]> The Tcpdump Group git mirrors - tcpdump/blob - print-isakmp.c
projects / tcpdump / blob
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
updated test cases for fixed msgid/cookie printing for IKEv2.
[tcpdump] / print-isakmp.c
1 /*
2 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. Neither the name of the project nor the names of its contributors
14 * may be used to endorse or promote products derived from this software
15 * without specific prior written permission.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 * SUCH DAMAGE.
28 *
29 */
30
31 #ifndef lint
32 static const char rcsid[] _U_ =
33 "@(#) $Header: /tcpdump/master/tcpdump/print-isakmp.c,v 1.57 2007-11-22 21:53:43 mcr Exp $ (LBL)";
34 #endif
35
36 #define NETDISSECT_REWORKED
37 #ifdef HAVE_CONFIG_H
38 #include "config.h"
39 #endif
40
41 #include <tcpdump-stdinc.h>
42
43 #include <string.h>
44
45 #include <stdio.h>
46
47 #include "isakmp.h"
48 #include "ipsec_doi.h"
49 #include "oakley.h"
50 #include "interface.h"
51 #include "addrtoname.h"
52 #include "extract.h" /* must come after interface.h */
53
54 #include "ip.h"
55 #ifdef INET6
56 #include "ip6.h"
57 #endif
58
59 #ifndef HAVE_SOCKADDR_STORAGE
60 #define sockaddr_storage sockaddr
61 #endif
62
63 #define DECLARE_PRINTER(func) static const u_char *ike##func##_print( \
64 netdissect_options *ndo, u_char tpay, \
65 const struct isakmp_gen *ext, \
66 u_int item_len, \
67 const u_char *end_pointer, \
68 u_int32_t phase,\
69 u_int32_t doi0, \
70 u_int32_t proto0, int depth)
71
72 DECLARE_PRINTER(v1_sa);
73 DECLARE_PRINTER(v1_p);
74 DECLARE_PRINTER(v1_t);
75 DECLARE_PRINTER(v1_ke);
76 DECLARE_PRINTER(v1_id);
77 DECLARE_PRINTER(v1_cert);
78 DECLARE_PRINTER(v1_cr);
79 DECLARE_PRINTER(v1_sig);
80 DECLARE_PRINTER(v1_hash);
81 DECLARE_PRINTER(v1_nonce);
82 DECLARE_PRINTER(v1_n);
83 DECLARE_PRINTER(v1_d);
84 DECLARE_PRINTER(v1_vid);
85
86 DECLARE_PRINTER(v2_sa);
87 DECLARE_PRINTER(v2_ke);
88 DECLARE_PRINTER(v2_ID);
89 DECLARE_PRINTER(v2_cert);
90 DECLARE_PRINTER(v2_cr);
91 DECLARE_PRINTER(v2_auth);
92 DECLARE_PRINTER(v2_nonce);
93 DECLARE_PRINTER(v2_n);
94 DECLARE_PRINTER(v2_d);
95 DECLARE_PRINTER(v2_vid);
96 DECLARE_PRINTER(v2_TS);
97 DECLARE_PRINTER(v2_e);
98 DECLARE_PRINTER(v2_cp);
99 DECLARE_PRINTER(v2_eap);
100
101 static const u_char *ike_sub0_print(netdissect_options *ndo,u_char, const struct isakmp_gen *,
102 const u_char *, u_int32_t, u_int32_t, u_int32_t, int);
103 static const u_char *ikev1_sub_print(netdissect_options *ndo,u_char, const struct isakmp_gen *,
104 const u_char *, u_int32_t, u_int32_t, u_int32_t, int);
105
106 static const u_char *ikev2_sub_print(netdissect_options *ndo,
107 u_char np, const struct isakmp_gen *ext,
108 const u_char *ep, u_int32_t phase,
109 u_int32_t doi, u_int32_t proto,
110 int depth);
111
112
113 static char *numstr(int);
114 static void safememcpy(void *, const void *, size_t);
115
116 static void
117 ikev1_print(netdissect_options *ndo,
118 const u_char *bp, u_int length,
119 const u_char *bp2, struct isakmp *base);
120
121 #define MAXINITIATORS 20
122 int ninitiator = 0;
123 struct {
124 cookie_t initiator;
125 struct sockaddr_storage iaddr;
126 struct sockaddr_storage raddr;
127 } cookiecache[MAXINITIATORS];
128
129 /* protocol id */
130 static const char *protoidstr[] = {
131 NULL, "isakmp", "ipsec-ah", "ipsec-esp", "ipcomp",
132 };
133
134 /* isakmp->np */
135 static const char *npstr[] = {
136 "none", "sa", "p", "t", "ke", "id", "cert", "cr", "hash", /* 0 - 8 */
137 "sig", "nonce", "n", "d", "vid", /* 9 - 13 */
138 "pay14", "pay15", "pay16", "pay17", "pay18", /* 14- 18 */
139 "pay19", "pay20", "pay21", "pay22", "pay23", /* 19- 23 */
140 "pay24", "pay25", "pay26", "pay27", "pay28", /* 24- 28 */
141 "pay29", "pay30", "pay31", "pay32", /* 29- 32 */
142 "v2sa", "v2ke", "v2IDi", "v2IDr", "v2cert",/* 33- 37 */
143 "v2cr", "v2auth","v2nonce", "v2n", "v2d", /* 38- 42 */
144 "v2vid", "v2TSi", "v2TSr", "v2e", "v2cp", /* 43- 47 */
145 "v2eap", /* 48 */
146
147 };
148
149 /* isakmp->np */
150 static const u_char *(*npfunc[])(netdissect_options *ndo, u_char tpay,
151 const struct isakmp_gen *ext,
152 u_int item_len,
153 const u_char *end_pointer,
154 u_int32_t phase,
155 u_int32_t doi0,
156 u_int32_t proto0, int depth) = {
157 NULL,
158 ikev1_sa_print,
159 ikev1_p_print,
160 ikev1_t_print,
161 ikev1_ke_print,
162 ikev1_id_print,
163 ikev1_cert_print,
164 ikev1_cr_print,
165 ikev1_hash_print,
166 ikev1_sig_print,
167 ikev1_nonce_print,
168 ikev1_n_print,
169 ikev1_d_print,
170 ikev1_vid_print, /* 13 */
171 NULL, NULL, NULL, NULL, NULL, /* 14- 18 */
172 NULL, NULL, NULL, NULL, NULL, /* 19- 23 */
173 NULL, NULL, NULL, NULL, NULL, /* 24- 28 */
174 NULL, NULL, NULL, NULL, /* 29- 32 */
175 ikev2_sa_print, /* 33 */
176 ikev2_ke_print, /* 34 */
177 ikev2_ID_print, /* 35 */
178 ikev2_ID_print, /* 36 */
179 ikev2_cert_print, /* 37 */
180 ikev2_cr_print, /* 38 */
181 ikev2_auth_print, /* 39 */
182 ikev2_nonce_print, /* 40 */
183 ikev2_n_print, /* 41 */
184 ikev2_d_print, /* 42 */
185 ikev2_vid_print, /* 43 */
186 ikev2_TS_print, /* 44 */
187 ikev2_TS_print, /* 45 */
188 ikev2_e_print, /* 46 */
189 ikev2_cp_print, /* 47 */
190 ikev2_eap_print, /* 48 */
191 };
192
193 /* isakmp->etype */
194 static const char *etypestr[] = {
195 /* IKEv1 exchange types */
196 "none", "base", "ident", "auth", "agg", "inf", NULL, NULL, /* 0-7 */
197 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, /* 8-15 */
198 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, /* 16-23 */
199 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, /* 24-31 */
200 "oakley-quick", "oakley-newgroup", /* 32-33 */
201 /* IKEv2 exchange types */
202 "ikev2_init", "ikev2_auth", "child_sa", "inf2" /* 34-37 */
203 };
204
205 #define STR_OR_ID(x, tab) \
206 (((x) < sizeof(tab)/sizeof(tab[0]) && tab[(x)]) ? tab[(x)] : numstr(x))
207 #define PROTOIDSTR(x) STR_OR_ID(x, protoidstr)
208 #define NPSTR(x) STR_OR_ID(x, npstr)
209 #define ETYPESTR(x) STR_OR_ID(x, etypestr)
210
211 #define CHECKLEN(p, np) \
212 if (ep < (u_char *)(p)) { \
213 ND_PRINT((ndo," [|%s]", NPSTR(np))); \
214 goto done; \
215 }
216
217
218 #define NPFUNC(x) \
219 (((x) < sizeof(npfunc)/sizeof(npfunc[0]) && npfunc[(x)]) \
220 ? npfunc[(x)] : NULL)
221
222 static int
223 iszero(u_char *p, size_t l)
224 {
225 while (l--) {
226 if (*p++)
227 return 0;
228 }
229 return 1;
230 }
231
232 /* find cookie from initiator cache */
233 static int
234 cookie_find(cookie_t *in)
235 {
236 int i;
237
238 for (i = 0; i < MAXINITIATORS; i++) {
239 if (memcmp(in, &cookiecache[i].initiator, sizeof(*in)) == 0)
240 return i;
241 }
242
243 return -1;
244 }
245
246 /* record initiator */
247 static void
248 cookie_record(cookie_t *in, const u_char *bp2)
249 {
250 int i;
251 struct ip *ip;
252 struct sockaddr_in *sin;
253 #ifdef INET6
254 struct ip6_hdr *ip6;
255 struct sockaddr_in6 *sin6;
256 #endif
257
258 i = cookie_find(in);
259 if (0 <= i) {
260 ninitiator = (i + 1) % MAXINITIATORS;
261 return;
262 }
263
264 ip = (struct ip *)bp2;
265 switch (IP_V(ip)) {
266 case 4:
267 memset(&cookiecache[ninitiator].iaddr, 0,
268 sizeof(cookiecache[ninitiator].iaddr));
269 memset(&cookiecache[ninitiator].raddr, 0,
270 sizeof(cookiecache[ninitiator].raddr));
271
272 sin = (struct sockaddr_in *)&cookiecache[ninitiator].iaddr;
273 #ifdef HAVE_SOCKADDR_SA_LEN
274 sin->sin_len = sizeof(struct sockaddr_in);
275 #endif
276 sin->sin_family = AF_INET;
277 memcpy(&sin->sin_addr, &ip->ip_src, sizeof(ip->ip_src));
278 sin = (struct sockaddr_in *)&cookiecache[ninitiator].raddr;
279 #ifdef HAVE_SOCKADDR_SA_LEN
280 sin->sin_len = sizeof(struct sockaddr_in);
281 #endif
282 sin->sin_family = AF_INET;
283 memcpy(&sin->sin_addr, &ip->ip_dst, sizeof(ip->ip_dst));
284 break;
285 #ifdef INET6
286 case 6:
287 memset(&cookiecache[ninitiator].iaddr, 0,
288 sizeof(cookiecache[ninitiator].iaddr));
289 memset(&cookiecache[ninitiator].raddr, 0,
290 sizeof(cookiecache[ninitiator].raddr));
291
292 ip6 = (struct ip6_hdr *)bp2;
293 sin6 = (struct sockaddr_in6 *)&cookiecache[ninitiator].iaddr;
294 #ifdef HAVE_SOCKADDR_SA_LEN
295 sin6->sin6_len = sizeof(struct sockaddr_in6);
296 #endif
297 sin6->sin6_family = AF_INET6;
298 memcpy(&sin6->sin6_addr, &ip6->ip6_src, sizeof(ip6->ip6_src));
299 sin6 = (struct sockaddr_in6 *)&cookiecache[ninitiator].raddr;
300 #ifdef HAVE_SOCKADDR_SA_LEN
