The Tcpdump Group git mirrors - tcpdump/blob - print-esp.c

   1 /*      $NetBSD: print-ah.c,v 1.4 1996/05/20 00:41:16 fvdl Exp $        */
   2
   3 /*
   4  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994
   5  *      The Regents of the University of California.  All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that: (1) source code distributions
   9  * retain the above copyright notice and this paragraph in its entirety, (2)
  10  * distributions including binary code include the above copyright notice and
  11  * this paragraph in its entirety in the documentation or other materials
  12  * provided with the distribution, and (3) all advertising materials mentioning
  13  * features or use of this software display the following acknowledgement:
  14  * ``This product includes software developed by the University of California,
  15  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
  16  * the University nor the names of its contributors may be used to endorse
  17  * or promote products derived from this software without specific prior
  18  * written permission.
  19  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  20  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  21  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  22  */
  23
  24
  25 #ifdef HAVE_CONFIG_H
  26 #include "config.h"
  27 #endif
  28
  29 #include <string.h>
  30
  31 #include <tcpdump-stdinc.h>
  32
  33 #include <stdlib.h>
  34
  35 #ifdef HAVE_LIBCRYPTO
  36 #ifdef HAVE_OPENSSL_EVP_H
  37 #include <openssl/evp.h>
  38 #endif
  39 #endif
  40
  41 #include <stdio.h>
  42
  43 #include "ip.h"
  44 #include "esp.h"
  45 #ifdef INET6
  46 #include "ip6.h"
  47 #endif
  48
  49 #if defined(__MINGW32__) || defined(__WATCOMC__)
  50 extern char *strsep(char **stringp, const char *delim); /* Missing/strsep.c */
  51 #endif
  52
  53 #include "interface.h"
  54 #include "addrtoname.h"
  55 #include "extract.h"
  56
  57 #ifndef lint
  58 static const char rcsid[] _U_ =
  59     "@(#) $Header: /tcpdump/master/tcpdump/print-esp.c,v 1.45 2003-11-15 00:39:22 guy Exp $ (LBL)";
  60 #endif
  61 #ifndef HAVE_SOCKADDR_STORAGE
  62 #ifdef INET6
  63 struct sockaddr_storage {
  64         union {
  65                 struct sockaddr_in sin;
  66                 struct sockaddr_in6 sin6;
  67         } un;
  68 };
  69 #else
  70 #define sockaddr_storage sockaddr
  71 #endif
  72 #endif /* HAVE_SOCKADDR_STORAGE */
  73
  74 #ifdef HAVE_LIBCRYPTO
  75 struct sa_list {
  76         struct sa_list  *next;
  77         struct sockaddr_storage daddr;
  78         u_int32_t       spi;
  79         const EVP_CIPHER *evp;
  80         int             ivlen;
  81         int             authlen;
  82         char            secret[256];  /* is that big enough for all secrets? */
  83         int             secretlen;
  84 };
  85
  86 static struct sa_list *sa_list_head = NULL;
  87 static struct sa_list *sa_default = NULL;
  88
  89 static void esp_print_addsa(struct sa_list *sa, int sa_def)
  90 {
  91         /* copy the "sa" */
  92
  93         struct sa_list *nsa;
  94
  95         nsa = (struct sa_list *)malloc(sizeof(struct sa_list));
  96         if (nsa == NULL)
  97                 error("ran out of memory to allocate sa structure");
  98
  99         *nsa = *sa;
 100
 101         if (sa_def)
 102                 sa_default = nsa;
 103
 104         nsa->next = sa_list_head;
 105         sa_list_head = nsa;
 106 }
 107
 108
 109 static int hexdigit(char hex)
 110 {
 111         if (hex >= '0' && hex <= '9')
 112                 return (hex - '0');
 113         else if (hex >= 'A' && hex <= 'F')
 114                 return (hex - 'A' + 10);
 115         else if (hex >= 'a' && hex <= 'f')
 116                 return (hex - 'a' + 10);
 117         else {
 118                 printf("invalid hex digit %c in espsecret\n", hex);
 119                 return 0;
 120         }
 121 }
 122
 123 static int hex2byte(char *hexstring)
 124 {
 125         int byte;
 126
 127         byte = (hexdigit(hexstring[0]) << 4) + hexdigit(hexstring[1]);
 128         return byte;
 129 }
 130
 131 /*
 132  * decode the form:    SPINUM@IP <tab> ALGONAME:0xsecret
 133  *
 134  * special form: file /name
 135  * causes us to go read from this file instead.
