]> The Tcpdump Group git mirrors - tcpdump/blob - print-isakmp.c
projects / tcpdump / blob
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
Fix the pointer tests in the non-ndoified TTEST2() macro as well.
[tcpdump] / print-isakmp.c
1 /*
2 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. Neither the name of the project nor the names of its contributors
14 * may be used to endorse or promote products derived from this software
15 * without specific prior written permission.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 * SUCH DAMAGE.
28 *
29 */
30
31 #ifndef lint
32 static const char rcsid[] _U_ =
33 "@(#) $Header: /tcpdump/master/tcpdump/print-isakmp.c,v 1.61 2008-02-05 19:34:25 guy Exp $ (LBL)";
34 #endif
35
36 #define NETDISSECT_REWORKED
37 #ifdef HAVE_CONFIG_H
38 #include "config.h"
39 #endif
40
41 #include <tcpdump-stdinc.h>
42
43 #include <string.h>
44
45 #include <stdio.h>
46
47 #include "isakmp.h"
48 #include "ipsec_doi.h"
49 #include "oakley.h"
50 #include "interface.h"
51 #include "addrtoname.h"
52 #include "extract.h" /* must come after interface.h */
53
54 #include "ip.h"
55 #ifdef INET6
56 #include "ip6.h"
57 #endif
58
59 #ifndef HAVE_SOCKADDR_STORAGE
60 #define sockaddr_storage sockaddr
61 #endif
62
63 #define DECLARE_PRINTER(func) static const u_char *ike##func##_print( \
64 netdissect_options *ndo, u_char tpay, \
65 const struct isakmp_gen *ext, \
66 u_int item_len, \
67 const u_char *end_pointer, \
68 u_int32_t phase,\
69 u_int32_t doi0, \
70 u_int32_t proto0, int depth)
71
72 DECLARE_PRINTER(v1_sa);
73 DECLARE_PRINTER(v1_p);
74 DECLARE_PRINTER(v1_t);
75 DECLARE_PRINTER(v1_ke);
76 DECLARE_PRINTER(v1_id);
77 DECLARE_PRINTER(v1_cert);
78 DECLARE_PRINTER(v1_cr);
79 DECLARE_PRINTER(v1_sig);
80 DECLARE_PRINTER(v1_hash);
81 DECLARE_PRINTER(v1_nonce);
82 DECLARE_PRINTER(v1_n);
83 DECLARE_PRINTER(v1_d);
84 DECLARE_PRINTER(v1_vid);
85
86 DECLARE_PRINTER(v2_sa);
87 DECLARE_PRINTER(v2_ke);
88 DECLARE_PRINTER(v2_ID);
89 DECLARE_PRINTER(v2_cert);
90 DECLARE_PRINTER(v2_cr);
91 DECLARE_PRINTER(v2_auth);
92 DECLARE_PRINTER(v2_nonce);
93 DECLARE_PRINTER(v2_n);
94 DECLARE_PRINTER(v2_d);
95 DECLARE_PRINTER(v2_vid);
96 DECLARE_PRINTER(v2_TS);
97 DECLARE_PRINTER(v2_cp);
98 DECLARE_PRINTER(v2_eap);
99
100 static const u_char *ikev2_e_print(netdissect_options *ndo,
101 struct isakmp *base,
102 u_char tpay,
103 const struct isakmp_gen *ext,
104 u_int item_len,
105 const u_char *end_pointer,
106 u_int32_t phase,
107 u_int32_t doi0,
108 u_int32_t proto0, int depth);
109
110
111 static const u_char *ike_sub0_print(netdissect_options *ndo,u_char, const struct isakmp_gen *,
112 const u_char *, u_int32_t, u_int32_t, u_int32_t, int);
113 static const u_char *ikev1_sub_print(netdissect_options *ndo,u_char, const struct isakmp_gen *,
114 const u_char *, u_int32_t, u_int32_t, u_int32_t, int);
115
116 static const u_char *ikev2_sub_print(netdissect_options *ndo,
117 struct isakmp *base,
118 u_char np, const struct isakmp_gen *ext,
119 const u_char *ep, u_int32_t phase,
120 u_int32_t doi, u_int32_t proto,
121 int depth);
122
123
124 static char *numstr(int);
125 static void safememcpy(void *, const void *, size_t);
126
127 static void
128 ikev1_print(netdissect_options *ndo,
129 const u_char *bp, u_int length,
130 const u_char *bp2, struct isakmp *base);
131
132 #define MAXINITIATORS 20
133 int ninitiator = 0;
134 struct {
135 cookie_t initiator;
136 struct sockaddr_storage iaddr;
137 struct sockaddr_storage raddr;
138 } cookiecache[MAXINITIATORS];
139
140 /* protocol id */
141 static const char *protoidstr[] = {
142 NULL, "isakmp", "ipsec-ah", "ipsec-esp", "ipcomp",
143 };
144
145 /* isakmp->np */
146 static const char *npstr[] = {
147 "none", "sa", "p", "t", "ke", "id", "cert", "cr", "hash", /* 0 - 8 */
148 "sig", "nonce", "n", "d", "vid", /* 9 - 13 */
149 "pay14", "pay15", "pay16", "pay17", "pay18", /* 14- 18 */
150 "pay19", "pay20", "pay21", "pay22", "pay23", /* 19- 23 */
151 "pay24", "pay25", "pay26", "pay27", "pay28", /* 24- 28 */
152 "pay29", "pay30", "pay31", "pay32", /* 29- 32 */
153 "v2sa", "v2ke", "v2IDi", "v2IDr", "v2cert",/* 33- 37 */
154 "v2cr", "v2auth","v2nonce", "v2n", "v2d", /* 38- 42 */
155 "v2vid", "v2TSi", "v2TSr", "v2e", "v2cp", /* 43- 47 */
156 "v2eap", /* 48 */
157
158 };
159
160 /* isakmp->np */
161 static const u_char *(*npfunc[])(netdissect_options *ndo, u_char tpay,
162 const struct isakmp_gen *ext,
163 u_int item_len,
164 const u_char *end_pointer,
165 u_int32_t phase,
166 u_int32_t doi0,
167 u_int32_t proto0, int depth) = {
168 NULL,
169 ikev1_sa_print,
170 ikev1_p_print,
171 ikev1_t_print,
172 ikev1_ke_print,
173 ikev1_id_print,
174 ikev1_cert_print,
175 ikev1_cr_print,
176 ikev1_hash_print,
177 ikev1_sig_print,
178 ikev1_nonce_print,
179 ikev1_n_print,
180 ikev1_d_print,
181 ikev1_vid_print, /* 13 */
182 NULL, NULL, NULL, NULL, NULL, /* 14- 18 */
183 NULL, NULL, NULL, NULL, NULL, /* 19- 23 */
184 NULL, NULL, NULL, NULL, NULL, /* 24- 28 */
185 NULL, NULL, NULL, NULL, /* 29- 32 */
186 ikev2_sa_print, /* 33 */
187 ikev2_ke_print, /* 34 */
188 ikev2_ID_print, /* 35 */
189 ikev2_ID_print, /* 36 */
190 ikev2_cert_print, /* 37 */
191 ikev2_cr_print, /* 38 */
192 ikev2_auth_print, /* 39 */
193 ikev2_nonce_print, /* 40 */
194 ikev2_n_print, /* 41 */
195 ikev2_d_print, /* 42 */
196 ikev2_vid_print, /* 43 */
197 ikev2_TS_print, /* 44 */
198 ikev2_TS_print, /* 45 */
199 NULL, /* ikev2_e_print,*/ /* 46 - special */
200 ikev2_cp_print, /* 47 */
201 ikev2_eap_print, /* 48 */
202 };
203
204 /* isakmp->etype */
205 static const char *etypestr[] = {
206 /* IKEv1 exchange types */
207 "none", "base", "ident", "auth", "agg", "inf", NULL, NULL, /* 0-7 */
208 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, /* 8-15 */
209 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, /* 16-23 */
210 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, /* 24-31 */
211 "oakley-quick", "oakley-newgroup", /* 32-33 */
212 /* IKEv2 exchange types */
213 "ikev2_init", "ikev2_auth", "child_sa", "inf2" /* 34-37 */
214 };
215
216 #define STR_OR_ID(x, tab) \
217 (((x) < sizeof(tab)/sizeof(tab[0]) && tab[(x)]) ? tab[(x)] : numstr(x))
218 #define PROTOIDSTR(x) STR_OR_ID(x, protoidstr)
219 #define NPSTR(x) STR_OR_ID(x, npstr)
220 #define ETYPESTR(x) STR_OR_ID(x, etypestr)
221
222 #define CHECKLEN(p, np) \
223 if (ep < (u_char *)(p)) { \
224 ND_PRINT((ndo," [|%s]", NPSTR(np))); \
225 goto done; \
226 }
227
228
229 #define NPFUNC(x) \
230 (((x) < sizeof(npfunc)/sizeof(npfunc[0]) && npfunc[(x)]) \
231 ? npfunc[(x)] : NULL)
232
233 static int
234 iszero(u_char *p, size_t l)
235 {
236 while (l--) {
237 if (*p++)
238 return 0;
239 }
240 return 1;
241 }
242
243 /* find cookie from initiator cache */
244 static int
245 cookie_find(cookie_t *in)
246 {
247 int i;
248
249 for (i = 0; i < MAXINITIATORS; i++) {
250 if (memcmp(in, &cookiecache[i].initiator, sizeof(*in)) == 0)
251 return i;
252 }
253
254 return -1;
255 }
256
257 /* record initiator */
258 static void
259 cookie_record(cookie_t *in, const u_char *bp2)
260 {
261 int i;
262 struct ip *ip;
263 struct sockaddr_in *sin;
264 #ifdef INET6
265 struct ip6_hdr *ip6;
266 struct sockaddr_in6 *sin6;
267 #endif
268
269 i = cookie_find(in);
270 if (0 <= i) {
271 ninitiator = (i + 1) % MAXINITIATORS;
272 return;
273 }
274
275 ip = (struct ip *)bp2;
276 switch (IP_V(ip)) {
277 case 4:
278 memset(&cookiecache[ninitiator].iaddr, 0,
279 sizeof(cookiecache[ninitiator].iaddr));
280 memset(&cookiecache[ninitiator].raddr, 0,
281 sizeof(cookiecache[ninitiator].raddr));
282
283 sin = (struct sockaddr_in *)&cookiecache[ninitiator].iaddr;
284 #ifdef HAVE_SOCKADDR_SA_LEN
285 sin->sin_len = sizeof(struct sockaddr_in);
286 #endif
287 sin->sin_family = AF_INET;
288 memcpy(&sin->sin_addr, &ip->ip_src, sizeof(ip->ip_src));
289 sin = (struct sockaddr_in *)&cookiecache[ninitiator].raddr;
290 #ifdef HAVE_SOCKADDR_SA_LEN
291 sin->sin_len = sizeof(struct sockaddr_in);
292 #endif
293 sin->sin_family = AF_INET;
294 memcpy(&sin->sin_addr, &ip->ip_dst, sizeof(ip->ip_dst));
295 break;
296 #ifdef INET6
297 case 6:
298 memset(&cookiecache[ninitiator].iaddr, 0,
299 sizeof(cookiecache[ninitiator].iaddr));
300 memset(&cookiecache[ninitiator].raddr, 0,
301 sizeof(cookiecache[ninitiator].raddr));
302
303 ip6 = (struct ip6_hdr *)bp2;
304 sin6 = (struct sockaddr_in6 *)&cookiecache[ninitiator].iaddr;
305 #ifdef HAVE_SOCKADDR_SA_LEN
306 sin6->sin6_len = sizeof(struct sockaddr_in6);
307 #endif
308 sin6->sin6_family = AF_INET6;
309 memcpy(&sin6->sin6_addr, &ip6->ip6_src, sizeof(ip6->ip6_src));
310 sin6 = (struct sockaddr_in6 *)&cookiecache[ninitiator].raddr;
311 #ifdef HAVE_SOCKADDR_SA_LEN
312 sin6->sin6_len = sizeof(struct sockaddr_in6);
313 #endif
314 sin6->sin6_family = AF_INET6;
315 memcpy(&sin6->sin6_addr, &ip6->ip6_dst, sizeof(ip6->ip6_dst));