301 sin6->sin6_len = sizeof(struct sockaddr_in6);
302 #endif
303 sin6->sin6_family = AF_INET6;
304 memcpy(&sin6->sin6_addr, &ip6->ip6_dst, sizeof(ip6->ip6_dst));
305 break;
306 #endif
307 default:
308 return;
309 }
310 memcpy(&cookiecache[ninitiator].initiator, in, sizeof(*in));
311 ninitiator = (ninitiator + 1) % MAXINITIATORS;
312 }
313
314 #define cookie_isinitiator(x, y) cookie_sidecheck((x), (y), 1)
315 #define cookie_isresponder(x, y) cookie_sidecheck((x), (y), 0)
316 static int
317 cookie_sidecheck(int i, const u_char *bp2, int initiator)
318 {
319 struct sockaddr_storage ss;
320 struct sockaddr *sa;
321 struct ip *ip;
322 struct sockaddr_in *sin;
323 #ifdef INET6
324 struct ip6_hdr *ip6;
325 struct sockaddr_in6 *sin6;
326 #endif
327 int salen;
328
329 memset(&ss, 0, sizeof(ss));
330 ip = (struct ip *)bp2;
331 switch (IP_V(ip)) {
332 case 4:
333 sin = (struct sockaddr_in *)&ss;
334 #ifdef HAVE_SOCKADDR_SA_LEN
335 sin->sin_len = sizeof(struct sockaddr_in);
336 #endif
337 sin->sin_family = AF_INET;
338 memcpy(&sin->sin_addr, &ip->ip_src, sizeof(ip->ip_src));
339 break;
340 #ifdef INET6
341 case 6:
342 ip6 = (struct ip6_hdr *)bp2;
343 sin6 = (struct sockaddr_in6 *)&ss;
344 #ifdef HAVE_SOCKADDR_SA_LEN
345 sin6->sin6_len = sizeof(struct sockaddr_in6);
346 #endif
347 sin6->sin6_family = AF_INET6;
348 memcpy(&sin6->sin6_addr, &ip6->ip6_src, sizeof(ip6->ip6_src));
349 break;
350 #endif
351 default:
352 return 0;
353 }
354
355 sa = (struct sockaddr *)&ss;
356 if (initiator) {
357 if (sa->sa_family != ((struct sockaddr *)&cookiecache[i].iaddr)->sa_family)
358 return 0;
359 #ifdef HAVE_SOCKADDR_SA_LEN
360 salen = sa->sa_len;
361 #else
362 #ifdef INET6
363 if (sa->sa_family == AF_INET6)
364 salen = sizeof(struct sockaddr_in6);
365 else
366 salen = sizeof(struct sockaddr);
367 #else
368 salen = sizeof(struct sockaddr);
369 #endif
370 #endif
371 if (memcmp(&ss, &cookiecache[i].iaddr, salen) == 0)
372 return 1;
373 } else {
374 if (sa->sa_family != ((struct sockaddr *)&cookiecache[i].raddr)->sa_family)
375 return 0;
376 #ifdef HAVE_SOCKADDR_SA_LEN
377 salen = sa->sa_len;
378 #else
379 #ifdef INET6
380 if (sa->sa_family == AF_INET6)
381 salen = sizeof(struct sockaddr_in6);
382 else
383 salen = sizeof(struct sockaddr);
384 #else
385 salen = sizeof(struct sockaddr);
386 #endif
387 #endif
388 if (memcmp(&ss, &cookiecache[i].raddr, salen) == 0)
389 return 1;
390 }
391 return 0;
392 }
393
394 static int
395 rawprint(netdissect_options *ndo, caddr_t loc, size_t len)
396 {
397 static u_char *p;
398 size_t i;
399
400 ND_TCHECK2(*loc, len);
401
402 p = (u_char *)loc;
403 for (i = 0; i < len; i++)
404 ND_PRINT((ndo,"%02x", p[i] & 0xff));
405 return 1;
406 trunc:
407 return 0;
408 }
409
410 /*
411 * returns false if we run out of data buffer
412 */
413 static int ike_show_somedata(struct netdissect_options *ndo,
414 const u_char *cp, const u_char *ep)
415 {
416 /* there is too much data, just show some of it */
417 const u_char *end = ep - 20;
418 int elen = 20;
419 int len = ep - cp;
420 if(len > 10) {
421 len = 10;
422 }
423
424 /* really shouldn't happen because of above */
425 if(end < cp + len) {
426 end = cp+len;
427 elen = ep - end;
428 }
429
430 ND_PRINT((ndo," data=("));
431 if(!rawprint(ndo, (caddr_t)(cp), len)) goto trunc;
432 ND_PRINT((ndo, "..."));
433 if(elen) {
434 if(!rawprint(ndo, (caddr_t)(end), elen)) goto trunc;
435 }
436 ND_PRINT((ndo,")"));
437 return 1;
438
439 trunc:
440 return 0;
441 }
442
443 struct attrmap {
444 const char *type;
445 u_int nvalue;
446 const char *value[30]; /*XXX*/
447 };
448
449 static const u_char *
450 ikev1_attrmap_print(netdissect_options *ndo,
451 const u_char *p, const u_char *ep,
452 const struct attrmap *map, size_t nmap)
453 {
454 u_int16_t *q;
455 int totlen;
456 u_int32_t t, v;
457
458 q = (u_int16_t *)p;
459 if (p[0] & 0x80)
460 totlen = 4;
461 else
462 totlen = 4 + EXTRACT_16BITS(&q[1]);
463 if (ep < p + totlen) {
464 ND_PRINT((ndo,"[|attr]"));
465 return ep + 1;
466 }
467
468 ND_PRINT((ndo,"("));
469 t = EXTRACT_16BITS(&q[0]) & 0x7fff;
470 if (map && t < nmap && map[t].type)
471 ND_PRINT((ndo,"type=%s ", map[t].type));
472 else
473 ND_PRINT((ndo,"type=#%d ", t));
474 if (p[0] & 0x80) {
475 ND_PRINT((ndo,"value="));
476 v = EXTRACT_16BITS(&q[1]);
477 if (map && t < nmap && v < map[t].nvalue && map[t].value[v])
478 ND_PRINT((ndo,"%s", map[t].value[v]));
479 else
480 rawprint(ndo, (caddr_t)&q[1], 2);
481 } else {
482 ND_PRINT((ndo,"len=%d value=", EXTRACT_16BITS(&q[1])));
483 rawprint(ndo, (caddr_t)&p[4], EXTRACT_16BITS(&q[1]));
484 }
485 ND_PRINT((ndo,")"));
486 return p + totlen;
487 }
488
489 static const u_char *
490 ikev1_attr_print(netdissect_options *ndo, const u_char *p, const u_char *ep)
491 {
492 u_int16_t *q;
493 int totlen;
494 u_int32_t t;
495
496 q = (u_int16_t *)p;
497 if (p[0] & 0x80)
498 totlen = 4;
499 else
500 totlen = 4 + EXTRACT_16BITS(&q[1]);
501 if (ep < p + totlen) {
502 ND_PRINT((ndo,"[|attr]"));
503 return ep + 1;
504 }
505
506 ND_PRINT((ndo,"("));
507 t = EXTRACT_16BITS(&q[0]) & 0x7fff;
508 ND_PRINT((ndo,"type=#%d ", t));
509 if (p[0] & 0x80) {
510 ND_PRINT((ndo,"value="));
511 t = q[1];
512 rawprint(ndo, (caddr_t)&q[1], 2);
513 } else {
514 ND_PRINT((ndo,"len=%d value=", EXTRACT_16BITS(&q[1])));
515 rawprint(ndo, (caddr_t)&p[2], EXTRACT_16BITS(&q[1]));
516 }
517 ND_PRINT((ndo,")"));
518 return p + totlen;
519 }
520
521 static const u_char *
522 ikev1_sa_print(netdissect_options *ndo, u_char tpay _U_,
523 const struct isakmp_gen *ext,
524 u_int item_len _U_,
525 const u_char *ep, u_int32_t phase, u_int32_t doi0 _U_,
526 u_int32_t proto0, int depth)
527 {
528 const struct ikev1_pl_sa *p;
529 struct ikev1_pl_sa sa;
530 const u_int32_t *q;
531 u_int32_t doi, sit, ident;
532 const u_char *cp, *np;
533 int t;
534
535 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_SA)));
536
537 p = (struct ikev1_pl_sa *)ext;
538 ND_TCHECK(*p);
539 safememcpy(&sa, ext, sizeof(sa));
540 doi = ntohl(sa.doi);
541 sit = ntohl(sa.sit);
542 if (doi != 1) {
543 ND_PRINT((ndo," doi=%d", doi));
544 ND_PRINT((ndo," situation=%u", (u_int32_t)ntohl(sa.sit)));
545 return (u_char *)(p + 1);
546 }
547
548 ND_PRINT((ndo," doi=ipsec"));
549 q = (u_int32_t *)&sa.sit;
550 ND_PRINT((ndo," situation="));
551 t = 0;
552 if (sit & 0x01) {
553 ND_PRINT((ndo,"identity"));
554 t++;
555 }
556 if (sit & 0x02) {
557 ND_PRINT((ndo,"%ssecrecy", t ? "+" : ""));
558 t++;
559 }
560 if (sit & 0x04)
561 ND_PRINT((ndo,"%sintegrity", t ? "+" : ""));
562
563 np = (u_char *)ext + sizeof(sa);
564 if (sit != 0x01) {
565 ND_TCHECK2(*(ext + 1), sizeof(ident));
566 safememcpy(&ident, ext + 1, sizeof(ident));
567 ND_PRINT((ndo," ident=%u", (u_int32_t)ntohl(ident)));
568 np += sizeof(ident);
569 }
570
571 ext = (struct isakmp_gen *)np;
572 ND_TCHECK(*ext);
573
574 cp = ikev1_sub_print(ndo, ISAKMP_NPTYPE_P, ext, ep, phase, doi, proto0,
575 depth);
576
577 return cp;
578 trunc:
579 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_SA)));
580 return NULL;
581 }
582
583 static const u_char *
584 ikev1_p_print(netdissect_options *ndo, u_char tpay _U_,
585 const struct isakmp_gen *ext, u_int item_len _U_,
586 const u_char *ep, u_int32_t phase, u_int32_t doi0,
587 u_int32_t proto0 _U_, int depth)
588 {
589 const struct ikev1_pl_p *p;
590 struct ikev1_pl_p prop;
591 const u_char *cp;
592
593 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_P)));
594
595 p = (struct ikev1_pl_p *)ext;
596 ND_TCHECK(*p);
597 safememcpy(&prop, ext, sizeof(prop));
598 ND_PRINT((ndo," #%d protoid=%s transform=%d",
599 prop.p_no, PROTOIDSTR(prop.prot_id), prop.num_t));
600 if (prop.spi_size) {
601 ND_PRINT((ndo," spi="));
602 if (!rawprint(ndo, (caddr_t)(p + 1), prop.spi_size))
603 goto trunc;
604 }
605
606 ext = (struct isakmp_gen *)((u_char *)(p + 1) + prop.spi_size);
607 ND_TCHECK(*ext);
608
609 cp = ikev1_sub_print(ndo, ISAKMP_NPTYPE_T, ext, ep, phase, doi0,
610 prop.prot_id, depth);
611
612 return cp;
613 trunc:
614 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_P)));
615 return NULL;
616 }
617
618 static const char *ikev1_p_map[] = {
619 NULL, "ike",
620 };
621
622 static const char *ikev2_t_type_map[]={
623 NULL, "encr", "prf", "integ", "dh", "esn"
624 };
625
626 static const char *ah_p_map[] = {
627 NULL, "(reserved)", "md5", "sha", "1des",
628 "sha2-256", "sha2-384", "sha2-512",
629 };
630
631 static const char *prf_p_map[] = {