 136  *
 137  */
 138 static void esp_print_decode_onesecret(char *line)
 139 {
 140         struct sa_list sa1;
 141         int sa_def;
 142
 143         char *spikey;
 144         char *decode;
 145
 146         spikey = strsep(&line, " \t");
 147         sa_def = 0;
 148         memset(&sa1, 0, sizeof(struct sa_list));
 149
 150         /* if there is only one token, then it is an algo:key token */
 151         if (line == NULL) {
 152                 decode = spikey;
 153                 spikey = NULL;
 154                 /* memset(&sa1.daddr, 0, sizeof(sa1.daddr)); */
 155                 /* sa1.spi = 0; */
 156                 sa_def    = 1;
 157         } else
 158                 decode = line;
 159
 160         if (spikey && strcasecmp(spikey, "file") == 0) {
 161                 /* open file and read it */
 162                 FILE *secretfile;
 163                 char  fileline[1024];
 164                 char  *nl;
 165
 166                 secretfile = fopen(line, FOPEN_READ_TXT);
 167                 if (secretfile == NULL) {
 168                         perror(line);
 169                         exit(3);
 170                 }
 171
 172                 while (fgets(fileline, sizeof(fileline)-1, secretfile) != NULL) {
 173                         /* remove newline from the line */
 174                         nl = strchr(fileline, '\n');
 175                         if (nl)
 176                                 *nl = '\0';
 177                         if (fileline[0] == '#') continue;
 178                         if (fileline[0] == '\0') continue;
 179
 180                         esp_print_decode_onesecret(fileline);
 181                 }
 182                 fclose(secretfile);
 183
 184                 return;
 185         }
 186
 187         if (spikey) {
 188                 char *spistr, *foo;
 189                 u_int32_t spino;
 190                 struct sockaddr_in *sin;
 191 #ifdef INET6
 192                 struct sockaddr_in6 *sin6;
 193 #endif
 194
 195                 spistr = strsep(&spikey, "@");
 196
 197                 spino = strtoul(spistr, &foo, 0);
 198                 if (spistr == foo || !spikey) {
 199                         printf("print_esp: failed to decode spi# %s\n", foo);
 200                         return;
 201                 }
 202
 203                 sa1.spi = spino;
 204
 205                 sin = (struct sockaddr_in *)&sa1.daddr;
 206 #ifdef INET6
 207                 sin6 = (struct sockaddr_in6 *)&sa1.daddr;
 208                 if (inet_pton(AF_INET6, spikey, &sin6->sin6_addr) == 1) {
 209 #ifdef HAVE_SOCKADDR_SA_LEN
 210                         sin6->sin6_len = sizeof(struct sockaddr_in6);
 211 #endif
 212                         sin6->sin6_family = AF_INET6;
 213                 } else
 214 #endif
 215                 if (inet_pton(AF_INET, spikey, &sin->sin_addr) == 1) {
 216 #ifdef HAVE_SOCKADDR_SA_LEN
 217                         sin->sin_len = sizeof(struct sockaddr_in);
 218 #endif
 219                         sin->sin_family = AF_INET;
 220                 } else {
 221                         printf("print_esp: can not decode IP# %s\n", spikey);
 222                         return;
 223                 }
 224         }
 225
 226         if (decode) {
 227                 char *colon, *p;
 228                 char  espsecret_key[256];
 229                 int len;
 230                 size_t i;
 231                 const EVP_CIPHER *evp;
 232                 int ivlen = 8;
 233                 int authlen = 0;
 234
 235                 /* skip any blank spaces */
 236                 while (isspace((unsigned char)*decode))
 237                         decode++;
 238
 239                 colon = strchr(decode, ':');
 240                 if (colon == NULL) {
 241                         printf("failed to decode espsecret: %s\n", decode);
 242                         return;
 243                 }
 244                 *colon = '\0';
 245
 246                 len = colon - decode;
 247                 if (strlen(decode) > strlen("-hmac96") &&
 248                     !strcmp(decode + strlen(decode) - strlen("-hmac96"),
 249                     "-hmac96")) {
 250                         p = strstr(decode, "-hmac96");
 251                         *p = '\0';
 252                         authlen = 12;
 253                 }
