_int32_t esp_spi; /* ESP */
72 /*variable size, 32bit bound*/ /* Initialization Vector */
73 /*variable size*/ /* Payload data */
74 /*variable size*/ /* padding */
75 /*8bit*/ /* pad size */
76 /*8bit*/ /* next header */
77 /*8bit*/ /* next header */
78 /*variable size, 32bit bound*/ /* Authentication data (new IPsec) */
82 u_int32_t esp_spi; /* ESP */
83 u_int32_t esp_seq; /* Sequence number */
84 /*variable size*/ /* (IV and) Payload data */
85 /*variable size*/ /* padding */
86 /*8bit*/ /* pad size */
87 /*8bit*/ /* next header */
88 /*8bit*/ /* next header */
89 /*variable size, 32bit bound*/ /* Authentication data */
92 #include "interface.h"
93 #include "addrtoname.h"
96 esp_print(register const u_char *bp, register const u_char *bp2, int *nhdr)
98 register const struct esp *esp;
99 register const u_char *ep;
101 enum { NONE, DESCBC, BLOWFISH, RC5, CAST128, DES3CBC } algo = NONE;
102 struct ip *ip = NULL;
104 struct ip6_hdr *ip6 = NULL;
112 esp = (struct esp *)bp;
113 spi = (u_int32_t)ntohl(esp->esp_spi);
115 /* 'ep' points to the end of avaible data. */
118 if ((u_char *)(esp + 1) >= ep - sizeof(struct esp)) {
119 fputs("[|ESP]", stdout);
122 printf("ESP(spi=%u", spi);
123 printf(",seq=0x%x", (u_int32_t)ntohl(*(u_int32_t *)(esp + 1)));
126 /* if we don't have decryption key, we can't decrypt this packet. */
130 if (strncmp(espsecret, "des-cbc:", 8) == 0
131 && strlen(espsecret + 8) == 8) {
134 secret = espsecret + 8;
135 } else if (strncmp(espsecret, "blowfish-cbc:", 13) == 0) {
138 secret = espsecret + 13;
139 } else if (strncmp(espsecret, "rc5-cbc:", 8) == 0) {
142 secret = espsecret + 8;
143 } else if (strncmp(espsecret, "cast128-cbc:", 12) == 0) {
146 secret = espsecret + 12;
147 } else if (strncmp(espsecret, "3des-cbc:", 9) == 0
148 && strlen(espsecret + 9) == 24) {
151 secret = espsecret + 9;
152 } else if (strncmp(espsecret, "none:", 5) == 0) {
155 secret = espsecret + 5;
156 } else if (strlen(espsecret) == 8) {
166 ip = (struct ip *)bp2;
170 ip6 = (struct ip6_hdr *)bp2;
172 /* we do not attempt to decrypt jumbograms */
173 if (!ntohs(ip6->ip6_plen))
175 /* if we can't get nexthdr, we do not need to decrypt it */
176 len = sizeof(struct ip6_hdr) + ntohs(ip6->ip6_plen);
183 len = ntohs(ip->ip_len);
189 /* if we can't get nexthdr, we do not need to decrypt it */
194 ivoff = (u_char *)(esp + 1) + sizeof(u_int32_t);
196 ivoff = (u_char *)(esp + 1);
203 des_key_schedule schedule;
208 memcpy(iv, ivoff, 4);
209 memcpy(&iv[4], ivoff, 4);
217 memcpy(iv, ivoff, 8);
224 des_set_key((void *)secret, schedule);
227 des_cbc_encrypt((void *)p, (void *)p,
228 (long)(ep - p), schedule, (void *)iv,
230 advance = ivoff - (u_char *)esp + ivlen;
243 BF_set_key(&schedule, strlen(secret), secret);
246 BF_cbc_encrypt(p, p, (long)(ep - p), &schedule, ivoff,
248 advance = ivoff - (u_char *)esp + ivlen;
256 #if defined(CRYPTO) && defined(HAVE_RC5_H)
261 RC5_32_set_key(&schedule, strlen(secret), secret,
265 RC5_32_cbc_encrypt(p, p, (long)(ep - p), &schedule, ivoff,
267 advance = ivoff - (u_char *)esp + ivlen;
275 #if defined(CRYPTO) && defined(HAVE_CAST_H) && !defined(HAVE_BUGGY_CAST128)
280 CAST_set_key(&schedule, strlen(secret), secret);
283 CAST_cbc_encrypt(p, p, (long)(ep - p), &schedule, ivoff,
285 advance = ivoff - (u_char *)esp + ivlen;
295 des_key_schedule s1, s2, s3;
299 des_set_key((void *)secret, s1);
300 des_set_key((void *)(secret + 8), s2);
301 des_set_key((void *)(secret + 16), s3);
304 des_ede3_cbc_encrypt((void *)p, (void *)p,
305 (long)(ep - p), s1, s2, s3, (void *)ivoff, DES_DECRYPT);
306 advance = ivoff - (u_char *)esp + ivlen;
316 advance = sizeof(struct esp) + sizeof(u_int32_t);
318 advance = sizeof(struct esp);
322 /* sanity check for pad length */
323 if (ep - bp < *(ep - 2))