17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate * CDDL HEADER START
37c478bd9Sstevel@tonic-gate *
47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the
545916cd2Sjpk * Common Development and Distribution License (the "License").
645916cd2Sjpk * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate *
87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate * and limitations under the License.
127c478bd9Sstevel@tonic-gate *
137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate *
197c478bd9Sstevel@tonic-gate * CDDL HEADER END
207c478bd9Sstevel@tonic-gate */
217c478bd9Sstevel@tonic-gate /*
22*cc1d2096SPaul Wernau * Copyright 2009 Sun Microsystems, Inc. All rights reserved.
237c478bd9Sstevel@tonic-gate * Use is subject to license terms.
247c478bd9Sstevel@tonic-gate */
257c478bd9Sstevel@tonic-gate
267c478bd9Sstevel@tonic-gate #include <stdio.h>
277c478bd9Sstevel@tonic-gate #include <stdlib.h>
287c478bd9Sstevel@tonic-gate #include <ctype.h>
297c478bd9Sstevel@tonic-gate #include <string.h>
307c478bd9Sstevel@tonic-gate #include <fcntl.h>
317c478bd9Sstevel@tonic-gate #include <string.h>
3245916cd2Sjpk #include <strings.h>
337c478bd9Sstevel@tonic-gate #include <sys/types.h>
347c478bd9Sstevel@tonic-gate #include <sys/sysmacros.h>
357c478bd9Sstevel@tonic-gate #include <sys/time.h>
367c478bd9Sstevel@tonic-gate
377c478bd9Sstevel@tonic-gate #include <sys/socket.h>
387c478bd9Sstevel@tonic-gate #include <sys/sockio.h>
397c478bd9Sstevel@tonic-gate #include <net/if.h>
407c478bd9Sstevel@tonic-gate #include <netinet/in_systm.h>
417c478bd9Sstevel@tonic-gate #include <netinet/in.h>
427c478bd9Sstevel@tonic-gate #include <netinet/ip.h>
437c478bd9Sstevel@tonic-gate #include <netinet/ip_icmp.h>
447c478bd9Sstevel@tonic-gate #include <netinet/icmp6.h>
457c478bd9Sstevel@tonic-gate #include <netinet/if_ether.h>
467c478bd9Sstevel@tonic-gate #include <inet/ipsecesp.h>
477c478bd9Sstevel@tonic-gate #include <inet/ipsecah.h>
487c478bd9Sstevel@tonic-gate #include "snoop.h"
497c478bd9Sstevel@tonic-gate
5045916cd2Sjpk /* ARGSUSED */
517c478bd9Sstevel@tonic-gate int
interpret_esp(int flags,uint8_t * hdr,int iplen,int fraglen)527c478bd9Sstevel@tonic-gate interpret_esp(int flags, uint8_t *hdr, int iplen, int fraglen)
537c478bd9Sstevel@tonic-gate {
5445916cd2Sjpk /* LINTED: alignment */
557c478bd9Sstevel@tonic-gate esph_t *esph = (esph_t *)hdr;
567c478bd9Sstevel@tonic-gate esph_t *aligned_esph;
577c478bd9Sstevel@tonic-gate esph_t storage; /* In case hdr isn't aligned. */
587c478bd9Sstevel@tonic-gate char *line;
597c478bd9Sstevel@tonic-gate
607c478bd9Sstevel@tonic-gate if (fraglen < sizeof (esph_t))
612e3b6467Skcpoon return (fraglen); /* incomplete header */
627c478bd9Sstevel@tonic-gate
637c478bd9Sstevel@tonic-gate if (!IS_P2ALIGNED(hdr, 4)) {
647c478bd9Sstevel@tonic-gate aligned_esph = &storage;
657c478bd9Sstevel@tonic-gate bcopy(hdr, aligned_esph, sizeof (esph_t));
667c478bd9Sstevel@tonic-gate } else {
677c478bd9Sstevel@tonic-gate aligned_esph = esph;
687c478bd9Sstevel@tonic-gate }
697c478bd9Sstevel@tonic-gate
707c478bd9Sstevel@tonic-gate if (flags & F_SUM) {
717c478bd9Sstevel@tonic-gate line = (char *)get_sum_line();
727c478bd9Sstevel@tonic-gate /*
737c478bd9Sstevel@tonic-gate * sprintf() is safe because line guarantees us 80 columns,
747c478bd9Sstevel@tonic-gate * and SPI and replay certainly won't exceed that.
