1*0Sstevel@tonic-gate /* 2*0Sstevel@tonic-gate * CDDL HEADER START 3*0Sstevel@tonic-gate * 4*0Sstevel@tonic-gate * The contents of this file are subject to the terms of the 5*0Sstevel@tonic-gate * Common Development and Distribution License, Version 1.0 only 6*0Sstevel@tonic-gate * (the "License"). You may not use this file except in compliance 7*0Sstevel@tonic-gate * with the License. 8*0Sstevel@tonic-gate * 9*0Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10*0Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 11*0Sstevel@tonic-gate * See the License for the specific language governing permissions 12*0Sstevel@tonic-gate * and limitations under the License. 13*0Sstevel@tonic-gate * 14*0Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 15*0Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16*0Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 17*0Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 18*0Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 19*0Sstevel@tonic-gate * 20*0Sstevel@tonic-gate * CDDL HEADER END 21*0Sstevel@tonic-gate */ 22*0Sstevel@tonic-gate /* 23*0Sstevel@tonic-gate * Copyright 2004 Sun Microsystems, Inc. All rights reserved. 24*0Sstevel@tonic-gate * Use is subject to license terms. 25*0Sstevel@tonic-gate */ 26*0Sstevel@tonic-gate 27*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 28*0Sstevel@tonic-gate 29*0Sstevel@tonic-gate #include <stdio.h> 30*0Sstevel@tonic-gate #include <stdlib.h> 31*0Sstevel@tonic-gate #include <ctype.h> 32*0Sstevel@tonic-gate #include <string.h> 33*0Sstevel@tonic-gate #include <fcntl.h> 34*0Sstevel@tonic-gate #include <string.h> 35*0Sstevel@tonic-gate #include <sys/types.h> 36*0Sstevel@tonic-gate #include <sys/sysmacros.h> 37*0Sstevel@tonic-gate #include <sys/time.h> 38*0Sstevel@tonic-gate 39*0Sstevel@tonic-gate #include <sys/socket.h> 40*0Sstevel@tonic-gate #include <sys/sockio.h> 41*0Sstevel@tonic-gate #include <net/if.h> 42*0Sstevel@tonic-gate #include <netinet/in_systm.h> 43*0Sstevel@tonic-gate #include <netinet/in.h> 44*0Sstevel@tonic-gate #include <netinet/ip.h> 45*0Sstevel@tonic-gate #include <netinet/ip_icmp.h> 46*0Sstevel@tonic-gate #include <netinet/icmp6.h> 47*0Sstevel@tonic-gate #include <netinet/if_ether.h> 48*0Sstevel@tonic-gate #include <inet/ipsecesp.h> 49*0Sstevel@tonic-gate #include <inet/ipsecah.h> 50*0Sstevel@tonic-gate #include "snoop.h" 51*0Sstevel@tonic-gate 52*0Sstevel@tonic-gate extern char *dlc_header; 53*0Sstevel@tonic-gate 54*0Sstevel@tonic-gate int 55*0Sstevel@tonic-gate interpret_esp(int flags, uint8_t *hdr, int iplen, int fraglen) 56*0Sstevel@tonic-gate { 57*0Sstevel@tonic-gate esph_t *esph = (esph_t *)hdr; 58*0Sstevel@tonic-gate esph_t *aligned_esph; 59*0Sstevel@tonic-gate esph_t storage; /* In case hdr isn't aligned. */ 60*0Sstevel@tonic-gate char *line; 61*0Sstevel@tonic-gate 