]> The Tcpdump Group git mirrors - tcpdump/blobdiff - print-esp.c
projects / tcpdump / blobdiff
summary | shortlog | log | commit | commitdiff | tree
raw | inline | side by side
When checking for pcap_if_t, add $V_INCLS to CFLAGS, so we look at the
[tcpdump] / print-esp.c
diff --git a/print-esp.c b/print-esp.c
index 0166a85a497d5e0538d3663e07fd87a254a77ee5..25303e30d4457aa71fd851f821e0238da0859a8b 100644 (file)
--- a/print-esp.c
+++ b/print-esp.c
@@ -22,8 +22,8 @@
  */
 
 #ifndef lint
  */
 
 #ifndef lint
-static const char rcsid[] =
-    "@(#) $Header: /tcpdump/master/tcpdump/print-esp.c,v 1.40 2003-07-17 11:01:06 itojun Exp $ (LBL)";
+static const char rcsid[] _U_ =
+    "@(#) $Header: /tcpdump/master/tcpdump/print-esp.c,v 1.51 2004-04-10 08:41:22 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -37,13 +37,8 @@ static const char rcsid[] =
 #include <stdlib.h>
 
 #ifdef HAVE_LIBCRYPTO
 #include <stdlib.h>
 
 #ifdef HAVE_LIBCRYPTO
-#include <openssl/des.h>
-#include <openssl/blowfish.h>
-#ifdef HAVE_OPENSSL_RC5_H
-#include <openssl/rc5.h>
-#endif
-#ifdef HAVE_OPENSSL_CAST_H
-#include <openssl/cast.h>
+#ifdef HAVE_OPENSSL_EVP_H
+#include <openssl/evp.h>
 #endif
 #endif
 
 #endif
 #endif
 
@@ -56,41 +51,13 @@ static const char rcsid[] =
 #endif
 
 #if defined(__MINGW32__) || defined(__WATCOMC__)
 #endif
 
 #if defined(__MINGW32__) || defined(__WATCOMC__)
-extern char *strsep (char **stringp, const char *delim); /* Missing/strsep.c */
+extern char *strsep(char **stringp, const char *delim); /* Missing/strsep.c */
 #endif
 
 #endif
 
-#include "interface.h"
+#include "netdissect.h"
 #include "addrtoname.h"
 #include "extract.h"
 
 #include "addrtoname.h"
 #include "extract.h"
 
-enum cipher { NONE, DESCBC, BLOWFISH, RC5, CAST128, DES3CBC};
-
-struct esp_algorithm {
-       const char      *name;
-       enum cipher     algo;
-       int             ivlen;
-       int             authlen;
-       int             replaysize;     /* number of bytes, in excess of 4,
-                                          may be negative */
-};
-
-struct esp_algorithm esp_xforms[]={
-       {"none",                  NONE,    0,  0, 0},
-       {"des-cbc",               DESCBC,  8,  0, 0},
-       {"des-cbc-hmac96",        DESCBC,  8, 12, 0},
-       {"blowfish-cbc",          BLOWFISH,8,  0, 0},
-       {"blowfish-cbc-hmac96",   BLOWFISH,8, 12, 0},
-       {"rc5-cbc",               RC5,     8,  0, 0},
-       {"rc5-cbc-hmac96",        RC5,     8, 12, 0},
-       {"cast128-cbc",           CAST128, 8,  0, 0},
-       {"cast128-cbc-hmac96",    CAST128, 8, 12, 0},
-       {"3des-cbc-hmac96",       DES3CBC, 8, 12, 0},
-       {NULL,                    NONE,    0,  0, 0}
-};
-
-struct esp_algorithm *null_xf =
-  &esp_xforms[sizeof(esp_xforms)/sizeof(esp_xforms[0]) - 1];
-
 #ifndef HAVE_SOCKADDR_STORAGE
 #ifdef INET6
 struct sockaddr_storage {
 #ifndef HAVE_SOCKADDR_STORAGE
 #ifdef INET6
 struct sockaddr_storage {
@@ -104,19 +71,20 @@ struct sockaddr_storage {
 #endif
 #endif /* HAVE_SOCKADDR_STORAGE */
 