316 break;
317 #endif
318 default:
319 return;
320 }
321 memcpy(&cookiecache[ninitiator].initiator, in, sizeof(*in));
322 ninitiator = (ninitiator + 1) % MAXINITIATORS;
323 }
324
325 #define cookie_isinitiator(x, y) cookie_sidecheck((x), (y), 1)
326 #define cookie_isresponder(x, y) cookie_sidecheck((x), (y), 0)
327 static int
328 cookie_sidecheck(int i, const u_char *bp2, int initiator)
329 {
330 struct sockaddr_storage ss;
331 struct sockaddr *sa;
332 struct ip *ip;
333 struct sockaddr_in *sin;
334 #ifdef INET6
335 struct ip6_hdr *ip6;
336 struct sockaddr_in6 *sin6;
337 #endif
338 int salen;
339
340 memset(&ss, 0, sizeof(ss));
341 ip = (struct ip *)bp2;
342 switch (IP_V(ip)) {
343 case 4:
344 sin = (struct sockaddr_in *)&ss;
345 #ifdef HAVE_SOCKADDR_SA_LEN
346 sin->sin_len = sizeof(struct sockaddr_in);
347 #endif
348 sin->sin_family = AF_INET;
349 memcpy(&sin->sin_addr, &ip->ip_src, sizeof(ip->ip_src));
350 break;
351 #ifdef INET6
352 case 6:
353 ip6 = (struct ip6_hdr *)bp2;
354 sin6 = (struct sockaddr_in6 *)&ss;
355 #ifdef HAVE_SOCKADDR_SA_LEN
356 sin6->sin6_len = sizeof(struct sockaddr_in6);
357 #endif
358 sin6->sin6_family = AF_INET6;
359 memcpy(&sin6->sin6_addr, &ip6->ip6_src, sizeof(ip6->ip6_src));
360 break;
361 #endif
362 default:
363 return 0;
364 }
365
366 sa = (struct sockaddr *)&ss;
367 if (initiator) {
368 if (sa->sa_family != ((struct sockaddr *)&cookiecache[i].iaddr)->sa_family)
369 return 0;
370 #ifdef HAVE_SOCKADDR_SA_LEN
371 salen = sa->sa_len;
372 #else
373 #ifdef INET6
374 if (sa->sa_family == AF_INET6)
375 salen = sizeof(struct sockaddr_in6);
376 else
377 salen = sizeof(struct sockaddr);
378 #else
379 salen = sizeof(struct sockaddr);
380 #endif
381 #endif
382 if (memcmp(&ss, &cookiecache[i].iaddr, salen) == 0)
383 return 1;
384 } else {
385 if (sa->sa_family != ((struct sockaddr *)&cookiecache[i].raddr)->sa_family)
386 return 0;
387 #ifdef HAVE_SOCKADDR_SA_LEN
388 salen = sa->sa_len;
389 #else
390 #ifdef INET6
391 if (sa->sa_family == AF_INET6)
392 salen = sizeof(struct sockaddr_in6);
393 else
394 salen = sizeof(struct sockaddr);
395 #else
396 salen = sizeof(struct sockaddr);
397 #endif
398 #endif
399 if (memcmp(&ss, &cookiecache[i].raddr, salen) == 0)
400 return 1;
401 }
402 return 0;
403 }
404
405 static void
406 hexprint(netdissect_options *ndo, caddr_t loc, size_t len)
407 {
408 u_char *p;
409 size_t i;
410
411 p = (u_char *)loc;
412 for (i = 0; i < len; i++)
413 ND_PRINT((ndo,"%02x", p[i] & 0xff));
414 }
415
416 static int
417 rawprint(netdissect_options *ndo, caddr_t loc, size_t len)
418 {
419 ND_TCHECK2(*loc, len);
420
421 hexprint(ndo, loc, len);
422 return 1;
423 trunc:
424 return 0;
425 }
426
427
428 /*
429 * returns false if we run out of data buffer
430 */
431 static int ike_show_somedata(struct netdissect_options *ndo,
432 const u_char *cp, const u_char *ep)
433 {
434 /* there is too much data, just show some of it */
435 const u_char *end = ep - 20;
436 int elen = 20;
437 int len = ep - cp;
438 if(len > 10) {
439 len = 10;
440 }
441
442 /* really shouldn't happen because of above */
443 if(end < cp + len) {
444 end = cp+len;
445 elen = ep - end;
446 }
447
448 ND_PRINT((ndo," data=("));
449 if(!rawprint(ndo, (caddr_t)(cp), len)) goto trunc;
450 ND_PRINT((ndo, "..."));
451 if(elen) {
452 if(!rawprint(ndo, (caddr_t)(end), elen)) goto trunc;
453 }
454 ND_PRINT((ndo,")"));
455 return 1;
456
457 trunc:
458 return 0;
459 }
460
461 struct attrmap {
462 const char *type;
463 u_int nvalue;
464 const char *value[30]; /*XXX*/
465 };
466
467 static const u_char *
468 ikev1_attrmap_print(netdissect_options *ndo,
469 const u_char *p, const u_char *ep,
470 const struct attrmap *map, size_t nmap)
471 {
472 u_int16_t *q;
473 int totlen;
474 u_int32_t t, v;
475
476 q = (u_int16_t *)p;
477 if (p[0] & 0x80)
478 totlen = 4;
479 else
480 totlen = 4 + EXTRACT_16BITS(&q[1]);
481 if (ep < p + totlen) {
482 ND_PRINT((ndo,"[|attr]"));
483 return ep + 1;
484 }
485
486 ND_PRINT((ndo,"("));
487 t = EXTRACT_16BITS(&q[0]) & 0x7fff;
488 if (map && t < nmap && map[t].type)
489 ND_PRINT((ndo,"type=%s ", map[t].type));
490 else
491 ND_PRINT((ndo,"type=#%d ", t));
492 if (p[0] & 0x80) {
493 ND_PRINT((ndo,"value="));
494 v = EXTRACT_16BITS(&q[1]);
495 if (map && t < nmap && v < map[t].nvalue && map[t].value[v])
496 ND_PRINT((ndo,"%s", map[t].value[v]));
497 else
498 rawprint(ndo, (caddr_t)&q[1], 2);
499 } else {
500 ND_PRINT((ndo,"len=%d value=", EXTRACT_16BITS(&q[1])));
501 rawprint(ndo, (caddr_t)&p[4], EXTRACT_16BITS(&q[1]));
502 }
503 ND_PRINT((ndo,")"));
504 return p + totlen;
505 }
506
507 static const u_char *
508 ikev1_attr_print(netdissect_options *ndo, const u_char *p, const u_char *ep)
509 {
510 u_int16_t *q;
511 int totlen;
512 u_int32_t t;
513
514 q = (u_int16_t *)p;
515 if (p[0] & 0x80)
516 totlen = 4;
517 else
518 totlen = 4 + EXTRACT_16BITS(&q[1]);
519 if (ep < p + totlen) {
520 ND_PRINT((ndo,"[|attr]"));
521 return ep + 1;
522 }
523
524 ND_PRINT((ndo,"("));
525 t = EXTRACT_16BITS(&q[0]) & 0x7fff;
526 ND_PRINT((ndo,"type=#%d ", t));
527 if (p[0] & 0x80) {
528 ND_PRINT((ndo,"value="));
529 t = q[1];
530 rawprint(ndo, (caddr_t)&q[1], 2);
531 } else {
532 ND_PRINT((ndo,"len=%d value=", EXTRACT_16BITS(&q[1])));
533 rawprint(ndo, (caddr_t)&p[2], EXTRACT_16BITS(&q[1]));
534 }
535 ND_PRINT((ndo,")"));
536 return p + totlen;
537 }
538
539 static const u_char *
540 ikev1_sa_print(netdissect_options *ndo, u_char tpay _U_,
541 const struct isakmp_gen *ext,
542 u_int item_len _U_,
543 const u_char *ep, u_int32_t phase, u_int32_t doi0 _U_,
544 u_int32_t proto0, int depth)
545 {
546 const struct ikev1_pl_sa *p;
547 struct ikev1_pl_sa sa;
548 const u_int32_t *q;
549 u_int32_t doi, sit, ident;
550 const u_char *cp, *np;
551 int t;
552
553 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_SA)));
554
555 p = (struct ikev1_pl_sa *)ext;
556 ND_TCHECK(*p);
557 safememcpy(&sa, ext, sizeof(sa));
558 doi = ntohl(sa.doi);
559 sit = ntohl(sa.sit);
560 if (doi != 1) {
561 ND_PRINT((ndo," doi=%d", doi));
562 ND_PRINT((ndo," situation=%u", (u_int32_t)ntohl(sa.sit)));
563 return (u_char *)(p + 1);
564 }
565
566 ND_PRINT((ndo," doi=ipsec"));
567 q = (u_int32_t *)&sa.sit;
568 ND_PRINT((ndo," situation="));
569 t = 0;
570 if (sit & 0x01) {
571 ND_PRINT((ndo,"identity"));
572 t++;
573 }
574 if (sit & 0x02) {
575 ND_PRINT((ndo,"%ssecrecy", t ? "+" : ""));
576 t++;
577 }
578 if (sit & 0x04)
579 ND_PRINT((ndo,"%sintegrity", t ? "+" : ""));
580
581 np = (u_char *)ext + sizeof(sa);
582 if (sit != 0x01) {
583 ND_TCHECK2(*(ext + 1), sizeof(ident));
584 safememcpy(&ident, ext + 1, sizeof(ident));
585 ND_PRINT((ndo," ident=%u", (u_int32_t)ntohl(ident)));
586 np += sizeof(ident);
587 }
588
589 ext = (struct isakmp_gen *)np;
590 ND_TCHECK(*ext);
591
592 cp = ikev1_sub_print(ndo, ISAKMP_NPTYPE_P, ext, ep, phase, doi, proto0,
593 depth);
594
595 return cp;
596 trunc:
597 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_SA)));
598 return NULL;
599 }
600
601 static const u_char *
602 ikev1_p_print(netdissect_options *ndo, u_char tpay _U_,
603 const struct isakmp_gen *ext, u_int item_len _U_,
604 const u_char *ep, u_int32_t phase, u_int32_t doi0,
605 u_int32_t proto0 _U_, int depth)
606 {
607 const struct ikev1_pl_p *p;
608 struct ikev1_pl_p prop;
609 const u_char *cp;
610
611 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_P)));
612
613 p = (struct ikev1_pl_p *)ext;
614 ND_TCHECK(*p);
615 safememcpy(&prop, ext, sizeof(prop));
616 ND_PRINT((ndo," #%d protoid=%s transform=%d",
617 prop.p_no, PROTOIDSTR(prop.prot_id), prop.num_t));
618 if (prop.spi_size) {
619 ND_PRINT((ndo," spi="));
620 if (!rawprint(ndo, (caddr_t)(p + 1), prop.spi_size))
621 goto trunc;
622 }
623
624 ext = (struct isakmp_gen *)((u_char *)(p + 1) + prop.spi_size);
625 ND_TCHECK(*ext);
626
627 cp = ikev1_sub_print(ndo, ISAKMP_NPTYPE_T, ext, ep, phase, doi0,
628 prop.prot_id, depth);
629
630 return cp;
631 trunc:
632 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_P)));
633 return NULL;
634 }
635
636 static const char *ikev1_p_map[] = {
637 NULL, "ike",
638 };
639
640 static const char *ikev2_t_type_map[]={
641 NULL, "encr", "prf", "integ", "dh", "esn"
642 };
643
644 static const char *ah_p_map[] = {
645 NULL, "(reserved)", "md5", "sha", "1des",
646 "sha2-256", "sha2-384", "sha2-512",
647 };
648
649 static const char *prf_p_map[] = {
650 NULL, "hmac-md5", "hmac-sha", "hmac-tiger",
651 "aes128_xcbc"
652 };
653
654 static const char *integ_p_map[] = {
655 NULL, "hmac-md5", "hmac-sha", "dec-mac",
656 "kpdk-md5", "aes-xcbc"
657 };
658
659 static const char *esn_p_map[] = {
660 "no-esn", "esn"
661 };
662
663 static const char *dh_p_map[] = {
664 NULL, "modp768",
665 "modp1024", /* group 2 */
666 "EC2N 2^155", /* group 3 */
667 "EC2N 2^185", /* group 4 */