632 NULL, "hmac-md5", "hmac-sha", "hmac-tiger",
633 "aes128_xcbc"
634 };
635
636 static const char *integ_p_map[] = {
637 NULL, "hmac-md5", "hmac-sha", "dec-mac",
638 "kpdk-md5", "aes-xcbc"
639 };
640
641 static const char *esn_p_map[] = {
642 "no-esn", "esn"
643 };
644
645 static const char *dh_p_map[] = {
646 NULL, "modp768",
647 "modp1024", /* group 2 */
648 "EC2N 2^155", /* group 3 */
649 "EC2N 2^185", /* group 4 */
650 "modp1536", /* group 5 */
651 "iana-grp06", "iana-grp07", /* reserved */
652 "iana-grp08", "iana-grp09",
653 "iana-grp10", "iana-grp11",
654 "iana-grp12", "iana-grp13",
655 "modp2048", /* group 14 */
656 "modp3072", /* group 15 */
657 "modp4096", /* group 16 */
658 "modp6144", /* group 17 */
659 "modp8192", /* group 18 */
660 };
661
662 static const char *esp_p_map[] = {
663 NULL, "1des-iv64", "1des", "3des", "rc5", "idea", "cast",
664 "blowfish", "3idea", "1des-iv32", "rc4", "null", "aes"
665 };
666
667 static const char *ipcomp_p_map[] = {
668 NULL, "oui", "deflate", "lzs",
669 };
670
671 const struct attrmap ipsec_t_map[] = {
672 { NULL, 0, { NULL } },
673 { "lifetype", 3, { NULL, "sec", "kb", }, },
674 { "life", 0, { NULL } },
675 { "group desc", 18, { NULL, "modp768",
676 "modp1024", /* group 2 */
677 "EC2N 2^155", /* group 3 */
678 "EC2N 2^185", /* group 4 */
679 "modp1536", /* group 5 */
680 "iana-grp06", "iana-grp07", /* reserved */
681 "iana-grp08", "iana-grp09",
682 "iana-grp10", "iana-grp11",
683 "iana-grp12", "iana-grp13",
684 "modp2048", /* group 14 */
685 "modp3072", /* group 15 */
686 "modp4096", /* group 16 */
687 "modp6144", /* group 17 */
688 "modp8192", /* group 18 */
689 }, },
690 { "enc mode", 3, { NULL, "tunnel", "transport", }, },
691 { "auth", 5, { NULL, "hmac-md5", "hmac-sha1", "1des-mac", "keyed", }, },
692 { "keylen", 0, { NULL } },
693 { "rounds", 0, { NULL } },
694 { "dictsize", 0, { NULL } },
695 { "privalg", 0, { NULL } },
696 };
697
698 const struct attrmap encr_t_map[] = {
699 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 0, 1 */
700 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 2, 3 */
701 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 4, 5 */
702 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 6, 7 */
703 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 8, 9 */
704 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 10,11*/
705 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 12,13*/
706 { "keylen", 14, { NULL }},
707 };
708
709 const struct attrmap oakley_t_map[] = {
710 { NULL, 0, { NULL } },
711 { "enc", 8, { NULL, "1des", "idea", "blowfish", "rc5",
712 "3des", "cast", "aes", }, },
713 { "hash", 7, { NULL, "md5", "sha1", "tiger",
714 "sha2-256", "sha2-384", "sha2-512", }, },
715 { "auth", 6, { NULL, "preshared", "dss", "rsa sig", "rsa enc",
716 "rsa enc revised", }, },
717 { "group desc", 18, { NULL, "modp768",
718 "modp1024", /* group 2 */
719 "EC2N 2^155", /* group 3 */
720 "EC2N 2^185", /* group 4 */
721 "modp1536", /* group 5 */
722 "iana-grp06", "iana-grp07", /* reserved */
723 "iana-grp08", "iana-grp09",
724 "iana-grp10", "iana-grp11",
725 "iana-grp12", "iana-grp13",
726 "modp2048", /* group 14 */
727 "modp3072", /* group 15 */
728 "modp4096", /* group 16 */
729 "modp6144", /* group 17 */
730 "modp8192", /* group 18 */
731 }, },
732 { "group type", 4, { NULL, "MODP", "ECP", "EC2N", }, },
733 { "group prime", 0, { NULL } },
734 { "group gen1", 0, { NULL } },
735 { "group gen2", 0, { NULL } },
736 { "group curve A", 0, { NULL } },
737 { "group curve B", 0, { NULL } },
738 { "lifetype", 3, { NULL, "sec", "kb", }, },
739 { "lifeduration", 0, { NULL } },
740 { "prf", 0, { NULL } },
741 { "keylen", 0, { NULL } },
742 { "field", 0, { NULL } },
743 { "order", 0, { NULL } },
744 };
745
746 static const u_char *
747 ikev1_t_print(netdissect_options *ndo, u_char tpay _U_,
748 const struct isakmp_gen *ext, u_int item_len,
749 const u_char *ep, u_int32_t phase _U_, u_int32_t doi _U_,
750 u_int32_t proto, int depth _U_)
751 {
752 const struct ikev1_pl_t *p;
753 struct ikev1_pl_t t;
754 const u_char *cp;
755 const char *idstr;
756 const struct attrmap *map;
757 size_t nmap;
758 const u_char *ep2;
759
760 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_T)));
761
762 p = (struct ikev1_pl_t *)ext;
763 ND_TCHECK(*p);
764 safememcpy(&t, ext, sizeof(t));
765
766 switch (proto) {
767 case 1:
768 idstr = STR_OR_ID(t.t_id, ikev1_p_map);
769 map = oakley_t_map;
770 nmap = sizeof(oakley_t_map)/sizeof(oakley_t_map[0]);
771 break;
772 case 2:
773 idstr = STR_OR_ID(t.t_id, ah_p_map);
774 map = ipsec_t_map;
775 nmap = sizeof(ipsec_t_map)/sizeof(ipsec_t_map[0]);
776 break;
777 case 3:
778 idstr = STR_OR_ID(t.t_id, esp_p_map);
779 map = ipsec_t_map;
780 nmap = sizeof(ipsec_t_map)/sizeof(ipsec_t_map[0]);
781 break;
782 case 4:
783 idstr = STR_OR_ID(t.t_id, ipcomp_p_map);
784 map = ipsec_t_map;
785 nmap = sizeof(ipsec_t_map)/sizeof(ipsec_t_map[0]);
786 break;
787 default:
788 idstr = NULL;
789 map = NULL;
790 nmap = 0;
791 break;
792 }
793
794 if (idstr)
795 ND_PRINT((ndo," #%d id=%s ", t.t_no, idstr));
796 else
797 ND_PRINT((ndo," #%d id=%d ", t.t_no, t.t_id));
798 cp = (u_char *)(p + 1);
799 ep2 = (u_char *)p + item_len;
800 while (cp < ep && cp < ep2) {
801 if (map && nmap) {
802 cp = ikev1_attrmap_print(ndo, cp, (ep < ep2) ? ep : ep2,
803 map, nmap);
804 } else
805 cp = ikev1_attr_print(ndo, cp, (ep < ep2) ? ep : ep2);
806 }
807 if (ep < ep2)
808 ND_PRINT((ndo,"..."));
809 return cp;
810 trunc:
811 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_T)));
812 return NULL;
813 }
814
815 static const u_char *
816 ikev1_ke_print(netdissect_options *ndo, u_char tpay _U_,
817 const struct isakmp_gen *ext, u_int item_len _U_,
818 const u_char *ep _U_, u_int32_t phase _U_, u_int32_t doi _U_,
819 u_int32_t proto _U_, int depth _U_)
820 {
821 struct isakmp_gen e;
822
823 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_KE)));
824
825 ND_TCHECK(*ext);
826 safememcpy(&e, ext, sizeof(e));
827 ND_PRINT((ndo," key len=%d", ntohs(e.len) - 4));
828 if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
829 ND_PRINT((ndo," "));
830 if (!rawprint(ndo, (caddr_t)(ext + 1), ntohs(e.len) - 4))
831 goto trunc;
832 }
833 return (u_char *)ext + ntohs(e.len);
834 trunc:
835 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_KE)));
836 return NULL;
837 }
838
839 static const u_char *
840 ikev1_id_print(netdissect_options *ndo, u_char tpay _U_,
841 const struct isakmp_gen *ext, u_int item_len _U_,
842 const u_char *ep _U_, u_int32_t phase, u_int32_t doi _U_,
843 u_int32_t proto _U_, int depth _U_)
844 {
845 #define USE_IPSECDOI_IN_PHASE1 1
846 const struct ikev1_pl_id *p;
847 struct ikev1_pl_id id;
848 static const char *idtypestr[] = {
849 "IPv4", "IPv4net", "IPv6", "IPv6net",
850 };
851 static const char *ipsecidtypestr[] = {
852 NULL, "IPv4", "FQDN", "user FQDN", "IPv4net", "IPv6",
853 "IPv6net", "IPv4range", "IPv6range", "ASN1 DN", "ASN1 GN",
854 "keyid",
855 };
856 int len;
857 const u_char *data;
858
859 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_ID)));
860
861 p = (struct ikev1_pl_id *)ext;
862 ND_TCHECK(*p);
863 safememcpy(&id, ext, sizeof(id));
864 if (sizeof(*p) < item_len) {
865 data = (u_char *)(p + 1);
866 len = item_len - sizeof(*p);
867 } else {
868 data = NULL;
869 len = 0;
870 }
871
872 #if 0 /*debug*/
873 ND_PRINT((ndo," [phase=%d doi=%d proto=%d]", phase, doi, proto));
874 #endif
875 switch (phase) {
876 #ifndef USE_IPSECDOI_IN_PHASE1
877 case 1:
878 #endif
879 default:
880 ND_PRINT((ndo," idtype=%s", STR_OR_ID(id.d.id_type, idtypestr)));
881 ND_PRINT((ndo," doi_data=%u",
882 (u_int32_t)(ntohl(id.d.doi_data) & 0xffffff)));
883 break;
884
885 #ifdef USE_IPSECDOI_IN_PHASE1
886 case 1:
887 #endif
888 case 2:
889 {
890 const struct ipsecdoi_id *p;
891 struct ipsecdoi_id id;
892 struct protoent *pe;
893
894 p = (struct ipsecdoi_id *)ext;
895 ND_TCHECK(*p);
896 safememcpy(&id, ext, sizeof(id));
897 ND_PRINT((ndo," idtype=%s", STR_OR_ID(id.type, ipsecidtypestr)));
898 if (id.proto_id) {
899 #ifndef WIN32
900 setprotoent(1);
901 #endif /* WIN32 */
902 pe = getprotobynumber(id.proto_id);
903 if (pe)
904 ND_PRINT((ndo," protoid=%s", pe->p_name));
905 #ifndef WIN32
906 endprotoent();
907 #endif /* WIN32 */
908 } else {
909 /* it DOES NOT mean IPPROTO_IP! */
910 ND_PRINT((ndo," protoid=%s", "0"));
911 }