 #endif
 #endif /* HAVE_SOCKADDR_STORAGE */
 
+#ifdef HAVE_LIBCRYPTO
 struct sa_list {
        struct sa_list  *next;
        struct sockaddr_storage daddr;
        u_int32_t       spi;
 struct sa_list {
        struct sa_list  *next;
        struct sockaddr_storage daddr;
        u_int32_t       spi;
-       struct esp_algorithm *xform;
+       const EVP_CIPHER *evp;
+       int             ivlen;
+       int             authlen;
        char            secret[256];  /* is that big enough for all secrets? */
        int             secretlen;
 };
 
        char            secret[256];  /* is that big enough for all secrets? */
        int             secretlen;
 };
 
-static struct sa_list *sa_list_head = NULL;
-static struct sa_list *sa_default = NULL;
-
-static void esp_print_addsa(struct sa_list *sa, int sa_def)
+static void esp_print_addsa(netdissect_options *ndo,
+                           struct sa_list *sa, int sa_def)
 {
        /* copy the "sa" */
 
 {
        /* copy the "sa" */
 
@@ -124,19 +92,19 @@ static void esp_print_addsa(struct sa_list *sa, int sa_def)
 
        nsa = (struct sa_list *)malloc(sizeof(struct sa_list));
        if (nsa == NULL)
 
        nsa = (struct sa_list *)malloc(sizeof(struct sa_list));
        if (nsa == NULL)
-               error("ran out of memory to allocate sa structure");
+               (*ndo->ndo_error)(ndo, "ran out of memory to allocate sa structure");
 
        *nsa = *sa;
 
        if (sa_def)
 
        *nsa = *sa;
 
        if (sa_def)
-               sa_default = nsa;
+               ndo->ndo_sa_default = nsa;
 
 
-       nsa->next = sa_list_head;
-       sa_list_head = nsa;
+       nsa->next = ndo->ndo_sa_list_head;
+       ndo->ndo_sa_list_head = nsa;
 }
 }
- 
 
 
-static int hexdigit(char hex)
+
+static int hexdigit(netdissect_options *ndo, char hex)
 {
        if (hex >= '0' && hex <= '9')
                return (hex - '0');
 {
        if (hex >= '0' && hex <= '9')
                return (hex - '0');
@@ -145,29 +113,28 @@ static int hexdigit(char hex)
        else if (hex >= 'a' && hex <= 'f')
                return (hex - 'a' + 10);
        else {
        else if (hex >= 'a' && hex <= 'f')
                return (hex - 'a' + 10);
        else {
-               printf("invalid hex digit %c in espsecret\n", hex);
+               (*ndo->ndo_error)(ndo, "invalid hex digit %c in espsecret\n", hex);
                return 0;
        }
 }
 
                return 0;
        }
 }
 
-static int hex2byte(char *hexstring)
+static int hex2byte(netdissect_options *ndo, char *hexstring)
 {
        int byte;
 
 {
        int byte;
 
-       byte = (hexdigit(hexstring[0]) << 4) + hexdigit(hexstring[1]);
+       byte = (hexdigit(ndo, hexstring[0]) << 4) + hexdigit(ndo, hexstring[1]);
        return byte;
 }
 
        return byte;
 }
 
-/* 
+/*
  * decode the form:    SPINUM@IP <tab> ALGONAME:0xsecret
  *
  * decode the form:    SPINUM@IP <tab> ALGONAME:0xsecret
  *
- * special form: file /name 
+ * special form: file /name
  * causes us to go read from this file instead.
  *
  */
  * causes us to go read from this file instead.
  *
  */
-static void esp_print_decode_onesecret(char *line)
+static void esp_print_decode_onesecret(netdissect_options *ndo, char *line)
 {
 {
-       struct esp_algorithm *xf;
        struct sa_list sa1;
        int sa_def;
 
        struct sa_list sa1;
        int sa_def;
 
@@ -208,7 +175,7 @@ static void esp_print_decode_onesecret(char *line)
                        if (fileline[0] == '#') continue;
                        if (fileline[0] == '\0') continue;
 
                        if (fileline[0] == '#') continue;
                        if (fileline[0] == '\0') continue;
 
-                       esp_print_decode_onesecret(fileline);
+                       esp_print_decode_onesecret(ndo, fileline);
                }
                fclose(secretfile);
 
                }
                fclose(secretfile);
 