668 "modp1536", /* group 5 */
669 "iana-grp06", "iana-grp07", /* reserved */
670 "iana-grp08", "iana-grp09",
671 "iana-grp10", "iana-grp11",
672 "iana-grp12", "iana-grp13",
673 "modp2048", /* group 14 */
674 "modp3072", /* group 15 */
675 "modp4096", /* group 16 */
676 "modp6144", /* group 17 */
677 "modp8192", /* group 18 */
678 };
679
680 static const char *esp_p_map[] = {
681 NULL, "1des-iv64", "1des", "3des", "rc5", "idea", "cast",
682 "blowfish", "3idea", "1des-iv32", "rc4", "null", "aes"
683 };
684
685 static const char *ipcomp_p_map[] = {
686 NULL, "oui", "deflate", "lzs",
687 };
688
689 const struct attrmap ipsec_t_map[] = {
690 { NULL, 0, { NULL } },
691 { "lifetype", 3, { NULL, "sec", "kb", }, },
692 { "life", 0, { NULL } },
693 { "group desc", 18, { NULL, "modp768",
694 "modp1024", /* group 2 */
695 "EC2N 2^155", /* group 3 */
696 "EC2N 2^185", /* group 4 */
697 "modp1536", /* group 5 */
698 "iana-grp06", "iana-grp07", /* reserved */
699 "iana-grp08", "iana-grp09",
700 "iana-grp10", "iana-grp11",
701 "iana-grp12", "iana-grp13",
702 "modp2048", /* group 14 */
703 "modp3072", /* group 15 */
704 "modp4096", /* group 16 */
705 "modp6144", /* group 17 */
706 "modp8192", /* group 18 */
707 }, },
708 { "enc mode", 3, { NULL, "tunnel", "transport", }, },
709 { "auth", 5, { NULL, "hmac-md5", "hmac-sha1", "1des-mac", "keyed", }, },
710 { "keylen", 0, { NULL } },
711 { "rounds", 0, { NULL } },
712 { "dictsize", 0, { NULL } },
713 { "privalg", 0, { NULL } },
714 };
715
716 const struct attrmap encr_t_map[] = {
717 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 0, 1 */
718 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 2, 3 */
719 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 4, 5 */
720 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 6, 7 */
721 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 8, 9 */
722 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 10,11*/
723 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 12,13*/
724 { "keylen", 14, { NULL }},
725 };
726
727 const struct attrmap oakley_t_map[] = {
728 { NULL, 0, { NULL } },
729 { "enc", 8, { NULL, "1des", "idea", "blowfish", "rc5",
730 "3des", "cast", "aes", }, },
731 { "hash", 7, { NULL, "md5", "sha1", "tiger",
732 "sha2-256", "sha2-384", "sha2-512", }, },
733 { "auth", 6, { NULL, "preshared", "dss", "rsa sig", "rsa enc",
734 "rsa enc revised", }, },
735 { "group desc", 18, { NULL, "modp768",
736 "modp1024", /* group 2 */
737 "EC2N 2^155", /* group 3 */
738 "EC2N 2^185", /* group 4 */
739 "modp1536", /* group 5 */
740 "iana-grp06", "iana-grp07", /* reserved */
741 "iana-grp08", "iana-grp09",
742 "iana-grp10", "iana-grp11",
743 "iana-grp12", "iana-grp13",
744 "modp2048", /* group 14 */
745 "modp3072", /* group 15 */
746 "modp4096", /* group 16 */
747 "modp6144", /* group 17 */
748 "modp8192", /* group 18 */
749 }, },
750 { "group type", 4, { NULL, "MODP", "ECP", "EC2N", }, },
751 { "group prime", 0, { NULL } },
752 { "group gen1", 0, { NULL } },
753 { "group gen2", 0, { NULL } },
754 { "group curve A", 0, { NULL } },
755 { "group curve B", 0, { NULL } },
756 { "lifetype", 3, { NULL, "sec", "kb", }, },
757 { "lifeduration", 0, { NULL } },
758 { "prf", 0, { NULL } },
759 { "keylen", 0, { NULL } },
760 { "field", 0, { NULL } },
761 { "order", 0, { NULL } },
762 };
763
764 static const u_char *
765 ikev1_t_print(netdissect_options *ndo, u_char tpay _U_,
766 const struct isakmp_gen *ext, u_int item_len,
767 const u_char *ep, u_int32_t phase _U_, u_int32_t doi _U_,
768 u_int32_t proto, int depth _U_)
769 {
770 const struct ikev1_pl_t *p;
771 struct ikev1_pl_t t;
772 const u_char *cp;
773 const char *idstr;
774 const struct attrmap *map;
775 size_t nmap;
776 const u_char *ep2;
777
778 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_T)));
779
780 p = (struct ikev1_pl_t *)ext;
781 ND_TCHECK(*p);
782 safememcpy(&t, ext, sizeof(t));
783
784 switch (proto) {
785 case 1:
786 idstr = STR_OR_ID(t.t_id, ikev1_p_map);
787 map = oakley_t_map;
788 nmap = sizeof(oakley_t_map)/sizeof(oakley_t_map[0]);
789 break;
790 case 2:
791 idstr = STR_OR_ID(t.t_id, ah_p_map);
792 map = ipsec_t_map;
793 nmap = sizeof(ipsec_t_map)/sizeof(ipsec_t_map[0]);
794 break;
795 case 3:
796 idstr = STR_OR_ID(t.t_id, esp_p_map);
797 map = ipsec_t_map;
798 nmap = sizeof(ipsec_t_map)/sizeof(ipsec_t_map[0]);
799 break;
800 case 4:
801 idstr = STR_OR_ID(t.t_id, ipcomp_p_map);
802 map = ipsec_t_map;
803 nmap = sizeof(ipsec_t_map)/sizeof(ipsec_t_map[0]);
804 break;
805 default:
806 idstr = NULL;
807 map = NULL;
808 nmap = 0;
809 break;
810 }
811
812 if (idstr)
813 ND_PRINT((ndo," #%d id=%s ", t.t_no, idstr));
814 else
815 ND_PRINT((ndo," #%d id=%d ", t.t_no, t.t_id));
816 cp = (u_char *)(p + 1);
817 ep2 = (u_char *)p + item_len;
818 while (cp < ep && cp < ep2) {
819 if (map && nmap) {
820 cp = ikev1_attrmap_print(ndo, cp, (ep < ep2) ? ep : ep2,
821 map, nmap);
822 } else
823 cp = ikev1_attr_print(ndo, cp, (ep < ep2) ? ep : ep2);
824 }
825 if (ep < ep2)
826 ND_PRINT((ndo,"..."));
827 return cp;
828 trunc:
829 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_T)));
830 return NULL;
831 }
832
833 static const u_char *
834 ikev1_ke_print(netdissect_options *ndo, u_char tpay _U_,
835 const struct isakmp_gen *ext, u_int item_len _U_,
836 const u_char *ep _U_, u_int32_t phase _U_, u_int32_t doi _U_,
837 u_int32_t proto _U_, int depth _U_)
838 {
839 struct isakmp_gen e;
840
841 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_KE)));
842
843 ND_TCHECK(*ext);
844 safememcpy(&e, ext, sizeof(e));
845 ND_PRINT((ndo," key len=%d", ntohs(e.len) - 4));
846 if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
847 ND_PRINT((ndo," "));
848 if (!rawprint(ndo, (caddr_t)(ext + 1), ntohs(e.len) - 4))
849 goto trunc;
850 }
851 return (u_char *)ext + ntohs(e.len);
852 trunc:
853 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_KE)));
854 return NULL;
855 }
856
857 static const u_char *
858 ikev1_id_print(netdissect_options *ndo, u_char tpay _U_,
859 const struct isakmp_gen *ext, u_int item_len _U_,
860 const u_char *ep _U_, u_int32_t phase, u_int32_t doi _U_,
861 u_int32_t proto _U_, int depth _U_)
862 {
863 #define USE_IPSECDOI_IN_PHASE1 1
864 const struct ikev1_pl_id *p;
865 struct ikev1_pl_id id;
866 static const char *idtypestr[] = {
867 "IPv4", "IPv4net", "IPv6", "IPv6net",
868 };
869 static const char *ipsecidtypestr[] = {
870 NULL, "IPv4", "FQDN", "user FQDN", "IPv4net", "IPv6",
871 "IPv6net", "IPv4range", "IPv6range", "ASN1 DN", "ASN1 GN",
872 "keyid",
873 };
874 int len;
875 const u_char *data;
876
877 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_ID)));
878
879 p = (struct ikev1_pl_id *)ext;
880 ND_TCHECK(*p);
881 safememcpy(&id, ext, sizeof(id));
882 if (sizeof(*p) < item_len) {
883 data = (u_char *)(p + 1);
884 len = item_len - sizeof(*p);
885 } else {
886 data = NULL;
887 len = 0;
888 }
889
890 #if 0 /*debug*/
891 ND_PRINT((ndo," [phase=%d doi=%d proto=%d]", phase, doi, proto));
892 #endif
893 switch (phase) {
894 #ifndef USE_IPSECDOI_IN_PHASE1
895 case 1:
896 #endif
897 default:
898 ND_PRINT((ndo," idtype=%s", STR_OR_ID(id.d.id_type, idtypestr)));
899 ND_PRINT((ndo," doi_data=%u",
900 (u_int32_t)(ntohl(id.d.doi_data) & 0xffffff)));
901 break;
902
903 #ifdef USE_IPSECDOI_IN_PHASE1
904 case 1:
905 #endif
906 case 2:
907 {
908 const struct ipsecdoi_id *p;
909 struct ipsecdoi_id id;
910 struct protoent *pe;
911
912 p = (struct ipsecdoi_id *)ext;
913 ND_TCHECK(*p);
914 safememcpy(&id, ext, sizeof(id));
915 ND_PRINT((ndo," idtype=%s", STR_OR_ID(id.type, ipsecidtypestr)));
916 if (id.proto_id) {
917 #ifndef WIN32
918 setprotoent(1);
919 #endif /* WIN32 */
920 pe = getprotobynumber(id.proto_id);
921 if (pe)
922 ND_PRINT((ndo," protoid=%s", pe->p_name));
923 #ifndef WIN32
924 endprotoent();
925 #endif /* WIN32 */
926 } else {
927 /* it DOES NOT mean IPPROTO_IP! */
928 ND_PRINT((ndo," protoid=%s", "0"));
929 }
930 ND_PRINT((ndo," port=%d", ntohs(id.port)));
931 if (!len)
932 break;
933 if (data == NULL)
934 goto trunc;
935 ND_TCHECK2(*data, len);
936 switch (id.type) {
937 case IPSECDOI_ID_IPV4_ADDR:
938 if (len < 4)
939 ND_PRINT((ndo," len=%d [bad: < 4]", len));
940 else
941 ND_PRINT((ndo," len=%d %s", len, ipaddr_string(data)));
942 len = 0;
943 break;
944 case IPSECDOI_ID_FQDN:
945 case IPSECDOI_ID_USER_FQDN:
946 {
947 int i;
948 ND_PRINT((ndo," len=%d ", len));
949 for (i = 0; i < len; i++)
950 safeputchar(data[i]);
951 len = 0;
952 break;
953 }
954 case IPSECDOI_ID_IPV4_ADDR_SUBNET:
955 {
956 const u_char *mask;
957 if (len < 8)
958 ND_PRINT((ndo," len=%d [bad: < 8]", len));
959 else {
960 mask = data + sizeof(struct in_addr);
961 ND_PRINT((ndo," len=%d %s/%u.%u.%u.%u", len,
962 ipaddr_string(data),
963 mask[0], mask[1], mask[2], mask[3]));
964 }
965 len = 0;
