(self, pkt, verify=True, esn_en=None, esn=None)
| 1158 | esn_en=esn_en, esn=esn) |
| 1159 | |
| 1160 | def _decrypt_esp(self, pkt, verify=True, esn_en=None, esn=None): |
| 1161 | |
| 1162 | encrypted = pkt[ESP] |
| 1163 | |
| 1164 | if verify: |
| 1165 | self.check_spi(pkt) |
| 1166 | self.auth_algo.verify(encrypted, self.auth_key, |
| 1167 | esn_en=esn_en or self.esn_en, |
| 1168 | esn=esn or self.esn) |
| 1169 | |
| 1170 | esp = self.crypt_algo.decrypt(self, encrypted, self.crypt_key, |
| 1171 | self.crypt_icv_size or |
| 1172 | self.crypt_algo.icv_size or |
| 1173 | self.auth_algo.icv_size, |
| 1174 | esn_en=esn_en or self.esn_en, |
| 1175 | esn=esn or self.esn) |
| 1176 | |
| 1177 | if self.tunnel_header: |
| 1178 | # drop the tunnel header and return the payload untouched |
| 1179 | |
| 1180 | pkt.remove_payload() |
| 1181 | if pkt.version == 4: |
| 1182 | pkt.proto = esp.nh |
| 1183 | else: |
| 1184 | pkt.nh = esp.nh |
| 1185 | cls = pkt.guess_payload_class(esp.data) |
| 1186 | |
| 1187 | return cls(esp.data) |
| 1188 | else: |
| 1189 | ip_header = pkt |
| 1190 | |
| 1191 | if ip_header.version == 4: |
| 1192 | ip_header.proto = esp.nh |
| 1193 | del ip_header.chksum |
| 1194 | ip_header.remove_payload() |
| 1195 | ip_header.len = len(ip_header) + len(esp.data) |
| 1196 | # recompute checksum |
| 1197 | ip_header = ip_header.__class__(raw(ip_header)) |
| 1198 | else: |
| 1199 | if self.nat_t_header: |
| 1200 | # drop the UDP header and return the payload untouched |
| 1201 | ip_header.nh = esp.nh |
| 1202 | ip_header.remove_payload() |
| 1203 | else: |
| 1204 | encrypted.underlayer.nh = esp.nh |
| 1205 | encrypted.underlayer.remove_payload() |
| 1206 | ip_header.plen = len(ip_header.payload) + len(esp.data) |
| 1207 | |
| 1208 | cls = ip_header.guess_payload_class(esp.data) |
| 1209 | |
| 1210 | # reassemble the ip_header with the ESP payload |
| 1211 | return ip_header / cls(esp.data) |
| 1212 | |
| 1213 | def _decrypt_ah(self, pkt, verify=True, esn_en=None, esn=None): |
| 1214 |
no test coverage detected