@@ -227,7 +194,7 @@ static void esp_print_decode_onesecret(char *line)
 
                spino = strtoul(spistr, &foo, 0);
                if (spistr == foo || !spikey) {
 
                spino = strtoul(spistr, &foo, 0);
                if (spistr == foo || !spikey) {
-                       printf("print_esp: failed to decode spi# %s\n", foo);
+                       (*ndo->ndo_warning)(ndo, "print_esp: failed to decode spi# %s\n", foo);
                        return;
                }
 
                        return;
                }
 
@@ -249,15 +216,18 @@ static void esp_print_decode_onesecret(char *line)
 #endif
                        sin->sin_family = AF_INET;
                } else {
 #endif
                        sin->sin_family = AF_INET;
                } else {
-                       printf("print_esp: can not decode IP# %s\n", spikey);
+                       (*ndo->ndo_warning)(ndo, "print_esp: can not decode IP# %s\n", spikey);
                        return;
                }
        }
 
        if (decode) {
                        return;
                }
        }
 
        if (decode) {
-               char *colon;
+               char *colon, *p;
                char  espsecret_key[256];
                char  espsecret_key[256];
-               unsigned int   len, i;
+               int len;
+               size_t i;
+               const EVP_CIPHER *evp;
+               int authlen = 0;
 
                /* skip any blank spaces */
                while (isspace((unsigned char)*decode))
 
                /* skip any blank spaces */
                while (isspace((unsigned char)*decode))
@@ -265,20 +235,36 @@ static void esp_print_decode_onesecret(char *line)
 
                colon = strchr(decode, ':');
                if (colon == NULL) {
 
                colon = strchr(decode, ':');
                if (colon == NULL) {
-                       printf("failed to decode espsecret: %s\n", decode);
+                       (*ndo->ndo_warning)(ndo, "failed to decode espsecret: %s\n", decode);
                        return;
                }
                        return;
                }
+               *colon = '\0';
 
                len = colon - decode;
 
                len = colon - decode;
-               xf = esp_xforms;
-               while (xf->name && strncasecmp(decode, xf->name, len) != 0)
-                       xf++;
-               if (xf->name == NULL) {
-                       printf("failed to find cipher algo %s\n", decode);
-                       /* set to NULL transform */
+               if (strlen(decode) > strlen("-hmac96") &&
+                   !strcmp(decode + strlen(decode) - strlen("-hmac96"),
+                   "-hmac96")) {
+                       p = strstr(decode, "-hmac96");
+                       *p = '\0';
+                       authlen = 12;
+               }
+               if (strlen(decode) > strlen("-cbc") &&
+                   !strcmp(decode + strlen(decode) - strlen("-cbc"), "-cbc")) {
+                       p = strstr(decode, "-cbc");
+                       *p = '\0';
+               }
+               evp = EVP_get_cipherbyname(decode);
+               if (!evp) {
+                       (*ndo->ndo_warning)(ndo, "failed to find cipher algo %s\n", decode);
+                       sa1.evp = NULL;
+                       sa1.authlen = 0;
+                       sa1.ivlen = 0;
                        return;
                }
                        return;
                }
-               sa1.xform = xf;
+
+               sa1.evp = evp;
+               sa1.authlen = authlen;
+               sa1.ivlen = EVP_CIPHER_iv_length(evp);
 
                colon++;
                if (colon[0] == '0' && colon[1] == 'x') {
 
                colon++;
                if (colon[0] == '0' && colon[1] == 'x') {
@@ -287,67 +273,82 @@ static void esp_print_decode_onesecret(char *line)
                        len = strlen(colon) / 2;
 
                        if (len > 256) {
                        len = strlen(colon) / 2;
 
                        if (len > 256) {
-                               printf("secret is too big: %d\n", len);
+                               (*ndo->ndo_warning)(ndo, "secret is too big: %d\n", len);
                                return;
                        }
 
                        i = 0;
                        while (colon[0] != '\0' && colon[1]!='\0') {
                                return;
                        }
 
                        i = 0;
                        while (colon[0] != '\0' && colon[1]!='\0') {
-                               espsecret_key[i] = hex2byte(colon);
+                               espsecret_key[i] = hex2byte(ndo, colon);
                                colon += 2;
                                i++;
                        }
                                colon += 2;
                                i++;
                        }
+
                        memcpy(sa1.secret, espsecret_key, i);
                        memcpy(sa1.secret, espsecret_key, i);
-                       sa1.secretlen=i;
+                       sa1.secretlen = i;
                } else {
                        i = strlen(colon);
                } else {
                        i = strlen(colon);
+
                        if (i < sizeof(sa1.secret)) {
                        if (i < sizeof(sa1.secret)) {
-                               memcpy(sa1.secret, espsecret_key, i);
+                               memcpy(sa1.secret, colon, i);
                                sa1.secretlen = i;
                        } else {
                                sa1.secretlen = i;
                        } else {
-                               memcpy(sa1.secret, espsecret_key,
-                                   sizeof(sa1.secret));
+                               memcpy(sa1.secret, colon, sizeof(sa1.secret));
                                sa1.secretlen = sizeof(sa1.secret);
                        }
                }
        }
 