912 ND_PRINT((ndo," port=%d", ntohs(id.port)));
913 if (!len)
914 break;
915 if (data == NULL)
916 goto trunc;
917 ND_TCHECK2(*data, len);
918 switch (id.type) {
919 case IPSECDOI_ID_IPV4_ADDR:
920 if (len < 4)
921 ND_PRINT((ndo," len=%d [bad: < 4]", len));
922 else
923 ND_PRINT((ndo," len=%d %s", len, ipaddr_string(data)));
924 len = 0;
925 break;
926 case IPSECDOI_ID_FQDN:
927 case IPSECDOI_ID_USER_FQDN:
928 {
929 int i;
930 ND_PRINT((ndo," len=%d ", len));
931 for (i = 0; i < len; i++)
932 safeputchar(data[i]);
933 len = 0;
934 break;
935 }
936 case IPSECDOI_ID_IPV4_ADDR_SUBNET:
937 {
938 const u_char *mask;
939 if (len < 8)
940 ND_PRINT((ndo," len=%d [bad: < 8]", len));
941 else {
942 mask = data + sizeof(struct in_addr);
943 ND_PRINT((ndo," len=%d %s/%u.%u.%u.%u", len,
944 ipaddr_string(data),
945 mask[0], mask[1], mask[2], mask[3]));
946 }
947 len = 0;
948 break;
949 }
950 #ifdef INET6
951 case IPSECDOI_ID_IPV6_ADDR:
952 if (len < 16)
953 ND_PRINT((ndo," len=%d [bad: < 16]", len));
954 else
955 ND_PRINT((ndo," len=%d %s", len, ip6addr_string(data)));
956 len = 0;
957 break;
958 case IPSECDOI_ID_IPV6_ADDR_SUBNET:
959 {
960 const u_int32_t *mask;
961 if (len < 20)
962 ND_PRINT((ndo," len=%d [bad: < 20]", len));
963 else {
964 mask = (u_int32_t *)(data + sizeof(struct in6_addr));
965 /*XXX*/
966 ND_PRINT((ndo," len=%d %s/0x%08x%08x%08x%08x", len,
967 ip6addr_string(data),
968 mask[0], mask[1], mask[2], mask[3]));
969 }
970 len = 0;
971 break;
972 }
973 #endif /*INET6*/
974 case IPSECDOI_ID_IPV4_ADDR_RANGE:
975 if (len < 8)
976 ND_PRINT((ndo," len=%d [bad: < 8]", len));
977 else {
978 ND_PRINT((ndo," len=%d %s-%s", len,
979 ipaddr_string(data),
980 ipaddr_string(data + sizeof(struct in_addr))));
981 }
982 len = 0;
983 break;
984 #ifdef INET6
985 case IPSECDOI_ID_IPV6_ADDR_RANGE:
986 if (len < 32)
987 ND_PRINT((ndo," len=%d [bad: < 32]", len));
988 else {
989 ND_PRINT((ndo," len=%d %s-%s", len,
990 ip6addr_string(data),
991 ip6addr_string(data + sizeof(struct in6_addr))));
992 }
993 len = 0;
994 break;
995 #endif /*INET6*/
996 case IPSECDOI_ID_DER_ASN1_DN:
997 case IPSECDOI_ID_DER_ASN1_GN:
998 case IPSECDOI_ID_KEY_ID:
999 break;
1000 }
1001 break;
1002 }
1003 }
1004 if (data && len) {
1005 ND_PRINT((ndo," len=%d", len));
1006 if (2 < ndo->ndo_vflag) {
1007 ND_PRINT((ndo," "));
1008 if (!rawprint(ndo, (caddr_t)data, len))
1009 goto trunc;
1010 }
1011 }
1012 return (u_char *)ext + item_len;
1013 trunc:
1014 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_ID)));
1015 return NULL;
1016 }
1017
1018 static const u_char *
1019 ikev1_cert_print(netdissect_options *ndo, u_char tpay _U_,
1020 const struct isakmp_gen *ext, u_int item_len _U_,
1021 const u_char *ep _U_, u_int32_t phase _U_,
1022 u_int32_t doi0 _U_,
1023 u_int32_t proto0 _U_, int depth _U_)
1024 {
1025 const struct ikev1_pl_cert *p;
1026 struct ikev1_pl_cert cert;
1027 static const char *certstr[] = {
1028 "none", "pkcs7", "pgp", "dns",
1029 "x509sign", "x509ke", "kerberos", "crl",
1030 "arl", "spki", "x509attr",
1031 };
1032
1033 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_CERT)));
1034
1035 p = (struct ikev1_pl_cert *)ext;
1036 ND_TCHECK(*p);
1037 safememcpy(&cert, ext, sizeof(cert));
1038 ND_PRINT((ndo," len=%d", item_len - 4));
1039 ND_PRINT((ndo," type=%s", STR_OR_ID((cert.encode), certstr)));
1040 if (2 < ndo->ndo_vflag && 4 < item_len) {
1041 ND_PRINT((ndo," "));
1042 if (!rawprint(ndo, (caddr_t)(ext + 1), item_len - 4))
1043 goto trunc;
1044 }
1045 return (u_char *)ext + item_len;
1046 trunc:
1047 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_CERT)));
1048 return NULL;
1049 }
1050
1051 static const u_char *
1052 ikev1_cr_print(netdissect_options *ndo, u_char tpay _U_,
1053 const struct isakmp_gen *ext, u_int item_len _U_,
1054 const u_char *ep _U_, u_int32_t phase _U_, u_int32_t doi0 _U_,
1055 u_int32_t proto0 _U_, int depth _U_)
1056 {
1057 const struct ikev1_pl_cert *p;
1058 struct ikev1_pl_cert cert;
1059 static const char *certstr[] = {
1060 "none", "pkcs7", "pgp", "dns",
1061 "x509sign", "x509ke", "kerberos", "crl",
1062 "arl", "spki", "x509attr",
1063 };
1064
1065 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_CR)));
1066
1067 p = (struct ikev1_pl_cert *)ext;
1068 ND_TCHECK(*p);
1069 safememcpy(&cert, ext, sizeof(cert));
1070 ND_PRINT((ndo," len=%d", item_len - 4));
1071 ND_PRINT((ndo," type=%s", STR_OR_ID((cert.encode), certstr)));
1072 if (2 < ndo->ndo_vflag && 4 < item_len) {
1073 ND_PRINT((ndo," "));
1074 if (!rawprint(ndo, (caddr_t)(ext + 1), item_len - 4))
1075 goto trunc;
1076 }
1077 return (u_char *)ext + item_len;
1078 trunc:
1079 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_CR)));
1080 return NULL;
1081 }
1082
1083 static const u_char *
1084 ikev1_hash_print(netdissect_options *ndo, u_char tpay _U_,
1085 const struct isakmp_gen *ext, u_int item_len _U_,
1086 const u_char *ep _U_, u_int32_t phase _U_, u_int32_t doi _U_,
1087 u_int32_t proto _U_, int depth _U_)
1088 {
1089 struct isakmp_gen e;
1090
1091 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_HASH)));
1092
1093 ND_TCHECK(*ext);
1094 safememcpy(&e, ext, sizeof(e));
1095 ND_PRINT((ndo," len=%d", ntohs(e.len) - 4));
1096 if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1097 ND_PRINT((ndo," "));
1098 if (!rawprint(ndo, (caddr_t)(ext + 1), ntohs(e.len) - 4))
1099 goto trunc;
1100 }
1101 return (u_char *)ext + ntohs(e.len);
1102 trunc:
1103 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_HASH)));
1104 return NULL;
1105 }
1106
1107 static const u_char *
1108 ikev1_sig_print(netdissect_options *ndo, u_char tpay _U_,
1109 const struct isakmp_gen *ext, u_int item_len _U_,
1110 const u_char *ep _U_, u_int32_t phase _U_, u_int32_t doi _U_,
1111 u_int32_t proto _U_, int depth _U_)
1112 {
1113 struct isakmp_gen e;
1114
1115 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_SIG)));
1116
1117 ND_TCHECK(*ext);
1118 safememcpy(&e, ext, sizeof(e));
1119 ND_PRINT((ndo," len=%d", ntohs(e.len) - 4));
1120 if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1121 ND_PRINT((ndo," "));
1122 if (!rawprint(ndo, (caddr_t)(ext + 1), ntohs(e.len) - 4))
1123 goto trunc;
1124 }
1125 return (u_char *)ext + ntohs(e.len);
1126 trunc:
1127 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_SIG)));
1128 return NULL;
1129 }
1130
1131 static const u_char *
1132 ikev1_nonce_print(netdissect_options *ndo, u_char tpay _U_,
1133 const struct isakmp_gen *ext,
1134 u_int item_len _U_,
1135 const u_char *ep _U_,
1136 u_int32_t phase _U_, u_int32_t doi _U_,
1137 u_int32_t proto _U_, int depth _U_)
1138 {
1139 struct isakmp_gen e;
1140
1141 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_NONCE)));
1142
1143 ND_TCHECK(*ext);
1144 safememcpy(&e, ext, sizeof(e));
1145 ND_PRINT((ndo," n len=%d", ntohs(e.len) - 4));
1146 if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1147 ND_PRINT((ndo," "));
1148 if (!rawprint(ndo, (caddr_t)(ext + 1), ntohs(e.len) - 4))
1149 goto trunc;
1150 } else if (1 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1151 ND_PRINT((ndo," "));
1152 if (!ike_show_somedata(ndo, (u_char *)(caddr_t)(ext + 1), ep))
1153 goto trunc;
1154 }
1155 return (u_char *)ext + ntohs(e.len);
1156 trunc:
1157 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_NONCE)));
1158 return NULL;
1159 }
1160
1161 static const u_char *
1162 ikev1_n_print(netdissect_options *ndo, u_char tpay _U_,
1163 const struct isakmp_gen *ext, u_int item_len,
1164 const u_char *ep, u_int32_t phase, u_int32_t doi0 _U_,
1165 u_int32_t proto0 _U_, int depth)
1166 {
1167 struct ikev1_pl_n *p, n;
1168 const u_char *cp;
1169 u_char *ep2;
1170 u_int32_t doi;
1171 u_int32_t proto;
1172 static const char *notify_error_str[] = {
1173 NULL, "INVALID-PAYLOAD-TYPE",
1174 "DOI-NOT-SUPPORTED", "SITUATION-NOT-SUPPORTED",
1175 "INVALID-COOKIE", "INVALID-MAJOR-VERSION",
1176 "INVALID-MINOR-VERSION", "INVALID-EXCHANGE-TYPE",
1177 "INVALID-FLAGS", "INVALID-MESSAGE-ID",
1178 "INVALID-PROTOCOL-ID", "INVALID-SPI",
1179 "INVALID-TRANSFORM-ID", "ATTRIBUTES-NOT-SUPPORTED",
1180 "NO-PROPOSAL-CHOSEN", "BAD-PROPOSAL-SYNTAX",
1181 "PAYLOAD-MALFORMED", "INVALID-KEY-INFORMATION",
1182 "INVALID-ID-INFORMATION", "INVALID-CERT-ENCODING",
1183 "INVALID-CERTIFICATE", "CERT-TYPE-UNSUPPORTED",
1184 "INVALID-CERT-AUTHORITY", "INVALID-HASH-INFORMATION",
1185 "AUTHENTICATION-FAILED", "INVALID-SIGNATURE",
