Update print-esp.c

[tcpdump] / print-esp.c

diff --git a/print-esp.c b/print-esp.c
index 50cc2d1f7b72a3abfc1e59872134adfdf14022dc..52081491914b9d188a7e272137c260d7f6c9fe4d 100644 (file)
--- a/print-esp.c
+++ b/print-esp.c
@@ -21,6 +21,8 @@
  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  */
 
  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  */
 

+/* \summary: IPSEC Encapsulating Security Payload (ESP) printer */
+

 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #endif
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #endif


@@ -42,15 +44,15 @@
 #endif
 #endif
 
 #endif
 #endif
 

-#include "ip.h"
-#include "ip6.h"
-

 #include "netdissect.h"
 #include "strtoaddr.h"
 #include "extract.h"
 
 #include "ascii_strcasecmp.h"
 
 #include "netdissect.h"
 #include "strtoaddr.h"
 #include "extract.h"
 
 #include "ascii_strcasecmp.h"
 

+#include "ip.h"
+#include "ip6.h"
+

 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
  * All rights reserved.
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
  * All rights reserved.


@@ -117,6 +119,32 @@ struct sa_list {
        int             secretlen;
 };
 
        int             secretlen;
 };
 

+#ifndef HAVE_EVP_CIPHER_CTX_NEW
+/*
+ * Allocate an EVP_CIPHER_CTX.
+ * Used if we have an older version of OpenSSL that doesn't provide
+ * routines to allocate and free them.
+ */
+static EVP_CIPHER_CTX *
+EVP_CIPHER_CTX_new(void)
+{
+       EVP_CIPHER_CTX *ctx;
+
+       ctx = malloc(sizeof(*ctx));
+       if (ctx == NULL)
+               return (NULL);
+       memset(ctx, 0, sizeof(*ctx));
+       return (ctx);
+}
+
+static void
+EVP_CIPHER_CTX_free(EVP_CIPHER_CTX *ctx)
+{
+       EVP_CIPHER_CTX_cleanup(ctx);
+       free(ctx);
+}
+#endif
+

 /*
  * this will adjust ndo_packetp and ndo_snapend to new buffer!
  */
 /*
  * this will adjust ndo_packetp and ndo_snapend to new buffer!
  */


@@ -128,8 +156,9 @@ int esp_print_decrypt_buffer_by_ikev2(netdissect_options *ndo,
 {
        struct sa_list *sa;
        const u_char *iv;
 {
        struct sa_list *sa;
        const u_char *iv;

-       int len;
-       EVP_CIPHER_CTX ctx;
+       u_char *buf_mut, *output_buffer;
+       int len, block_size, cipher_nid, output_buffer_size ;
+       EVP_CIPHER_CTX *ctx;

 
        /* initiator arg is any non-zero value */
        if(initiator) initiator=1;
 
        /* initiator arg is any non-zero value */
        if(initiator) initiator=1;


@@ -157,18 +186,35 @@ int esp_print_decrypt_buffer_by_ikev2(netdissect_options *ndo,
 
        if(end <= buf) return 0;
 
 
        if(end <= buf) return 0;
 

-       memset(&ctx, 0, sizeof(ctx));
-       if (EVP_CipherInit(&ctx, sa->evp, sa->secret, NULL, 0) < 0)
+       ctx = EVP_CIPHER_CTX_new();
+       if (ctx == NULL)
+               return 0;
+       if (EVP_CipherInit(ctx, sa->evp, sa->secret, NULL, 0) < 0)

                (*ndo->ndo_warning)(ndo, "espkey init failed");
                (*ndo->ndo_warning)(ndo, "espkey init failed");

-       EVP_CipherInit(&ctx, NULL, NULL, iv, 0);
-       EVP_Cipher(&ctx, buf, buf, len);
-       EVP_CIPHER_CTX_cleanup(&ctx);
+       EVP_CipherInit(ctx, NULL, NULL, iv, 0);
+
+       /* We need a block size */
+       block_size = EVP_CIPHER_CTX_block_size(ctx);
+       /* We need the buffer size to be multiple of a block size */
+       output_buffer_size = len + (block_size - len % block_size);
+       output_buffer = (u_char *)calloc(output_buffer_size, sizeof(u_char));
+       /* EVP_Cipher output buffer should be different from the input one.
+        * Also it should be of size that is multiple of cipher block size. */
+       EVP_Cipher(ctx, output_buffer, buf, len);
+       EVP_CIPHER_CTX_free(ctx);
+
+       buf_mut = (u_char*) buf;
+       /* Of course this is wrong, because buf is a const buffer, but changing this
+        * would require more complicated fix. */
+       memcpy(buf_mut, output_buffer, len);
+       free(output_buffer);

 
        ndo->ndo_packetp = buf;
        ndo->ndo_snapend = end;
 
        return 1;
 
 
        ndo->ndo_packetp = buf;
        ndo->ndo_snapend = end;
 
        return 1;
 