                                sa1.secretlen = sizeof(sa1.secret);
                        }
                }
        }
 
-       esp_print_addsa(&sa1, sa_def);
+       esp_print_addsa(ndo, &sa1, sa_def);
 }
 
 }
 
-
-static void esp_print_decodesecret(void)
+static void esp_print_decodesecret(netdissect_options *ndo)
 {
        char *line;
        char *p;
 
 {
        char *line;
        char *p;
 
-       if (espsecret == NULL) {
-               sa_list_head = NULL;
-               return;
-       }
-
-       if (sa_list_head != NULL)
-               return;
+       p = ndo->ndo_espsecret;
 
 
-       p = espsecret;
-
-       while (espsecret && espsecret[0] != '\0') { 
+       while (ndo->ndo_espsecret && ndo->ndo_espsecret[0] != '\0') {
                /* pick out the first line or first thing until a comma */
                /* pick out the first line or first thing until a comma */
-               if ((line = strsep(&espsecret, "\n,")) == NULL) {
-                       line = espsecret;
-                       espsecret = NULL;
+               if ((line = strsep(&ndo->ndo_espsecret, "\n,")) == NULL) {
+                       line = ndo->ndo_espsecret;
+                       ndo->ndo_espsecret = NULL;
                }
 
                }
 
-               esp_print_decode_onesecret(line);
+               esp_print_decode_onesecret(ndo, line);
        }
 }
 
        }
 }
 
+static void esp_init(netdissect_options *ndo _U_)
+{
+
+       OpenSSL_add_all_algorithms();
+       EVP_add_cipher_alias(SN_des_ede3_cbc, "3des");
+}
+#endif
+
 int
 int
-esp_print(register const u_char *bp, register const u_char *bp2,
-         int *nhdr, int *padlen)
+esp_print(netdissect_options *ndo,
+         const u_char *bp, const u_char *bp2
+#ifndef HAVE_LIBCRYPTO
+       _U_
+#endif
+       ,
+       int *nhdr
+#ifndef HAVE_LIBCRYPTO
+       _U_
+#endif
+       ,
+       int *padlen
+#ifndef HAVE_LIBCRYPTO
+       _U_
+#endif
+       )
 {
        register const struct newesp *esp;
        register const u_char *ep;
 {
        register const struct newesp *esp;
        register const u_char *ep;
+#ifdef HAVE_LIBCRYPTO
        struct ip *ip;
        struct sa_list *sa = NULL;
        int espsecret_keylen;
        struct ip *ip;
        struct sa_list *sa = NULL;
        int espsecret_keylen;
@@ -359,38 +360,51 @@ esp_print(register const u_char *bp, register const u_char *bp2,
        char *secret;
        int ivlen = 0;
        u_char *ivoff;
        char *secret;
        int ivlen = 0;
        u_char *ivoff;
-#ifdef HAVE_LIBCRYPTO
        u_char *p;
        u_char *p;
+       EVP_CIPHER_CTX ctx;
+       int blocksz;
+       static int initialized = 0;
 #endif
 
        esp = (struct newesp *)bp;
 #endif
 
        esp = (struct newesp *)bp;
+
+#ifdef HAVE_LIBCRYPTO
        secret = NULL;
        advance = 0;
 
        secret = NULL;
        advance = 0;
 
+       if (!initialized) {
+               esp_init(ndo);
+               initialized = 1;
+       }
+#endif
+
 #if 0
        /* keep secret out of a register */
        p = (u_char *)&secret;
 #endif
 
        /* 'ep' points to the end of available data. */
 #if 0
        /* keep secret out of a register */
        p = (u_char *)&secret;
 #endif
 