62*0Sstevel@tonic-gate if (fraglen < sizeof (esph_t)) 63*0Sstevel@tonic-gate return; /* incomplete header */ 64*0Sstevel@tonic-gate 65*0Sstevel@tonic-gate if (!IS_P2ALIGNED(hdr, 4)) { 66*0Sstevel@tonic-gate aligned_esph = &storage; 67*0Sstevel@tonic-gate bcopy(hdr, aligned_esph, sizeof (esph_t)); 68*0Sstevel@tonic-gate } else { 69*0Sstevel@tonic-gate aligned_esph = esph; 70*0Sstevel@tonic-gate } 71*0Sstevel@tonic-gate 72*0Sstevel@tonic-gate if (flags & F_SUM) { 73*0Sstevel@tonic-gate line = (char *)get_sum_line(); 74*0Sstevel@tonic-gate /* 75*0Sstevel@tonic-gate * sprintf() is safe because line guarantees us 80 columns, 76*0Sstevel@tonic-gate * and SPI and replay certainly won't exceed that. 77*0Sstevel@tonic-gate */ 78*0Sstevel@tonic-gate (void) sprintf(line, "ESP SPI=0x%x Replay=%u", 79*0Sstevel@tonic-gate ntohl(aligned_esph->esph_spi), 80*0Sstevel@tonic-gate ntohl(aligned_esph->esph_replay)); 81*0Sstevel@tonic-gate line += strlen(line); 82*0Sstevel@tonic-gate } 83*0Sstevel@tonic-gate 84*0Sstevel@tonic-gate if (flags & F_DTAIL) { 85*0Sstevel@tonic-gate show_header("ESP: ", "Encapsulating Security Payload", 86*0Sstevel@tonic-gate sizeof (esph_t)); 87*0Sstevel@tonic-gate show_space(); 88*0Sstevel@tonic-gate /* 89*0Sstevel@tonic-gate * sprintf() is safe because get_line guarantees us 80 columns, 90*0Sstevel@tonic-gate * and SPI and replay certainly won't exceed that. 91*0Sstevel@tonic-gate */ 92*0Sstevel@tonic-gate (void) sprintf(get_line((char *)&esph->esph_spi - dlc_header, 93*0Sstevel@tonic-gate 4), "SPI = 0x%x", ntohl(aligned_esph->esph_spi)); 94*0Sstevel@tonic-gate (void) sprintf(get_line((char *)&esph->esph_replay - 95*0Sstevel@tonic-gate dlc_header, 4), "Replay = %u", 96*0Sstevel@tonic-gate ntohl(aligned_esph->esph_replay)); 97*0Sstevel@tonic-gate (void) sprintf(get_line((char *)(esph + 1) - dlc_header, 98*0Sstevel@tonic-gate 4), " ....ENCRYPTED DATA...."); 99*0Sstevel@tonic-gate } 100*0Sstevel@tonic-gate 101*0Sstevel@tonic-gate return (sizeof (esph_t)); 102*0Sstevel@tonic-gate } 103*0Sstevel@tonic-gate 104*0Sstevel@tonic-gate int 105*0Sstevel@tonic-gate interpret_ah(int flags, uint8_t *hdr, int iplen, int fraglen) 106*0Sstevel@tonic-gate { 107*0Sstevel@tonic-gate ah_t *ah = (ah_t *)hdr; 108*0Sstevel@tonic-gate ah_t *aligned_ah; 109*0Sstevel@tonic-gate ah_t storage; /* In case hdr isn't aligned. */ 110*0Sstevel@tonic-gate char *line, *buff; 111*0Sstevel@tonic-gate uint_t ahlen, auth_data_len; 112*0Sstevel@tonic-gate uint8_t *auth_data, *data; 113*0Sstevel@tonic-gate int new_iplen; 114*0Sstevel@tonic-gate uint8_t proto; 115*0Sstevel@tonic-gate 116*0Sstevel@tonic-gate if (fraglen < sizeof (ah_t)) 117*0Sstevel@tonic-gate return; /* incomplete header */ 118*0Sstevel@tonic-gate 119*0Sstevel@tonic-gate if (!IS_P2ALIGNED(hdr, 4)) { 120*0Sstevel@tonic-gate aligned_ah = (ah_t *)&storage; 121*0Sstevel@tonic-gate bcopy(hdr, storage, sizeof (ah_t)); 122*0Sstevel@tonic-gate } else { 123*0Sstevel@tonic-gate aligned_ah = ah; 124*0Sstevel@tonic-gate } 125*0Sstevel@tonic-gate 126*0Sstevel@tonic-gate /* 127*0Sstevel@tonic-gate * "+ 8" is for the "constant" part that's not included in the AH 128*0Sstevel@tonic-gate * length. 