static void esp_print_decode_ikeline(netdissect_options *ndo, char *line,
const char *file, int lineno)
{
/* it's an IKEv2 secret, store it instead */
struct sa_list sa1;
char *init;
char *icookie, *rcookie;
int ilen, rlen;
char *authkey;
char *enckey;
init = strsep(&line, " \t");
icookie = strsep(&line, " \t");
rcookie = strsep(&line, " \t");
authkey = strsep(&line, " \t");
enckey = strsep(&line, " \t");
/* if any fields are missing */
if(!init || !icookie || !rcookie || !authkey || !enckey) {
(*ndo->ndo_warning)(ndo, "print_esp: failed to find all fields for ikev2 at %s:%u",
file, lineno);
return;
}
ilen = strlen(icookie);
rlen = strlen(rcookie);
if((init[0]!='I' && init[0]!='R')
|| icookie[0]!='0' || icookie[1]!='x'
|| rcookie[0]!='0' || rcookie[1]!='x'
|| ilen!=18
|| rlen!=18) {
(*ndo->ndo_warning)(ndo, "print_esp: line %s:%u improperly formatted.",
file, lineno);
(*ndo->ndo_warning)(ndo, "init=%s icookie=%s(%u) rcookie=%s(%u)",
init, icookie, ilen, rcookie, rlen);
return;
}
sa1.spi = 0;
sa1.initiator = (init[0] == 'I');
if(espprint_decode_hex(ndo, sa1.spii, sizeof(sa1.spii), icookie+2)!=8)
return;
if(espprint_decode_hex(ndo, sa1.spir, sizeof(sa1.spir), rcookie+2)!=8)
return;
if(!espprint_decode_encalgo(ndo, enckey, &sa1)) return;
if(!espprint_decode_authalgo(ndo, authkey, &sa1)) return;
esp_print_addsa(ndo, &sa1, FALSE);
}
/*
*
* special form: file /name
* causes us to go read from this file instead.
*
*/
static void esp_print_decode_onesecret(netdissect_options *ndo, char *line,
const char *file, int lineno)
{
struct sa_list sa1;
int sa_def;
char *spikey;
char *decode;
spikey = strsep(&line, " \t");
sa_def = 0;
memset(&sa1, 0, sizeof(struct sa_list));
/* if there is only one token, then it is an algo:key token */
if (line == NULL) {
decode = spikey;
spikey = NULL;
/* memset(&sa1.daddr, 0, sizeof(sa1.daddr)); */
/* sa1.spi = 0; */
sa_def = 1;
} else
decode = line;
if (spikey && strcasecmp(spikey, "file") == 0) {
/* open file and read it */
FILE *secretfile;
char fileline[1024];
int lineno=0;
char *nl;
char *filename = line;
secretfile = fopen(filename, FOPEN_READ_TXT);
if (secretfile == NULL) {
perror(filename);
exit(3);
}
while (fgets(fileline, sizeof(fileline)-1, secretfile) != NULL) {
lineno++;
/* remove newline from the line */
nl = strchr(fileline, '\n');
if (nl)
*nl = '\0';
if (fileline[0] == '#') continue;
if (fileline[0] == '\0') continue;
esp_print_decode_onesecret(ndo, fileline, filename, lineno);
}
fclose(secretfile);
return;
}
if (spikey && strcasecmp(spikey, "ikev2") == 0) {
esp_print_decode_ikeline(ndo, line, file, lineno);
return;
}
if (spikey) {
char *spistr, *foo;
u_int32_t spino;
struct sockaddr_in *sin;
#ifdef INET6
struct sockaddr_in6 *sin6;
#endif
spistr = strsep(&spikey, "@");
spino = strtoul(spistr, &foo, 0);
if (spistr == foo || !spikey) {
(*ndo->ndo_warning)(ndo, "print_esp: failed to decode spi# %s\n", foo);
return;
}
sa1.spi = spino;
sin = (struct sockaddr_in *)&sa1.daddr;
#ifdef INET6
sin6 = (struct sockaddr_in6 *)&sa1.daddr;
if (inet_pton(AF_INET6, spikey, &sin6->sin6_addr) == 1) {
#ifdef HAVE_SOCKADDR_SA_LEN
sin6->sin6_len = sizeof(struct sockaddr_in6);
#endif
sin6->sin6_family = AF_INET6;
} else
#endif
if (inet_pton(AF_INET, spikey, &sin->sin_addr) == 1) {
#ifdef HAVE_SOCKADDR_SA_LEN
sin->sin_len = sizeof(struct sockaddr_in);
#endif
sin->sin_family = AF_INET;
} else {
(*ndo->ndo_warning)(ndo, "print_esp: can not decode IP# %s\n", spikey);
return;
}
}
if (decode) {
/* skip any blank spaces */
while (isspace((unsigned char)*decode))
decode++;
if(!espprint_decode_encalgo(ndo, decode, &sa1)) {
return;
}
}
esp_print_addsa(ndo, &sa1, sa_def);
}
/*
* decode the form: SPINUM@IP <tab> ALGONAME:0xsecret
*
* special form: file /name
* causes us to go read from this file instead.
