X-Git-Url: https://git.tcpdump.org/tcpdump/blobdiff_plain/c1c3c77463d592cc576eaa491e604752044ca55a..06df4f81b66c76be479e2dd1e2d18a011410037b:/print-esp.c diff --git a/print-esp.c b/print-esp.c index fe494a39..52081491 100644 --- a/print-esp.c +++ b/print-esp.c @@ -21,11 +21,13 @@ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. */ +/* \summary: IPSEC Encapsulating Security Payload (ESP) printer */ + #ifdef HAVE_CONFIG_H #include "config.h" #endif -#include +#include #include #include @@ -42,16 +44,15 @@ #endif #endif -#include "ip.h" -#ifdef INET6 -#include "ip6.h" -#endif - #include "netdissect.h" +#include "strtoaddr.h" #include "extract.h" #include "ascii_strcasecmp.h" +#include "ip.h" +#include "ip6.h" + /* * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. * All rights reserved. @@ -99,9 +100,7 @@ struct newesp { #ifdef HAVE_LIBCRYPTO union inaddr_u { struct in_addr in4; -#ifdef INET6 struct in6_addr in6; -#endif }; struct sa_list { struct sa_list *next; @@ -120,6 +119,32 @@ struct sa_list { int secretlen; }; +#ifndef HAVE_EVP_CIPHER_CTX_NEW +/* + * Allocate an EVP_CIPHER_CTX. + * Used if we have an older version of OpenSSL that doesn't provide + * routines to allocate and free them. + */ +static EVP_CIPHER_CTX * +EVP_CIPHER_CTX_new(void) +{ + EVP_CIPHER_CTX *ctx; + + ctx = malloc(sizeof(*ctx)); + if (ctx == NULL) + return (NULL); + memset(ctx, 0, sizeof(*ctx)); + return (ctx); +} + +static void +EVP_CIPHER_CTX_free(EVP_CIPHER_CTX *ctx) +{ + EVP_CIPHER_CTX_cleanup(ctx); + free(ctx); +} +#endif + /* * this will adjust ndo_packetp and ndo_snapend to new buffer! */ @@ -131,8 +156,9 @@ int esp_print_decrypt_buffer_by_ikev2(netdissect_options *ndo, { struct sa_list *sa; const u_char *iv; - int len; - EVP_CIPHER_CTX ctx; + u_char *buf_mut, *output_buffer; + int len, block_size, cipher_nid, output_buffer_size ; + EVP_CIPHER_CTX *ctx; /* initiator arg is any non-zero value */ if(initiator) initiator=1; @@ -160,18 +186,35 @@ int esp_print_decrypt_buffer_by_ikev2(netdissect_options *ndo, if(end <= buf) return 0; - memset(&ctx, 0, sizeof(ctx)); - if (EVP_CipherInit(&ctx, sa->evp, sa->secret, NULL, 0) < 0) + ctx = EVP_CIPHER_CTX_new(); + if (ctx == NULL) + return 0; + if (EVP_CipherInit(ctx, sa->evp, sa->secret, NULL, 0) < 0) (*ndo->ndo_warning)(ndo, "espkey init failed"); - EVP_CipherInit(&ctx, NULL, NULL, iv, 0); - EVP_Cipher(&ctx, buf, buf, len); - EVP_CIPHER_CTX_cleanup(&ctx); + EVP_CipherInit(ctx, NULL, NULL, iv, 0); + + /* We need a block size */ + block_size = EVP_CIPHER_CTX_block_size(ctx); + /* We need the buffer size to be multiple of a block size */ + output_buffer_size = len + (block_size - len % block_size); + output_buffer = (u_char *)calloc(output_buffer_size, sizeof(u_char)); + /* EVP_Cipher output buffer should be different from the input one. + * Also it should be of size that is multiple of cipher block size. */ + EVP_Cipher(ctx, output_buffer, buf, len); + EVP_CIPHER_CTX_free(ctx); + + buf_mut = (u_char*) buf; + /* Of course this is wrong, because buf is a const buffer, but changing this + * would require more complicated fix. */ + memcpy(buf_mut, output_buffer, len); + free(output_buffer); ndo->ndo_packetp = buf; ndo->ndo_snapend = end; return 1; + } USES_APPLE_RST @@ -438,8 +481,9 @@ static void esp_print_decode_onesecret(netdissect_options *ndo, char *line, secretfile = fopen(filename, FOPEN_READ_TXT); if (secretfile == NULL) { - perror(filename); - exit(3); + (*ndo->ndo_error)(ndo, "print_esp: can't open %s: %s\n", + filename, strerror(errno)); + return; } while (fgets(fileline, sizeof(fileline)-1, secretfile) != NULL) { @@ -478,17 +522,14 @@ static void esp_print_decode_onesecret(netdissect_options *ndo, char *line, sa1.spi = spino; -#ifdef INET6 - if (inet_pton(AF_INET6, spikey, &sa1.daddr.in6) == 1) { + if (strtoaddr6(spikey, &sa1.daddr.in6) == 1) { sa1.daddr_version = 6; - } else -#endif - if (inet_pton(AF_INET, spikey, &sa1.daddr.in4) == 1) { - sa1.daddr_version = 4; - } else { - (*ndo->ndo_warning)(ndo, "print_esp: can not decode IP# %s\n", spikey); - return; - } + } else if (strtoaddr(spikey, &sa1.daddr.in4) == 1) { + sa1.daddr_version = 4; + } else { + (*ndo->ndo_warning)(ndo, "print_esp: can not decode IP# %s\n", spikey); + return; + } } if (decode) { @@ -507,8 +548,14 @@ static void esp_print_decode_onesecret(netdissect_options *ndo, char *line, USES_APPLE_DEPRECATED_API static void esp_init(netdissect_options *ndo _U_) { - + /* + * 0.9.6 doesn't appear to define OPENSSL_API_COMPAT, so + * we check whether it's undefined or it's less than the + * value for 1.1.0. + */ +#if !defined(OPENSSL_API_COMPAT) || OPENSSL_API_COMPAT < 0x10100000L OpenSSL_add_all_algorithms(); +#endif EVP_add_cipher_alias(SN_des_ede3_cbc, "3des"); } USES_APPLE_RST @@ -567,16 +614,16 @@ esp_print(netdissect_options *ndo, #ifdef HAVE_LIBCRYPTO const struct ip *ip; struct sa_list *sa = NULL; -#ifdef INET6 const struct ip6_hdr *ip6 = NULL; -#endif int advance; int len; u_char *secret; int ivlen = 0; const u_char *ivoff; const u_char *p; - EVP_CIPHER_CTX ctx; + EVP_CIPHER_CTX *ctx; + u_char *buf_mut, *output_buffer; + int block_size, cipher_nid, output_buffer_size; #endif esp = (const struct newesp *)bp; @@ -618,7 +665,6 @@ esp_print(netdissect_options *ndo, ip = (const struct ip *)bp2; switch (IP_V(ip)) { -#ifdef INET6 case 6: ip6 = (const struct ip6_hdr *)bp2; /* we do not attempt to decrypt jumbograms */ @@ -637,7 +683,6 @@ esp_print(netdissect_options *ndo, } } break; -#endif /*INET6*/ case 4: /* nexthdr & padding are in the last fragment */ if (EXTRACT_16BITS(&ip->ip_off) & IP_MF) @@ -682,15 +727,29 @@ esp_print(netdissect_options *ndo, ep = ep - sa->authlen; if (sa->evp) { - memset(&ctx, 0, sizeof(ctx)); - if (EVP_CipherInit(&ctx, sa->evp, secret, NULL, 0) < 0) - (*ndo->ndo_warning)(ndo, "espkey init failed"); - - p = ivoff; - EVP_CipherInit(&ctx, NULL, NULL, p, 0); - EVP_Cipher(&ctx, p + ivlen, p + ivlen, ep - (p + ivlen)); - EVP_CIPHER_CTX_cleanup(&ctx); - advance = ivoff - (const u_char *)esp + ivlen; + ctx = EVP_CIPHER_CTX_new(); + if (ctx != NULL) { + if (EVP_CipherInit(ctx, sa->evp, secret, NULL, 0) < 0) + (*ndo->ndo_warning)(ndo, "espkey init failed"); + + p = ivoff; + EVP_CipherInit(ctx, NULL, NULL, p, 0); + len = ep - (p + ivlen); + + /* We need a block size */ + block_size = EVP_CIPHER_CTX_block_size(ctx); + /* We need the buffer size to be multiple of a block size */ + output_buffer_size = len + (block_size - len % block_size); + output_buffer = (u_char *)calloc(output_buffer_size, sizeof(u_char)); + /* EVP_Cipher output buffer should be different from the input one. + * Also it should be of size that is multiple of cipher block size. */ + EVP_Cipher(ctx, output_buffer, p + ivlen, len); + EVP_CIPHER_CTX_free(ctx); + memcpy(p + ivlen, output_buffer, len); + free(output_buffer); + advance = ivoff - (const u_char *)esp + ivlen; + } else + advance = sizeof(struct newesp); } else advance = sizeof(struct newesp);