17c478bd9Sstevel@tonic-gate /* 27c478bd9Sstevel@tonic-gate * CDDL HEADER START 37c478bd9Sstevel@tonic-gate * 47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the 57c478bd9Sstevel@tonic-gate * Common Development and Distribution License, Version 1.0 only 67c478bd9Sstevel@tonic-gate * (the "License"). You may not use this file except in compliance 77c478bd9Sstevel@tonic-gate * with the License. 87c478bd9Sstevel@tonic-gate * 97c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 107c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 117c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions 127c478bd9Sstevel@tonic-gate * and limitations under the License. 137c478bd9Sstevel@tonic-gate * 147c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 157c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 167c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 177c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 187c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 197c478bd9Sstevel@tonic-gate * 207c478bd9Sstevel@tonic-gate * CDDL HEADER END 217c478bd9Sstevel@tonic-gate */ 227c478bd9Sstevel@tonic-gate /* 23*2e3b6467Skcpoon * Copyright 2005 Sun Microsystems, Inc. All rights reserved. 247c478bd9Sstevel@tonic-gate * Use is subject to license terms. 257c478bd9Sstevel@tonic-gate */ 267c478bd9Sstevel@tonic-gate 277c478bd9Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 287c478bd9Sstevel@tonic-gate 297c478bd9Sstevel@tonic-gate #include <stdio.h> 307c478bd9Sstevel@tonic-gate #include <stdlib.h> 317c478bd9Sstevel@tonic-gate #include <ctype.h> 327c478bd9Sstevel@tonic-gate #include <string.h> 337c478bd9Sstevel@tonic-gate #include <fcntl.h> 347c478bd9Sstevel@tonic-gate #include <string.h> 357c478bd9Sstevel@tonic-gate #include <sys/types.h> 367c478bd9Sstevel@tonic-gate #include <sys/sysmacros.h> 377c478bd9Sstevel@tonic-gate #include <sys/time.h> 387c478bd9Sstevel@tonic-gate 397c478bd9Sstevel@tonic-gate #include <sys/socket.h> 407c478bd9Sstevel@tonic-gate #include <sys/sockio.h> 417c478bd9Sstevel@tonic-gate #include <net/if.h> 427c478bd9Sstevel@tonic-gate #include <netinet/in_systm.h> 437c478bd9Sstevel@tonic-gate #include <netinet/in.h> 447c478bd9Sstevel@tonic-gate #include <netinet/ip.h> 457c478bd9Sstevel@tonic-gate #include <netinet/ip_icmp.h> 467c478bd9Sstevel@tonic-gate #include <netinet/icmp6.h> 477c478bd9Sstevel@tonic-gate #include <netinet/if_ether.h> 487c478bd9Sstevel@tonic-gate #include <inet/ipsecesp.h> 497c478bd9Sstevel@tonic-gate #include <inet/ipsecah.h> 507c478bd9Sstevel@tonic-gate #include "snoop.h" 517c478bd9Sstevel@tonic-gate 527c478bd9Sstevel@tonic-gate extern char *dlc_header; 537c478bd9Sstevel@tonic-gate 547c478bd9Sstevel@tonic-gate int 557c478bd9Sstevel@tonic-gate interpret_esp(int flags, uint8_t *hdr, int iplen, int fraglen) 567c478bd9Sstevel@tonic-gate { 577c478bd9Sstevel@tonic-gate esph_t *esph = (esph_t *)hdr; 587c478bd9Sstevel@tonic-gate esph_t *aligned_esph; 597c478bd9Sstevel@tonic-gate esph_t storage; /* In case hdr isn't aligned. */ 607c478bd9Sstevel@tonic-gate char *line; 617c478bd9Sstevel@tonic-gate 627c478bd9Sstevel@tonic-gate if (fraglen < sizeof (esph_t)) 