 254                 if (strlen(decode) > strlen("-cbc") &&
 255                     !strcmp(decode + strlen(decode) - strlen("-cbc"), "-cbc")) {
 256                         p = strstr(decode, "-cbc");
 257                         *p = '\0';
 258                 }
 259                 evp = EVP_get_cipherbyname(decode);
 260                 if (!evp) {
 261                         printf("failed to find cipher algo %s\n", decode);
 262                         sa1.evp = NULL;
 263                         sa1.authlen = 0;
 264                         sa1.ivlen = 0;
 265                         return;
 266                 }
 267
 268                 sa1.evp = evp;
 269                 sa1.authlen = authlen;
 270                 sa1.ivlen = ivlen;
 271
 272                 colon++;
 273                 if (colon[0] == '0' && colon[1] == 'x') {
 274                         /* decode some hex! */
 275                         colon += 2;
 276                         len = strlen(colon) / 2;
 277
 278                         if (len > 256) {
 279                                 printf("secret is too big: %d\n", len);
 280                                 return;
 281                         }
 282
 283                         i = 0;
 284                         while (colon[0] != '\0' && colon[1]!='\0') {
 285                                 espsecret_key[i] = hex2byte(colon);
 286                                 colon += 2;
 287                                 i++;
 288                         }
 289
 290                         memcpy(sa1.secret, espsecret_key, i);
 291                         sa1.secretlen = i;
 292                 } else {
 293                         i = strlen(colon);
 294
 295                         if (i < sizeof(sa1.secret)) {
 296                                 memcpy(sa1.secret, colon, i);
 297                                 sa1.secretlen = i;
 298                         } else {
 299                                 memcpy(sa1.secret, colon, sizeof(sa1.secret));
 300                                 sa1.secretlen = sizeof(sa1.secret);
 301                         }
 302                 }
 303         }
 304
 305         esp_print_addsa(&sa1, sa_def);
 306 }
 307
 308 static void esp_print_decodesecret(void)
 309 {
 310         char *line;
 311         char *p;
 312
 313         p = espsecret;
 314
 315         while (espsecret && espsecret[0] != '\0') {
 316                 /* pick out the first line or first thing until a comma */
 317                 if ((line = strsep(&espsecret, "\n,")) == NULL) {
 318                         line = espsecret;
 319                         espsecret = NULL;
 320                 }
 321
 322                 esp_print_decode_onesecret(line);
 323         }
 324 }
 325
 326 static void esp_init(void)
 327 {
 328
 329         OpenSSL_add_all_algorithms();
 330         EVP_add_cipher_alias(SN_des_ede3_cbc, "3des");
 331 }
 332 #endif
 333
 334 int
 335 esp_print(const u_char *bp, const u_char *bp2
 336 #ifndef HAVE_LIBCRYPTO
 337         _U_
 338 #endif
 339         ,
 340         int *nhdr, int *padlen
 341 #ifndef HAVE_LIBCRYPTO
 342         _U_
 343 #endif
 344         )
 345 {
 346         register const struct newesp *esp;
 347         register const u_char *ep;
 348 #ifdef HAVE_LIBCRYPTO
 349         struct ip *ip;
 350         struct sa_list *sa = NULL;
 351         int espsecret_keylen;
 352 #ifdef INET6
 353         struct ip6_hdr *ip6 = NULL;
 354 #endif
 355         int advance;
 356         int len;
 357         char *secret;
 358         int ivlen = 0;
 359         u_char *ivoff;
 360         const u_char *p;
 361         EVP_CIPHER_CTX ctx;
 362         int blocksz;
 363         static int initialized = 0;
 364 #endif
 365
 366         esp = (struct newesp *)bp;
 367
 368 #ifdef HAVE_LIBCRYPTO
 369         secret = NULL;
 370         advance = 0;
 371
 372         if (!initialized) {
 373                 esp_init();
 374                 initialized = 1;
 375         }
 376 #endif
 377
 378 #if 0
 379         /* keep secret out of a register */
 380         p = (u_char *)&secret;
 381 #endif
 382
 383         /* 'ep' points to the end of available data. */
 384         ep = snapend;
 385
 386         if ((u_char *)(esp + 1) >= ep) {
 387                 fputs("[|ESP]", stdout);
 388                 goto fail;
 389         }
 390         printf("ESP(spi=0x%08x", EXTRACT_32BITS(&esp->esp_spi));
