17c478bdstevel@tonic-gate/*
27c478bdstevel@tonic-gate * CDDL HEADER START
37c478bdstevel@tonic-gate *
47c478bdstevel@tonic-gate * The contents of this file are subject to the terms of the
545916cdjpk * Common Development and Distribution License (the "License").
645916cdjpk * You may not use this file except in compliance with the License.
77c478bdstevel@tonic-gate *
87c478bdstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bdstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
107c478bdstevel@tonic-gate * See the License for the specific language governing permissions
117c478bdstevel@tonic-gate * and limitations under the License.
127c478bdstevel@tonic-gate *
137c478bdstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
147c478bdstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bdstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
167c478bdstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
177c478bdstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bdstevel@tonic-gate *
197c478bdstevel@tonic-gate * CDDL HEADER END
207c478bdstevel@tonic-gate */
217c478bdstevel@tonic-gate/*
22cc1d209Paul Wernau * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
237c478bdstevel@tonic-gate * Use is subject to license terms.
247c478bdstevel@tonic-gate */
257c478bdstevel@tonic-gate
267c478bdstevel@tonic-gate#include <stdio.h>
277c478bdstevel@tonic-gate#include <stdlib.h>
287c478bdstevel@tonic-gate#include <ctype.h>
297c478bdstevel@tonic-gate#include <string.h>
307c478bdstevel@tonic-gate#include <fcntl.h>
317c478bdstevel@tonic-gate#include <string.h>
3245916cdjpk#include <strings.h>
337c478bdstevel@tonic-gate#include <sys/types.h>
347c478bdstevel@tonic-gate#include <sys/sysmacros.h>
357c478bdstevel@tonic-gate#include <sys/time.h>
367c478bdstevel@tonic-gate
377c478bdstevel@tonic-gate#include <sys/socket.h>
387c478bdstevel@tonic-gate#include <sys/sockio.h>
397c478bdstevel@tonic-gate#include <net/if.h>
407c478bdstevel@tonic-gate#include <netinet/in_systm.h>
417c478bdstevel@tonic-gate#include <netinet/in.h>
427c478bdstevel@tonic-gate#include <netinet/ip.h>
437c478bdstevel@tonic-gate#include <netinet/ip_icmp.h>
447c478bdstevel@tonic-gate#include <netinet/icmp6.h>
457c478bdstevel@tonic-gate#include <netinet/if_ether.h>
467c478bdstevel@tonic-gate#include <inet/ipsecesp.h>
477c478bdstevel@tonic-gate#include <inet/ipsecah.h>
487c478bdstevel@tonic-gate#include "snoop.h"
497c478bdstevel@tonic-gate
5045916cdjpk/* ARGSUSED */
517c478bdstevel@tonic-gateint
527c478bdstevel@tonic-gateinterpret_esp(int flags, uint8_t *hdr, int iplen, int fraglen)
537c478bdstevel@tonic-gate{
5445916cdjpk	/* LINTED: alignment */
557c478bdstevel@tonic-gate	esph_t *esph = (esph_t *)hdr;
567c478bdstevel@tonic-gate	esph_t *aligned_esph;
577c478bdstevel@tonic-gate	esph_t storage;	/* In case hdr isn't aligned. */
587c478bdstevel@tonic-gate	char *line;
597c478bdstevel@tonic-gate
607c478bdstevel@tonic-gate	if (fraglen < sizeof (esph_t))
612e3b646kcpoon		return (fraglen);	/* incomplete header */
627c478bdstevel@tonic-gate
637c478bdstevel@tonic-gate	if (!IS_P2ALIGNED(hdr, 4)) {
647c478bdstevel@tonic-gate		aligned_esph = &storage;
657c478bdstevel@tonic-gate		bcopy(hdr, aligned_esph, sizeof (esph_t));
667c478bdstevel@tonic-gate	} else {
677c478bdstevel@tonic-gate		aligned_esph = esph;
687c478bdstevel@tonic-gate	}
697c478bdstevel@tonic-gate
707c478bdstevel@tonic-gate	if (flags & F_SUM) {
717c478bdstevel@tonic-gate		line = (char *)get_sum_line();
727c478bdstevel@tonic-gate		/*
737c478bdstevel@tonic-gate		 * sprintf() is safe because line guarantees us 80 columns,
747c478bdstevel@tonic-gate		 * and SPI and replay certainly won't exceed that.