966 break;
967 }
968 #ifdef INET6
969 case IPSECDOI_ID_IPV6_ADDR:
970 if (len < 16)
971 ND_PRINT((ndo," len=%d [bad: < 16]", len));
972 else
973 ND_PRINT((ndo," len=%d %s", len, ip6addr_string(data)));
974 len = 0;
975 break;
976 case IPSECDOI_ID_IPV6_ADDR_SUBNET:
977 {
978 const u_int32_t *mask;
979 if (len < 20)
980 ND_PRINT((ndo," len=%d [bad: < 20]", len));
981 else {
982 mask = (u_int32_t *)(data + sizeof(struct in6_addr));
983 /*XXX*/
984 ND_PRINT((ndo," len=%d %s/0x%08x%08x%08x%08x", len,
985 ip6addr_string(data),
986 mask[0], mask[1], mask[2], mask[3]));
987 }
988 len = 0;
989 break;
990 }
991 #endif /*INET6*/
992 case IPSECDOI_ID_IPV4_ADDR_RANGE:
993 if (len < 8)
994 ND_PRINT((ndo," len=%d [bad: < 8]", len));
995 else {
996 ND_PRINT((ndo," len=%d %s-%s", len,
997 ipaddr_string(data),
998 ipaddr_string(data + sizeof(struct in_addr))));
999 }
1000 len = 0;
1001 break;
1002 #ifdef INET6
1003 case IPSECDOI_ID_IPV6_ADDR_RANGE:
1004 if (len < 32)
1005 ND_PRINT((ndo," len=%d [bad: < 32]", len));
1006 else {
1007 ND_PRINT((ndo," len=%d %s-%s", len,
1008 ip6addr_string(data),
1009 ip6addr_string(data + sizeof(struct in6_addr))));
1010 }
1011 len = 0;
1012 break;
1013 #endif /*INET6*/
1014 case IPSECDOI_ID_DER_ASN1_DN:
1015 case IPSECDOI_ID_DER_ASN1_GN:
1016 case IPSECDOI_ID_KEY_ID:
1017 break;
1018 }
1019 break;
1020 }
1021 }
1022 if (data && len) {
1023 ND_PRINT((ndo," len=%d", len));
1024 if (2 < ndo->ndo_vflag) {
1025 ND_PRINT((ndo," "));
1026 if (!rawprint(ndo, (caddr_t)data, len))
1027 goto trunc;
1028 }
1029 }
1030 return (u_char *)ext + item_len;
1031 trunc:
1032 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_ID)));
1033 return NULL;
1034 }
1035
1036 static const u_char *
1037 ikev1_cert_print(netdissect_options *ndo, u_char tpay _U_,
1038 const struct isakmp_gen *ext, u_int item_len _U_,
1039 const u_char *ep _U_, u_int32_t phase _U_,
1040 u_int32_t doi0 _U_,
1041 u_int32_t proto0 _U_, int depth _U_)
1042 {
1043 const struct ikev1_pl_cert *p;
1044 struct ikev1_pl_cert cert;
1045 static const char *certstr[] = {
1046 "none", "pkcs7", "pgp", "dns",
1047 "x509sign", "x509ke", "kerberos", "crl",
1048 "arl", "spki", "x509attr",
1049 };
1050
1051 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_CERT)));
1052
1053 p = (struct ikev1_pl_cert *)ext;
1054 ND_TCHECK(*p);
1055 safememcpy(&cert, ext, sizeof(cert));
1056 ND_PRINT((ndo," len=%d", item_len - 4));
1057 ND_PRINT((ndo," type=%s", STR_OR_ID((cert.encode), certstr)));
1058 if (2 < ndo->ndo_vflag && 4 < item_len) {
1059 ND_PRINT((ndo," "));
1060 if (!rawprint(ndo, (caddr_t)(ext + 1), item_len - 4))
1061 goto trunc;
1062 }
1063 return (u_char *)ext + item_len;
1064 trunc:
1065 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_CERT)));
1066 return NULL;
1067 }
1068
1069 static const u_char *
1070 ikev1_cr_print(netdissect_options *ndo, u_char tpay _U_,
1071 const struct isakmp_gen *ext, u_int item_len _U_,
1072 const u_char *ep _U_, u_int32_t phase _U_, u_int32_t doi0 _U_,
1073 u_int32_t proto0 _U_, int depth _U_)
1074 {
1075 const struct ikev1_pl_cert *p;
1076 struct ikev1_pl_cert cert;
1077 static const char *certstr[] = {
1078 "none", "pkcs7", "pgp", "dns",
1079 "x509sign", "x509ke", "kerberos", "crl",
1080 "arl", "spki", "x509attr",
1081 };
1082
1083 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_CR)));
1084
1085 p = (struct ikev1_pl_cert *)ext;
1086 ND_TCHECK(*p);
1087 safememcpy(&cert, ext, sizeof(cert));
1088 ND_PRINT((ndo," len=%d", item_len - 4));
1089 ND_PRINT((ndo," type=%s", STR_OR_ID((cert.encode), certstr)));
1090 if (2 < ndo->ndo_vflag && 4 < item_len) {
1091 ND_PRINT((ndo," "));
1092 if (!rawprint(ndo, (caddr_t)(ext + 1), item_len - 4))
1093 goto trunc;
1094 }
1095 return (u_char *)ext + item_len;
1096 trunc:
1097 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_CR)));
1098 return NULL;
1099 }
1100
1101 static const u_char *
1102 ikev1_hash_print(netdissect_options *ndo, u_char tpay _U_,
1103 const struct isakmp_gen *ext, u_int item_len _U_,
1104 const u_char *ep _U_, u_int32_t phase _U_, u_int32_t doi _U_,
1105 u_int32_t proto _U_, int depth _U_)
1106 {
1107 struct isakmp_gen e;
1108
1109 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_HASH)));
1110
1111 ND_TCHECK(*ext);
1112 safememcpy(&e, ext, sizeof(e));
1113 ND_PRINT((ndo," len=%d", ntohs(e.len) - 4));
1114 if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1115 ND_PRINT((ndo," "));
1116 if (!rawprint(ndo, (caddr_t)(ext + 1), ntohs(e.len) - 4))
1117 goto trunc;
1118 }
1119 return (u_char *)ext + ntohs(e.len);
1120 trunc:
1121 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_HASH)));
1122 return NULL;
1123 }
1124
1125 static const u_char *
1126 ikev1_sig_print(netdissect_options *ndo, u_char tpay _U_,
1127 const struct isakmp_gen *ext, u_int item_len _U_,
1128 const u_char *ep _U_, u_int32_t phase _U_, u_int32_t doi _U_,
1129 u_int32_t proto _U_, int depth _U_)
1130 {
1131 struct isakmp_gen e;
1132
1133 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_SIG)));
1134
1135 ND_TCHECK(*ext);
1136 safememcpy(&e, ext, sizeof(e));
1137 ND_PRINT((ndo," len=%d", ntohs(e.len) - 4));
1138 if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1139 ND_PRINT((ndo," "));
1140 if (!rawprint(ndo, (caddr_t)(ext + 1), ntohs(e.len) - 4))
1141 goto trunc;
1142 }
1143 return (u_char *)ext + ntohs(e.len);
1144 trunc:
1145 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_SIG)));
1146 return NULL;
1147 }
1148
1149 static const u_char *
1150 ikev1_nonce_print(netdissect_options *ndo, u_char tpay _U_,
1151 const struct isakmp_gen *ext,
1152 u_int item_len _U_,
1153 const u_char *ep _U_,
1154 u_int32_t phase _U_, u_int32_t doi _U_,
1155 u_int32_t proto _U_, int depth _U_)
1156 {
1157 struct isakmp_gen e;
1158
1159 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_NONCE)));
1160
1161 ND_TCHECK(*ext);
1162 safememcpy(&e, ext, sizeof(e));
1163 ND_PRINT((ndo," n len=%d", ntohs(e.len) - 4));
1164 if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1165 ND_PRINT((ndo," "));
1166 if (!rawprint(ndo, (caddr_t)(ext + 1), ntohs(e.len) - 4))
1167 goto trunc;
1168 } else if (1 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1169 ND_PRINT((ndo," "));
1170 if (!ike_show_somedata(ndo, (u_char *)(caddr_t)(ext + 1), ep))
1171 goto trunc;
1172 }
1173 return (u_char *)ext + ntohs(e.len);
1174 trunc:
1175 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_NONCE)));
1176 return NULL;
1177 }
1178
1179 static const u_char *
1180 ikev1_n_print(netdissect_options *ndo, u_char tpay _U_,
1181 const struct isakmp_gen *ext, u_int item_len,
1182 const u_char *ep, u_int32_t phase, u_int32_t doi0 _U_,
1183 u_int32_t proto0 _U_, int depth)
1184 {
1185 struct ikev1_pl_n *p, n;
1186 const u_char *cp;
1187 u_char *ep2;
1188 u_int32_t doi;
1189 u_int32_t proto;
1190 static const char *notify_error_str[] = {
1191 NULL, "INVALID-PAYLOAD-TYPE",
1192 "DOI-NOT-SUPPORTED", "SITUATION-NOT-SUPPORTED",
1193 "INVALID-COOKIE", "INVALID-MAJOR-VERSION",
1194 "INVALID-MINOR-VERSION", "INVALID-EXCHANGE-TYPE",
1195 "INVALID-FLAGS", "INVALID-MESSAGE-ID",
1196 "INVALID-PROTOCOL-ID", "INVALID-SPI",
1197 "INVALID-TRANSFORM-ID", "ATTRIBUTES-NOT-SUPPORTED",
1198 "NO-PROPOSAL-CHOSEN", "BAD-PROPOSAL-SYNTAX",
1199 "PAYLOAD-MALFORMED", "INVALID-KEY-INFORMATION",
1200 "INVALID-ID-INFORMATION", "INVALID-CERT-ENCODING",
1201 "INVALID-CERTIFICATE", "CERT-TYPE-UNSUPPORTED",
1202 "INVALID-CERT-AUTHORITY", "INVALID-HASH-INFORMATION",
1203 "AUTHENTICATION-FAILED", "INVALID-SIGNATURE",
1204 "ADDRESS-NOTIFICATION", "NOTIFY-SA-LIFETIME",
1205 "CERTIFICATE-UNAVAILABLE", "UNSUPPORTED-EXCHANGE-TYPE",
1206 "UNEQUAL-PAYLOAD-LENGTHS",
1207 };
1208 static const char *ipsec_notify_error_str[] = {
1209 "RESERVED",
1210 };
1211 static const char *notify_status_str[] = {
1212 "CONNECTED",
1213 };
1214 static const char *ipsec_notify_status_str[] = {
1215 "RESPONDER-LIFETIME", "REPLAY-STATUS",
1216 "INITIAL-CONTACT",
1217 };
1218 /* NOTE: these macro must be called with x in proper range */
1219
1220 /* 0 - 8191 */
1221 #define NOTIFY_ERROR_STR(x) \
1222 STR_OR_ID((x), notify_error_str)
1223
1224 /* 8192 - 16383 */
1225 #define IPSEC_NOTIFY_ERROR_STR(x) \
1226 STR_OR_ID((u_int)((x) - 8192), ipsec_notify_error_str)
1227
1228 /* 16384 - 24575 */
1229 #define NOTIFY_STATUS_STR(x) \
1230 STR_OR_ID((u_int)((x) - 16384), notify_status_str)
1231
1232 /* 24576 - 32767 */
1233 #define IPSEC_NOTIFY_STATUS_STR(x) \
1234 STR_OR_ID((u_int)((x) - 24576), ipsec_notify_status_str)
1235
1236 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_N)));
1237
1238 p = (struct ikev1_pl_n *)ext;
1239 ND_TCHECK(*p);
1240 safememcpy(&n, ext, sizeof(n));
1241 doi = ntohl(n.doi);
1242 proto = n.prot_id;
1243 if (doi != 1) {
1244 ND_PRINT((ndo," doi=%d", doi));