+

 }
 USES_APPLE_RST
 
 }
 USES_APPLE_RST
 


@@ -435,8 +481,9 @@ static void esp_print_decode_onesecret(netdissect_options *ndo, char *line,
 
                secretfile = fopen(filename, FOPEN_READ_TXT);
                if (secretfile == NULL) {
 
                secretfile = fopen(filename, FOPEN_READ_TXT);
                if (secretfile == NULL) {

-                       perror(filename);
-                       exit(3);
+                       (*ndo->ndo_error)(ndo, "print_esp: can't open %s: %s\n",
+                           filename, strerror(errno));
+                       return;

                }
 
                while (fgets(fileline, sizeof(fileline)-1, secretfile) != NULL) {
                }
 
                while (fgets(fileline, sizeof(fileline)-1, secretfile) != NULL) {


@@ -501,8 +548,14 @@ static void esp_print_decode_onesecret(netdissect_options *ndo, char *line,
 USES_APPLE_DEPRECATED_API
 static void esp_init(netdissect_options *ndo _U_)
 {
 USES_APPLE_DEPRECATED_API
 static void esp_init(netdissect_options *ndo _U_)
 {

-
+       /*
+        * 0.9.6 doesn't appear to define OPENSSL_API_COMPAT, so
+        * we check whether it's undefined or it's less than the
+        * value for 1.1.0.
+        */
+#if !defined(OPENSSL_API_COMPAT) || OPENSSL_API_COMPAT < 0x10100000L

        OpenSSL_add_all_algorithms();
        OpenSSL_add_all_algorithms();

+#endif

        EVP_add_cipher_alias(SN_des_ede3_cbc, "3des");
 }
 USES_APPLE_RST
        EVP_add_cipher_alias(SN_des_ede3_cbc, "3des");
 }
 USES_APPLE_RST


@@ -568,7 +621,9 @@ esp_print(netdissect_options *ndo,
        int ivlen = 0;
        const u_char *ivoff;
        const u_char *p;
        int ivlen = 0;
        const u_char *ivoff;
        const u_char *p;

-       EVP_CIPHER_CTX ctx;
+       EVP_CIPHER_CTX *ctx;
+       u_char *buf_mut, *output_buffer;
+       int block_size, cipher_nid, output_buffer_size;

 #endif
 
        esp = (const struct newesp *)bp;
 #endif
 
        esp = (const struct newesp *)bp;


@@ -672,15 +727,29 @@ esp_print(netdissect_options *ndo,
        ep = ep - sa->authlen;
 
        if (sa->evp) {
        ep = ep - sa->authlen;
 
        if (sa->evp) {

-               memset(&ctx, 0, sizeof(ctx));
-               if (EVP_CipherInit(&ctx, sa->evp, secret, NULL, 0) < 0)
-                       (*ndo->ndo_warning)(ndo, "espkey init failed");
-
-               p = ivoff;
-               EVP_CipherInit(&ctx, NULL, NULL, p, 0);
-               EVP_Cipher(&ctx, p + ivlen, p + ivlen, ep - (p + ivlen));
-               EVP_CIPHER_CTX_cleanup(&ctx);
-               advance = ivoff - (const u_char *)esp + ivlen;
+               ctx = EVP_CIPHER_CTX_new();
+               if (ctx != NULL) {
+                       if (EVP_CipherInit(ctx, sa->evp, secret, NULL, 0) < 0)
+                               (*ndo->ndo_warning)(ndo, "espkey init failed");
+
+                       p = ivoff;
+                       EVP_CipherInit(ctx, NULL, NULL, p, 0);
+                       len = ep - (p + ivlen);
+
+                       /* We need a block size */
+                       block_size = EVP_CIPHER_CTX_block_size(ctx);
+                       /* We need the buffer size to be multiple of a block size */
+                       output_buffer_size = len + (block_size - len % block_size);
+                       output_buffer = (u_char *)calloc(output_buffer_size, sizeof(u_char));
+                       /* EVP_Cipher output buffer should be different from the input one.
+                        * Also it should be of size that is multiple of cipher block size. */
+                       EVP_Cipher(ctx, output_buffer, p + ivlen, len);
+                       EVP_CIPHER_CTX_free(ctx);
+                       memcpy(p + ivlen, output_buffer, len);
+                       free(output_buffer);
+                       advance = ivoff - (const u_char *)esp + ivlen;
+               } else
+                       advance = sizeof(struct newesp);

        } else
                advance = sizeof(struct newesp);
 
        } else
                advance = sizeof(struct newesp);