1186 "ADDRESS-NOTIFICATION", "NOTIFY-SA-LIFETIME",
1187 "CERTIFICATE-UNAVAILABLE", "UNSUPPORTED-EXCHANGE-TYPE",
1188 "UNEQUAL-PAYLOAD-LENGTHS",
1189 };
1190 static const char *ipsec_notify_error_str[] = {
1191 "RESERVED",
1192 };
1193 static const char *notify_status_str[] = {
1194 "CONNECTED",
1195 };
1196 static const char *ipsec_notify_status_str[] = {
1197 "RESPONDER-LIFETIME", "REPLAY-STATUS",
1198 "INITIAL-CONTACT",
1199 };
1200 /* NOTE: these macro must be called with x in proper range */
1201
1202 /* 0 - 8191 */
1203 #define NOTIFY_ERROR_STR(x) \
1204 STR_OR_ID((x), notify_error_str)
1205
1206 /* 8192 - 16383 */
1207 #define IPSEC_NOTIFY_ERROR_STR(x) \
1208 STR_OR_ID((u_int)((x) - 8192), ipsec_notify_error_str)
1209
1210 /* 16384 - 24575 */
1211 #define NOTIFY_STATUS_STR(x) \
1212 STR_OR_ID((u_int)((x) - 16384), notify_status_str)
1213
1214 /* 24576 - 32767 */
1215 #define IPSEC_NOTIFY_STATUS_STR(x) \
1216 STR_OR_ID((u_int)((x) - 24576), ipsec_notify_status_str)
1217
1218 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_N)));
1219
1220 p = (struct ikev1_pl_n *)ext;
1221 ND_TCHECK(*p);
1222 safememcpy(&n, ext, sizeof(n));
1223 doi = ntohl(n.doi);
1224 proto = n.prot_id;
1225 if (doi != 1) {
1226 ND_PRINT((ndo," doi=%d", doi));
1227 ND_PRINT((ndo," proto=%d", proto));
1228 if (ntohs(n.type) < 8192)
1229 ND_PRINT((ndo," type=%s", NOTIFY_ERROR_STR(ntohs(n.type))));
1230 else if (ntohs(n.type) < 16384)
1231 ND_PRINT((ndo," type=%s", numstr(ntohs(n.type))));
1232 else if (ntohs(n.type) < 24576)
1233 ND_PRINT((ndo," type=%s", NOTIFY_STATUS_STR(ntohs(n.type))));
1234 else
1235 ND_PRINT((ndo," type=%s", numstr(ntohs(n.type))));
1236 if (n.spi_size) {
1237 ND_PRINT((ndo," spi="));
1238 if (!rawprint(ndo, (caddr_t)(p + 1), n.spi_size))
1239 goto trunc;
1240 }
1241 return (u_char *)(p + 1) + n.spi_size;
1242 }
1243
1244 ND_PRINT((ndo," doi=ipsec"));
1245 ND_PRINT((ndo," proto=%s", PROTOIDSTR(proto)));
1246 if (ntohs(n.type) < 8192)
1247 ND_PRINT((ndo," type=%s", NOTIFY_ERROR_STR(ntohs(n.type))));
1248 else if (ntohs(n.type) < 16384)
1249 ND_PRINT((ndo," type=%s", IPSEC_NOTIFY_ERROR_STR(ntohs(n.type))));
1250 else if (ntohs(n.type) < 24576)
1251 ND_PRINT((ndo," type=%s", NOTIFY_STATUS_STR(ntohs(n.type))));
1252 else if (ntohs(n.type) < 32768)
1253 ND_PRINT((ndo," type=%s", IPSEC_NOTIFY_STATUS_STR(ntohs(n.type))));
1254 else
1255 ND_PRINT((ndo," type=%s", numstr(ntohs(n.type))));
1256 if (n.spi_size) {
1257 ND_PRINT((ndo," spi="));
1258 if (!rawprint(ndo, (caddr_t)(p + 1), n.spi_size))
1259 goto trunc;
1260 }
1261
1262 cp = (u_char *)(p + 1) + n.spi_size;
1263 ep2 = (u_char *)p + item_len;
1264
1265 if (cp < ep) {
1266 ND_PRINT((ndo," orig=("));
1267 switch (ntohs(n.type)) {
1268 case IPSECDOI_NTYPE_RESPONDER_LIFETIME:
1269 {
1270 const struct attrmap *map = oakley_t_map;
1271 size_t nmap = sizeof(oakley_t_map)/sizeof(oakley_t_map[0]);
1272 while (cp < ep && cp < ep2) {
1273 cp = ikev1_attrmap_print(ndo, cp,
1274 (ep < ep2) ? ep : ep2, map, nmap);
1275 }
1276 break;
1277 }
1278 case IPSECDOI_NTYPE_REPLAY_STATUS:
1279 ND_PRINT((ndo,"replay detection %sabled",
1280 (*(u_int32_t *)cp) ? "en" : "dis"));
1281 break;
1282 case ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN:
1283 if (ikev1_sub_print(ndo, ISAKMP_NPTYPE_SA,
1284 (struct isakmp_gen *)cp, ep, phase, doi, proto,
1285 depth) == NULL)
1286 return NULL;
1287 break;
1288 default:
1289 /* NULL is dummy */
1290 isakmp_print(ndo, cp,
1291 item_len - sizeof(*p) - n.spi_size,
1292 NULL);
1293 }
1294 ND_PRINT((ndo,")"));
1295 }
1296 return (u_char *)ext + item_len;
1297 trunc:
1298 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_N)));
1299 return NULL;
1300 }
1301
1302 static const u_char *
1303 ikev1_d_print(netdissect_options *ndo, u_char tpay _U_,
1304 const struct isakmp_gen *ext, u_int item_len _U_,
1305 const u_char *ep _U_, u_int32_t phase _U_, u_int32_t doi0 _U_,
1306 u_int32_t proto0 _U_, int depth _U_)
1307 {
1308 const struct ikev1_pl_d *p;
1309 struct ikev1_pl_d d;
1310 const u_int8_t *q;
1311 u_int32_t doi;
1312 u_int32_t proto;
1313 int i;
1314
1315 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_D)));
1316
1317 p = (struct ikev1_pl_d *)ext;
1318 ND_TCHECK(*p);
1319 safememcpy(&d, ext, sizeof(d));
1320 doi = ntohl(d.doi);
1321 proto = d.prot_id;
1322 if (doi != 1) {
1323 ND_PRINT((ndo," doi=%u", doi));
1324 ND_PRINT((ndo," proto=%u", proto));
1325 } else {
1326 ND_PRINT((ndo," doi=ipsec"));
1327 ND_PRINT((ndo," proto=%s", PROTOIDSTR(proto)));
1328 }
1329 ND_PRINT((ndo," spilen=%u", d.spi_size));
1330 ND_PRINT((ndo," nspi=%u", ntohs(d.num_spi)));
1331 ND_PRINT((ndo," spi="));
1332 q = (u_int8_t *)(p + 1);
1333 for (i = 0; i < ntohs(d.num_spi); i++) {
1334 if (i != 0)
1335 ND_PRINT((ndo,","));
1336 if (!rawprint(ndo, (caddr_t)q, d.spi_size))
1337 goto trunc;
1338 q += d.spi_size;
1339 }
1340 return q;
1341 trunc:
1342 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_D)));
1343 return NULL;
1344 }
1345
1346 static const u_char *
1347 ikev1_vid_print(netdissect_options *ndo, u_char tpay _U_,
1348 const struct isakmp_gen *ext,
1349 u_int item_len _U_, const u_char *ep _U_,
1350 u_int32_t phase _U_, u_int32_t doi _U_,
1351 u_int32_t proto _U_, int depth _U_)
1352 {
1353 struct isakmp_gen e;
1354
1355 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_VID)));
1356
1357 ND_TCHECK(*ext);
1358 safememcpy(&e, ext, sizeof(e));
1359 ND_PRINT((ndo," len=%d", ntohs(e.len) - 4));
1360 if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1361 ND_PRINT((ndo," "));
1362 if (!rawprint(ndo, (caddr_t)(ext + 1), ntohs(e.len) - 4))
1363 goto trunc;
1364 }
1365 return (u_char *)ext + ntohs(e.len);
1366 trunc:
1367 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_VID)));
1368 return NULL;
1369 }
1370
1371 /************************************************************/
1372 /* */
1373 /* IKE v2 - rfc4306 - dissector */
1374 /* */
1375 /************************************************************/
1376
1377 static void
1378 ikev2_pay_print(netdissect_options *ndo, const char *payname, int critical)
1379 {
1380 ND_PRINT((ndo,"%s%s:", payname, critical&0x80 ? "[C]" : ""));
1381 }
1382
1383 static const u_char *
1384 ikev2_gen_print(netdissect_options *ndo, u_char tpay,
1385 const struct isakmp_gen *ext)
1386 {
1387 struct isakmp_gen e;
1388
1389 ND_TCHECK(*ext);
1390 safememcpy(&e, ext, sizeof(e));
1391 ikev2_pay_print(ndo, NPSTR(tpay), e.critical);
1392
1393 ND_PRINT((ndo," len=%d", ntohs(e.len) - 4));
1394 if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1395 ND_PRINT((ndo," "));
1396 if (!rawprint(ndo, (caddr_t)(ext + 1), ntohs(e.len) - 4))
1397 goto trunc;
1398 }
1399 return (u_char *)ext + ntohs(e.len);
1400 trunc:
1401 ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
1402 return NULL;
1403 }
1404
1405 static const u_char *
1406 ikev2_t_print(netdissect_options *ndo, u_char tpay _U_, int pcount,
1407 const struct isakmp_gen *ext, u_int item_len,
1408 const u_char *ep, u_int32_t phase _U_, u_int32_t doi _U_,
1409 u_int32_t proto _U_, int depth _U_)
1410 {
1411 const struct ikev2_t *p;
1412 struct ikev2_t t;
1413 u_int16_t t_id;
1414 const u_char *cp;
1415 const char *idstr;
1416 const struct attrmap *map;
1417 size_t nmap;
1418 const u_char *ep2;
1419
1420 p = (struct ikev2_t *)ext;
1421 ND_TCHECK(*p);
1422 safememcpy(&t, ext, sizeof(t));
1423 ikev2_pay_print(ndo, NPSTR(ISAKMP_NPTYPE_T), t.h.critical);
1424
1425 t_id = ntohs(t.t_id);
1426
1427 map = NULL;
1428 nmap = 0;
1429
1430 switch (t.t_type) {
1431 case IV2_T_ENCR:
1432 idstr = STR_OR_ID(t_id, esp_p_map);
1433 map = encr_t_map;
1434 nmap = sizeof(encr_t_map)/sizeof(encr_t_map[0]);
1435 break;
1436
1437 case IV2_T_PRF:
1438 idstr = STR_OR_ID(t_id, prf_p_map);
1439 break;
1440
1441 case IV2_T_INTEG:
1442 idstr = STR_OR_ID(t_id, integ_p_map);
1443 break;
1444
1445 case IV2_T_DH:
1446 idstr = STR_OR_ID(t_id, dh_p_map);
1447 break;
1448
1449 case IV2_T_ESN:
1450 idstr = STR_OR_ID(t_id, esn_p_map);
1451 break;
1452
1453 default:
1454 idstr = NULL;
1455 break;
1456 }
1457
1458 if (idstr)
1459 ND_PRINT((ndo," #%u type=%s id=%s ", pcount,
1460 STR_OR_ID(t.t_type, ikev2_t_type_map),
1461 idstr));
1462 else
1463 ND_PRINT((ndo," #%u type=%s id=%u ", pcount,
1464 STR_OR_ID(t.t_type, ikev2_t_type_map),
1465 t.t_id));
1466 cp = (u_char *)(p + 1);
1467 ep2 = (u_char *)p + item_len;