757c478bdstevel@tonic-gate		 */
767c478bdstevel@tonic-gate		(void) sprintf(line, "ESP SPI=0x%x Replay=%u",
777c478bdstevel@tonic-gate		    ntohl(aligned_esph->esph_spi),
787c478bdstevel@tonic-gate		    ntohl(aligned_esph->esph_replay));
797c478bdstevel@tonic-gate		line += strlen(line);
807c478bdstevel@tonic-gate	}
817c478bdstevel@tonic-gate
827c478bdstevel@tonic-gate	if (flags & F_DTAIL) {
837c478bdstevel@tonic-gate		show_header("ESP:  ", "Encapsulating Security Payload",
847c478bdstevel@tonic-gate		    sizeof (esph_t));
857c478bdstevel@tonic-gate		show_space();
867c478bdstevel@tonic-gate		/*
877c478bdstevel@tonic-gate		 * sprintf() is safe because get_line guarantees us 80 columns,
887c478bdstevel@tonic-gate		 * and SPI and replay certainly won't exceed that.
897c478bdstevel@tonic-gate		 */
907c478bdstevel@tonic-gate		(void) sprintf(get_line((char *)&esph->esph_spi - dlc_header,
917c478bdstevel@tonic-gate		    4), "SPI = 0x%x", ntohl(aligned_esph->esph_spi));
927c478bdstevel@tonic-gate		(void) sprintf(get_line((char *)&esph->esph_replay -
937c478bdstevel@tonic-gate		    dlc_header, 4), "Replay = %u",
947c478bdstevel@tonic-gate		    ntohl(aligned_esph->esph_replay));
957c478bdstevel@tonic-gate		(void) sprintf(get_line((char *)(esph + 1) - dlc_header,
967c478bdstevel@tonic-gate		    4), "   ....ENCRYPTED DATA....");
977c478bdstevel@tonic-gate	}
987c478bdstevel@tonic-gate
997c478bdstevel@tonic-gate	return (sizeof (esph_t));
1007c478bdstevel@tonic-gate}
1017c478bdstevel@tonic-gate
1027c478bdstevel@tonic-gateint
1037c478bdstevel@tonic-gateinterpret_ah(int flags, uint8_t *hdr, int iplen, int fraglen)
1047c478bdstevel@tonic-gate{
10545916cdjpk	/* LINTED: alignment */
1067c478bdstevel@tonic-gate	ah_t *ah = (ah_t *)hdr;
1077c478bdstevel@tonic-gate	ah_t *aligned_ah;
1087c478bdstevel@tonic-gate	ah_t storage;	/* In case hdr isn't aligned. */
1097c478bdstevel@tonic-gate	char *line, *buff;
1107c478bdstevel@tonic-gate	uint_t ahlen, auth_data_len;
1117c478bdstevel@tonic-gate	uint8_t *auth_data, *data;
1127c478bdstevel@tonic-gate	int new_iplen;
1137c478bdstevel@tonic-gate	uint8_t proto;
1147c478bdstevel@tonic-gate
1157c478bdstevel@tonic-gate	if (fraglen < sizeof (ah_t))
1162e3b646kcpoon		return (fraglen);		/* incomplete header */
1177c478bdstevel@tonic-gate
1187c478bdstevel@tonic-gate	if (!IS_P2ALIGNED(hdr, 4)) {
1197c478bdstevel@tonic-gate		aligned_ah = (ah_t *)&storage;
12045916cdjpk		bcopy(hdr, &storage, sizeof (ah_t));
1217c478bdstevel@tonic-gate	} else {
1227c478bdstevel@tonic-gate		aligned_ah = ah;
1237c478bdstevel@tonic-gate	}
1247c478bdstevel@tonic-gate
1257c478bdstevel@tonic-gate	/*
1267c478bdstevel@tonic-gate	 * "+ 8" is for the "constant" part that's not included in the AH
1277c478bdstevel@tonic-gate	 * length.
1287c478bdstevel@tonic-gate	 *
1297c478bdstevel@tonic-gate	 * The AH RFC specifies the length field in "length in 4-byte units,
1307c478bdstevel@tonic-gate	 * not counting the first 8 bytes".  So if an AH is 24 bytes long,
1317c478bdstevel@tonic-gate	 * the length field will contain "4".  (4 * 4 + 8 == 24).