*
*/
static void esp_print_decode_onesecret(netdissect_options *ndo, char *line)
{
struct sa_list sa1;
int sa_def;
char *spikey;
char *decode;
spikey = strsep(&line, " \t");
sa_def = 0;
memset(&sa1, 0, sizeof(struct sa_list));
/* if there is only one token, then it is an algo:key token */
if (line == NULL) {
decode = spikey;
spikey = NULL;
/* memset(&sa1.daddr, 0, sizeof(sa1.daddr)); */
/* sa1.spi = 0; */
sa_def = 1;
} else
decode = line;
if (spikey && strcasecmp(spikey, "file") == 0) {
/* open file and read it */
FILE *secretfile;
char fileline[1024];
char *nl;
secretfile = fopen(line, FOPEN_READ_TXT);
if (secretfile == NULL) {
perror(line);
exit(3);
}
while (fgets(fileline, sizeof(fileline)-1, secretfile) != NULL) {
/* remove newline from the line */
nl = strchr(fileline, '\n');
if (nl)
*nl = '\0';
if (fileline[0] == '#') continue;
if (fileline[0] == '\0') continue;
esp_print_decode_onesecret(ndo, fileline);
}
fclose(secretfile);
return;
}
if (spikey) {
char *spistr, *foo;
u_int32_t spino;
struct sockaddr_in *sin;
#ifdef INET6
struct sockaddr_in6 *sin6;
#endif
spistr = strsep(&spikey, "@");
spino = strtoul(spistr, &foo, 0);
if (spistr == foo || !spikey) {
(*ndo->ndo_warning)(ndo, "print_esp: failed to decode spi# %s\n", foo);
return;
}
sa1.spi = spino;
sin = (struct sockaddr_in *)&sa1.daddr;
#ifdef INET6
sin6 = (struct sockaddr_in6 *)&sa1.daddr;
if (inet_pton(AF_INET6, spikey, &sin6->sin6_addr) == 1) {
#ifdef HAVE_SOCKADDR_SA_LEN
sin6->sin6_len = sizeof(struct sockaddr_in6);
#endif
sin6->sin6_family = AF_INET6;
} else
#endif
if (inet_pton(AF_INET, spikey, &sin->sin_addr) == 1) {
#ifdef HAVE_SOCKADDR_SA_LEN
sin->sin_len = sizeof(struct sockaddr_in);
#endif
sin->sin_family = AF_INET;
} else {
(*ndo->ndo_warning)(ndo, "print_esp: can not decode IP# %s\n", spikey);
return;
}
}
if (decode) {
char *colon, *p;
u_char espsecret_key[256];
int len;
size_t i;
const EVP_CIPHER *evp;
int authlen = 0;
/* skip any blank spaces */
while (isspace((unsigned char)*decode))
decode++;
colon = strchr(decode, ':');
if (colon == NULL) {
(*ndo->ndo_warning)(ndo, "failed to decode espsecret: %s\n", decode);
return;
}
*colon = '\0';
len = colon - decode;
if (strlen(decode) > strlen("-hmac96") &&
!strcmp(decode + strlen(decode) - strlen("-hmac96"),
"-hmac96")) {
p = strstr(decode, "-hmac96");
*p = '\0';
authlen = 12;
}
if (strlen(decode) > strlen("-cbc") &&
!strcmp(decode + strlen(decode) - strlen("-cbc"), "-cbc")) {
p = strstr(decode, "-cbc");
*p = '\0';
}
evp = EVP_get_cipherbyname(decode);
if (!evp) {
(*ndo->ndo_warning)(ndo, "failed to find cipher algo %s\n", decode);
sa1.evp = NULL;
sa1.authlen = 0;
sa1.ivlen = 0;
return;
}
sa1.evp = evp;