63*2e3b6467Skcpoon return (fraglen); /* incomplete header */ 647c478bd9Sstevel@tonic-gate 657c478bd9Sstevel@tonic-gate if (!IS_P2ALIGNED(hdr, 4)) { 667c478bd9Sstevel@tonic-gate aligned_esph = &storage; 677c478bd9Sstevel@tonic-gate bcopy(hdr, aligned_esph, sizeof (esph_t)); 687c478bd9Sstevel@tonic-gate } else { 697c478bd9Sstevel@tonic-gate aligned_esph = esph; 707c478bd9Sstevel@tonic-gate } 717c478bd9Sstevel@tonic-gate 727c478bd9Sstevel@tonic-gate if (flags & F_SUM) { 737c478bd9Sstevel@tonic-gate line = (char *)get_sum_line(); 747c478bd9Sstevel@tonic-gate /* 757c478bd9Sstevel@tonic-gate * sprintf() is safe because line guarantees us 80 columns, 767c478bd9Sstevel@tonic-gate * and SPI and replay certainly won't exceed that. 777c478bd9Sstevel@tonic-gate */ 787c478bd9Sstevel@tonic-gate (void) sprintf(line, "ESP SPI=0x%x Replay=%u", 797c478bd9Sstevel@tonic-gate ntohl(aligned_esph->esph_spi), 807c478bd9Sstevel@tonic-gate ntohl(aligned_esph->esph_replay)); 817c478bd9Sstevel@tonic-gate line += strlen(line); 827c478bd9Sstevel@tonic-gate } 837c478bd9Sstevel@tonic-gate 847c478bd9Sstevel@tonic-gate if (flags & F_DTAIL) { 857c478bd9Sstevel@tonic-gate show_header("ESP: ", "Encapsulating Security Payload", 867c478bd9Sstevel@tonic-gate sizeof (esph_t)); 877c478bd9Sstevel@tonic-gate show_space(); 887c478bd9Sstevel@tonic-gate /* 897c478bd9Sstevel@tonic-gate * sprintf() is safe because get_line guarantees us 80 columns, 907c478bd9Sstevel@tonic-gate * and SPI and replay certainly won't exceed that. 917c478bd9Sstevel@tonic-gate */ 927c478bd9Sstevel@tonic-gate (void) sprintf(get_line((char *)&esph->esph_spi - dlc_header, 937c478bd9Sstevel@tonic-gate 4), "SPI = 0x%x", ntohl(aligned_esph->esph_spi)); 947c478bd9Sstevel@tonic-gate (void) sprintf(get_line((char *)&esph->esph_replay - 957c478bd9Sstevel@tonic-gate dlc_header, 4), "Replay = %u", 967c478bd9Sstevel@tonic-gate ntohl(aligned_esph->esph_replay)); 977c478bd9Sstevel@tonic-gate (void) sprintf(get_line((char *)(esph + 1) - dlc_header, 987c478bd9Sstevel@tonic-gate 4), " ....ENCRYPTED DATA...."); 997c478bd9Sstevel@tonic-gate } 1007c478bd9Sstevel@tonic-gate 1017c478bd9Sstevel@tonic-gate return (sizeof (esph_t)); 1027c478bd9Sstevel@tonic-gate } 1037c478bd9Sstevel@tonic-gate 1047c478bd9Sstevel@tonic-gate int 1057c478bd9Sstevel@tonic-gate interpret_ah(int flags, uint8_t *hdr, int iplen, int fraglen) 1067c478bd9Sstevel@tonic-gate { 1077c478bd9Sstevel@tonic-gate ah_t *ah = (ah_t *)hdr; 1087c478bd9Sstevel@tonic-gate ah_t *aligned_ah; 1097c478bd9Sstevel@tonic-gate ah_t storage; /* In case hdr isn't aligned. */ 1107c478bd9Sstevel@tonic-gate char *line, *buff; 1117c478bd9Sstevel@tonic-gate uint_t ahlen, auth_data_len; 1127c478bd9Sstevel@tonic-gate uint8_t *auth_data, *data; 1137c478bd9Sstevel@tonic-gate int new_iplen; 1147c478bd9Sstevel@tonic-gate uint8_t proto; 1157c478bd9Sstevel@tonic-gate 1167c478bd9Sstevel@tonic-gate if (fraglen < sizeof (ah_t)) 117*2e3b6467Skcpoon return (fraglen); /* incomplete header */ 1187c478bd9Sstevel@tonic-gate 1197c478bd9Sstevel@tonic-gate if (!IS_P2ALIGNED(hdr, 4)) { 1207c478bd9Sstevel@tonic-gate aligned_ah = (ah_t *)&storage; 1217c478bd9Sstevel@tonic-gate bcopy(hdr, storage, sizeof (ah_t)); 1227c478bd9Sstevel@tonic-gate } else { 1237c478bd9Sstevel@tonic-gate aligned_ah = ah; 1247c478bd9Sstevel@tonic-gate } 1257c478bd9Sstevel@tonic-gate 1267c478bd9Sstevel@tonic-gate /* 1277c478bd9Sstevel@tonic-gate * "+ 8" is for the "constant" part that's not included in the AH 1287c478bd9Sstevel@tonic-gate * length. 