1327c478bdstevel@tonic-gate	 */
1337c478bdstevel@tonic-gate	ahlen = (aligned_ah->ah_length << 2) + 8;
1347c478bdstevel@tonic-gate	fraglen -= ahlen;
1357c478bdstevel@tonic-gate	if (fraglen < 0)
1362e3b646kcpoon		return (fraglen + ahlen);	/* incomplete header */
1377c478bdstevel@tonic-gate
1387c478bdstevel@tonic-gate	auth_data_len = ahlen - sizeof (ah_t);
1397c478bdstevel@tonic-gate	auth_data = (uint8_t *)(ah + 1);
1407c478bdstevel@tonic-gate	data = auth_data + auth_data_len;
1417c478bdstevel@tonic-gate
1427c478bdstevel@tonic-gate	if (flags & F_SUM) {
1437c478bdstevel@tonic-gate		line = (char *)get_sum_line();
1447c478bdstevel@tonic-gate		(void) sprintf(line, "AH SPI=0x%x Replay=%u",
1457c478bdstevel@tonic-gate		    ntohl(aligned_ah->ah_spi), ntohl(aligned_ah->ah_replay));
1467c478bdstevel@tonic-gate		line += strlen(line);
1477c478bdstevel@tonic-gate	}
1487c478bdstevel@tonic-gate
1497c478bdstevel@tonic-gate	if (flags & F_DTAIL) {
1507c478bdstevel@tonic-gate		show_header("AH:  ", "Authentication Header", ahlen);
1517c478bdstevel@tonic-gate		show_space();
1527c478bdstevel@tonic-gate		(void) sprintf(get_line((char *)&ah->ah_nexthdr - dlc_header,
1537c478bdstevel@tonic-gate		    1), "Next header = %d (%s)", aligned_ah->ah_nexthdr,
1547c478bdstevel@tonic-gate		    getproto(aligned_ah->ah_nexthdr));
1557c478bdstevel@tonic-gate		(void) sprintf(get_line((char *)&ah->ah_length - dlc_header, 1),
1567c478bdstevel@tonic-gate		    "AH length = %d (%d bytes)", aligned_ah->ah_length, ahlen);
1577c478bdstevel@tonic-gate		(void) sprintf(get_line((char *)&ah->ah_reserved - dlc_header,
1587c478bdstevel@tonic-gate		    2), "<Reserved field = 0x%x>",
1597c478bdstevel@tonic-gate		    ntohs(aligned_ah->ah_reserved));
1607c478bdstevel@tonic-gate		(void) sprintf(get_line((char *)&ah->ah_spi - dlc_header, 4),
1617c478bdstevel@tonic-gate		    "SPI = 0x%x", ntohl(aligned_ah->ah_spi));
1627c478bdstevel@tonic-gate		(void) sprintf(get_line((char *)&ah->ah_replay - dlc_header, 4),
1637c478bdstevel@tonic-gate		    "Replay = %u", ntohl(aligned_ah->ah_replay));
1647c478bdstevel@tonic-gate
165cc1d209Paul Wernau		/*
166cc1d209Paul Wernau		 * 2 for two hex digits per auth_data byte
167cc1d209Paul Wernau		 * plus one byte for trailing null byte.
168cc1d209Paul Wernau		 */
169cc1d209Paul Wernau		buff = malloc(auth_data_len * 2 + 1);
1707c478bdstevel@tonic-gate		if (buff != NULL) {
1717c478bdstevel@tonic-gate			int i;
1727c478bdstevel@tonic-gate
1737c478bdstevel@tonic-gate			for (i = 0; i < auth_data_len; i++)
1747c478bdstevel@tonic-gate				sprintf(buff + i * 2, "%02x", auth_data[i]);
1757c478bdstevel@tonic-gate		}
1767c478bdstevel@tonic-gate
1777c478bdstevel@tonic-gate		(void) sprintf(get_line((char *)auth_data - dlc_header,
1787c478bdstevel@tonic-gate		    auth_data_len), "ICV = %s",
1797c478bdstevel@tonic-gate		    (buff == NULL) ? "<out of memory>" : buff);
1807c478bdstevel@tonic-gate
1817c478bdstevel@tonic-gate		/* malloc(3c) says I can call free even if buff == NULL */
1827c478bdstevel@tonic-gate		free(buff);
1837c478bdstevel@tonic-gate
1847c478bdstevel@tonic-gate		show_space();
1857c478bdstevel@tonic-gate	}
1867c478bdstevel@tonic-gate
1877c478bdstevel@tonic-gate	new_iplen = iplen - ahlen;
1887c478bdstevel@tonic-gate	proto = aligned_ah->ah_nexthdr;
1897c478bdstevel@tonic-gate
1907c478bdstevel@tonic-gate	/*
1917c478bdstevel@tonic-gate	 * Print IPv6 Extension Headers, or skip them in the summary case.