757c478bd9Sstevel@tonic-gate */
767c478bd9Sstevel@tonic-gate (void) sprintf(line, "ESP SPI=0x%x Replay=%u",
777c478bd9Sstevel@tonic-gate ntohl(aligned_esph->esph_spi),
787c478bd9Sstevel@tonic-gate ntohl(aligned_esph->esph_replay));
797c478bd9Sstevel@tonic-gate line += strlen(line);
807c478bd9Sstevel@tonic-gate }
817c478bd9Sstevel@tonic-gate
827c478bd9Sstevel@tonic-gate if (flags & F_DTAIL) {
837c478bd9Sstevel@tonic-gate show_header("ESP: ", "Encapsulating Security Payload",
847c478bd9Sstevel@tonic-gate sizeof (esph_t));
857c478bd9Sstevel@tonic-gate show_space();
867c478bd9Sstevel@tonic-gate /*
877c478bd9Sstevel@tonic-gate * sprintf() is safe because get_line guarantees us 80 columns,
887c478bd9Sstevel@tonic-gate * and SPI and replay certainly won't exceed that.
897c478bd9Sstevel@tonic-gate */
907c478bd9Sstevel@tonic-gate (void) sprintf(get_line((char *)&esph->esph_spi - dlc_header,
917c478bd9Sstevel@tonic-gate 4), "SPI = 0x%x", ntohl(aligned_esph->esph_spi));
927c478bd9Sstevel@tonic-gate (void) sprintf(get_line((char *)&esph->esph_replay -
937c478bd9Sstevel@tonic-gate dlc_header, 4), "Replay = %u",
947c478bd9Sstevel@tonic-gate ntohl(aligned_esph->esph_replay));
957c478bd9Sstevel@tonic-gate (void) sprintf(get_line((char *)(esph + 1) - dlc_header,
967c478bd9Sstevel@tonic-gate 4), " ....ENCRYPTED DATA....");
977c478bd9Sstevel@tonic-gate }
987c478bd9Sstevel@tonic-gate
997c478bd9Sstevel@tonic-gate return (sizeof (esph_t));
1007c478bd9Sstevel@tonic-gate }
1017c478bd9Sstevel@tonic-gate
1027c478bd9Sstevel@tonic-gate int
interpret_ah(int flags,uint8_t * hdr,int iplen,int fraglen)1037c478bd9Sstevel@tonic-gate interpret_ah(int flags, uint8_t *hdr, int iplen, int fraglen)
1047c478bd9Sstevel@tonic-gate {
10545916cd2Sjpk /* LINTED: alignment */
1067c478bd9Sstevel@tonic-gate ah_t *ah = (ah_t *)hdr;
1077c478bd9Sstevel@tonic-gate ah_t *aligned_ah;
1087c478bd9Sstevel@tonic-gate ah_t storage; /* In case hdr isn't aligned. */
1097c478bd9Sstevel@tonic-gate char *line, *buff;
1107c478bd9Sstevel@tonic-gate uint_t ahlen, auth_data_len;
1117c478bd9Sstevel@tonic-gate uint8_t *auth_data, *data;
1127c478bd9Sstevel@tonic-gate int new_iplen;
1137c478bd9Sstevel@tonic-gate uint8_t proto;
1147c478bd9Sstevel@tonic-gate
1157c478bd9Sstevel@tonic-gate if (fraglen < sizeof (ah_t))
1162e3b6467Skcpoon return (fraglen); /* incomplete header */
1177c478bd9Sstevel@tonic-gate
1187c478bd9Sstevel@tonic-gate if (!IS_P2ALIGNED(hdr, 4)) {
1197c478bd9Sstevel@tonic-gate aligned_ah = (ah_t *)&storage;
12045916cd2Sjpk bcopy(hdr, &storage, sizeof (ah_t));
1217c478bd9Sstevel@tonic-gate } else {
1227c478bd9Sstevel@tonic-gate aligned_ah = ah;
1237c478bd9Sstevel@tonic-gate }
1247c478bd9Sstevel@tonic-gate
1257c478bd9Sstevel@tonic-gate /*
1267c478bd9Sstevel@tonic-gate * "+ 8" is for the "constant" part that's not included in the AH
1277c478bd9Sstevel@tonic-gate * length.
1287c478bd9Sstevel@tonic-gate *
1297c478bd9Sstevel@tonic-gate * The AH RFC specifies the length field in "length in 4-byte units,
1307c478bd9Sstevel@tonic-gate * not counting the first 8 bytes". So if an AH is 24 bytes long,
1317c478bd9Sstevel@tonic-gate * the length field will contain "4". (4 * 4 + 8 == 24).