1245 ND_PRINT((ndo," proto=%d", proto));
1246 if (ntohs(n.type) < 8192)
1247 ND_PRINT((ndo," type=%s", NOTIFY_ERROR_STR(ntohs(n.type))));
1248 else if (ntohs(n.type) < 16384)
1249 ND_PRINT((ndo," type=%s", numstr(ntohs(n.type))));
1250 else if (ntohs(n.type) < 24576)
1251 ND_PRINT((ndo," type=%s", NOTIFY_STATUS_STR(ntohs(n.type))));
1252 else
1253 ND_PRINT((ndo," type=%s", numstr(ntohs(n.type))));
1254 if (n.spi_size) {
1255 ND_PRINT((ndo," spi="));
1256 if (!rawprint(ndo, (caddr_t)(p + 1), n.spi_size))
1257 goto trunc;
1258 }
1259 return (u_char *)(p + 1) + n.spi_size;
1260 }
1261
1262 ND_PRINT((ndo," doi=ipsec"));
1263 ND_PRINT((ndo," proto=%s", PROTOIDSTR(proto)));
1264 if (ntohs(n.type) < 8192)
1265 ND_PRINT((ndo," type=%s", NOTIFY_ERROR_STR(ntohs(n.type))));
1266 else if (ntohs(n.type) < 16384)
1267 ND_PRINT((ndo," type=%s", IPSEC_NOTIFY_ERROR_STR(ntohs(n.type))));
1268 else if (ntohs(n.type) < 24576)
1269 ND_PRINT((ndo," type=%s", NOTIFY_STATUS_STR(ntohs(n.type))));
1270 else if (ntohs(n.type) < 32768)
1271 ND_PRINT((ndo," type=%s", IPSEC_NOTIFY_STATUS_STR(ntohs(n.type))));
1272 else
1273 ND_PRINT((ndo," type=%s", numstr(ntohs(n.type))));
1274 if (n.spi_size) {
1275 ND_PRINT((ndo," spi="));
1276 if (!rawprint(ndo, (caddr_t)(p + 1), n.spi_size))
1277 goto trunc;
1278 }
1279
1280 cp = (u_char *)(p + 1) + n.spi_size;
1281 ep2 = (u_char *)p + item_len;
1282
1283 if (cp < ep) {
1284 ND_PRINT((ndo," orig=("));
1285 switch (ntohs(n.type)) {
1286 case IPSECDOI_NTYPE_RESPONDER_LIFETIME:
1287 {
1288 const struct attrmap *map = oakley_t_map;
1289 size_t nmap = sizeof(oakley_t_map)/sizeof(oakley_t_map[0]);
1290 while (cp < ep && cp < ep2) {
1291 cp = ikev1_attrmap_print(ndo, cp,
1292 (ep < ep2) ? ep : ep2, map, nmap);
1293 }
1294 break;
1295 }
1296 case IPSECDOI_NTYPE_REPLAY_STATUS:
1297 ND_PRINT((ndo,"replay detection %sabled",
1298 (*(u_int32_t *)cp) ? "en" : "dis"));
1299 break;
1300 case ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN:
1301 if (ikev1_sub_print(ndo, ISAKMP_NPTYPE_SA,
1302 (struct isakmp_gen *)cp, ep, phase, doi, proto,
1303 depth) == NULL)
1304 return NULL;
1305 break;
1306 default:
1307 /* NULL is dummy */
1308 isakmp_print(ndo, cp,
1309 item_len - sizeof(*p) - n.spi_size,
1310 NULL);
1311 }
1312 ND_PRINT((ndo,")"));
1313 }
1314 return (u_char *)ext + item_len;
1315 trunc:
1316 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_N)));
1317 return NULL;
1318 }
1319
1320 static const u_char *
1321 ikev1_d_print(netdissect_options *ndo, u_char tpay _U_,
1322 const struct isakmp_gen *ext, u_int item_len _U_,
1323 const u_char *ep _U_, u_int32_t phase _U_, u_int32_t doi0 _U_,
1324 u_int32_t proto0 _U_, int depth _U_)
1325 {
1326 const struct ikev1_pl_d *p;
1327 struct ikev1_pl_d d;
1328 const u_int8_t *q;
1329 u_int32_t doi;
1330 u_int32_t proto;
1331 int i;
1332
1333 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_D)));
1334
1335 p = (struct ikev1_pl_d *)ext;
1336 ND_TCHECK(*p);
1337 safememcpy(&d, ext, sizeof(d));
1338 doi = ntohl(d.doi);
1339 proto = d.prot_id;
1340 if (doi != 1) {
1341 ND_PRINT((ndo," doi=%u", doi));
1342 ND_PRINT((ndo," proto=%u", proto));
1343 } else {
1344 ND_PRINT((ndo," doi=ipsec"));
1345 ND_PRINT((ndo," proto=%s", PROTOIDSTR(proto)));
1346 }
1347 ND_PRINT((ndo," spilen=%u", d.spi_size));
1348 ND_PRINT((ndo," nspi=%u", ntohs(d.num_spi)));
1349 ND_PRINT((ndo," spi="));
1350 q = (u_int8_t *)(p + 1);
1351 for (i = 0; i < ntohs(d.num_spi); i++) {
1352 if (i != 0)
1353 ND_PRINT((ndo,","));
1354 if (!rawprint(ndo, (caddr_t)q, d.spi_size))
1355 goto trunc;
1356 q += d.spi_size;
1357 }
1358 return q;
1359 trunc:
1360 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_D)));
1361 return NULL;
1362 }
1363
1364 static const u_char *
1365 ikev1_vid_print(netdissect_options *ndo, u_char tpay _U_,
1366 const struct isakmp_gen *ext,
1367 u_int item_len _U_, const u_char *ep _U_,
1368 u_int32_t phase _U_, u_int32_t doi _U_,
1369 u_int32_t proto _U_, int depth _U_)
1370 {
1371 struct isakmp_gen e;
1372
1373 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_VID)));
1374
1375 ND_TCHECK(*ext);
1376 safememcpy(&e, ext, sizeof(e));
1377 ND_PRINT((ndo," len=%d", ntohs(e.len) - 4));
1378 if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1379 ND_PRINT((ndo," "));
1380 if (!rawprint(ndo, (caddr_t)(ext + 1), ntohs(e.len) - 4))
1381 goto trunc;
1382 }
1383 return (u_char *)ext + ntohs(e.len);
1384 trunc:
1385 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_VID)));
1386 return NULL;
1387 }
1388
1389 /************************************************************/
1390 /* */
1391 /* IKE v2 - rfc4306 - dissector */
1392 /* */
1393 /************************************************************/
1394
1395 static void
1396 ikev2_pay_print(netdissect_options *ndo, const char *payname, int critical)
1397 {
1398 ND_PRINT((ndo,"%s%s:", payname, critical&0x80 ? "[C]" : ""));
1399 }
1400
1401 static const u_char *
1402 ikev2_gen_print(netdissect_options *ndo, u_char tpay,
1403 const struct isakmp_gen *ext)
1404 {
1405 struct isakmp_gen e;
1406
1407 ND_TCHECK(*ext);
1408 safememcpy(&e, ext, sizeof(e));
1409 ikev2_pay_print(ndo, NPSTR(tpay), e.critical);
1410
1411 ND_PRINT((ndo," len=%d", ntohs(e.len) - 4));
1412 if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1413 ND_PRINT((ndo," "));
1414 if (!rawprint(ndo, (caddr_t)(ext + 1), ntohs(e.len) - 4))
1415 goto trunc;
1416 }
1417 return (u_char *)ext + ntohs(e.len);
1418 trunc:
1419 ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
1420 return NULL;
1421 }
1422
1423 static const u_char *
1424 ikev2_t_print(netdissect_options *ndo, u_char tpay _U_, int pcount,
1425 const struct isakmp_gen *ext, u_int item_len,
1426 const u_char *ep, u_int32_t phase _U_, u_int32_t doi _U_,
1427 u_int32_t proto _U_, int depth _U_)
1428 {
1429 const struct ikev2_t *p;
1430 struct ikev2_t t;
1431 u_int16_t t_id;
1432 const u_char *cp;
1433 const char *idstr;
1434 const struct attrmap *map;
1435 size_t nmap;
1436 const u_char *ep2;
1437
1438 p = (struct ikev2_t *)ext;
1439 ND_TCHECK(*p);
1440 safememcpy(&t, ext, sizeof(t));
1441 ikev2_pay_print(ndo, NPSTR(ISAKMP_NPTYPE_T), t.h.critical);
1442
1443 t_id = ntohs(t.t_id);
1444
1445 map = NULL;
1446 nmap = 0;
1447
1448 switch (t.t_type) {
1449 case IV2_T_ENCR:
1450 idstr = STR_OR_ID(t_id, esp_p_map);
1451 map = encr_t_map;
1452 nmap = sizeof(encr_t_map)/sizeof(encr_t_map[0]);
1453 break;
1454
1455 case IV2_T_PRF:
1456 idstr = STR_OR_ID(t_id, prf_p_map);
1457 break;
1458
1459 case IV2_T_INTEG:
1460 idstr = STR_OR_ID(t_id, integ_p_map);
1461 break;
1462
1463 case IV2_T_DH:
1464 idstr = STR_OR_ID(t_id, dh_p_map);
1465 break;
1466
1467 case IV2_T_ESN:
1468 idstr = STR_OR_ID(t_id, esn_p_map);
1469 break;
1470
1471 default:
1472 idstr = NULL;
1473 break;
1474 }
1475
1476 if (idstr)
1477 ND_PRINT((ndo," #%u type=%s id=%s ", pcount,
1478 STR_OR_ID(t.t_type, ikev2_t_type_map),
1479 idstr));
1480 else
1481 ND_PRINT((ndo," #%u type=%s id=%u ", pcount,
1482 STR_OR_ID(t.t_type, ikev2_t_type_map),
1483 t.t_id));
1484 cp = (u_char *)(p + 1);
1485 ep2 = (u_char *)p + item_len;
1486 while (cp < ep && cp < ep2) {
1487 if (map && nmap) {
1488 cp = ikev1_attrmap_print(ndo, cp, (ep < ep2) ? ep : ep2,
1489 map, nmap);
1490 } else
1491 cp = ikev1_attr_print(ndo, cp, (ep < ep2) ? ep : ep2);
1492 }
1493 if (ep < ep2)
1494 ND_PRINT((ndo,"..."));
1495 return cp;
1496 trunc:
1497 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_T)));
1498 return NULL;
1499 }
1500
1501 static const u_char *
1502 ikev2_p_print(netdissect_options *ndo, u_char tpay _U_, int pcount _U_,
1503 const struct isakmp_gen *ext, u_int item_len _U_,
1504 const u_char *ep, u_int32_t phase, u_int32_t doi0,
1505 u_int32_t proto0 _U_, int depth)
1506 {
1507 const struct ikev2_p *p;
1508 struct ikev2_p prop;
1509 const u_char *cp;
1510
1511 p = (struct ikev2_p *)ext;
1512 ND_TCHECK(*p);
1513 safememcpy(&prop, ext, sizeof(prop));
1514 ikev2_pay_print(ndo, NPSTR(ISAKMP_NPTYPE_P), prop.h.critical);
1515
1516 ND_PRINT((ndo," #%u protoid=%s transform=%d len=%u",
1517 prop.p_no, PROTOIDSTR(prop.prot_id),
1518 prop.num_t, ntohs(prop.h.len)));
1519 if (prop.spi_size) {
1520 ND_PRINT((ndo," spi="));
1521 if (!rawprint(ndo, (caddr_t)(p + 1), prop.spi_size))
1522 goto trunc;
1523 }
1524
1525 ext = (struct isakmp_gen *)((u_char *)(p + 1) + prop.spi_size);
1526 ND_TCHECK(*ext);
1527
1528 cp = ikev2_sub_print(ndo, NULL, ISAKMP_NPTYPE_T, ext, ep, phase, doi0,
1529 prop.prot_id, depth);
1530
1531 return cp;
1532 trunc:
1533 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_P)));
1534 return NULL;
1535 }
1536
1537 static const u_char *
1538 ikev2_sa_print(netdissect_options *ndo, u_char tpay,
1539 const struct isakmp_gen *ext1,
1540 u_int item_len _U_, const u_char *ep _U_,
1541 u_int32_t phase _U_, u_int32_t doi _U_,