        /* 'ep' points to the end of available data. */
-       ep = snapend;
+       ep = ndo->ndo_snapend;
 
        if ((u_char *)(esp + 1) >= ep) {
                fputs("[|ESP]", stdout);
                goto fail;
        }
 
        if ((u_char *)(esp + 1) >= ep) {
                fputs("[|ESP]", stdout);
                goto fail;
        }
-       printf("ESP(spi=0x%08x", EXTRACT_32BITS(&esp->esp_spi));
-       printf(",seq=0x%x", EXTRACT_32BITS(&esp->esp_seq));
-       printf(")");
+       (*ndo->ndo_printf)(ndo, "ESP(spi=0x%08x", EXTRACT_32BITS(&esp->esp_spi));
+       (*ndo->ndo_printf)(ndo, ",seq=0x%x)", EXTRACT_32BITS(&esp->esp_seq));
 
 
-       /* if we don't have decryption key, we can't decrypt this packet. */
-       if (sa_list_head == NULL) {
-               if (!espsecret)
+#ifndef HAVE_LIBCRYPTO
+       goto fail;
+#else
+       /* initiailize SAs */
+       if (ndo->ndo_sa_list_head == NULL) {
+               if (!ndo->ndo_espsecret)
                        goto fail;
                        goto fail;
-               esp_print_decodesecret();
+
+               esp_print_decodesecret(ndo);
        }
 
        }
 
-       if (sa_list_head == NULL)
+       if (ndo->ndo_sa_list_head == NULL)
                goto fail;
 
        ip = (struct ip *)bp2;
                goto fail;
 
        ip = (struct ip *)bp2;
@@ -405,7 +419,7 @@ esp_print(register const u_char *bp, register const u_char *bp2,
                len = sizeof(struct ip6_hdr) + EXTRACT_16BITS(&ip6->ip6_plen);
 
                /* see if we can find the SA, and if so, decode it */
                len = sizeof(struct ip6_hdr) + EXTRACT_16BITS(&ip6->ip6_plen);
 
                /* see if we can find the SA, and if so, decode it */
-               for (sa = sa_list_head; sa != NULL; sa = sa->next) {
+               for (sa = ndo->ndo_sa_list_head; sa != NULL; sa = sa->next) {
                        struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&sa->daddr;
                        if (sa->spi == ntohl(esp->esp_spi) &&
                            sin6->sin6_family == AF_INET6 &&
                        struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&sa->daddr;
                        if (sa->spi == ntohl(esp->esp_spi) &&
                            sin6->sin6_family == AF_INET6 &&
@@ -423,7 +437,7 @@ esp_print(register const u_char *bp, register const u_char *bp2,
                len = EXTRACT_16BITS(&ip->ip_len);
 
                /* see if we can find the SA, and if so, decode it */
                len = EXTRACT_16BITS(&ip->ip_len);
 
                /* see if we can find the SA, and if so, decode it */
-               for (sa = sa_list_head; sa != NULL; sa = sa->next) {
+               for (sa = ndo->ndo_sa_list_head; sa != NULL; sa = sa->next) {
                        struct sockaddr_in *sin = (struct sockaddr_in *)&sa->daddr;
                        if (sa->spi == ntohl(esp->esp_spi) &&
                            sin->sin_family == AF_INET &&
                        struct sockaddr_in *sin = (struct sockaddr_in *)&sa->daddr;
                        if (sa->spi == ntohl(esp->esp_spi) &&
                            sin->sin_family == AF_INET &&
@@ -439,9 +453,8 @@ esp_print(register const u_char *bp, register const u_char *bp2,
        /* if we didn't find the specific one, then look for
         * an unspecified one.
         */
        /* if we didn't find the specific one, then look for
         * an unspecified one.
         */
-       if (sa == NULL) {
-               sa = sa_default;
-       }
+       if (sa == NULL)
+               sa = ndo->ndo_sa_default;
        
        /* if not found fail */
        if (sa == NULL)
        
        /* if not found fail */
        if (sa == NULL)
@@ -455,191 +468,26 @@ esp_print(register const u_char *bp, register const u_char *bp2,
                ep = bp2 + len;
        }
 
                ep = bp2 + len;
        }
 
-       ivoff = (u_char *)(esp + 1) + sa->xform->replaysize;
-       ivlen = sa->xform->ivlen;
+       ivoff = (u_char *)(esp + 1) + 0;
+       ivlen = sa->ivlen;
        secret = sa->secret;
        espsecret_keylen = sa->secretlen;
        secret = sa->secret;
        espsecret_keylen = sa->secretlen;
+       ep = ep - sa->authlen;
 