129*0Sstevel@tonic-gate * 130*0Sstevel@tonic-gate * The AH RFC specifies the length field in "length in 4-byte units, 131*0Sstevel@tonic-gate * not counting the first 8 bytes". So if an AH is 24 bytes long, 132*0Sstevel@tonic-gate * the length field will contain "4". (4 * 4 + 8 == 24). 133*0Sstevel@tonic-gate */ 134*0Sstevel@tonic-gate ahlen = (aligned_ah->ah_length << 2) + 8; 135*0Sstevel@tonic-gate fraglen -= ahlen; 136*0Sstevel@tonic-gate if (fraglen < 0) 137*0Sstevel@tonic-gate return; /* incomplete header */ 138*0Sstevel@tonic-gate 139*0Sstevel@tonic-gate auth_data_len = ahlen - sizeof (ah_t); 140*0Sstevel@tonic-gate auth_data = (uint8_t *)(ah + 1); 141*0Sstevel@tonic-gate data = auth_data + auth_data_len; 142*0Sstevel@tonic-gate 143*0Sstevel@tonic-gate if (flags & F_SUM) { 144*0Sstevel@tonic-gate line = (char *)get_sum_line(); 145*0Sstevel@tonic-gate (void) sprintf(line, "AH SPI=0x%x Replay=%u", 146*0Sstevel@tonic-gate ntohl(aligned_ah->ah_spi), ntohl(aligned_ah->ah_replay)); 147*0Sstevel@tonic-gate line += strlen(line); 148*0Sstevel@tonic-gate } 149*0Sstevel@tonic-gate 150*0Sstevel@tonic-gate if (flags & F_DTAIL) { 151*0Sstevel@tonic-gate show_header("AH: ", "Authentication Header", ahlen); 152*0Sstevel@tonic-gate show_space(); 153*0Sstevel@tonic-gate (void) sprintf(get_line((char *)&ah->ah_nexthdr - dlc_header, 154*0Sstevel@tonic-gate 1), "Next header = %d (%s)", aligned_ah->ah_nexthdr, 155*0Sstevel@tonic-gate getproto(aligned_ah->ah_nexthdr)); 156*0Sstevel@tonic-gate (void) sprintf(get_line((char *)&ah->ah_length - dlc_header, 1), 157*0Sstevel@tonic-gate "AH length = %d (%d bytes)", aligned_ah->ah_length, ahlen); 158*0Sstevel@tonic-gate (void) sprintf(get_line((char *)&ah->ah_reserved - dlc_header, 159*0Sstevel@tonic-gate 2), "<Reserved field = 0x%x>", 160*0Sstevel@tonic-gate ntohs(aligned_ah->ah_reserved)); 161*0Sstevel@tonic-gate (void) sprintf(get_line((char *)&ah->ah_spi - dlc_header, 4), 162*0Sstevel@tonic-gate "SPI = 0x%x", ntohl(aligned_ah->ah_spi)); 163*0Sstevel@tonic-gate (void) sprintf(get_line((char *)&ah->ah_replay - dlc_header, 4), 164*0Sstevel@tonic-gate "Replay = %u", ntohl(aligned_ah->ah_replay)); 165*0Sstevel@tonic-gate 166*0Sstevel@tonic-gate /* * 2 for two hex digits per auth_data byte. */ 167*0Sstevel@tonic-gate buff = malloc(auth_data_len * 2); 168*0Sstevel@tonic-gate if (buff != NULL) { 169*0Sstevel@tonic-gate int i; 170*0Sstevel@tonic-gate 171*0Sstevel@tonic-gate for (i = 0; i < auth_data_len; i++) 