1542 u_int32_t proto _U_, int depth _U_)
1543 {
1544 struct isakmp_gen e;
1545 int osa_length, sa_length;
1546
1547 ND_TCHECK(*ext1);
1548 safememcpy(&e, ext1, sizeof(e));
1549 ikev2_pay_print(ndo, "sa", e.critical);
1550
1551 osa_length= ntohs(e.len);
1552 sa_length = osa_length - 4;
1553 ND_PRINT((ndo," len=%d", sa_length));
1554
1555 ikev2_sub_print(ndo, NULL, ISAKMP_NPTYPE_P,
1556 ext1+1, ep,
1557 0, 0, 0, depth);
1558
1559 return (u_char *)ext1 + osa_length;
1560 trunc:
1561 ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
1562 return NULL;
1563 }
1564
1565 static const u_char *
1566 ikev2_ke_print(netdissect_options *ndo, u_char tpay,
1567 const struct isakmp_gen *ext,
1568 u_int item_len _U_, const u_char *ep _U_,
1569 u_int32_t phase _U_, u_int32_t doi _U_,
1570 u_int32_t proto _U_, int depth _U_)
1571 {
1572 struct ikev2_ke ke;
1573 struct ikev2_ke *k;
1574
1575 k = (struct ikev2_ke *)ext;
1576 ND_TCHECK(*ext);
1577 safememcpy(&ke, ext, sizeof(ke));
1578 ikev2_pay_print(ndo, NPSTR(tpay), ke.h.critical);
1579
1580 ND_PRINT((ndo," len=%u group=%s", ntohs(ke.h.len) - 8,
1581 STR_OR_ID(ntohs(ke.ke_group), dh_p_map)));
1582
1583 if (2 < ndo->ndo_vflag && 8 < ntohs(ke.h.len)) {
1584 ND_PRINT((ndo," "));
1585 if (!rawprint(ndo, (caddr_t)(k + 1), ntohs(ke.h.len) - 8))
1586 goto trunc;
1587 }
1588 return (u_char *)ext + ntohs(ke.h.len);
1589 trunc:
1590 ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
1591 return NULL;
1592 }
1593
1594 static const u_char *
1595 ikev2_ID_print(netdissect_options *ndo, u_char tpay,
1596 const struct isakmp_gen *ext,
1597 u_int item_len _U_, const u_char *ep _U_,
1598 u_int32_t phase _U_, u_int32_t doi _U_,
1599 u_int32_t proto _U_, int depth _U_)
1600 {
1601 struct ikev2_id id;
1602 int id_len, idtype_len, i;
1603 unsigned int dumpascii, dumphex;
1604 unsigned char *typedata;
1605
1606 ND_TCHECK(*ext);
1607 safememcpy(&id, ext, sizeof(id));
1608 ikev2_pay_print(ndo, NPSTR(tpay), id.h.critical);
1609
1610 id_len = ntohs(id.h.len);
1611
1612 ND_PRINT((ndo," len=%d", id_len - 4));
1613 if (2 < ndo->ndo_vflag && 4 < id_len) {
1614 ND_PRINT((ndo," "));
1615 if (!rawprint(ndo, (caddr_t)(ext + 1), id_len - 4))
1616 goto trunc;
1617 }
1618
1619 idtype_len =id_len - sizeof(struct ikev2_id);
1620 dumpascii = 0;
1621 dumphex = 0;
1622 typedata = (unsigned char *)(ext)+sizeof(struct ikev2_id);
1623
1624 switch(id.type) {
1625 case ID_IPV4_ADDR:
1626 ND_PRINT((ndo, " ipv4:"));
1627 dumphex=1;
1628 break;
1629 case ID_FQDN:
1630 ND_PRINT((ndo, " fqdn:"));
1631 dumpascii=1;
1632 break;
1633 case ID_RFC822_ADDR:
1634 ND_PRINT((ndo, " rfc822:"));
1635 dumpascii=1;
1636 break;
1637 case ID_IPV6_ADDR:
1638 ND_PRINT((ndo, " ipv6:"));
1639 dumphex=1;
1640 break;
1641 case ID_DER_ASN1_DN:
1642 ND_PRINT((ndo, " dn:"));
1643 dumphex=1;
1644 break;
1645 case ID_DER_ASN1_GN:
1646 ND_PRINT((ndo, " gn:"));
1647 dumphex=1;
1648 break;
1649 case ID_KEY_ID:
1650 ND_PRINT((ndo, " keyid:"));
1651 dumphex=1;
1652 break;
1653 }
1654
1655 if(dumpascii) {
1656 ND_TCHECK2(*typedata, idtype_len);
1657 for(i=0; i<idtype_len; i++) {
1658 if(isprint(typedata[i])) {
1659 ND_PRINT((ndo, "%c", typedata[i]));
1660 } else {
1661 ND_PRINT((ndo, "."));
1662 }
1663 }
1664 }
1665 if(dumphex) {
1666 if (!rawprint(ndo, (caddr_t)typedata, idtype_len))
1667 goto trunc;
1668 }
1669
1670 return (u_char *)ext + id_len;
1671 trunc:
1672 ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
1673 return NULL;
1674 }
1675
1676 static const u_char *
1677 ikev2_cert_print(netdissect_options *ndo, u_char tpay,
1678 const struct isakmp_gen *ext,
1679 u_int item_len _U_, const u_char *ep _U_,
1680 u_int32_t phase _U_, u_int32_t doi _U_,
1681 u_int32_t proto _U_, int depth _U_)
1682 {
1683 return ikev2_gen_print(ndo, tpay, ext);
1684 }
1685
1686 static const u_char *
1687 ikev2_cr_print(netdissect_options *ndo, u_char tpay,
1688 const struct isakmp_gen *ext,
1689 u_int item_len _U_, const u_char *ep _U_,
1690 u_int32_t phase _U_, u_int32_t doi _U_,
1691 u_int32_t proto _U_, int depth _U_)
1692 {
1693 return ikev2_gen_print(ndo, tpay, ext);
1694 }
1695
1696 static const u_char *
1697 ikev2_auth_print(netdissect_options *ndo, u_char tpay,
1698 const struct isakmp_gen *ext,
1699 u_int item_len _U_, const u_char *ep _U_,
1700 u_int32_t phase _U_, u_int32_t doi _U_,
1701 u_int32_t proto _U_, int depth _U_)
1702 {
1703 struct ikev2_auth a;
1704 const char *v2_auth[]={ "invalid", "rsasig",
1705 "shared-secret", "dsssig" };
1706 u_char *authdata = (u_char*)ext + sizeof(a);
1707 unsigned int len;
1708
1709 ND_TCHECK(*ext);
1710 safememcpy(&a, ext, sizeof(a));
1711 ikev2_pay_print(ndo, NPSTR(tpay), a.h.critical);
1712 len = ntohs(a.h.len);
1713
1714 ND_PRINT((ndo," len=%d method=%s", len-4,
1715 STR_OR_ID(a.auth_method, v2_auth)));
1716
1717 if (1 < ndo->ndo_vflag && 4 < len) {
1718 ND_PRINT((ndo," authdata=("));
1719 if (!rawprint(ndo, (caddr_t)authdata, len - sizeof(a)))
1720 goto trunc;
1721 ND_PRINT((ndo,") "));
1722 } else if(ndo->ndo_vflag && 4 < len) {
1723 if(!ike_show_somedata(ndo, authdata, ep)) goto trunc;
1724 }
1725
1726 return (u_char *)ext + len;
1727 trunc:
1728 ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
1729 return NULL;
1730 }
1731
1732 static const u_char *
1733 ikev2_nonce_print(netdissect_options *ndo, u_char tpay,
1734 const struct isakmp_gen *ext,
1735 u_int item_len _U_, const u_char *ep _U_,
1736 u_int32_t phase _U_, u_int32_t doi _U_,
1737 u_int32_t proto _U_, int depth _U_)
1738 {
1739 struct isakmp_gen e;
1740
1741 ND_TCHECK(*ext);
1742 safememcpy(&e, ext, sizeof(e));
1743 ikev2_pay_print(ndo, "nonce", e.critical);
1744
1745 ND_PRINT((ndo," len=%d", ntohs(e.len) - 4));
1746 if (1 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1747 ND_PRINT((ndo," nonce=("));
1748 if (!rawprint(ndo, (caddr_t)(ext + 1), ntohs(e.len) - 4))
1749 goto trunc;
1750 ND_PRINT((ndo,") "));
1751 } else if(ndo->ndo_vflag && 4 < ntohs(e.len)) {
1752 if(!ike_show_somedata(ndo, (const u_char *)(ext+1), ep)) goto trunc;
1753 }
1754
1755 return (u_char *)ext + ntohs(e.len);
1756 trunc:
1757 ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
1758 return NULL;
1759 }
1760
1761 /* notify payloads */
1762 static const u_char *
1763 ikev2_n_print(netdissect_options *ndo, u_char tpay _U_,
1764 const struct isakmp_gen *ext,
1765 u_int item_len _U_, const u_char *ep _U_,
1766 u_int32_t phase _U_, u_int32_t doi _U_,
1767 u_int32_t proto _U_, int depth _U_)
1768 {
1769 struct ikev2_n *p, n;
1770 const u_char *cp;
1771 u_char *ep2;
1772 u_char showspi, showdata, showsomedata;
1773 const char *notify_name;
1774 u_int32_t type;
1775
1776 p = (struct ikev2_n *)ext;
1777 ND_TCHECK(*p);
1778 safememcpy(&n, ext, sizeof(n));
1779 ikev2_pay_print(ndo, NPSTR(ISAKMP_NPTYPE_N), n.h.critical);
1780
1781 showspi = 1;
1782 showdata = 0;
1783 showsomedata=0;
1784 notify_name=NULL;
1785
1786 ND_PRINT((ndo," prot_id=%s", PROTOIDSTR(n.prot_id)));
1787
1788 type = ntohs(n.type);
1789
1790 /* notify space is annoying sparse */
1791 switch(type) {
1792 case IV2_NOTIFY_UNSUPPORTED_CRITICAL_PAYLOAD:
1793 notify_name = "unsupported_critical_payload";
1794 showspi = 0;
1795 break;
1796
1797 case IV2_NOTIFY_INVALID_IKE_SPI:
1798 notify_name = "invalid_ike_spi";
1799 showspi = 1;
1800 break;
1801
1802 case IV2_NOTIFY_INVALID_MAJOR_VERSION:
1803 notify_name = "invalid_major_version";
1804 showspi = 0;
1805 break;
1806
1807 case IV2_NOTIFY_INVALID_SYNTAX:
1808 notify_name = "invalid_syntax";
1809 showspi = 1;
1810 break;
1811
1812 case IV2_NOTIFY_INVALID_MESSAGE_ID:
1813 notify_name = "invalid_message_id";
1814 showspi = 1;
1815 break;
1816
1817 case IV2_NOTIFY_INVALID_SPI:
1818 notify_name = "invalid_spi";
1819 showspi = 1;
1820 break;
1821
1822 case IV2_NOTIFY_NO_PROPOSAL_CHOSEN:
1823 notify_name = "no_protocol_chosen";
1824 showspi = 1;
1825 break;
1826
1827 case IV2_NOTIFY_INVALID_KE_PAYLOAD:
1828 notify_name = "invalid_ke_payload";
1829 showspi = 1;
1830 break;
1831
1832 case IV2_NOTIFY_AUTHENTICATION_FAILED:
1833 notify_name = "authentication_failed";
1834 showspi = 1;
1835 break;
1836
1837 case IV2_NOTIFY_SINGLE_PAIR_REQUIRED:
1838 notify_name = "single_pair_required";
1839 showspi = 1;
1840 break;
1841
1842 case IV2_NOTIFY_NO_ADDITIONAL_SAS:
1843 notify_name = "no_additional_sas";
1844 showspi = 0;
1845 break;
1846
1847 case IV2_NOTIFY_INTERNAL_ADDRESS_FAILURE:
1848 notify_name = "internal_address_failure";
1849 showspi = 0;
1850 break;
1851
1852 case IV2_NOTIFY_FAILED_CP_REQUIRED:
1853 notify_name = "failed:cp_required";
1854 showspi = 0;
1855 break;
1856
1857 case IV2_NOTIFY_INVALID_SELECTORS:
1858 notify_name = "invalid_selectors";
1859 showspi = 0;
1860 break;
1861
1862 case IV2_NOTIFY_INITIAL_CONTACT:
1863 notify_name = "initial_contact";