1468 while (cp < ep && cp < ep2) {
1469 if (map && nmap) {
1470 cp = ikev1_attrmap_print(ndo, cp, (ep < ep2) ? ep : ep2,
1471 map, nmap);
1472 } else
1473 cp = ikev1_attr_print(ndo, cp, (ep < ep2) ? ep : ep2);
1474 }
1475 if (ep < ep2)
1476 ND_PRINT((ndo,"..."));
1477 return cp;
1478 trunc:
1479 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_T)));
1480 return NULL;
1481 }
1482
1483 static const u_char *
1484 ikev2_p_print(netdissect_options *ndo, u_char tpay _U_, int pcount _U_,
1485 const struct isakmp_gen *ext, u_int item_len _U_,
1486 const u_char *ep, u_int32_t phase, u_int32_t doi0,
1487 u_int32_t proto0 _U_, int depth)
1488 {
1489 const struct ikev2_p *p;
1490 struct ikev2_p prop;
1491 const u_char *cp;
1492
1493 p = (struct ikev2_p *)ext;
1494 ND_TCHECK(*p);
1495 safememcpy(&prop, ext, sizeof(prop));
1496 ikev2_pay_print(ndo, NPSTR(ISAKMP_NPTYPE_P), prop.h.critical);
1497
1498 ND_PRINT((ndo," #%u protoid=%s transform=%d len=%u",
1499 prop.p_no, PROTOIDSTR(prop.prot_id),
1500 prop.num_t, ntohs(prop.h.len)));
1501 if (prop.spi_size) {
1502 ND_PRINT((ndo," spi="));
1503 if (!rawprint(ndo, (caddr_t)(p + 1), prop.spi_size))
1504 goto trunc;
1505 }
1506
1507 ext = (struct isakmp_gen *)((u_char *)(p + 1) + prop.spi_size);
1508 ND_TCHECK(*ext);
1509
1510 cp = ikev2_sub_print(ndo, ISAKMP_NPTYPE_T, ext, ep, phase, doi0,
1511 prop.prot_id, depth);
1512
1513 return cp;
1514 trunc:
1515 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_P)));
1516 return NULL;
1517 }
1518
1519 static const u_char *
1520 ikev2_sa_print(netdissect_options *ndo, u_char tpay,
1521 const struct isakmp_gen *ext1,
1522 u_int item_len _U_, const u_char *ep _U_,
1523 u_int32_t phase _U_, u_int32_t doi _U_,
1524 u_int32_t proto _U_, int depth _U_)
1525 {
1526 struct isakmp_gen e;
1527 int osa_len, sa_len;
1528
1529 ND_TCHECK(*ext1);
1530 safememcpy(&e, ext1, sizeof(e));
1531 ikev2_pay_print(ndo, "sa", e.critical);
1532
1533 osa_len= ntohs(e.len);
1534 sa_len = osa_len - 4;
1535 ND_PRINT((ndo," len=%d", sa_len));
1536
1537 ikev2_sub_print(ndo, ISAKMP_NPTYPE_P,
1538 ext1+1, ep,
1539 0, 0, 0, depth);
1540
1541 return (u_char *)ext1 + osa_len;
1542 trunc:
1543 ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
1544 return NULL;
1545 }
1546
1547 static const u_char *
1548 ikev2_ke_print(netdissect_options *ndo, u_char tpay,
1549 const struct isakmp_gen *ext,
1550 u_int item_len _U_, const u_char *ep _U_,
1551 u_int32_t phase _U_, u_int32_t doi _U_,
1552 u_int32_t proto _U_, int depth _U_)
1553 {
1554 struct ikev2_ke ke;
1555 struct ikev2_ke *k;
1556
1557 k = (struct ikev2_ke *)ext;
1558 ND_TCHECK(*ext);
1559 safememcpy(&ke, ext, sizeof(ke));
1560 ikev2_pay_print(ndo, NPSTR(tpay), ke.h.critical);
1561
1562 ND_PRINT((ndo," len=%u group=%s", ntohs(ke.h.len) - 8,
1563 STR_OR_ID(ntohs(ke.ke_group), dh_p_map)));
1564
1565 if (2 < ndo->ndo_vflag && 8 < ntohs(ke.h.len)) {
1566 ND_PRINT((ndo," "));
1567 if (!rawprint(ndo, (caddr_t)(k + 1), ntohs(ke.h.len) - 8))
1568 goto trunc;
1569 }
1570 return (u_char *)ext + ntohs(ke.h.len);
1571 trunc:
1572 ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
1573 return NULL;
1574 }
1575
1576 static const u_char *
1577 ikev2_ID_print(netdissect_options *ndo, u_char tpay,
1578 const struct isakmp_gen *ext,
1579 u_int item_len _U_, const u_char *ep _U_,
1580 u_int32_t phase _U_, u_int32_t doi _U_,
1581 u_int32_t proto _U_, int depth _U_)
1582 {
1583 return ikev2_gen_print(ndo, tpay, ext);
1584 }
1585
1586 static const u_char *
1587 ikev2_cert_print(netdissect_options *ndo, u_char tpay,
1588 const struct isakmp_gen *ext,
1589 u_int item_len _U_, const u_char *ep _U_,
1590 u_int32_t phase _U_, u_int32_t doi _U_,
1591 u_int32_t proto _U_, int depth _U_)
1592 {
1593 return ikev2_gen_print(ndo, tpay, ext);
1594 }
1595
1596 static const u_char *
1597 ikev2_cr_print(netdissect_options *ndo, u_char tpay,
1598 const struct isakmp_gen *ext,
1599 u_int item_len _U_, const u_char *ep _U_,
1600 u_int32_t phase _U_, u_int32_t doi _U_,
1601 u_int32_t proto _U_, int depth _U_)
1602 {
1603 return ikev2_gen_print(ndo, tpay, ext);
1604 }
1605
1606 static const u_char *
1607 ikev2_auth_print(netdissect_options *ndo, u_char tpay,
1608 const struct isakmp_gen *ext,
1609 u_int item_len _U_, const u_char *ep _U_,
1610 u_int32_t phase _U_, u_int32_t doi _U_,
1611 u_int32_t proto _U_, int depth _U_)
1612 {
1613 struct ikev2_auth e;
1614 const char *v2_auth[]={ "invalid", "rsasig",
1615 "shared-secret", "dsssig" };
1616
1617 ND_TCHECK(*ext);
1618 safememcpy(&e, ext, sizeof(e));
1619 ikev2_pay_print(ndo, NPSTR(tpay), e.h.critical);
1620
1621 ND_PRINT((ndo," len=%d method=%s", ntohs(e.h.len) - 4,
1622 STR_OR_ID(e.auth_method, v2_auth)));
1623
1624 if (1 < ndo->ndo_vflag && 4 < ntohs(e.h.len)) {
1625 ND_PRINT((ndo," authdata=("));
1626 if (!rawprint(ndo, (caddr_t)(ext + 1), ntohs(e.h.len) - 4))
1627 goto trunc;
1628 ND_PRINT((ndo,") "));
1629 } else if(ndo->ndo_vflag && 4 < ntohs(e.h.len)) {
1630 if(!ike_show_somedata(ndo, (const u_char *)(ext+1), ep)) goto trunc;
1631 }
1632
1633 return (u_char *)ext + ntohs(e.h.len);
1634 trunc:
1635 ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
1636 return NULL;
1637 }
1638
1639 static const u_char *
1640 ikev2_nonce_print(netdissect_options *ndo, u_char tpay,
1641 const struct isakmp_gen *ext,
1642 u_int item_len _U_, const u_char *ep _U_,
1643 u_int32_t phase _U_, u_int32_t doi _U_,
1644 u_int32_t proto _U_, int depth _U_)
1645 {
1646 struct isakmp_gen e;
1647
1648 ND_TCHECK(*ext);
1649 safememcpy(&e, ext, sizeof(e));
1650 ikev2_pay_print(ndo, "nonce", e.critical);
1651
1652 ND_PRINT((ndo," len=%d", ntohs(e.len) - 4));
1653 if (1 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1654 ND_PRINT((ndo," nonce=("));
1655 if (!rawprint(ndo, (caddr_t)(ext + 1), ntohs(e.len) - 4))
1656 goto trunc;
1657 ND_PRINT((ndo,") "));
1658 } else if(ndo->ndo_vflag && 4 < ntohs(e.len)) {
1659 if(!ike_show_somedata(ndo, (const u_char *)(ext+1), ep)) goto trunc;
1660 }
1661
1662 return (u_char *)ext + ntohs(e.len);
1663 trunc:
1664 ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
1665 return NULL;
1666 }
1667
1668 /* notify payloads */
1669 static const u_char *
1670 ikev2_n_print(netdissect_options *ndo, u_char tpay _U_,
1671 const struct isakmp_gen *ext,
1672 u_int item_len _U_, const u_char *ep _U_,
1673 u_int32_t phase _U_, u_int32_t doi _U_,
1674 u_int32_t proto _U_, int depth _U_)
1675 {
1676 struct ikev2_n *p, n;
1677 const u_char *cp;
1678 u_char *ep2;
1679 u_char showspi, showdata, showsomedata;
1680 const char *notify_name;
1681 u_int32_t type;
1682
1683 p = (struct ikev2_n *)ext;
1684 ND_TCHECK(*p);
1685 safememcpy(&n, ext, sizeof(n));
1686 ikev2_pay_print(ndo, NPSTR(ISAKMP_NPTYPE_N), n.h.critical);
1687
1688 showspi = 1;
1689 showdata = 0;
1690 showsomedata=0;
1691 notify_name=NULL;
1692
1693 ND_PRINT((ndo," prot_id=%s", PROTOIDSTR(n.prot_id)));
1694
1695 type = ntohs(n.type);
1696
1697 /* notify space is annoying sparse */
1698 switch(type) {
1699 case IV2_NOTIFY_UNSUPPORTED_CRITICAL_PAYLOAD:
1700 notify_name = "unsupported_critical_payload";
1701 showspi = 0;
1702 break;
1703
1704 case IV2_NOTIFY_INVALID_IKE_SPI:
1705 notify_name = "invalid_ike_spi";
1706 showspi = 1;
1707 break;
1708
1709 case IV2_NOTIFY_INVALID_MAJOR_VERSION:
1710 notify_name = "invalid_major_version";
1711 showspi = 0;
1712 break;
1713
1714 case IV2_NOTIFY_INVALID_SYNTAX:
1715 notify_name = "invalid_syntax";
1716 showspi = 1;
1717 break;
1718
1719 case IV2_NOTIFY_INVALID_MESSAGE_ID:
1720 notify_name = "invalid_message_id";
1721 showspi = 1;
1722 break;
1723
1724 case IV2_NOTIFY_INVALID_SPI:
1725 notify_name = "invalid_spi";
1726 showspi = 1;
1727 break;
1728
1729 case IV2_NOTIFY_NO_PROPOSAL_CHOSEN:
1730 notify_name = "no_protocol_chosen";
1731 showspi = 1;
1732 break;
1733
1734 case IV2_NOTIFY_INVALID_KE_PAYLOAD:
1735 notify_name = "invalid_ke_payload";
1736 showspi = 1;
1737 break;
1738
1739 case IV2_NOTIFY_AUTHENTICATION_FAILED:
1740 notify_name = "authentication_failed";
1741 showspi = 1;
1742 break;
1743
1744 case IV2_NOTIFY_SINGLE_PAIR_REQUIRED:
1745 notify_name = "single_pair_required";
1746 showspi = 1;
1747 break;
1748
1749 case IV2_NOTIFY_NO_ADDITIONAL_SAS:
1750 notify_name = "no_additional_sas";
1751 showspi = 0;
1752 break;
1753
1754 case IV2_NOTIFY_INTERNAL_ADDRESS_FAILURE:
1755 notify_name = "internal_address_failure";