1927c478bdstevel@tonic-gate	 */
1937c478bdstevel@tonic-gate	if (proto == IPPROTO_HOPOPTS || proto == IPPROTO_DSTOPTS ||
1947c478bdstevel@tonic-gate	    proto == IPPROTO_ROUTING || proto == IPPROTO_FRAGMENT) {
1957c478bdstevel@tonic-gate		(void) print_ipv6_extensions(flags, &data, &proto, &iplen,
1967c478bdstevel@tonic-gate		    &fraglen);
1977c478bdstevel@tonic-gate	}
1987c478bdstevel@tonic-gate
1997c478bdstevel@tonic-gate	if (fraglen > 0)
2007c478bdstevel@tonic-gate		switch (proto) {
2017c478bdstevel@tonic-gate			case IPPROTO_ENCAP:
20245916cdjpk				/* LINTED: alignment */
2037c478bdstevel@tonic-gate				(void) interpret_ip(flags, (struct ip *)data,
2047c478bdstevel@tonic-gate				    new_iplen);
2057c478bdstevel@tonic-gate				break;
2067c478bdstevel@tonic-gate			case IPPROTO_IPV6:
2077c478bdstevel@tonic-gate				(void) interpret_ipv6(flags, (ip6_t *)data,
2087c478bdstevel@tonic-gate				    new_iplen);
2097c478bdstevel@tonic-gate				break;
2107c478bdstevel@tonic-gate			case IPPROTO_ICMP:
21145916cdjpk				(void) interpret_icmp(flags,
21245916cdjpk				    /* LINTED: alignment */
21345916cdjpk				    (struct icmp *)data, new_iplen, fraglen);
2147c478bdstevel@tonic-gate				break;
2157c478bdstevel@tonic-gate			case IPPROTO_ICMPV6:
21645916cdjpk				/* LINTED: alignment */
21745916cdjpk				(void) interpret_icmpv6(flags, (icmp6_t *)data,
2187c478bdstevel@tonic-gate				    new_iplen, fraglen);
2197c478bdstevel@tonic-gate				break;
2207c478bdstevel@tonic-gate			case IPPROTO_TCP:
22145916cdjpk				(void) interpret_tcp(flags,
22245916cdjpk				    (struct tcphdr *)data, new_iplen, fraglen);
2237c478bdstevel@tonic-gate				break;
2247c478bdstevel@tonic-gate
2257c478bdstevel@tonic-gate			case IPPROTO_ESP:
22645916cdjpk				(void) interpret_esp(flags, data, new_iplen,
22745916cdjpk				    fraglen);
2287c478bdstevel@tonic-gate				break;
22945916cdjpk
2307c478bdstevel@tonic-gate			case IPPROTO_AH:
23145916cdjpk				(void) interpret_ah(flags, data, new_iplen,
23245916cdjpk				    fraglen);
2337c478bdstevel@tonic-gate				break;
2347c478bdstevel@tonic-gate
2357c478bdstevel@tonic-gate			case IPPROTO_UDP:
23645916cdjpk				(void) interpret_udp(flags,
23745916cdjpk				    (struct udphdr *)data, new_iplen, fraglen);
2387c478bdstevel@tonic-gate				break;
2397c478bdstevel@tonic-gate			/* default case is to not print anything else */
2407c478bdstevel@tonic-gate		}
2417c478bdstevel@tonic-gate
2427c478bdstevel@tonic-gate	return (ahlen);
2437c478bdstevel@tonic-gate}
244