1864 showspi = 0;
1865 break;
1866
1867 case IV2_NOTIFY_SET_WINDOW_SIZE:
1868 notify_name = "set_window_size";
1869 showspi = 0;
1870 break;
1871
1872 case IV2_NOTIFY_ADDITIONAL_TS_POSSIBLE:
1873 notify_name = "additional_ts_possible";
1874 showspi = 0;
1875 break;
1876
1877 case IV2_NOTIFY_IPCOMP_SUPPORTED:
1878 notify_name = "ipcomp_supported";
1879 showspi = 0;
1880 break;
1881
1882 case IV2_NOTIFY_NAT_DETECTION_SOURCE_IP:
1883 notify_name = "nat_detection_source_ip";
1884 showspi = 1;
1885 break;
1886
1887 case IV2_NOTIFY_NAT_DETECTION_DESTINATION_IP:
1888 notify_name = "nat_detection_destination_ip";
1889 showspi = 1;
1890 break;
1891
1892 case IV2_NOTIFY_COOKIE:
1893 notify_name = "cookie";
1894 showspi = 1;
1895 showsomedata= 1;
1896 showdata= 0;
1897 break;
1898
1899 case IV2_NOTIFY_USE_TRANSPORT_MODE:
1900 notify_name = "use_transport_mode";
1901 showspi = 0;
1902 break;
1903
1904 case IV2_NOTIFY_HTTP_CERT_LOOKUP_SUPPORTED:
1905 notify_name = "http_cert_lookup_supported";
1906 showspi = 0;
1907 break;
1908
1909 case IV2_NOTIFY_REKEY_SA:
1910 notify_name = "rekey_sa";
1911 showspi = 1;
1912 break;
1913
1914 case IV2_NOTIFY_ESP_TFC_PADDING_NOT_SUPPORTED:
1915 notify_name = "tfc_padding_not_supported";
1916 showspi = 0;
1917 break;
1918
1919 case IV2_NOTIFY_NON_FIRST_FRAGMENTS_ALSO:
1920 notify_name = "non_first_fragment_also";
1921 showspi = 0;
1922 break;
1923
1924 default:
1925 if (type < 8192) {
1926 notify_name="error";
1927 } else if(type < 16384) {
1928 notify_name="private-error";
1929 } else if(type < 40960) {
1930 notify_name="status";
1931 } else {
1932 notify_name="private-status";
1933 }
1934 }
1935
1936 if(notify_name) {
1937 ND_PRINT((ndo," type=%u(%s)", type, notify_name));
1938 }
1939
1940
1941 if (showspi && n.spi_size) {
1942 ND_PRINT((ndo," spi="));
1943 if (!rawprint(ndo, (caddr_t)(p + 1), n.spi_size))
1944 goto trunc;
1945 }
1946
1947 cp = (u_char *)(p + 1) + n.spi_size;
1948 ep2 = (u_char *)p + item_len;
1949
1950 if(3 < ndo->ndo_vflag) {
1951 showdata = 1;
1952 }
1953
1954 if ((showdata || (showsomedata && ep-cp < 30)) && cp < ep) {
1955 ND_PRINT((ndo," data=("));
1956 if (!rawprint(ndo, (caddr_t)(cp), ep - cp))
1957 goto trunc;
1958
1959 ND_PRINT((ndo,")"));
1960
1961 } else if(showsomedata && cp < ep) {
1962 if(!ike_show_somedata(ndo, cp, ep)) goto trunc;
1963 }
1964
1965 return (u_char *)ext + item_len;
1966 trunc:
1967 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_N)));
1968 return NULL;
1969 }
1970
1971 static const u_char *
1972 ikev2_d_print(netdissect_options *ndo, u_char tpay,
1973 const struct isakmp_gen *ext,
1974 u_int item_len _U_, const u_char *ep _U_,
1975 u_int32_t phase _U_, u_int32_t doi _U_,
1976 u_int32_t proto _U_, int depth _U_)
1977 {
1978 return ikev2_gen_print(ndo, tpay, ext);
1979 }
1980
1981 static const u_char *
1982 ikev2_vid_print(netdissect_options *ndo, u_char tpay,
1983 const struct isakmp_gen *ext,
1984 u_int item_len _U_, const u_char *ep _U_,
1985 u_int32_t phase _U_, u_int32_t doi _U_,
1986 u_int32_t proto _U_, int depth _U_)
1987 {
1988 struct isakmp_gen e;
1989 const u_char *vid;
1990 int i, len;
1991
1992 ND_TCHECK(*ext);
1993 safememcpy(&e, ext, sizeof(e));
1994 ikev2_pay_print(ndo, NPSTR(tpay), e.critical);
1995 ND_PRINT((ndo," len=%d vid=", ntohs(e.len) - 4));
1996
1997 vid = (const u_char *)(ext+1);
1998 len = ntohs(e.len) - 4;
1999 ND_TCHECK2(*vid, len);
2000 for(i=0; i<len; i++) {
2001 if(isprint(vid[i])) ND_PRINT((ndo, "%c", vid[i]));
2002 else ND_PRINT((ndo, "."));
2003 }
2004 if (2 < ndo->ndo_vflag && 4 < len) {
2005 ND_PRINT((ndo," "));
2006 if (!rawprint(ndo, (caddr_t)(ext + 1), ntohs(e.len) - 4))
2007 goto trunc;
2008 }
2009 return (u_char *)ext + ntohs(e.len);
2010 trunc:
2011 ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
2012 return NULL;
2013 }
2014
2015 static const u_char *
2016 ikev2_TS_print(netdissect_options *ndo, u_char tpay,
2017 const struct isakmp_gen *ext,
2018 u_int item_len _U_, const u_char *ep _U_,
2019 u_int32_t phase _U_, u_int32_t doi _U_,
2020 u_int32_t proto _U_, int depth _U_)
2021 {
2022 return ikev2_gen_print(ndo, tpay, ext);
2023 }
2024
2025 static const u_char *
2026 ikev2_e_print(netdissect_options *ndo,
2027 #ifndef HAVE_LIBCRYPTO
2028 _U_
2029 #endif
2030 struct isakmp *base,
2031 u_char tpay,
2032 const struct isakmp_gen *ext,
2033 u_int item_len _U_, const u_char *ep _U_,
2034 #ifndef HAVE_LIBCRYPTO
2035 _U_
2036 #endif
2037 u_int32_t phase,
2038 #ifndef HAVE_LIBCRYPTO
2039 _U_
2040 #endif
2041 u_int32_t doi,
2042 #ifndef HAVE_LIBCRYPTO
2043 _U_
2044 #endif
2045 u_int32_t proto,
2046 #ifndef HAVE_LIBCRYPTO
2047 _U_
2048 #endif
2049 int depth)
2050 {
2051 struct isakmp_gen e;
2052 u_char *dat;
2053 volatile int dlen;
2054
2055 ND_TCHECK(*ext);
2056 safememcpy(&e, ext, sizeof(e));
2057 ikev2_pay_print(ndo, NPSTR(tpay), e.critical);
2058
2059 dlen = ntohs(e.len)-4;
2060
2061 ND_PRINT((ndo," len=%d", dlen));
2062 if (2 < ndo->ndo_vflag && 4 < dlen) {
2063 ND_PRINT((ndo," "));
2064 if (!rawprint(ndo, (caddr_t)(ext + 1), dlen))
2065 goto trunc;
2066 }
2067
2068 dat = (u_char *)(ext+1);
2069 ND_TCHECK2(*dat, dlen);
2070
2071 #ifdef HAVE_LIBCRYPTO
2072 /* try to decypt it! */
2073 if(esp_print_decrypt_buffer_by_ikev2(ndo,
2074 base->flags & ISAKMP_FLAG_I,
2075 base->i_ck, base->r_ck,
2076 dat, dat+dlen)) {
2077
2078 ext = (const struct isakmp_gen *)ndo->ndo_packetp;
2079
2080 /* got it decrypted, print stuff inside. */
2081 ikev2_sub_print(ndo, base, e.np, ext, ndo->ndo_snapend,
2082 phase, doi, proto, depth+1);
2083 }
2084 #endif
2085
2086
2087 /* always return NULL, because E must be at end, and NP refers
2088 * to what was inside.
2089 */
2090 return NULL;
2091 trunc:
2092 ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
2093 return NULL;
2094 }
2095
2096 static const u_char *
2097 ikev2_cp_print(netdissect_options *ndo, u_char tpay,
2098 const struct isakmp_gen *ext,
2099 u_int item_len _U_, const u_char *ep _U_,
2100 u_int32_t phase _U_, u_int32_t doi _U_,
2101 u_int32_t proto _U_, int depth _U_)
2102 {
2103 return ikev2_gen_print(ndo, tpay, ext);
2104 }
2105
2106 static const u_char *
2107 ikev2_eap_print(netdissect_options *ndo, u_char tpay,
2108 const struct isakmp_gen *ext,
2109 u_int item_len _U_, const u_char *ep _U_,
2110 u_int32_t phase _U_, u_int32_t doi _U_,
2111 u_int32_t proto _U_, int depth _U_)
2112 {
2113 return ikev2_gen_print(ndo, tpay, ext);
2114 }
2115
2116 static const u_char *
2117 ike_sub0_print(netdissect_options *ndo,
2118 u_char np, const struct isakmp_gen *ext, const u_char *ep,
2119
2120 u_int32_t phase, u_int32_t doi, u_int32_t proto, int depth)
2121 {
2122 const u_char *cp;
2123 struct isakmp_gen e;
2124 u_int item_len;
2125
2126 cp = (u_char *)ext;
2127 ND_TCHECK(*ext);
2128 safememcpy(&e, ext, sizeof(e));
2129
2130 /*
2131 * Since we can't have a payload length of less than 4 bytes,
2132 * we need to bail out here if the generic header is nonsensical
2133 * or truncated, otherwise we could loop forever processing
2134 * zero-length items or otherwise misdissect the packet.
2135 */
2136 item_len = ntohs(e.len);
2137 if (item_len <= 4)
2138 return NULL;
2139
2140 if (NPFUNC(np)) {
2141 /*
2142 * XXX - what if item_len is too short, or too long,
2143 * for this payload type?
2144 */
2145 cp = (*npfunc[np])(ndo, np, ext, item_len, ep, phase, doi, proto, depth);
2146 } else {
2147 ND_PRINT((ndo,"%s", NPSTR(np)));
2148 cp += item_len;
2149 }
2150
2151 return cp;
2152 trunc:
2153 ND_PRINT((ndo," [|isakmp]"));
2154 return NULL;
2155 }
2156
2157 static const u_char *
2158 ikev1_sub_print(netdissect_options *ndo,
2159 u_char np, const struct isakmp_gen *ext, const u_char *ep,
2160 u_int32_t phase, u_int32_t doi, u_int32_t proto, int depth)
2161 {
2162 const u_char *cp;
2163 int i;
2164 struct isakmp_gen e;
2165
2166 cp = (const u_char *)ext;
2167
2168 while (np) {
2169 ND_TCHECK(*ext);
2170
2171 safememcpy(&e, ext, sizeof(e));
2172
2173 ND_TCHECK2(*ext, ntohs(e.len));
2174
2175 depth++;
2176 ND_PRINT((ndo,"\n"));
2177 for (i = 0; i < depth; i++)
2178 ND_PRINT((ndo," "));
2179 ND_PRINT((ndo,"("));
2180 cp = ike_sub0_print(ndo, np, ext, ep, phase, doi, proto, depth);
2181 ND_PRINT((ndo,")"));
2182 depth--;
2183
2184 if (cp == NULL) {
2185 /* Zero-length subitem */
2186 return NULL;
2187 }
2188
2189 np = e.np;
2190 ext = (struct isakmp_gen *)cp;
2191 }
2192 return cp;
2193 trunc:
2194 ND_PRINT((ndo," [|%s]", NPSTR(np)));
2195 return NULL;
2196 }
2197
2198 static char *
2199 numstr(int x)
2200 {
2201 static char buf[20];
2202 snprintf(buf, sizeof(buf), "#%d", x);
2203 return buf;
2204 }
2205
2206 /*
2207 * some compiler tries to optimize memcpy(), using the alignment constraint
2208 * on the argument pointer type. by using this function, we try to avoid the
2209 * optimization.
