dist/tcpdump/print-esp.c

   1 /*      $NetBSD: print-esp.c,v 1.7 2007/07/24 11:53:43 drochner Exp $   */
   2
   3 /*
   4  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994
   5  *      The Regents of the University of California.  All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that: (1) source code distributions
   9  * retain the above copyright notice and this paragraph in its entirety, (2)
  10  * distributions including binary code include the above copyright notice and
  11  * this paragraph in its entirety in the documentation or other materials
  12  * provided with the distribution, and (3) all advertising materials mentioning
  13  * features or use of this software display the following acknowledgement:
  14  * ``This product includes software developed by the University of California,
  15  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
  16  * the University nor the names of its contributors may be used to endorse
  17  * or promote products derived from this software without specific prior
  18  * written permission.
  19  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  20  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  21  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  22  */
  23
  24 #include <sys/cdefs.h>
  25 #ifndef lint
  26 #if 0
  27 static const char rcsid[] _U_ =
  28     "@(#) Header: /tcpdump/master/tcpdump/print-esp.c,v 1.55.2.1 2005/04/21 06:44:57 guy Exp (LBL)";
  29 #else
  30 __RCSID("$NetBSD: print-esp.c,v 1.7 2007/07/24 11:53:43 drochner Exp $");
  31 #endif
  32 #endif
  33
  34 #ifdef HAVE_CONFIG_H
  35 #include "config.h"
  36 #endif
  37
  38 #include <string.h>
  39
  40 #include <tcpdump-stdinc.h>
  41
  42 #include <stdlib.h>
  43
  44 #ifdef HAVE_LIBCRYPTO
  45 #ifdef HAVE_OPENSSL_EVP_H
  46 #include <openssl/evp.h>
  47 #endif
  48 #endif
  49
  50 #include <stdio.h>
  51
  52 #include "ip.h"
  53 #include "esp.h"
  54 #ifdef INET6
  55 #include "ip6.h"
  56 #endif
  57
  58 #include "netdissect.h"
  59 #include "addrtoname.h"
  60 #include "extract.h"
  61
  62 #ifndef HAVE_SOCKADDR_STORAGE
  63 #ifdef INET6
  64 struct sockaddr_storage {
  65         union {
  66                 struct sockaddr_in sin;
  67                 struct sockaddr_in6 sin6;
  68         } un;
  69 };
  70 #else
  71 #define sockaddr_storage sockaddr
  72 #endif
  73 #endif /* HAVE_SOCKADDR_STORAGE */
  74
  75 #ifdef HAVE_LIBCRYPTO
  76 struct sa_list {
  77         struct sa_list  *next;
  78         struct sockaddr_storage daddr;
  79         u_int32_t       spi;
  80         const EVP_CIPHER *evp;
  81         int             ivlen;
  82         int             authlen;
  83         u_char          secret[256];  /* is that big enough for all secrets? */
  84         int             secretlen;
  85 };
  86
  87 static void esp_print_addsa(netdissect_options *ndo,
  88                             struct sa_list *sa, int sa_def)
  89 {
  90         /* copy the "sa" */
  91
  92         struct sa_list *nsa;
  93
  94         nsa = (struct sa_list *)malloc(sizeof(struct sa_list));
  95         if (nsa == NULL)
  96                 (*ndo->ndo_error)(ndo, "ran out of memory to allocate sa structure");
  97
  98         *nsa = *sa;
  99
 100         if (sa_def)
 101                 ndo->ndo_sa_default = nsa;
 102
 103         nsa->next = ndo->ndo_sa_list_head;
 104         ndo->ndo_sa_list_head = nsa;
 105 }
 106
 107
 108 static u_int hexdigit(netdissect_options *ndo, char hex)
 109 {
 110         if (hex >= '0' && hex <= '9')
 111                 return (hex - '0');
 112         else if (hex >= 'A' && hex <= 'F')
 113                 return (hex - 'A' + 10);
 114         else if (hex >= 'a' && hex <= 'f')
 115                 return (hex - 'a' + 10);
 116         else {
 117                 (*ndo->ndo_error)(ndo, "invalid hex digit %c in espsecret\n", hex);
 118                 return 0;
 119         }
 120 }
 121
 122 static u_int hex2byte(netdissect_options *ndo, char *hexstring)
 123 {
 124         u_int byte;
 125
 126         byte = (hexdigit(ndo, hexstring[0]) << 4) + hexdigit(ndo, hexstring[1]);
 127         return byte;
 128 }
 129
 130 /*
 131  * decode the form:    SPINUM@IP <tab> ALGONAME:0xsecret
 132  *
 133  * special form: file /name
 134  * causes us to go read from this file instead.
