xref: /openbsd-src/usr.sbin/tcpdump/print-ipsec.c (revision cf2525843d483a385de106a1361b2b9c18d96583) 
1 /*	$OpenBSD: print-ipsec.c,v 1.9 2006/09/19 14:25:04 naddy Exp $	*/
2 
3 /*
4  * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999
5  *      The Regents of the University of California.  All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that: (1) source code distributions
9  * retain the above copyright notice and this paragraph in its entirety, (2)
10  * distributions including binary code include the above copyright notice and
11  * this paragraph in its entirety in the documentation or other materials
12  * provided with the distribution, and (3) all advertising materials mentioning
13  * features or use of this software display the following acknowledgement:
14  * ``This product includes software developed by the University of California,
15  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
16  * the University nor the names of its contributors may be used to endorse
17  * or promote products derived from this software without specific prior
18  * written permission.
19  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
20  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
21  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
22  *
23  * Format and print IPsec (ESP/AH) packets.
24  *      By Tero Kivinen <kivinen@ssh.fi>, Tero Mononen <tmo@ssh.fi>,
25  *         Tatu Ylonen <ylo@ssh.fi> and Timo J. Rinne <tri@ssh.fi>
26  *         in co-operation with SSH Communications Security, Espoo, Finland
27  */
28 
29 #ifndef lint
30 static const char rcsid[] =
31     "@(#) $Header: /home/cvs/src/usr.sbin/tcpdump/print-ipsec.c,v 1.9 2006/09/19 14:25:04 naddy Exp $ (XXX)";
32 #endif
33 
34 #include <sys/param.h>
35 #include <sys/time.h>
36 #include <sys/socket.h>
37 
38 #include <netinet/in.h>
39 #include <netinet/in_systm.h>
40 #include <netinet/ip.h>
41 #include <netinet/ip_var.h>
42 #include <netinet/udp.h>
43 #include <netinet/udp_var.h>
44 #include <netinet/tcp.h>
45 #include <netinet/tcpip.h>
46 
47 #include <stdio.h>
48 #include <stdlib.h>
49 #include <string.h>
50 #include <unistd.h>
51 
52 #ifdef INET6
53 #include <netinet/ip6.h>
54 #endif
55 
56 #include "addrtoname.h"
57 #include "interface.h"
58 #include "extract.h"		    /* must come after interface.h */
59 
60 #include <openssl/evp.h>
61 #include <ctype.h>
62 
63 /*
64  * IPsec/ESP header
65  */
66 struct esp_hdr {
67 	u_int esp_spi;
68 	u_int esp_seq;
69 };
70 
71 static int espinit = 0;
72 static int espauthlen = 12;
73 static EVP_CIPHER_CTX ctx;
74 
75 int
76 esp_init (char *espspec)
77 {
78 	const EVP_CIPHER *evp;
79 	char *p, *espkey, s[3], name[1024];
80 	u_char *key;
81 	int i, klen, len;
82 
83 	evp = EVP_aes_128_cbc();	/* default */
84 	espkey = espspec;
85 	if ((p = strchr(espspec, ':')) != NULL) {
86 		len = p - espspec;
87 		if (len >= sizeof(name))
88 			error("espalg too long");
89 		memcpy(name, espspec, len);
90 		name[len] = '\0';
91 		espkey = p + 1;
92 
93 		/* strip auth alg */
94 		espauthlen = 0;
95 		if ((p = strstr(name, "-hmac96")) != NULL) {
96 			espauthlen = 12;
97 			*p = '\0';
98 		}
99 		OpenSSL_add_all_algorithms();
100 		if ((evp = EVP_get_cipherbyname(name)) == NULL)
101 			error("espalg `%s' not supported", name);
102 	}
103 	klen = EVP_CIPHER_key_length(evp);
104 	if (strlen(espkey) != klen * 2)
105 		error("espkey size mismatch, %d bytes needed", klen);
106 	if ((key = malloc(klen)) == NULL)
107 		error("malloc failed");
108 	for (i = 0; i < klen; i++) {
109 		s[0] = espkey[2*i];
110 		s[1] = espkey[2*i + 1];
111 		s[2] = 0;
112 		if (!isxdigit(s[0]) || !isxdigit(s[1]))
113 			error("espkey must be specified in hex");
114 		key[i] = strtoul(s, NULL, 16);
115 	}
116 	EVP_CIPHER_CTX_init(&ctx);
117 	if (EVP_CipherInit(&ctx, evp, key, NULL, 0) < 0) {
118 		free(key);
119 		error("espkey init failed");
120 	}
121 	free(key);
122 	espinit = 1;
123 	return (0);
124 }
125 
126 void
127 esp_decrypt (const u_char *bp, u_int len, const u_char *bp2)
128 {
129 	const struct ip *ip;
130 	u_char *data, pad, nh;
131 	int blocksz;
132 
133 	ip = (const struct ip *)bp2;
134 
135 	blocksz = EVP_CIPHER_CTX_block_size(&ctx);
136 
137 	/* Skip fragments and short packets */
138 	if (ntohs(ip->ip_off) & 0x3fff)
139 		return;
140 	if (snapend - bp < len) {
141 		printf(" [|esp]");
142 		return;
143 	}
144 	/*
145 	 * Skip ESP header and ignore authentication trailer.