1297c478bd9Sstevel@tonic-gate * 1307c478bd9Sstevel@tonic-gate * The AH RFC specifies the length field in "length in 4-byte units, 1317c478bd9Sstevel@tonic-gate * not counting the first 8 bytes". So if an AH is 24 bytes long, 1327c478bd9Sstevel@tonic-gate * the length field will contain "4". (4 * 4 + 8 == 24). 1337c478bd9Sstevel@tonic-gate */ 1347c478bd9Sstevel@tonic-gate ahlen = (aligned_ah->ah_length << 2) + 8; 1357c478bd9Sstevel@tonic-gate fraglen -= ahlen; 1367c478bd9Sstevel@tonic-gate if (fraglen < 0) 137*2e3b6467Skcpoon return (fraglen + ahlen); /* incomplete header */ 1387c478bd9Sstevel@tonic-gate 1397c478bd9Sstevel@tonic-gate auth_data_len = ahlen - sizeof (ah_t); 1407c478bd9Sstevel@tonic-gate auth_data = (uint8_t *)(ah + 1); 1417c478bd9Sstevel@tonic-gate data = auth_data + auth_data_len; 1427c478bd9Sstevel@tonic-gate 1437c478bd9Sstevel@tonic-gate if (flags & F_SUM) { 1447c478bd9Sstevel@tonic-gate line = (char *)get_sum_line(); 1457c478bd9Sstevel@tonic-gate (void) sprintf(line, "AH SPI=0x%x Replay=%u", 1467c478bd9Sstevel@tonic-gate ntohl(aligned_ah->ah_spi), ntohl(aligned_ah->ah_replay)); 1477c478bd9Sstevel@tonic-gate line += strlen(line); 1487c478bd9Sstevel@tonic-gate } 1497c478bd9Sstevel@tonic-gate 1507c478bd9Sstevel@tonic-gate if (flags & F_DTAIL) { 1517c478bd9Sstevel@tonic-gate show_header("AH: ", "Authentication Header", ahlen); 1527c478bd9Sstevel@tonic-gate show_space(); 1537c478bd9Sstevel@tonic-gate (void) sprintf(get_line((char *)&ah->ah_nexthdr - dlc_header, 1547c478bd9Sstevel@tonic-gate 1), "Next header = %d (%s)", aligned_ah->ah_nexthdr, 1557c478bd9Sstevel@tonic-gate getproto(aligned_ah->ah_nexthdr)); 1567c478bd9Sstevel@tonic-gate (void) sprintf(get_line((char *)&ah->ah_length - dlc_header, 1), 1577c478bd9Sstevel@tonic-gate "AH length = %d (%d bytes)", aligned_ah->ah_length, ahlen); 1587c478bd9Sstevel@tonic-gate (void) sprintf(get_line((char *)&ah->ah_reserved - dlc_header, 1597c478bd9Sstevel@tonic-gate 2), "<Reserved field = 0x%x>", 1607c478bd9Sstevel@tonic-gate ntohs(aligned_ah->ah_reserved)); 1617c478bd9Sstevel@tonic-gate (void) sprintf(get_line((char *)&ah->ah_spi - dlc_header, 4), 1627c478bd9Sstevel@tonic-gate "SPI = 0x%x", ntohl(aligned_ah->ah_spi)); 1637c478bd9Sstevel@tonic-gate (void) sprintf(get_line((char *)&ah->ah_replay - dlc_header, 4), 1647c478bd9Sstevel@tonic-gate "Replay = %u", ntohl(aligned_ah->ah_replay)); 1657c478bd9Sstevel@tonic-gate 1667c478bd9Sstevel@tonic-gate /* * 2 for two hex digits per auth_data byte. */ 1677c478bd9Sstevel@tonic-gate buff = malloc(auth_data_len * 2); 1687c478bd9Sstevel@tonic-gate if (buff != NULL) { 1697c478bd9Sstevel@tonic-gate int i; 1707c478bd9Sstevel@tonic-gate 1717c478bd9Sstevel@tonic-gate for (i = 0; i < auth_data_len; i++) 1727c478bd9Sstevel@tonic-gate sprintf(buff + i * 