sa1.authlen = authlen;
sa1.ivlen = EVP_CIPHER_iv_length(evp);
colon++;
if (colon[0] == '0' && colon[1] == 'x') {
/* decode some hex! */
colon += 2;
len = strlen(colon) / 2;
if (len > 256) {
(*ndo->ndo_warning)(ndo, "secret is too big: %d\n", len);
return;
}
i = 0;
while (colon[0] != '\0' && colon[1]!='\0') {
espsecret_key[i] = hex2byte(ndo, colon);
colon += 2;
i++;
}
memcpy(sa1.secret, espsecret_key, i);
sa1.secretlen = i;
} else {
i = strlen(colon);
if (i < sizeof(sa1.secret)) {
memcpy(sa1.secret, colon, i);
sa1.secretlen = i;
} else {
memcpy(sa1.secret, colon, sizeof(sa1.secret));
sa1.secretlen = sizeof(sa1.secret);
}
}
}
esp_print_addsa(ndo, &sa1, sa_def);
}
/*
*
* special form: file /name
* causes us to go read from this file instead.
*
*/
static void esp_print_decode_onesecret(netdissect_options *ndo, char *line,
const char *file, int lineno)
{
struct sa_list sa1;
int sa_def;
char *spikey;
char *decode;
spikey = strsep(&line, " \t");
sa_def = 0;
memset(&sa1, 0, sizeof(struct sa_list));
/* if there is only one token, then it is an algo:key token */
if (line == NULL) {
decode = spikey;
spikey = NULL;
/* sa1.daddr.version = 0; */
/* memset(&sa1.daddr, 0, sizeof(sa1.daddr)); */
/* sa1.spi = 0; */
sa_def = 1;
} else
decode = line;
if (spikey && ascii_strcasecmp(spikey, "file") == 0) {
/* open file and read it */
FILE *secretfile;
char fileline[1024];
int subfile_lineno=0;
char *nl;
char *filename = line;
secretfile = fopen(filename, FOPEN_READ_TXT);
if (secretfile == NULL) {
perror(filename);
exit(3);
}
while (fgets(fileline, sizeof(fileline)-1, secretfile) != NULL) {
subfile_lineno++;
/* remove newline from the line */
nl = strchr(fileline, '\n');
if (nl)
*nl = '\0';
if (fileline[0] == '#') continue;
if (fileline[0] == '\0') continue;
esp_print_decode_onesecret(ndo, fileline, filename, subfile_lineno);
}
fclose(secretfile);
return;
}
if (spikey && ascii_strcasecmp(spikey, "ikev2") == 0) {
esp_print_decode_ikeline(ndo, line, file, lineno);
return;
}
if (spikey) {
char *spistr, *foo;
uint32_t spino;
spistr = strsep(&spikey, "@");
spino = strtoul(spistr, &foo, 0);
if (spistr == foo || !spikey) {
(*ndo->ndo_warning)(ndo, "print_esp: failed to decode spi# %s\n", foo);
return;
}
sa1.spi = spino;
if (strtoaddr6(spikey, &sa1.daddr.in6) == 1) {
sa1.daddr_version = 6;
} else if (strtoaddr(spikey, &sa1.daddr.in4) == 1) {
sa1.daddr_version = 4;
} else {
(*ndo->ndo_warning)(ndo, "print_esp: can not decode IP# %s\n", spikey);
return;
}
}
if (decode) {
/* skip any blank spaces */
while (isspace((unsigned char)*decode))
decode++;
if(!espprint_decode_encalgo(ndo, decode, &sa1)) {
return;
}
}
esp_print_addsa(ndo, &sa1, sa_def);
}