2210 */
2211 static void
2212 safememcpy(void *p, const void *q, size_t l)
2213 {
2214 memcpy(p, q, l);
2215 }
2216
2217 static void
2218 ikev1_print(netdissect_options *ndo,
2219 const u_char *bp, u_int length,
2220 const u_char *bp2, struct isakmp *base)
2221 {
2222 const struct isakmp *p;
2223 const u_char *ep;
2224 u_char np;
2225 int i;
2226 int phase;
2227
2228 p = (const struct isakmp *)bp;
2229 ep = ndo->ndo_snapend;
2230
2231 phase = (*(u_int32_t *)base->msgid == 0) ? 1 : 2;
2232 if (phase == 1)
2233 ND_PRINT((ndo," phase %d", phase));
2234 else
2235 ND_PRINT((ndo," phase %d/others", phase));
2236
2237 i = cookie_find(&base->i_ck);
2238 if (i < 0) {
2239 if (iszero((u_char *)&base->r_ck, sizeof(base->r_ck))) {
2240 /* the first packet */
2241 ND_PRINT((ndo," I"));
2242 if (bp2)
2243 cookie_record(&base->i_ck, bp2);
2244 } else
2245 ND_PRINT((ndo," ?"));
2246 } else {
2247 if (bp2 && cookie_isinitiator(i, bp2))
2248 ND_PRINT((ndo," I"));
2249 else if (bp2 && cookie_isresponder(i, bp2))
2250 ND_PRINT((ndo," R"));
2251 else
2252 ND_PRINT((ndo," ?"));
2253 }
2254
2255 ND_PRINT((ndo," %s", ETYPESTR(base->etype)));
2256 if (base->flags) {
2257 ND_PRINT((ndo,"[%s%s]", base->flags & ISAKMP_FLAG_E ? "E" : "",
2258 base->flags & ISAKMP_FLAG_C ? "C" : ""));
2259 }
2260
2261 if (ndo->ndo_vflag) {
2262 const struct isakmp_gen *ext;
2263 int nparen;
2264
2265 ND_PRINT((ndo,":"));
2266
2267 /* regardless of phase... */
2268 if (base->flags & ISAKMP_FLAG_E) {
2269 /*
2270 * encrypted, nothing we can do right now.
2271 * we hope to decrypt the packet in the future...
2272 */
2273 ND_PRINT((ndo," [encrypted %s]", NPSTR(base->np)));
2274 goto done;
2275 }
2276
2277 nparen = 0;
2278 CHECKLEN(p + 1, base->np);
2279 np = base->np;
2280 ext = (struct isakmp_gen *)(p + 1);
2281 ikev1_sub_print(ndo, np, ext, ep, phase, 0, 0, 0);
2282 }
2283
2284 done:
2285 if (ndo->ndo_vflag) {
2286 if (ntohl(base->len) != length) {
2287 ND_PRINT((ndo," (len mismatch: isakmp %u/ip %u)",
2288 (u_int32_t)ntohl(base->len), length));
2289 }
2290 }
2291 }
2292
2293 static const u_char *
2294 ikev2_sub0_print(netdissect_options *ndo, struct isakmp *base,
2295 u_char np, int pcount,
2296 const struct isakmp_gen *ext, const u_char *ep,
2297 u_int32_t phase, u_int32_t doi, u_int32_t proto, int depth)
2298 {
2299 const u_char *cp;
2300 struct isakmp_gen e;
2301 u_int item_len;
2302
2303 cp = (u_char *)ext;
2304 ND_TCHECK(*ext);
2305 safememcpy(&e, ext, sizeof(e));
2306
2307 /*
2308 * Since we can't have a payload length of less than 4 bytes,
2309 * we need to bail out here if the generic header is nonsensical
2310 * or truncated, otherwise we could loop forever processing
2311 * zero-length items or otherwise misdissect the packet.
2312 */
2313 item_len = ntohs(e.len);
2314 if (item_len <= 4)
2315 return NULL;
2316
2317 if(np == ISAKMP_NPTYPE_P) {
2318 cp = ikev2_p_print(ndo, np, pcount, ext, item_len,
2319 ep, phase, doi, proto, depth);
2320 } else if(np == ISAKMP_NPTYPE_T) {
2321 cp = ikev2_t_print(ndo, np, pcount, ext, item_len,
2322 ep, phase, doi, proto, depth);
2323 } else if(np == ISAKMP_NPTYPE_v2E) {
2324 cp = ikev2_e_print(ndo, base, np, ext, item_len,
2325 ep, phase, doi, proto, depth);
2326 } else if (NPFUNC(np)) {
2327 /*
2328 * XXX - what if item_len is too short, or too long,
2329 * for this payload type?
2330 */
2331 cp = (*npfunc[np])(ndo, np, /*pcount,*/ ext, item_len,
2332 ep, phase, doi, proto, depth);
2333 } else {
2334 ND_PRINT((ndo,"%s", NPSTR(np)));
2335 cp += item_len;
2336 }
2337
2338 return cp;
2339 trunc:
2340 ND_PRINT((ndo," [|isakmp]"));
2341 return NULL;
2342 }
2343
2344 static const u_char *
2345 ikev2_sub_print(netdissect_options *ndo,
2346 struct isakmp *base,
2347 u_char np, const struct isakmp_gen *ext, const u_char *ep,
2348 u_int32_t phase, u_int32_t doi, u_int32_t proto, int depth)
2349 {
2350 const u_char *cp;
2351 int i;
2352 int pcount;
2353 struct isakmp_gen e;
2354
2355 cp = (const u_char *)ext;
2356 pcount = 0;
2357 while (np) {
2358 pcount++;
2359 ND_TCHECK(*ext);
2360
2361 safememcpy(&e, ext, sizeof(e));
2362
2363 ND_TCHECK2(*ext, ntohs(e.len));
2364
2365 depth++;
2366 ND_PRINT((ndo,"\n"));
2367 for (i = 0; i < depth; i++)
2368 ND_PRINT((ndo," "));
2369 ND_PRINT((ndo,"("));
2370 cp = ikev2_sub0_print(ndo, base, np, pcount,
2371 ext, ep, phase, doi, proto, depth);
2372 ND_PRINT((ndo,")"));
2373 depth--;
2374
2375 if (cp == NULL) {
2376 /* Zero-length subitem */
2377 return NULL;
2378 }
2379
2380 np = e.np;
2381 ext = (struct isakmp_gen *)cp;
2382 }
2383 return cp;
2384 trunc:
2385 ND_PRINT((ndo," [|%s]", NPSTR(np)));
2386 return NULL;
2387 }
2388
2389 static void
2390 ikev2_print(netdissect_options *ndo,
2391 const u_char *bp, u_int length,
2392 const u_char *bp2 _U_, struct isakmp *base)
2393 {
2394 const struct isakmp *p;
2395 const u_char *ep;
2396 u_char np;
2397 int phase;
2398
2399 p = (const struct isakmp *)bp;
2400 ep = ndo->ndo_snapend;
2401
2402 phase = (*(u_int32_t *)base->msgid == 0) ? 1 : 2;
2403 if (phase == 1)
2404 ND_PRINT((ndo, " parent_sa"));
2405 else
2406 ND_PRINT((ndo, " child_sa "));
2407
2408 ND_PRINT((ndo, " %s", ETYPESTR(base->etype)));
2409 if (base->flags) {
2410 ND_PRINT((ndo, "[%s%s%s]",
2411 base->flags & ISAKMP_FLAG_I ? "I" : "",
2412 base->flags & ISAKMP_FLAG_V ? "V" : "",
2413 base->flags & ISAKMP_FLAG_R ? "R" : ""));
2414 }
2415
2416 if (ndo->ndo_vflag) {
2417 const struct isakmp_gen *ext;
2418 int nparen;
2419
2420 ND_PRINT((ndo, ":"));
2421
2422 /* regardless of phase... */
2423 if (base->flags & ISAKMP_FLAG_E) {
2424 /*
2425 * encrypted, nothing we can do right now.
2426 * we hope to decrypt the packet in the future...
2427 */
2428 ND_PRINT((ndo, " [encrypted %s]", NPSTR(base->np)));
2429 goto done;
2430 }
2431
2432 nparen = 0;
2433 CHECKLEN(p + 1, base->np)
2434
2435 np = base->np;
2436 ext = (struct isakmp_gen *)(p + 1);
2437 ikev2_sub_print(ndo, base, np, ext, ep, phase, 0, 0, 0);
2438 }
2439
2440 done:
2441 if (ndo->ndo_vflag) {
2442 if (ntohl(base->len) != length) {
2443 ND_PRINT((ndo, " (len mismatch: isakmp %u/ip %u)",
2444 (u_int32_t)ntohl(base->len), length));
2445 }
2446 }
2447 }
2448
2449 void
2450 isakmp_print(netdissect_options *ndo,
2451 const u_char *bp, u_int length,
2452 const u_char *bp2)
2453 {
2454 const struct isakmp *p;
2455 struct isakmp base;
2456 const u_char *ep;
2457 int major, minor;
2458
2459 #ifdef HAVE_LIBCRYPTO
2460 /* initialize SAs */
2461 if (ndo->ndo_sa_list_head == NULL) {
2462 if (ndo->ndo_espsecret)
2463 esp_print_decodesecret(ndo);
2464 }
2465 #endif
2466
2467 p = (const struct isakmp *)bp;
2468 ep = ndo->ndo_snapend;
2469
2470 if ((struct isakmp *)ep < p + 1) {
2471 ND_PRINT((ndo,"[|isakmp]"));
2472 return;
2473 }
2474
2475 safememcpy(&base, p, sizeof(base));
2476
2477 ND_PRINT((ndo,"isakmp"));
2478 major = (base.vers & ISAKMP_VERS_MAJOR)
2479 >> ISAKMP_VERS_MAJOR_SHIFT;
2480 minor = (base.vers & ISAKMP_VERS_MINOR)
2481 >> ISAKMP_VERS_MINOR_SHIFT;
2482
2483 if (ndo->ndo_vflag) {
2484 ND_PRINT((ndo," %d.%d", major, minor));
2485 }
2486
2487 if (ndo->ndo_vflag) {
2488 ND_PRINT((ndo," msgid "));
2489 hexprint(ndo, (caddr_t)&base.msgid, sizeof(base.msgid));
2490 }
2491
2492 if (1 < ndo->ndo_vflag) {
2493 ND_PRINT((ndo," cookie "));
2494 hexprint(ndo, (caddr_t)&base.i_ck, sizeof(base.i_ck));
2495 ND_PRINT((ndo,"->"));
2496 hexprint(ndo, (caddr_t)&base.r_ck, sizeof(base.r_ck));
2497 }
2498 ND_PRINT((ndo,":"));
2499
2500 switch(major) {
2501 case IKEv1_MAJOR_VERSION:
2502 ikev1_print(ndo, bp, length, bp2, &base);
2503 break;
2504
2505 case IKEv2_MAJOR_VERSION:
2506 ikev2_print(ndo, bp, length, bp2, &base);
2507 break;
2508 }
2509 }
2510
2511 void
2512 isakmp_rfc3948_print(netdissect_options *ndo,
2513 const u_char *bp, u_int length,
2514 const u_char *bp2)
2515 {
2516 const u_char *ep;
2517 ep = ndo->ndo_snapend;
2518
2519 if(length == 1 && bp[0]==0xff) {
2520 ND_PRINT((ndo, "isakmp-nat-keep-alive"));
2521 return;
2522 }
2523
2524 if(length < 4) {
2525 goto trunc;
2526 }
2527
2528 /*
2529 * see if this is an IKE packet
2530 */
2531 if(bp[0]==0 && bp[1]==0 && bp[2]==0 && bp[3]==0) {
2532 ND_PRINT((ndo, "NONESP-encap: "));
2533 isakmp_print(ndo, bp+4, length-4, bp2);
2534 return;
2535 }
2536
2537 /* must be an ESP packet */
2538 {
2539 int nh, enh, padlen;
2540 int advance;
2541
2542 ND_PRINT((ndo, "UDP-encap: "));
2543
2544 advance = esp_print(ndo, bp, length, bp2, &enh, &padlen);
2545 if(advance <= 0)
2546 return;
2547
2548 bp += advance;
2549 length -= advance + padlen;
2550 nh = enh & 0xff;
2551
2552 ip_print_inner(ndo, bp, length, nh, bp2);
2553 return;
2554 }
2555
2556 trunc:
2557 ND_PRINT((ndo,"[|isakmp]"));
2558 return;
2559 }
2560
2561 /*
2562 * Local Variables:
2563 * c-style: whitesmith
2564 * c-basic-offset: 8
2565 * End:
2566 */
2567
2568
2569
2570
[mirror] the TCPdump network dissector