2, "%02x", auth_data[i]); 1737c478bd9Sstevel@tonic-gate } 1747c478bd9Sstevel@tonic-gate 1757c478bd9Sstevel@tonic-gate (void) sprintf(get_line((char *)auth_data - dlc_header, 1767c478bd9Sstevel@tonic-gate auth_data_len), "ICV = %s", 1777c478bd9Sstevel@tonic-gate (buff == NULL) ? "<out of memory>" : buff); 1787c478bd9Sstevel@tonic-gate 1797c478bd9Sstevel@tonic-gate /* malloc(3c) says I can call free even if buff == NULL */ 1807c478bd9Sstevel@tonic-gate free(buff); 1817c478bd9Sstevel@tonic-gate 1827c478bd9Sstevel@tonic-gate show_space(); 1837c478bd9Sstevel@tonic-gate } 1847c478bd9Sstevel@tonic-gate 1857c478bd9Sstevel@tonic-gate new_iplen = iplen - ahlen; 1867c478bd9Sstevel@tonic-gate proto = aligned_ah->ah_nexthdr; 1877c478bd9Sstevel@tonic-gate 1887c478bd9Sstevel@tonic-gate /* 1897c478bd9Sstevel@tonic-gate * Print IPv6 Extension Headers, or skip them in the summary case. 1907c478bd9Sstevel@tonic-gate */ 1917c478bd9Sstevel@tonic-gate if (proto == IPPROTO_HOPOPTS || proto == IPPROTO_DSTOPTS || 1927c478bd9Sstevel@tonic-gate proto == IPPROTO_ROUTING || proto == IPPROTO_FRAGMENT) { 1937c478bd9Sstevel@tonic-gate (void) print_ipv6_extensions(flags, &data, &proto, &iplen, 1947c478bd9Sstevel@tonic-gate &fraglen); 1957c478bd9Sstevel@tonic-gate } 1967c478bd9Sstevel@tonic-gate 1977c478bd9Sstevel@tonic-gate if (fraglen > 0) 1987c478bd9Sstevel@tonic-gate switch (proto) { 1997c478bd9Sstevel@tonic-gate case IPPROTO_ENCAP: 2007c478bd9Sstevel@tonic-gate (void) interpret_ip(flags, (struct ip *)data, 2017c478bd9Sstevel@tonic-gate new_iplen); 2027c478bd9Sstevel@tonic-gate break; 2037c478bd9Sstevel@tonic-gate case IPPROTO_IPV6: 2047c478bd9Sstevel@tonic-gate (void) interpret_ipv6(flags, (ip6_t *)data, 2057c478bd9Sstevel@tonic-gate new_iplen); 2067c478bd9Sstevel@tonic-gate break; 2077c478bd9Sstevel@tonic-gate case IPPROTO_ICMP: 2087c478bd9Sstevel@tonic-gate interpret_icmp(flags, (struct icmp *)data, 2097c478bd9Sstevel@tonic-gate new_iplen, fraglen); 2107c478bd9Sstevel@tonic-gate break; 2117c478bd9Sstevel@tonic-gate case IPPROTO_ICMPV6: 2127c478bd9Sstevel@tonic-gate interpret_icmpv6(flags, (icmp6_t *)data, 2137c478bd9Sstevel@tonic-gate new_iplen, fraglen); 2147c478bd9Sstevel@tonic-gate break; 2157c478bd9Sstevel@tonic-gate case IPPROTO_TCP: 2167c478bd9Sstevel@tonic-gate interpret_tcp(flags, data, new_iplen, fraglen); 2177c478bd9Sstevel@tonic-gate break; 2187c478bd9Sstevel@tonic-gate 2197c478bd9Sstevel@tonic-gate case IPPROTO_ESP: 2207c478bd9Sstevel@tonic-gate interpret_esp(flags, data, new_iplen, fraglen); 2217c478bd9Sstevel@tonic-gate break; 2227c478bd9Sstevel@tonic-gate case IPPROTO_AH: 2237c478bd9Sstevel@tonic-gate interpret_ah(flags, data, new_iplen, fraglen); 2247c478bd9Sstevel@tonic-gate break; 2257c478bd9Sstevel@tonic-gate 2267c478bd9Sstevel@tonic-gate 2277c478bd9Sstevel@tonic-gate case IPPROTO_UDP: 2287c478bd9Sstevel@tonic-gate interpret_udp(flags, data, new_iplen, fraglen); 2297c478bd9Sstevel@tonic-gate break; 2307c478bd9Sstevel@tonic-gate /* default case is to not print anything else */ 2317c478bd9Sstevel@tonic-gate } 2327c478bd9Sstevel@tonic-gate 2337c478bd9Sstevel@tonic-gate return (ahlen); 2347c478bd9Sstevel@tonic-gate } 235