 391         printf(",seq=0x%x", EXTRACT_32BITS(&esp->esp_seq));
 392         printf(")");
 393
 394 #ifndef HAVE_LIBCRYPTO
 395         goto fail;
 396 #else
 397         /* initiailize SAs */
 398         if (sa_list_head == NULL) {
 399                 if (!espsecret)
 400                         goto fail;
 401
 402                 esp_print_decodesecret();
 403         }
 404
 405         if (sa_list_head == NULL)
 406                 goto fail;
 407
 408         ip = (struct ip *)bp2;
 409         switch (IP_V(ip)) {
 410 #ifdef INET6
 411         case 6:
 412                 ip6 = (struct ip6_hdr *)bp2;
 413                 /* we do not attempt to decrypt jumbograms */
 414                 if (!EXTRACT_16BITS(&ip6->ip6_plen))
 415                         goto fail;
 416                 /* if we can't get nexthdr, we do not need to decrypt it */
 417                 len = sizeof(struct ip6_hdr) + EXTRACT_16BITS(&ip6->ip6_plen);
 418
 419                 /* see if we can find the SA, and if so, decode it */
 420                 for (sa = sa_list_head; sa != NULL; sa = sa->next) {
 421                         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&sa->daddr;
 422                         if (sa->spi == ntohl(esp->esp_spi) &&
 423                             sin6->sin6_family == AF_INET6 &&
 424                             memcmp(&sin6->sin6_addr, &ip6->ip6_dst,
 425                                    sizeof(struct in6_addr)) == 0) {
 426                                 break;
 427                         }
 428                 }
 429                 break;
 430 #endif /*INET6*/
 431         case 4:
 432                 /* nexthdr & padding are in the last fragment */
 433                 if (EXTRACT_16BITS(&ip->ip_off) & IP_MF)
 434                         goto fail;
 435                 len = EXTRACT_16BITS(&ip->ip_len);
 436
 437                 /* see if we can find the SA, and if so, decode it */
 438                 for (sa = sa_list_head; sa != NULL; sa = sa->next) {
 439                         struct sockaddr_in *sin = (struct sockaddr_in *)&sa->daddr;
 440                         if (sa->spi == ntohl(esp->esp_spi) &&
 441                             sin->sin_family == AF_INET &&
 442                             sin->sin_addr.s_addr == ip->ip_dst.s_addr) {
 443                                 break;
 444                         }
 445                 }
 446                 break;
 447         default:
 448                 goto fail;
 449         }
 450
 451         /* if we didn't find the specific one, then look for
 452          * an unspecified one.
 453          */
 454         if (sa == NULL)
 455                 sa = sa_default;
 456
 457         /* if not found fail */
 458         if (sa == NULL)
 459                 goto fail;
 460
 461         /* if we can't get nexthdr, we do not need to decrypt it */
 462         if (ep - bp2 < len)
 463                 goto fail;
 464         if (ep - bp2 > len) {
 465                 /* FCS included at end of frame (NetBSD 1.6 or later) */
 466                 ep = bp2 + len;
 467         }
 468
 469         ivoff = (u_char *)(esp + 1) + 0;
 470         ivlen = sa->ivlen;
 471         secret = sa->secret;
 472         espsecret_keylen = sa->secretlen;
 473
 474         if (sa->evp) {
 475                 memset(&ctx, 0, sizeof(ctx));
 476                 if (EVP_CipherInit(&ctx, sa->evp, secret, NULL, 0) < 0)
 477                         printf("espkey init failed");
 478
 479                 blocksz = EVP_CIPHER_CTX_block_size(&ctx);
 480
 481                 p = ivoff;
 482                 EVP_CipherInit(&ctx, NULL, NULL, p, 0);
 483                 EVP_Cipher(&ctx, p + ivlen, p + ivlen, ep - (p + ivlen));
 484                 advance = ivoff - (u_char *)esp + ivlen;
 485         } else
 486                 advance = sizeof(struct newesp);
 487
 488         ep = ep - sa->authlen;
 489         /* sanity check for pad length */
 490         if (ep - bp < *(ep - 2))
 491                 goto fail;
 492
 493         if (padlen)
 494                 *padlen = *(ep - 2) + 2;
 495
 496         if (nhdr)
 497                 *nhdr = *(ep - 1);
 498
 499         printf(": ");
 500         return advance;
 501 #endif
 502
 503 fail:
 504         if (nhdr)
 505                 *nhdr = -1;
 506         return 65536;
 507 }