1756 showspi = 0;
1757 break;
1758
1759 case IV2_NOTIFY_FAILED_CP_REQUIRED:
1760 notify_name = "failed:cp_required";
1761 showspi = 0;
1762 break;
1763
1764 case IV2_NOTIFY_INVALID_SELECTORS:
1765 notify_name = "invalid_selectors";
1766 showspi = 0;
1767 break;
1768
1769 case IV2_NOTIFY_INITIAL_CONTACT:
1770 notify_name = "initial_contact";
1771 showspi = 0;
1772 break;
1773
1774 case IV2_NOTIFY_SET_WINDOW_SIZE:
1775 notify_name = "set_window_size";
1776 showspi = 0;
1777 break;
1778
1779 case IV2_NOTIFY_ADDITIONAL_TS_POSSIBLE:
1780 notify_name = "additional_ts_possible";
1781 showspi = 0;
1782 break;
1783
1784 case IV2_NOTIFY_IPCOMP_SUPPORTED:
1785 notify_name = "ipcomp_supported";
1786 showspi = 0;
1787 break;
1788
1789 case IV2_NOTIFY_NAT_DETECTION_SOURCE_IP:
1790 notify_name = "nat_detection_source_ip";
1791 showspi = 1;
1792 break;
1793
1794 case IV2_NOTIFY_NAT_DETECTION_DESTINATION_IP:
1795 notify_name = "nat_detection_destination_ip";
1796 showspi = 1;
1797 break;
1798
1799 case IV2_NOTIFY_COOKIE:
1800 notify_name = "cookie";
1801 showspi = 1;
1802 showsomedata= 1;
1803 showdata= 0;
1804 break;
1805
1806 case IV2_NOTIFY_USE_TRANSPORT_MODE:
1807 notify_name = "use_transport_mode";
1808 showspi = 0;
1809 break;
1810
1811 case IV2_NOTIFY_HTTP_CERT_LOOKUP_SUPPORTED:
1812 notify_name = "http_cert_lookup_supported";
1813 showspi = 0;
1814 break;
1815
1816 case IV2_NOTIFY_REKEY_SA:
1817 notify_name = "rekey_sa";
1818 showspi = 1;
1819 break;
1820
1821 case IV2_NOTIFY_ESP_TFC_PADDING_NOT_SUPPORTED:
1822 notify_name = "tfc_padding_not_supported";
1823 showspi = 0;
1824 break;
1825
1826 case IV2_NOTIFY_NON_FIRST_FRAGMENTS_ALSO:
1827 notify_name = "non_first_fragment_also";
1828 showspi = 0;
1829 break;
1830
1831 default:
1832 if (type < 8192) {
1833 notify_name="error";
1834 } else if(type < 16384) {
1835 notify_name="private-error";
1836 } else if(type < 40960) {
1837 notify_name="status";
1838 } else {
1839 notify_name="private-status";
1840 }
1841 }
1842
1843 if(notify_name) {
1844 ND_PRINT((ndo," type=%u(%s)", type, notify_name));
1845 }
1846
1847
1848 if (showspi && n.spi_size) {
1849 ND_PRINT((ndo," spi="));
1850 if (!rawprint(ndo, (caddr_t)(p + 1), n.spi_size))
1851 goto trunc;
1852 }
1853
1854 cp = (u_char *)(p + 1) + n.spi_size;
1855 ep2 = (u_char *)p + item_len;
1856
1857 if(3 < ndo->ndo_vflag) {
1858 showdata = 1;
1859 }
1860
1861 if ((showdata || (showsomedata && ep-cp < 30)) && cp < ep) {
1862 ND_PRINT((ndo," data=("));
1863 if (!rawprint(ndo, (caddr_t)(cp), ep - cp))
1864 goto trunc;
1865
1866 ND_PRINT((ndo,")"));
1867
1868 } else if(showsomedata && cp < ep) {
1869 if(!ike_show_somedata(ndo, cp, ep)) goto trunc;
1870 }
1871
1872 return (u_char *)ext + item_len;
1873 trunc:
1874 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_N)));
1875 return NULL;
1876 }
1877
1878 static const u_char *
1879 ikev2_d_print(netdissect_options *ndo, u_char tpay,
1880 const struct isakmp_gen *ext,
1881 u_int item_len _U_, const u_char *ep _U_,
1882 u_int32_t phase _U_, u_int32_t doi _U_,
1883 u_int32_t proto _U_, int depth _U_)
1884 {
1885 return ikev2_gen_print(ndo, tpay, ext);
1886 }
1887
1888 static const u_char *
1889 ikev2_vid_print(netdissect_options *ndo, u_char tpay,
1890 const struct isakmp_gen *ext,
1891 u_int item_len _U_, const u_char *ep _U_,
1892 u_int32_t phase _U_, u_int32_t doi _U_,
1893 u_int32_t proto _U_, int depth _U_)
1894 {
1895 struct isakmp_gen e;
1896 const u_char *vid;
1897 int i, len;
1898
1899 ND_TCHECK(*ext);
1900 safememcpy(&e, ext, sizeof(e));
1901 ikev2_pay_print(ndo, NPSTR(tpay), e.critical);
1902 ND_PRINT((ndo," len=%d vid=", ntohs(e.len) - 4));
1903
1904 vid = (const u_char *)(ext+1);
1905 len = ntohs(e.len) - 4;
1906 ND_TCHECK2(*vid, len);
1907 for(i=0; i<len; i++) {
1908 if(isprint(vid[i])) ND_PRINT((ndo, "%c", vid[i]));
1909 else ND_PRINT((ndo, ".", vid[i]));
1910 }
1911 if (2 < ndo->ndo_vflag && 4 < len) {
1912 ND_PRINT((ndo," "));
1913 if (!rawprint(ndo, (caddr_t)(ext + 1), ntohs(e.len) - 4))
1914 goto trunc;
1915 }
1916 return (u_char *)ext + ntohs(e.len);
1917 trunc:
1918 ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
1919 return NULL;
1920 }
1921
1922 static const u_char *
1923 ikev2_TS_print(netdissect_options *ndo, u_char tpay,
1924 const struct isakmp_gen *ext,
1925 u_int item_len _U_, const u_char *ep _U_,
1926 u_int32_t phase _U_, u_int32_t doi _U_,
1927 u_int32_t proto _U_, int depth _U_)
1928 {
1929 return ikev2_gen_print(ndo, tpay, ext);
1930 }
1931
1932 static const u_char *
1933 ikev2_e_print(netdissect_options *ndo, u_char tpay,
1934 const struct isakmp_gen *ext,
1935 u_int item_len _U_, const u_char *ep _U_,
1936 u_int32_t phase _U_, u_int32_t doi _U_,
1937 u_int32_t proto _U_, int depth _U_)
1938 {
1939 struct isakmp_gen e;
1940
1941 ND_TCHECK(*ext);
1942 safememcpy(&e, ext, sizeof(e));
1943 ikev2_pay_print(ndo, NPSTR(tpay), e.critical);
1944
1945 ND_PRINT((ndo," len=%d", ntohs(e.len) - 4));
1946 if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1947 ND_PRINT((ndo," "));
1948 if (!rawprint(ndo, (caddr_t)(ext + 1), ntohs(e.len) - 4))
1949 goto trunc;
1950 }
1951
1952 /* always return NULL, because E must be at end, and NP refers
1953 * to what was inside.
1954 */
1955 return NULL;
1956 trunc:
1957 ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
1958 return NULL;
1959 }
1960
1961 static const u_char *
1962 ikev2_cp_print(netdissect_options *ndo, u_char tpay,
1963 const struct isakmp_gen *ext,
1964 u_int item_len _U_, const u_char *ep _U_,
1965 u_int32_t phase _U_, u_int32_t doi _U_,
1966 u_int32_t proto _U_, int depth _U_)
1967 {
1968 return ikev2_gen_print(ndo, tpay, ext);
1969 }
1970
1971 static const u_char *
1972 ikev2_eap_print(netdissect_options *ndo, u_char tpay,
1973 const struct isakmp_gen *ext,
1974 u_int item_len _U_, const u_char *ep _U_,
1975 u_int32_t phase _U_, u_int32_t doi _U_,
1976 u_int32_t proto _U_, int depth _U_)
1977 {
1978 return ikev2_gen_print(ndo, tpay, ext);
1979 }
1980
1981 static const u_char *
1982 ike_sub0_print(netdissect_options *ndo,
1983 u_char np, const struct isakmp_gen *ext, const u_char *ep,
1984
1985 u_int32_t phase, u_int32_t doi, u_int32_t proto, int depth)
1986 {
1987 const u_char *cp;
1988 struct isakmp_gen e;
1989 u_int item_len;
1990
1991 cp = (u_char *)ext;
1992 ND_TCHECK(*ext);
1993 safememcpy(&e, ext, sizeof(e));
1994
1995 /*
1996 * Since we can't have a payload length of less than 4 bytes,
1997 * we need to bail out here if the generic header is nonsensical
1998 * or truncated, otherwise we could loop forever processing
1999 * zero-length items or otherwise misdissect the packet.
2000 */
2001 item_len = ntohs(e.len);
2002 if (item_len <= 4)
2003 return NULL;
2004
2005 if (NPFUNC(np)) {
2006 /*
2007 * XXX - what if item_len is too short, or too long,
2008 * for this payload type?
2009 */
2010 cp = (*npfunc[np])(ndo, np, ext, item_len, ep, phase, doi, proto, depth);
2011 } else {
2012 ND_PRINT((ndo,"%s", NPSTR(np)));
2013 cp += item_len;
2014 }
2015
2016 return cp;
2017 trunc:
2018 ND_PRINT((ndo," [|isakmp]"));
2019 return NULL;
2020 }
2021
2022 static const u_char *
2023 ikev1_sub_print(netdissect_options *ndo,
2024 u_char np, const struct isakmp_gen *ext, const u_char *ep,
2025 u_int32_t phase, u_int32_t doi, u_int32_t proto, int depth)
2026 {
2027 const u_char *cp;
2028 int i;
2029 struct isakmp_gen e;
2030
2031 cp = (const u_char *)ext;
2032
2033 while (np) {
2034 ND_TCHECK(*ext);
2035
2036 safememcpy(&e, ext, sizeof(e));
2037
2038 ND_TCHECK2(*ext, ntohs(e.len));
2039
2040 depth++;
2041 ND_PRINT((ndo,"\n"));
2042 for (i = 0; i < depth; i++)
2043 ND_PRINT((ndo," "));
2044 ND_PRINT((ndo,"("));
2045 cp = ike_sub0_print(ndo, np, ext, ep, phase, doi, proto, depth);
2046 ND_PRINT((ndo,")"));
2047 depth--;
2048
2049 if (cp == NULL) {
2050 /* Zero-length subitem */
2051 return NULL;
2052 }
2053
2054 np = e.np;
2055 ext = (struct isakmp_gen *)cp;
2056 }
2057 return cp;
2058 trunc:
2059 ND_PRINT((ndo," [|%s]", NPSTR(np)));
2060 return NULL;
2061 }
2062
2063 static char *
2064 numstr(int x)
2065 {
2066 static char buf[20];
2067 snprintf(buf, sizeof(buf), "#%d", x);
2068 return buf;
2069 }
2070
2071 /*
2072 * some compiler tries to optimize memcpy(), using the alignment constraint
2073 * on the argument pointer type. by using this function, we try to avoid the
2074 * optimization.