 135  *
 136  */
 137 static void esp_print_decode_onesecret(netdissect_options *ndo, char *line)
 138 {
 139         struct sa_list sa1;
 140         int sa_def;
 141
 142         char *spikey;
 143         char *decode;
 144
 145         spikey = strsep(&line, " \t");
 146         sa_def = 0;
 147         memset(&sa1, 0, sizeof(struct sa_list));
 148
 149         /* if there is only one token, then it is an algo:key token */
 150         if (line == NULL) {
 151                 decode = spikey;
 152                 spikey = NULL;
 153                 /* memset(&sa1.daddr, 0, sizeof(sa1.daddr)); */
 154                 /* sa1.spi = 0; */
 155                 sa_def    = 1;
 156         } else
 157                 decode = line;
 158
 159         if (spikey && strcasecmp(spikey, "file") == 0) {
 160                 /* open file and read it */
 161                 FILE *secretfile;
 162                 char  fileline[1024];
 163                 char  *nl;
 164
 165                 secretfile = fopen(line, FOPEN_READ_TXT);
 166                 if (secretfile == NULL) {
 167                         perror(line);
 168                         exit(3);
 169                 }
 170
 171                 while (fgets(fileline, sizeof(fileline)-1, secretfile) != NULL) {
 172                         /* remove newline from the line */
 173                         nl = strchr(fileline, '\n');
 174                         if (nl)
 175                                 *nl = '\0';
 176                         if (fileline[0] == '#') continue;
 177                         if (fileline[0] == '\0') continue;
 178
 179                         esp_print_decode_onesecret(ndo, fileline);
 180                 }
 181                 fclose(secretfile);
 182
 183                 return;
 184         }
 185
 186         if (spikey) {
 187                 char *spistr, *foo;
 188                 u_int32_t spino;
 189                 struct sockaddr_in *sin;
 190 #ifdef INET6
 191                 struct sockaddr_in6 *sin6;
 192 #endif
 193
 194                 spistr = strsep(&spikey, "@");
 195
 196                 spino = strtoul(spistr, &foo, 0);
 197                 if (spistr == foo || !spikey) {
 198                         (*ndo->ndo_warning)(ndo, "print_esp: failed to decode spi# %s\n", foo);
 199                         return;
 200                 }
 201
 202                 sa1.spi = spino;
 203
 204                 sin = (struct sockaddr_in *)&sa1.daddr;
 205 #ifdef INET6
 206                 sin6 = (struct sockaddr_in6 *)&sa1.daddr;
 207                 if (inet_pton(AF_INET6, spikey, &sin6->sin6_addr) == 1) {
 208 #ifdef HAVE_SOCKADDR_SA_LEN
 209                         sin6->sin6_len = sizeof(struct sockaddr_in6);
 210 #endif
 211                         sin6->sin6_family = AF_INET6;
 212                 } else
 213 #endif
 214                 if (inet_pton(AF_INET, spikey, &sin->sin_addr) == 1) {
 215 #ifdef HAVE_SOCKADDR_SA_LEN
 216                         sin->sin_len = sizeof(struct sockaddr_in);
 217 #endif
 218                         sin->sin_family = AF_INET;
 219                 } else {
 220                         (*ndo->ndo_warning)(ndo, "print_esp: can not decode IP# %s\n", spikey);
 221                         return;
 222                 }
 223         }
 224
 225         if (decode) {
 226                 char *colon, *p;
 227                 u_char espsecret_key[256];
 228                 int len;
 229                 size_t i;
 230                 const EVP_CIPHER *evp;
 231                 int authlen = 0;
 232
 233                 /* skip any blank spaces */
 234                 while (isspace((unsigned char)*decode))
 235                         decode++;
 236
 237                 colon = strchr(decode, ':');
 238                 if (colon == NULL) {
 239                         (*ndo->ndo_warning)(ndo, "failed to decode espsecret: %s\n", decode);
 240                         return;
 241                 }
 242                 *colon = '\0';
 243
 244                 len = colon - decode;
 245                 if (strlen(decode) > strlen("-hmac96") &&
 246                     !strcmp(decode + strlen(decode) - strlen("-hmac96"),
 247                     "-hmac96")) {
 248                         p = strstr(decode, "-hmac96");
 249                         *p = '\0';
 250                         authlen = 12;
 251                 }
 252                 if (strlen(decode) > strlen("-cbc") &&
 253                     !strcmp(decode + strlen(decode) - strlen("-cbc"), "-cbc")) {
 254                         p = strstr(decode, "-cbc");