1327c478bd9Sstevel@tonic-gate */
1337c478bd9Sstevel@tonic-gate ahlen = (aligned_ah->ah_length << 2) + 8;
1347c478bd9Sstevel@tonic-gate fraglen -= ahlen;
1357c478bd9Sstevel@tonic-gate if (fraglen < 0)
1362e3b6467Skcpoon return (fraglen + ahlen); /* incomplete header */
1377c478bd9Sstevel@tonic-gate
1387c478bd9Sstevel@tonic-gate auth_data_len = ahlen - sizeof (ah_t);
1397c478bd9Sstevel@tonic-gate auth_data = (uint8_t *)(ah + 1);
1407c478bd9Sstevel@tonic-gate data = auth_data + auth_data_len;
1417c478bd9Sstevel@tonic-gate
1427c478bd9Sstevel@tonic-gate if (flags & F_SUM) {
1437c478bd9Sstevel@tonic-gate line = (char *)get_sum_line();
1447c478bd9Sstevel@tonic-gate (void) sprintf(line, "AH SPI=0x%x Replay=%u",
1457c478bd9Sstevel@tonic-gate ntohl(aligned_ah->ah_spi), ntohl(aligned_ah->ah_replay));
1467c478bd9Sstevel@tonic-gate line += strlen(line);
1477c478bd9Sstevel@tonic-gate }
1487c478bd9Sstevel@tonic-gate
1497c478bd9Sstevel@tonic-gate if (flags & F_DTAIL) {
1507c478bd9Sstevel@tonic-gate show_header("AH: ", "Authentication Header", ahlen);
1517c478bd9Sstevel@tonic-gate show_space();
1527c478bd9Sstevel@tonic-gate (void) sprintf(get_line((char *)&ah->ah_nexthdr - dlc_header,
1537c478bd9Sstevel@tonic-gate 1), "Next header = %d (%s)", aligned_ah->ah_nexthdr,
1547c478bd9Sstevel@tonic-gate getproto(aligned_ah->ah_nexthdr));
1557c478bd9Sstevel@tonic-gate (void) sprintf(get_line((char *)&ah->ah_length - dlc_header, 1),
1567c478bd9Sstevel@tonic-gate "AH length = %d (%d bytes)", aligned_ah->ah_length, ahlen);
1577c478bd9Sstevel@tonic-gate (void) sprintf(get_line((char *)&ah->ah_reserved - dlc_header,
1587c478bd9Sstevel@tonic-gate 2), "<Reserved field = 0x%x>",
1597c478bd9Sstevel@tonic-gate ntohs(aligned_ah->ah_reserved));
1607c478bd9Sstevel@tonic-gate (void) sprintf(get_line((char *)&ah->ah_spi - dlc_header, 4),
1617c478bd9Sstevel@tonic-gate "SPI = 0x%x", ntohl(aligned_ah->ah_spi));
1627c478bd9Sstevel@tonic-gate (void) sprintf(get_line((char *)&ah->ah_replay - dlc_header, 4),
1637c478bd9Sstevel@tonic-gate "Replay = %u", ntohl(aligned_ah->ah_replay));
1647c478bd9Sstevel@tonic-gate
165*cc1d2096SPaul Wernau /*
166*cc1d2096SPaul Wernau * 2 for two hex digits per auth_data byte
167*cc1d2096SPaul Wernau * plus one byte for trailing null byte.
168*cc1d2096SPaul Wernau */
169*cc1d2096SPaul Wernau buff = malloc(auth_data_len * 2 + 1);
1707c478bd9Sstevel@tonic-gate if (buff != NULL) {
1717c478bd9Sstevel@tonic-gate int i;
1727c478bd9Sstevel@tonic-gate
1737c478bd9Sstevel@tonic-gate for (i = 0; i < auth_data_len; i++)
1747c478bd9Sstevel@tonic-gate sprintf(buff + i * 2, "%02x", auth_data[i]);
1757c478bd9Sstevel@tonic-gate }
1767c478bd9Sstevel@tonic-gate
1777c478bd9Sstevel@tonic-gate (void) sprintf(get_line((char *)auth_data - dlc_header,
1787c478bd9Sstevel@tonic-gate auth_data_len), "ICV = %s",
1797c478bd9Sstevel@tonic-gate (buff == NULL) ? "<out of memory>" : buff);
1807c478bd9Sstevel@tonic-gate
1817c478bd9Sstevel@tonic-gate /* malloc(3c) says I can call free even if buff == NULL */
1827c478bd9Sstevel@tonic-gate free(buff);
1837c478bd9Sstevel@tonic-gate
1847c478bd9Sstevel@tonic-gate show_space();
1857c478bd9Sstevel@tonic-gate }
1867c478bd9Sstevel@tonic-gate
1877c478bd9Sstevel@tonic-gate new_iplen = iplen - ahlen;
1887c478bd9Sstevel@tonic-gate proto = aligned_ah->ah_nexthdr;
1897c478bd9Sstevel@tonic-gate
1907c478bd9Sstevel@tonic-gate /*
1917c478bd9Sstevel@tonic-gate * Print IPv6 Extension Headers, or skip them in the summary case.