 
-       switch (sa->xform->algo) {
-       case DESCBC:
-#ifdef HAVE_LIBCRYPTO
-           {
-               u_char iv[8];
-#if OPENSSL_VERSION_NUMBER >= 0x00907000L
-               DES_key_schedule schedule;
-#else
-               des_key_schedule schedule;
-#endif
-
-               switch (ivlen) {
-               case 4:
-                       memcpy(iv, ivoff, 4);
-                       memcpy(&iv[4], ivoff, 4);
-                       p = &iv[4];
-                       *p++ ^= 0xff;
-                       *p++ ^= 0xff;
-                       *p++ ^= 0xff;
-                       *p++ ^= 0xff;
-                       break;
-               case 8:
-                       memcpy(iv, ivoff, 8);
-                       break;
-               default:
-                       goto fail;
-               }
-               p = ivoff + ivlen;
-
-               if (espsecret_keylen != 8)
-                       goto fail;
-
-#if OPENSSL_VERSION_NUMBER >= 0x00908000L
-               DES_set_key_unchecked((const_DES_cblock *)secret, &schedule);
-
-               DES_cbc_encrypt((const unsigned char *)p, p,
-                   (long)(ep - p), &schedule, (DES_cblock *)iv, DES_DECRYPT);
+       if (sa->evp) {
+               memset(&ctx, 0, sizeof(ctx));
+               if (EVP_CipherInit(&ctx, sa->evp, secret, NULL, 0) < 0)
+                       (*ndo->ndo_warning)(ndo, "espkey init failed");
 
 
-#elif OPENSSL_VERSION_NUMBER >= 0x00907000L
-               DES_set_key_unchecked((DES_cblock *)secret, schedule);
+               blocksz = EVP_CIPHER_CTX_block_size(&ctx);
 