146 	 * For decryption we need at least 2 blocks: IV and
147 	 * one cipher block.
148 	 */
149 	if (len < sizeof(struct esp_hdr) + espauthlen + 2 * blocksz) {
150 		printf(" [|esp]");
151 		return;
152 	}
153 
154 	data = (char *)bp;
155 	data += sizeof(struct esp_hdr);
156 	len -= sizeof(struct esp_hdr);
157 	len -= espauthlen;
158 
159 	/* the first block contains the IV */
160 	EVP_CipherInit(&ctx, NULL, NULL, data, 0);
161 	len -= blocksz;
162 	data += blocksz;
163 
164 	/* decrypt remaining payload */
165 	EVP_Cipher(&ctx, data, data, len);
166 
167 	nh = data[len - 1];
168 	pad = data[len - 2];
169 
170 	/* verify padding */
171 	if (pad + 2 > len)
172 		return;
173 	if (data[len - 3]  != pad)
174 		return;
175 	if (vflag > 1)
176 		printf(" pad %d", pad);
177 	len -= (pad + 2);
178 	printf(": ");
179 	switch (nh) {
180 	case IPPROTO_TCP:
181 		tcp_print(data, len, bp2);
182 		break;
183 	case IPPROTO_UDP:
184 		udp_print(data, len, bp2);
185 		break;
186 	case IPPROTO_IPV6:
187 		ip6_print(data, len);
188 		break;
189 	case IPPROTO_IPV4:
190 		ip_print(data, len);
191 		break;
192 	case IPPROTO_ICMP:
193 		icmp_print(data, bp2);
194 		break;
195 	default:
196 		printf("ip-proto-%d %d", nh, len);
197 		break;
198 	}
199 	if (vflag)
200 		printf(" (esp)");
201 }
202 
203 void
204 esp_print (register const u_char *bp, register u_int len,
205 	   register const u_char *bp2)
206 {
207 	const struct ip *ip;
208 	const struct esp_hdr *esp;
209 	u_int plen = len;
210 #ifdef INET6
211 	const struct ip6_hdr *ip6;
212 #endif
213 
214 	ip = (const struct ip *)bp2;
215 #ifdef INET6
216 	if (ip->ip_v == 6) {
217 		ip6 = (const struct ip6_hdr *)bp2;
218 		printf("esp %s > %s", ip6addr_string(&ip6->ip6_src),
219 		    ip6addr_string(&ip6->ip6_dst));
220 	} else
221 #endif
222 	{
223 		printf("esp %s > %s",
224 	    	    ipaddr_string(&ip->ip_src), ipaddr_string(&ip->ip_dst));
225 	}
226 
227 	if (plen < sizeof(struct esp_hdr)) {
228 		printf("[|esp]");
229 		return;
230 	}
231 	esp = (const struct esp_hdr *)bp;
232 
233 	printf(" spi 0x%08X seq %d len %d",
234 	    ntohl(esp->esp_spi), ntohl(esp->esp_seq), len);
235 
236 	if (espinit)
237 		esp_decrypt(bp, len, bp2);
238 }
239 
240 /*
241  * IPsec/AH header
242  */
243 struct ah_hdr {
244 	u_char  ah_nxt_hdr;
245 	u_char  ah_pl_len;
246 	u_short ah_reserved;
247 	u_int   ah_spi;
248 	u_int   ah_seq;
249 };
250 
251 void
252 ah_print (register const u_char *bp, register u_int len,
253 	  register const u_char *bp2)
254 {
255 	const struct ip *ip;
256 	const struct ah_hdr *ah;
257 	u_int pl_len = len;
258 #ifdef INET6