2075 */
2076 static void
2077 safememcpy(void *p, const void *q, size_t l)
2078 {
2079 memcpy(p, q, l);
2080 }
2081
2082 void
2083 ikev1_print(netdissect_options *ndo,
2084 const u_char *bp, u_int length,
2085 const u_char *bp2, struct isakmp *base)
2086 {
2087 const struct isakmp *p;
2088 const u_char *ep;
2089 u_char np;
2090 int i;
2091 int phase;
2092
2093 p = (const struct isakmp *)bp;
2094 ep = ndo->ndo_snapend;
2095
2096 phase = (*(u_int32_t *)base->msgid == 0) ? 1 : 2;
2097 if (phase == 1)
2098 ND_PRINT((ndo," phase %d", phase));
2099 else
2100 ND_PRINT((ndo," phase %d/others", phase));
2101
2102 i = cookie_find(&base->i_ck);
2103 if (i < 0) {
2104 if (iszero((u_char *)&base->r_ck, sizeof(base->r_ck))) {
2105 /* the first packet */
2106 ND_PRINT((ndo," I"));
2107 if (bp2)
2108 cookie_record(&base->i_ck, bp2);
2109 } else
2110 ND_PRINT((ndo," ?"));
2111 } else {
2112 if (bp2 && cookie_isinitiator(i, bp2))
2113 ND_PRINT((ndo," I"));
2114 else if (bp2 && cookie_isresponder(i, bp2))
2115 ND_PRINT((ndo," R"));
2116 else
2117 ND_PRINT((ndo," ?"));
2118 }
2119
2120 ND_PRINT((ndo," %s", ETYPESTR(base->etype)));
2121 if (base->flags) {
2122 ND_PRINT((ndo,"[%s%s]", base->flags & ISAKMP_FLAG_E ? "E" : "",
2123 base->flags & ISAKMP_FLAG_C ? "C" : ""));
2124 }
2125
2126 if (ndo->ndo_vflag) {
2127 const struct isakmp_gen *ext;
2128 int nparen;
2129
2130 ND_PRINT((ndo,":"));
2131
2132 /* regardless of phase... */
2133 if (base->flags & ISAKMP_FLAG_E) {
2134 /*
2135 * encrypted, nothing we can do right now.
2136 * we hope to decrypt the packet in the future...
2137 */
2138 ND_PRINT((ndo," [encrypted %s]", NPSTR(base->np)));
2139 goto done;
2140 }
2141
2142 nparen = 0;
2143 CHECKLEN(p + 1, base->np);
2144 np = base->np;
2145 ext = (struct isakmp_gen *)(p + 1);
2146 ikev1_sub_print(ndo, np, ext, ep, phase, 0, 0, 0);
2147 }
2148
2149 done:
2150 if (ndo->ndo_vflag) {
2151 if (ntohl(base->len) != length) {
2152 ND_PRINT((ndo," (len mismatch: isakmp %u/ip %u)",
2153 (u_int32_t)ntohl(base->len), length));
2154 }
2155 }
2156 }
2157
2158 static const u_char *
2159 ikev2_sub0_print(netdissect_options *ndo, u_char np, int pcount,
2160 const struct isakmp_gen *ext, const u_char *ep,
2161 u_int32_t phase, u_int32_t doi, u_int32_t proto, int depth)
2162 {
2163 const u_char *cp;
2164 struct isakmp_gen e;
2165 u_int item_len;
2166
2167 cp = (u_char *)ext;
2168 ND_TCHECK(*ext);
2169 safememcpy(&e, ext, sizeof(e));
2170
2171 /*
2172 * Since we can't have a payload length of less than 4 bytes,
2173 * we need to bail out here if the generic header is nonsensical
2174 * or truncated, otherwise we could loop forever processing
2175 * zero-length items or otherwise misdissect the packet.
2176 */
2177 item_len = ntohs(e.len);
2178 if (item_len <= 4)
2179 return NULL;
2180
2181 if(np == ISAKMP_NPTYPE_P) {
2182 cp = ikev2_p_print(ndo, np, pcount, ext, item_len,
2183 ep, phase, doi, proto, depth);
2184 } else if(np == ISAKMP_NPTYPE_T) {
2185 cp = ikev2_t_print(ndo, np, pcount, ext, item_len,
2186 ep, phase, doi, proto, depth);
2187 } else if (NPFUNC(np)) {
2188 /*
2189 * XXX - what if item_len is too short, or too long,
2190 * for this payload type?
2191 */
2192 cp = (*npfunc[np])(ndo, np, /*pcount,*/ ext, item_len,
2193 ep, phase, doi, proto, depth);
2194 } else {
2195 ND_PRINT((ndo,"%s", NPSTR(np)));
2196 cp += item_len;
2197 }
2198
2199 return cp;
2200 trunc:
2201 ND_PRINT((ndo," [|isakmp]"));
2202 return NULL;
2203 }
2204
2205 static const u_char *
2206 ikev2_sub_print(netdissect_options *ndo,
2207 u_char np, const struct isakmp_gen *ext, const u_char *ep,
2208 u_int32_t phase, u_int32_t doi, u_int32_t proto, int depth)
2209 {
2210 const u_char *cp;
2211 int i;
2212 int pcount;
2213 struct isakmp_gen e;
2214
2215 cp = (const u_char *)ext;
2216 pcount = 0;
2217 while (np) {
2218 pcount++;
2219 ND_TCHECK(*ext);
2220
2221 safememcpy(&e, ext, sizeof(e));
2222
2223 ND_TCHECK2(*ext, ntohs(e.len));
2224
2225 depth++;
2226 ND_PRINT((ndo,"\n"));
2227 for (i = 0; i < depth; i++)
2228 ND_PRINT((ndo," "));
2229 ND_PRINT((ndo,"("));
2230 cp = ikev2_sub0_print(ndo, np, pcount,
2231 ext, ep, phase, doi, proto, depth);
2232 ND_PRINT((ndo,")"));
2233 depth--;
2234
2235 if (cp == NULL) {
2236 /* Zero-length subitem */
2237 return NULL;
2238 }
2239
2240 np = e.np;
2241 ext = (struct isakmp_gen *)cp;
2242 }
2243 return cp;
2244 trunc:
2245 ND_PRINT((ndo," [|%s]", NPSTR(np)));
2246 return NULL;
2247 }
2248
2249 static void
2250 ikev2_print(netdissect_options *ndo,
2251 const u_char *bp, u_int length,
2252 const u_char *bp2 _U_, struct isakmp *base)
2253 {
2254 const struct isakmp *p;
2255 const u_char *ep;
2256 u_char np;
2257 int phase;
2258
2259 p = (const struct isakmp *)bp;
2260 ep = ndo->ndo_snapend;
2261
2262 phase = (*(u_int32_t *)base->msgid == 0) ? 1 : 2;
2263 if (phase == 1)
2264 ND_PRINT((ndo, " parent_sa"));
2265 else
2266 ND_PRINT((ndo, " child_sa "));
2267
2268 ND_PRINT((ndo, " %s", ETYPESTR(base->etype)));
2269 if (base->flags) {
2270 ND_PRINT((ndo, "[%s%s]",
2271 base->flags & ISAKMP_FLAG_I ? "I" : "",
2272 base->flags & ISAKMP_FLAG_V ? "V" : "",
2273 base->flags & ISAKMP_FLAG_R ? "R" : ""));
2274 }
2275
2276 if (ndo->ndo_vflag) {
2277 const struct isakmp_gen *ext;
2278 int nparen;
2279
2280 ND_PRINT((ndo, ":"));
2281
2282 /* regardless of phase... */
2283 if (base->flags & ISAKMP_FLAG_E) {
2284 /*
2285 * encrypted, nothing we can do right now.
2286 * we hope to decrypt the packet in the future...
2287 */
2288 ND_PRINT((ndo, " [encrypted %s]", NPSTR(base->np)));
2289 goto done;
2290 }
2291
2292 nparen = 0;
2293 CHECKLEN(p + 1, base->np)
2294
2295 np = base->np;
2296 ext = (struct isakmp_gen *)(p + 1);
2297 ikev2_sub_print(ndo, np, ext, ep, phase, 0, 0, 0);
2298 }
2299
2300 done:
2301 if (ndo->ndo_vflag) {
2302 if (ntohl(base->len) != length) {
2303 ND_PRINT((ndo, " (len mismatch: isakmp %u/ip %u)",
2304 (u_int32_t)ntohl(base->len), length));
2305 }
2306 }
2307 }
2308
2309 void
2310 isakmp_print(netdissect_options *ndo,
2311 const u_char *bp, u_int length,
2312 const u_char *bp2)
2313 {
2314 const struct isakmp *p;
2315 struct isakmp base;
2316 const u_char *ep;
2317 int major, minor;
2318
2319 p = (const struct isakmp *)bp;
2320 ep = ndo->ndo_snapend;
2321
2322 if ((struct isakmp *)ep < p + 1) {
2323 ND_PRINT((ndo,"[|isakmp]"));
2324 return;
2325 }
2326
2327 safememcpy(&base, p, sizeof(base));
2328
2329 ND_PRINT((ndo,"isakmp"));
2330 major = (base.vers & ISAKMP_VERS_MAJOR)
2331 >> ISAKMP_VERS_MAJOR_SHIFT;
2332 minor = (base.vers & ISAKMP_VERS_MINOR)
2333 >> ISAKMP_VERS_MINOR_SHIFT;
2334
2335 if (ndo->ndo_vflag) {
2336 ND_PRINT((ndo," %d.%d", major, minor));
2337 }
2338
2339 if (ndo->ndo_vflag) {
2340 ND_PRINT((ndo," msgid "));
2341 rawprint(ndo, (caddr_t)&base.msgid, sizeof(base.msgid));
2342 }
2343
2344 if (1 < ndo->ndo_vflag) {
2345 ND_PRINT((ndo," cookie "));
2346 rawprint(ndo, (caddr_t)&base.i_ck, sizeof(base.i_ck));
2347 ND_PRINT((ndo,"->"));
2348 rawprint(ndo, (caddr_t)&base.r_ck, sizeof(base.r_ck));
2349 }
2350 ND_PRINT((ndo,":"));
2351
2352 switch(major) {
2353 case IKEv1_MAJOR_VERSION:
2354 ikev1_print(ndo, bp, length, bp2, &base);
2355 break;
2356
2357 case IKEv2_MAJOR_VERSION:
2358 ikev2_print(ndo, bp, length, bp2, &base);
2359 break;
2360 }
2361 }
2362
2363 void
2364 isakmp_rfc3948_print(netdissect_options *ndo,
2365 const u_char *bp, u_int length,
2366 const u_char *bp2)
2367 {
2368 const u_char *ep;
2369 ep = ndo->ndo_snapend;
2370
2371 if(length == 1 && bp[0]==0xff) {
2372 ND_PRINT((ndo, "isakmp-nat-keep-alive"));
2373 return;
2374 }
2375
2376 if(length < 4) {
2377 goto trunc;
2378 }
2379
2380 /*
2381 * see if this is an IKE packet
2382 */
2383 if(bp[0]==0 && bp[1]==0 && bp[2]==0 && bp[3]==0) {
2384 ND_PRINT((ndo, "NONESP-encap: "));
2385 isakmp_print(ndo, bp+4, length-4, bp2);
2386 return;
2387 }
2388
2389 /* must be an ESP packet */
2390 {
2391 int nh, enh, padlen;
2392 int advance;
2393
2394 ND_PRINT((ndo, "UDP-encap: "));
2395
2396 advance = esp_print(ndo, bp, length, bp2, &enh, &padlen);
2397 if(advance <= 0)
2398 return;
2399
2400 bp += advance;
2401 length -= advance + padlen;
2402 nh = enh & 0xff;
2403
2404 ip_print_inner(ndo, bp, length, nh, bp2);
2405 return;
2406 }
2407
2408 trunc:
2409 ND_PRINT((ndo,"[|isakmp]"));
2410 return;
2411 }
2412
2413 /*
2414 * Local Variables:
2415 * c-style: whitesmith
2416 * c-basic-offset: 8
2417 * End:
2418 */
2419
2420
2421
2422
[mirror] the TCPdump network dissector