+ if (set_cipher_parameters(ctx, NULL, NULL, iv, 0) < 0) {
+ (*ndo->ndo_warning)(ndo, "IV init failed");
+ return;
+ }
+
+ /*
+ * Allocate buffers for the encrypted and decrypted
+ * data. Both buffers' sizes must be a multiple of
+ * the cipher block size, and the output buffer must
+ * be separate from the input buffer.
+ */
+ block_size = (unsigned int)EVP_CIPHER_CTX_block_size(ctx);
+ buffer_size = ctlen + (block_size - ctlen % block_size);
+
+ /*
+ * Attempt to allocate the input buffer.
+ */
+ input_buffer = (u_char *)malloc(buffer_size);
+ if (input_buffer == NULL) {
+ EVP_CIPHER_CTX_free(ctx);
+ (*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
+ "esp_print: can't allocate memory for encrypted data buffer");
+ }
+ /*
+ * Copy the input data to the encrypted data buffer,
+ * and pad it with zeroes.
+ */
+ memcpy(input_buffer, ct, ctlen);
+ memset(input_buffer + ctlen, 0, buffer_size - ctlen);
+
+ /*
+ * Attempt to allocate the output buffer.
+ */
+ output_buffer = (u_char *)malloc(buffer_size);
+ if (output_buffer == NULL) {
+ free(input_buffer);
+ EVP_CIPHER_CTX_free(ctx);
+ (*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
+ "esp_print: can't allocate memory for decryption buffer");
+ }
+
+ if (!EVP_Cipher(ctx, output_buffer, input_buffer, ctlen)) {
+ free(input_buffer);
+ (*ndo->ndo_warning)(ndo, "EVP_Cipher failed");
+ return;
+ }
+ free(input_buffer);
+ EVP_CIPHER_CTX_free(ctx);
+
+ /*
+ * Pointer to the plaintext.
+ */
+ pt = output_buffer;
+
+ /*
+ * Length of the plaintext, which is the same as the length
+ * of the ciphertext.
+ */
+ ptlen = ctlen;
+
+ /*
+ * Switch to the output buffer for dissection, and
+ * save it on the buffer stack so it can be freed.
+ */
+ if (!nd_push_buffer(ndo, output_buffer, pt, pt + ctlen)) {
+ free(output_buffer);
+ (*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
+ "esp_print: can't push buffer on buffer stack");
+ }
+ ep = pt + ptlen;
+
+ /*
+ * Sanity check for pad length; if it, plus 2 for the pad
+ * length and next header fields, is bigger than the ciphertext
+ * length (which is also the plaintext length), it's too big.
+ *
+ * XXX - the check can fail if the packet is corrupt *or* if
+ * it was not decrypted with the correct key, so that the
+ * "plaintext" is not what was being sent.
+ */
+ padlen = GET_U_1(ep - 2);
+ if (padlen + 2 > ptlen) {
+ nd_print_trunc(ndo);
+ return;
+ }
projects / tcpdump / blobdiff