259 	const struct ip6_hdr *ip6;
260 #endif
261 
262 	ip = (const struct ip *)bp2;
263 #ifdef INET6
264 	if (ip->ip_v == 6) {
265 		ip6 = (const struct ip6_hdr *)bp2;
266 		printf("ah %s > %s", ip6addr_string(&ip6->ip6_src),
267 		    ip6addr_string(&ip6->ip6_dst));
268 	} else
269 #endif
270 	{
271 		printf("ah %s > %s",
272 	    	    ipaddr_string(&ip->ip_src), ipaddr_string(&ip->ip_dst));
273 	}
274 
275 	if (pl_len < sizeof(struct ah_hdr)) {
276 		printf("[|ah]");
277 		return;
278 	}
279 	ah = (const struct ah_hdr *)bp;
280 
281 	printf(" spi 0x%08X seq %d len %d",
282 	    ntohl(ah->ah_spi), ntohl(ah->ah_seq), len);
283 
284 	if (vflag) {
285 	        (void)printf("\n\t[ ");
286 
287 	        pl_len = (ah->ah_pl_len + 2) << 2; /* RFC2402, sec 2.2 */
288 
289 		if (len - pl_len <= 0) {
290 		        (void)printf("truncated");
291 			goto out;
292 		}
293 
294 		switch (ah->ah_nxt_hdr) {
295 
296 		case IPPROTO_IPIP: /* Tunnel Mode, IP-in-IP */
297 		        ip_print(bp + pl_len, len - pl_len);
298 			break;
299 
300 	        case IPPROTO_ICMP: /* From here and down; Transport mode */
301 		        icmp_print(bp + pl_len, (const u_char *) ip);
302 			break;
303 
304 	        case IPPROTO_TCP:
305 		        tcp_print(bp + pl_len, len - pl_len,
306 				  (const u_char *) ip);
307 			break;
308 
309 	        case IPPROTO_UDP:
310 		        udp_print(bp + pl_len, len - pl_len,
311 				  (const u_char *) ip);
312 			break;
313 
314 		case IPPROTO_ESP:
315 		        esp_print(bp + pl_len, len - pl_len,
316 				  (const u_char *) ip);
317 			break;
318 
319 		case IPPROTO_AH:
320 		        ah_print(bp + pl_len, len - pl_len,
321 				 (const u_char *) ip);
322 			break;
323 
324 		default:
325 		        (void)printf("ip-proto-%d len %d", ah->ah_nxt_hdr,
326 				     len - pl_len);
327 		}
328 out:
329 		(void)printf(" ]");
330 	}
331 
332 }
333 
334 struct ipcomp_hdr {
335 	u_char  ipcomp_nxt_hdr;
336 	u_char	ipcomp_flags;
337 	u_short	ipcomp_cpi;
338 };
339 
340 void
341 ipcomp_print (register const u_char *bp, register u_int len,
342 	  register const u_char *bp2)
343 {
344 	const struct ip *ip;
345 	const struct ipcomp_hdr *ipc;
346 	u_int plen = len;
347 
348 	ip = (const struct ip *)bp2;
349 
350 	printf("ipcomp %s > %s",
351 	    ipaddr_string(&ip->ip_src), ipaddr_string(&ip->ip_dst));
352 
353 	if (plen < sizeof(struct ipcomp_hdr)) {
354 		printf("[|ipcomp]");
355 		return;
356 	}
357 	ipc = (const struct ipcomp_hdr *)bp;
358 
359 	printf(" cpi 0x%04X flags %x next %x",
360 	    ntohs(ipc->ipcomp_cpi), ipc->ipcomp_flags, ipc->ipcomp_nxt_hdr);
361 }
362