 255                         *p = '\0';
 256                 }
 257                 evp = EVP_get_cipherbyname(decode);
 258                 if (!evp) {
 259                         (*ndo->ndo_warning)(ndo, "failed to find cipher algo %s\n", decode);
 260                         sa1.evp = NULL;
 261                         sa1.authlen = 0;
 262                         sa1.ivlen = 0;
 263                         return;
 264                 }
 265
 266                 sa1.evp = evp;
 267                 sa1.authlen = authlen;
 268                 sa1.ivlen = EVP_CIPHER_iv_length(evp);
 269
 270                 colon++;
 271                 if (colon[0] == '0' && colon[1] == 'x') {
 272                         /* decode some hex! */
 273                         colon += 2;
 274                         len = strlen(colon) / 2;
 275
 276                         if (len > 256) {
 277                                 (*ndo->ndo_warning)(ndo, "secret is too big: %d\n", len);
 278                                 return;
 279                         }
 280
 281                         i = 0;
 282                         while (colon[0] != '\0' && colon[1]!='\0') {
 283                                 espsecret_key[i] = hex2byte(ndo, colon);
 284                                 colon += 2;
 285                                 i++;
 286                         }
 287
 288                         memcpy(sa1.secret, espsecret_key, i);
 289                         sa1.secretlen = i;
 290                 } else {
 291                         i = strlen(colon);
 292
 293                         if (i < sizeof(sa1.secret)) {
 294                                 memcpy(sa1.secret, colon, i);
 295                                 sa1.secretlen = i;
 296                         } else {
 297                                 memcpy(sa1.secret, colon, sizeof(sa1.secret));
 298                                 sa1.secretlen = sizeof(sa1.secret);
 299                         }
 300                 }
 301         }
 302
 303         esp_print_addsa(ndo, &sa1, sa_def);
 304 }
 305
 306 static void esp_print_decodesecret(netdissect_options *ndo)
 307 {
 308         char *line;
 309         char *p;
 310
 311         p = ndo->ndo_espsecret;
 312
 313         while (ndo->ndo_espsecret && ndo->ndo_espsecret[0] != '\0') {
 314                 /* pick out the first line or first thing until a comma */
 315                 if ((line = strsep(&ndo->ndo_espsecret, "\n,")) == NULL) {
 316                         line = ndo->ndo_espsecret;
 317                         ndo->ndo_espsecret = NULL;
 318                 }
 319
 320                 esp_print_decode_onesecret(ndo, line);
 321         }
 322 }
 323
 324 static void esp_init(netdissect_options *ndo _U_)
 325 {
 326
 327         OpenSSL_add_all_algorithms();
 328         EVP_add_cipher_alias(SN_des_ede3_cbc, "3des");
 329 }
 330 #endif
 331
 332 int
 333 esp_print(netdissect_options *ndo,
 334           const u_char *bp, const int length, const u_char *bp2
 335 #ifndef HAVE_LIBCRYPTO
 336         _U_
 337 #endif
 338         ,
 339         int *nhdr
 340 #ifndef HAVE_LIBCRYPTO
 341         _U_
 342 #endif
 343         ,
 344         int *padlen
 345 #ifndef HAVE_LIBCRYPTO
 346         _U_
 347 #endif
 348         )
 349 {
 350         register const struct newesp *esp;
 351         register const u_char *ep;
 352 #ifdef HAVE_LIBCRYPTO
 353         struct ip *ip;
 354         struct sa_list *sa = NULL;
 355         int espsecret_keylen;
 356 #ifdef INET6
 357         struct ip6_hdr *ip6 = NULL;
 358 #endif
 359         int advance;
 360         int len;
 361         u_char *secret;
 362         int ivlen = 0;
 363         u_char *ivoff;
 364         u_char *p;
 365         EVP_CIPHER_CTX ctx;
 366         int blocksz;
 367         static int initialized = 0;
 368 #endif
 369
 370         esp = (struct newesp *)bp;
 371
 372 #ifdef HAVE_LIBCRYPTO
 373         secret = NULL;
 374         advance = 0;
 375
 376         if (!initialized) {
 377                 esp_init(ndo);
 378                 initialized = 1;
 379         }
 380 #endif
 381
 382 #if 0
 383         /* keep secret out of a register */
 384         p = (u_char *)&secret;
 385 #endif
 386
 387         /* 'ep' points to the end of available data. */
 388         ep = ndo->ndo_snapend;
 389
 390         if ((u_char *)(esp + 1) >= ep) {
 391                 fputs("[|ESP]", stdout);
 392                 goto fail;
 393         }
 394         (*ndo->ndo_printf)(ndo, "ESP(spi=0x%08x", EXTRACT_32BITS(&esp->esp_spi));
