+#ifndef HAVE_EVP_CIPHER_CTX_NEW
+/*
+ * Allocate an EVP_CIPHER_CTX.
+ * Used if we have an older version of OpenSSL that doesn't provide
+ * routines to allocate and free them.
+ */
+static EVP_CIPHER_CTX *
+EVP_CIPHER_CTX_new(void)
+{
+ EVP_CIPHER_CTX *ctx;
+
+ ctx = calloc(1, sizeof(*ctx));
+ return (ctx);
+}
+
+static void
+EVP_CIPHER_CTX_free(EVP_CIPHER_CTX *ctx)
+{
+ EVP_CIPHER_CTX_cleanup(ctx);
+ free(ctx);
+}
+#endif
+
+#ifdef HAVE_EVP_DECRYPTINIT_EX
+/*
+ * Initialize the cipher by calling EVP_DecryptInit_ex(), because
+ * calling EVP_DecryptInit() will reset the cipher context, clearing
+ * the cipher, so calling it twice, with the second call having a
+ * null cipher, will clear the already-set cipher. EVP_DecryptInit_ex(),
+ * however, won't reset the cipher context, so you can use it to specify
+ * the IV in a second call after a first call to EVP_DecryptInit_ex()
+ * to set the cipher and the key.
+ *
+ * XXX - is there some reason why we need to make two calls?
+ */
+static int
+set_cipher_parameters(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
+ const unsigned char *key,
+ const unsigned char *iv)
+{
+ return EVP_DecryptInit_ex(ctx, cipher, NULL, key, iv);
+}
+#else
+/*
+ * Initialize the cipher by calling EVP_DecryptInit(), because we don't
+ * have EVP_DecryptInit_ex(); we rely on it not trashing the context.
+ */
+static int
+set_cipher_parameters(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
+ const unsigned char *key,
+ const unsigned char *iv)
+{
+ return EVP_DecryptInit(ctx, cipher, key, iv);
+}
+#endif
+
+static u_char *
+do_decrypt(netdissect_options *ndo, const char *caller, struct sa_list *sa,
+ const u_char *iv, const u_char *ct, unsigned int ctlen)
+{
+ EVP_CIPHER_CTX *ctx;
+ unsigned int block_size;
+ unsigned int ptlen;
+ u_char *pt;
+ int len;
+
+ ctx = EVP_CIPHER_CTX_new();
+ if (ctx == NULL) {
+ /*
+ * Failed to initialize the cipher context.
+ * From a look at the OpenSSL code, this appears to
+ * mean "couldn't allocate memory for the cipher context";
+ * note that we're not passing any parameters, so there's
+ * not much else it can mean.
+ */
+ (*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
+ "%s: can't allocate memory for cipher context", caller);
+ return NULL;
+ }
+
+ if (set_cipher_parameters(ctx, sa->evp, sa->secret, NULL) < 0) {
+ EVP_CIPHER_CTX_free(ctx);
+ (*ndo->ndo_warning)(ndo, "%s: espkey init failed", caller);
+ return NULL;
+ }
+ if (set_cipher_parameters(ctx, NULL, NULL, iv) < 0) {
+ EVP_CIPHER_CTX_free(ctx);
+ (*ndo->ndo_warning)(ndo, "%s: IV init failed", caller);
+ return NULL;
+ }
+
+ /*
+ * At least as I read RFC 5996 section 3.14 and RFC 4303 section 2.4,
+ * if the cipher has a block size of which the ciphertext's size must
+ * be a multiple, the payload must be padded to make that happen, so
+ * the ciphertext length must be a multiple of the block size. Fail
+ * if that's not the case.
+ */
+ block_size = (unsigned int)EVP_CIPHER_CTX_block_size(ctx);
+ if ((ctlen % block_size) != 0) {
+ EVP_CIPHER_CTX_free(ctx);
+ (*ndo->ndo_warning)(ndo,
+ "%s: ciphertext size %u is not a multiple of the cipher block size %u",
+ caller, ctlen, block_size);
+ return NULL;
+ }
+
+ /*
+ * Attempt to allocate a buffer for the decrypted data, because
+ * we can't decrypt on top of the input buffer.
+ */
+ ptlen = ctlen;
+ pt = (u_char *)calloc(1, ptlen);
+ if (pt == NULL) {
+ EVP_CIPHER_CTX_free(ctx);
+ (*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
+ "%s: can't allocate memory for decryption buffer", caller);
+ return NULL;
+ }
+
+ /*
+ * The size of the ciphertext handed to us is a multiple of the
+ * cipher block size, so we don't need to worry about padding.
+ */
+ if (!EVP_CIPHER_CTX_set_padding(ctx, 0)) {
+ free(pt);
+ EVP_CIPHER_CTX_free(ctx);
+ (*ndo->ndo_warning)(ndo,
+ "%s: EVP_CIPHER_CTX_set_padding failed", caller);
+ return NULL;
+ }
+ if (!EVP_DecryptUpdate(ctx, pt, &len, ct, ctlen)) {
+ free(pt);
+ EVP_CIPHER_CTX_free(ctx);
+ (*ndo->ndo_warning)(ndo, "%s: EVP_DecryptUpdate failed",
+ caller);
+ return NULL;
+ }
+ EVP_CIPHER_CTX_free(ctx);
+ return pt;
+}
+
projects / tcpdump / blobdiff