1927c478bd9Sstevel@tonic-gate */
1937c478bd9Sstevel@tonic-gate if (proto == IPPROTO_HOPOPTS || proto == IPPROTO_DSTOPTS ||
1947c478bd9Sstevel@tonic-gate proto == IPPROTO_ROUTING || proto == IPPROTO_FRAGMENT) {
1957c478bd9Sstevel@tonic-gate (void) print_ipv6_extensions(flags, &data, &proto, &iplen,
1967c478bd9Sstevel@tonic-gate &fraglen);
1977c478bd9Sstevel@tonic-gate }
1987c478bd9Sstevel@tonic-gate
1997c478bd9Sstevel@tonic-gate if (fraglen > 0)
2007c478bd9Sstevel@tonic-gate switch (proto) {
2017c478bd9Sstevel@tonic-gate case IPPROTO_ENCAP:
20245916cd2Sjpk /* LINTED: alignment */
2037c478bd9Sstevel@tonic-gate (void) interpret_ip(flags, (struct ip *)data,
2047c478bd9Sstevel@tonic-gate new_iplen);
2057c478bd9Sstevel@tonic-gate break;
2067c478bd9Sstevel@tonic-gate case IPPROTO_IPV6:
2077c478bd9Sstevel@tonic-gate (void) interpret_ipv6(flags, (ip6_t *)data,
2087c478bd9Sstevel@tonic-gate new_iplen);
2097c478bd9Sstevel@tonic-gate break;
2107c478bd9Sstevel@tonic-gate case IPPROTO_ICMP:
21145916cd2Sjpk (void) interpret_icmp(flags,
21245916cd2Sjpk /* LINTED: alignment */
21345916cd2Sjpk (struct icmp *)data, new_iplen, fraglen);
2147c478bd9Sstevel@tonic-gate break;
2157c478bd9Sstevel@tonic-gate case IPPROTO_ICMPV6:
21645916cd2Sjpk /* LINTED: alignment */
21745916cd2Sjpk (void) interpret_icmpv6(flags, (icmp6_t *)data,
2187c478bd9Sstevel@tonic-gate new_iplen, fraglen);
2197c478bd9Sstevel@tonic-gate break;
2207c478bd9Sstevel@tonic-gate case IPPROTO_TCP:
22145916cd2Sjpk (void) interpret_tcp(flags,
22245916cd2Sjpk (struct tcphdr *)data, new_iplen, fraglen);
2237c478bd9Sstevel@tonic-gate break;
2247c478bd9Sstevel@tonic-gate
2257c478bd9Sstevel@tonic-gate case IPPROTO_ESP:
22645916cd2Sjpk (void) interpret_esp(flags, data, new_iplen,
22745916cd2Sjpk fraglen);
2287c478bd9Sstevel@tonic-gate break;
22945916cd2Sjpk
2307c478bd9Sstevel@tonic-gate case IPPROTO_AH:
23145916cd2Sjpk (void) interpret_ah(flags, data, new_iplen,
23245916cd2Sjpk fraglen);
2337c478bd9Sstevel@tonic-gate break;
2347c478bd9Sstevel@tonic-gate
2357c478bd9Sstevel@tonic-gate case IPPROTO_UDP:
23645916cd2Sjpk (void) interpret_udp(flags,
23745916cd2Sjpk (struct udphdr *)data, new_iplen, fraglen);
2387c478bd9Sstevel@tonic-gate break;
2397c478bd9Sstevel@tonic-gate /* default case is to not print anything else */
2407c478bd9Sstevel@tonic-gate }
2417c478bd9Sstevel@tonic-gate
2427c478bd9Sstevel@tonic-gate return (ahlen);
2437c478bd9Sstevel@tonic-gate }
244