 395         (*ndo->ndo_printf)(ndo, ",seq=0x%x)", EXTRACT_32BITS(&esp->esp_seq));
 396         (*ndo->ndo_printf)(ndo, ", length %u", length);
 397
 398 #ifndef HAVE_LIBCRYPTO
 399         goto fail;
 400 #else
 401         /* initiailize SAs */
 402         if (ndo->ndo_sa_list_head == NULL) {
 403                 if (!ndo->ndo_espsecret)
 404                         goto fail;
 405
 406                 esp_print_decodesecret(ndo);
 407         }
 408
 409         if (ndo->ndo_sa_list_head == NULL)
 410                 goto fail;
 411
 412         ip = (struct ip *)bp2;
 413         switch (IP_V(ip)) {
 414 #ifdef INET6
 415         case 6:
 416                 ip6 = (struct ip6_hdr *)bp2;
 417                 /* we do not attempt to decrypt jumbograms */
 418                 if (!EXTRACT_16BITS(&ip6->ip6_plen))
 419                         goto fail;
 420                 /* if we can't get nexthdr, we do not need to decrypt it */
 421                 len = sizeof(struct ip6_hdr) + EXTRACT_16BITS(&ip6->ip6_plen);
 422
 423                 /* see if we can find the SA, and if so, decode it */
 424                 for (sa = ndo->ndo_sa_list_head; sa != NULL; sa = sa->next) {
 425                         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&sa->daddr;
 426                         if (sa->spi == ntohl(esp->esp_spi) &&
 427                             sin6->sin6_family == AF_INET6 &&
 428                             memcmp(&sin6->sin6_addr, &ip6->ip6_dst,
 429                                    sizeof(struct in6_addr)) == 0) {
 430                                 break;
 431                         }
 432                 }
 433                 break;
 434 #endif /*INET6*/
 435         case 4:
 436                 /* nexthdr & padding are in the last fragment */
 437                 if (EXTRACT_16BITS(&ip->ip_off) & IP_MF)
 438                         goto fail;
 439                 len = EXTRACT_16BITS(&ip->ip_len);
 440
 441                 /* see if we can find the SA, and if so, decode it */
 442                 for (sa = ndo->ndo_sa_list_head; sa != NULL; sa = sa->next) {
 443                         struct sockaddr_in *sin = (struct sockaddr_in *)&sa->daddr;
 444                         if (sa->spi == ntohl(esp->esp_spi) &&
 445                             sin->sin_family == AF_INET &&
 446                             sin->sin_addr.s_addr == ip->ip_dst.s_addr) {
 447                                 break;
 448                         }
 449                 }
 450                 break;
 451         default:
 452                 goto fail;
 453         }
 454
 455         /* if we didn't find the specific one, then look for
 456          * an unspecified one.
 457          */
 458         if (sa == NULL)
 459                 sa = ndo->ndo_sa_default;
 460
 461         /* if not found fail */
 462         if (sa == NULL)
 463                 goto fail;
 464
 465         /* if we can't get nexthdr, we do not need to decrypt it */
 466         if (ep - bp2 < len)
 467                 goto fail;
 468         if (ep - bp2 > len) {
 469                 /* FCS included at end of frame (NetBSD 1.6 or later) */
 470                 ep = bp2 + len;
 471         }
 472
 473         ivoff = (u_char *)(esp + 1) + 0;
 474         ivlen = sa->ivlen;
 475         secret = sa->secret;
 476         espsecret_keylen = sa->secretlen;
 477         ep = ep - sa->authlen;
 478
 479         if (sa->evp) {
 480                 memset(&ctx, 0, sizeof(ctx));
 481                 if (EVP_CipherInit(&ctx, sa->evp, secret, NULL, 0) < 0)
 482                         (*ndo->ndo_warning)(ndo, "espkey init failed");
 483
 484                 blocksz = EVP_CIPHER_CTX_block_size(&ctx);
 485
 486                 p = ivoff;
 487                 EVP_CipherInit(&ctx, NULL, NULL, p, 0);
 488                 EVP_Cipher(&ctx, p + ivlen, p + ivlen,
 489                     ep - (p + ivlen));
 490                 advance = ivoff - (u_char *)esp + ivlen;
 491         } else
 492                 advance = sizeof(struct newesp);
 493
 494         /* sanity check for pad length */
 495         if (ep - bp < *(ep - 2))
 496                 goto fail;
 497
 498         if (padlen)
 499                 *padlen = *(ep - 2) + 2;
 500
 501         if (nhdr)
 502                 *nhdr = *(ep - 1);
 503
 504         (ndo->ndo_printf)(ndo, ": ");
 505         return advance;
 506 #endif
 507
 508 fail:
 509         return -1;
 510 }
 511
 512 /*
 513  * Local Variables:
 514  * c-style: whitesmith
 515  * c-basic-offset: 8
 516  * End:
 517  */