 
-               DES_cbc_encrypt((const unsigned char *)p, p,
-                   (long)(ep - p), schedule, (DES_cblock *)iv, DES_DECRYPT);
-#else
-               des_check_key = 0;
-               des_set_key((void *)secret, schedule);
-
-               des_cbc_encrypt((void *)p, (void *)p,
-                   (long)(ep - p), schedule, (void *)iv, DES_DECRYPT);
-#endif
-               advance = ivoff - (u_char *)esp + ivlen;
-               break;
-           }
-#else
-               goto fail;
-#endif /*HAVE_LIBCRYPTO*/
-
-       case BLOWFISH:
-#ifdef HAVE_LIBCRYPTO
-           {
-               BF_KEY schedule;
-
-               if (espsecret_keylen < 5 || espsecret_keylen > 56)
-                       goto fail;
-               BF_set_key(&schedule, espsecret_keylen, secret);
-
-               p = ivoff + ivlen;
-               BF_cbc_encrypt(p, p, (long)(ep - p), &schedule, ivoff,
-                       BF_DECRYPT);
-               advance = ivoff - (u_char *)esp + ivlen;
-               break;
-           }
-#else
-               goto fail;
-#endif /*HAVE_LIBCRYPTO*/
-
-       case RC5:
-#if defined(HAVE_LIBCRYPTO) && defined(HAVE_RC5_H)
-           {
-               RC5_32_KEY schedule;
-
-               if (espsecret_keylen < 5 || espsecret_keylen > 255)
-                       goto fail;
-               RC5_32_set_key(&schedule, espsecret_keylen, secret,
-                       RC5_16_ROUNDS);
-
-               p = ivoff + ivlen;
-               RC5_32_cbc_encrypt(p, p, (long)(ep - p), &schedule, ivoff,
-                       RC5_DECRYPT);
-               advance = ivoff - (u_char *)esp + ivlen;
-               break;
-           }
-#else
-               goto fail;
-#endif /*HAVE_LIBCRYPTO*/
-
-       case CAST128:
-#if defined(HAVE_LIBCRYPTO) && defined(HAVE_CAST_H) && !defined(HAVE_BUGGY_CAST128)
-           {
-               CAST_KEY schedule;
-
-               if (espsecret_keylen < 5 || espsecret_keylen > 16)
-                       goto fail;
-               CAST_set_key(&schedule, espsecret_keylen, secret);
-
-               p = ivoff + ivlen;
-               CAST_cbc_encrypt(p, p, (long)(ep - p), &schedule, ivoff,
-                       CAST_DECRYPT);
+               p = ivoff;
+               EVP_CipherInit(&ctx, NULL, NULL, p, 0);
+               EVP_Cipher(&ctx, p + ivlen, p + ivlen, ep - (p + ivlen));
                advance = ivoff - (u_char *)esp + ivlen;
                advance = ivoff - (u_char *)esp + ivlen;
-               break;
-           }
-#else
-               goto fail;
-#endif /*HAVE_LIBCRYPTO*/
-
-       case DES3CBC:
-#if defined(HAVE_LIBCRYPTO)
-           {
-#if OPENSSL_VERSION_NUMBER >= 0x00907000L
-               DES_key_schedule s1, s2, s3;
-
-               if (espsecret_keylen != 24)
-                       goto fail;
-               DES_set_odd_parity((DES_cblock *)secret);
-               DES_set_odd_parity((DES_cblock *)(secret + 8));
-               DES_set_odd_parity((DES_cblock *)(secret + 16));
-#if OPENSSL_VERSION_NUMBER >= 0x00908000L
-               if (DES_set_key_checked((const_DES_cblock *)secret, &s1) != 0)
-                       printf("failed to schedule key 1\n");
-               if (DES_set_key_checked((const_DES_cblock *)(secret + 8), &s2) != 0)
-                       printf("failed to schedule key 2\n");
-               if (DES_set_key_checked((const_DES_cblock *)(secret + 16), &s3) != 0)
-                       printf("failed to schedule key 3\n");
-#else
-               if (DES_set_key_checked((DES_cblock *)secret, s1) != 0)
-                       printf("failed to schedule key 1\n");
-               if (DES_set_key_checked((DES_cblock *)(secret + 8), s2) != 0)
-                       printf("failed to schedule key 2\n");
-               if (DES_set_key_checked((DES_cblock *)(secret + 16), s3) != 0)
-                       printf("failed to schedule key 3\n");
-#endif
-
-               p = ivoff + ivlen;
-               DES_ede3_cbc_encrypt((const unsigned char *)p, p,
-                   (long)(ep - p), &s1, &s2, &s3, (DES_cblock *)ivoff,
-                   DES_DECRYPT);
-#else
-               des_key_schedule s1, s2, s3;
-
-               if (espsecret_keylen != 24)
-                       goto fail;
-               des_check_key = 1;
-               des_set_odd_parity((void *)secret);
-               des_set_odd_parity((void *)(secret + 8));
-               des_set_odd_parity((void *)(secret + 16));
-               if (des_set_key((void *)secret, s1) != 0)
-                       printf("failed to schedule key 1\n");
-               if (des_set_key((void *)(secret + 8), s2) != 0)
-                       printf("failed to schedule key 2\n");
-               if (des_set_key((void *)(secret + 16), s3) != 0)
-                       printf("failed to schedule key 3\n");
-
-               p = ivoff + ivlen;
-               des_ede3_cbc_encrypt((void *)p, (void *)p,
-                   (long)(ep - p), s1, s2, s3, (void *)ivoff, DES_DECRYPT);
-#endif
-               advance = ivoff - (u_char *)esp + ivlen;
-               break;
-           }
-#else
-               goto fail;
-#endif /*HAVE_LIBCRYPTO*/
-
-       case NONE:
-       default:
-               advance = sizeof(struct newesp) + sa->xform->replaysize;
-               break;
-       }
+       } else
+               advance = sizeof(struct newesp);
 
 
-       ep = ep - sa->xform->authlen;
        /* sanity check for pad length */
        if (ep - bp < *(ep - 2))
                goto fail;
        /* sanity check for pad length */
        if (ep - bp < *(ep - 2))
                goto fail;
@@ -650,11 +498,17 @@ esp_print(register const u_char *bp, register const u_char *bp2,
        if (nhdr)
                *nhdr = *(ep - 1);
 
        if (nhdr)
                *nhdr = *(ep - 1);
 
-       printf(": ");
+       (ndo->ndo_printf)(ndo, ": ");
        return advance;
        return advance;
+#endif
 
 fail:
 
 fail:
-       if (nhdr)
-               *nhdr = -1;
-       return 65536;
+       return -1;
 }
 }
+
+/*
+ * Local Variables:
+ * c-style: whitesmith
+ * c-basic-offset: 8
+ * End:
+ */
[mirror] the TCPdump network dissector