172*0Sstevel@tonic-gate sprintf(buff + i * 2, "%02x", auth_data[i]); 173*0Sstevel@tonic-gate } 174*0Sstevel@tonic-gate 175*0Sstevel@tonic-gate (void) sprintf(get_line((char *)auth_data - dlc_header, 176*0Sstevel@tonic-gate auth_data_len), "ICV = %s", 177*0Sstevel@tonic-gate (buff == NULL) ? "<out of memory>" : buff); 178*0Sstevel@tonic-gate 179*0Sstevel@tonic-gate /* malloc(3c) says I can call free even if buff == NULL */ 180*0Sstevel@tonic-gate free(buff); 181*0Sstevel@tonic-gate 182*0Sstevel@tonic-gate show_space(); 183*0Sstevel@tonic-gate } 184*0Sstevel@tonic-gate 185*0Sstevel@tonic-gate new_iplen = iplen - ahlen; 186*0Sstevel@tonic-gate proto = aligned_ah->ah_nexthdr; 187*0Sstevel@tonic-gate 188*0Sstevel@tonic-gate /* 189*0Sstevel@tonic-gate * Print IPv6 Extension Headers, or skip them in the summary case. 190*0Sstevel@tonic-gate */ 191*0Sstevel@tonic-gate if (proto == IPPROTO_HOPOPTS || proto == IPPROTO_DSTOPTS || 192*0Sstevel@tonic-gate proto == IPPROTO_ROUTING || proto == IPPROTO_FRAGMENT) { 193*0Sstevel@tonic-gate (void) print_ipv6_extensions(flags, &data, &proto, &iplen, 194*0Sstevel@tonic-gate &fraglen); 195*0Sstevel@tonic-gate } 196*0Sstevel@tonic-gate 197*0Sstevel@tonic-gate if (fraglen > 0) 198*0Sstevel@tonic-gate switch (proto) { 199*0Sstevel@tonic-gate case IPPROTO_ENCAP: 200*0Sstevel@tonic-gate (void) interpret_ip(flags, (struct ip *)data, 201*0Sstevel@tonic-gate new_iplen); 202*0Sstevel@tonic-gate break; 203*0Sstevel@tonic-gate case IPPROTO_IPV6: 204*0Sstevel@tonic-gate (void) interpret_ipv6(flags, (ip6_t *)data, 205*0Sstevel@tonic-gate new_iplen); 206*0Sstevel@tonic-gate break; 207*0Sstevel@tonic-gate case IPPROTO_ICMP: 208*0Sstevel@tonic-gate interpret_icmp(flags, (struct icmp *)data, 209*0Sstevel@tonic-gate new_iplen, fraglen); 210*0Sstevel@tonic-gate break; 211*0Sstevel@tonic-gate case IPPROTO_ICMPV6: 212*0Sstevel@tonic-gate interpret_icmpv6(flags, (icmp6_t *)data, 213*0Sstevel@tonic-gate new_iplen, fraglen); 214*0Sstevel@tonic-gate break; 215*0Sstevel@tonic-gate case IPPROTO_TCP: 216*0Sstevel@tonic-gate interpret_tcp(flags, data, new_iplen, fraglen); 217*0Sstevel@tonic-gate break; 218*0Sstevel@tonic-gate 219*0Sstevel@tonic-gate case IPPROTO_ESP: 220*0Sstevel@tonic-gate interpret_esp(flags, data, new_iplen, fraglen); 221*0Sstevel@tonic-gate break; 222*0Sstevel@tonic-gate case IPPROTO_AH: 223*0Sstevel@tonic-gate interpret_ah(flags, data, new_iplen, fraglen); 224*0Sstevel@tonic-gate break; 225*0Sstevel@tonic-gate 226*0Sstevel@tonic-gate 227*0Sstevel@tonic-gate case IPPROTO_UDP: 228*0Sstevel@tonic-gate interpret_udp(flags, data, new_iplen, fraglen); 229*0Sstevel@tonic-gate break; 230*0Sstevel@tonic-gate /* default case is to not print anything else */ 231*0Sstevel@tonic-gate } 232*0Sstevel@tonic-gate 233*0Sstevel@tonic-gate return (ahlen); 234*0Sstevel@tonic-gate } 235