+#include "extract.h" /* must come after interface.h */
+
+#include "ip.h"
+#ifdef INET6
+#include "ip6.h"
+#endif
+
+#ifndef HAVE_SOCKADDR_STORAGE
+#define sockaddr_storage sockaddr
+#endif
+
+static const u_char *isakmp_sa_print(const struct isakmp_gen *,
+ u_int, const u_char *, u_int32_t, u_int32_t, u_int32_t, int);
+static const u_char *isakmp_p_print(const struct isakmp_gen *,
+ u_int, const u_char *, u_int32_t, u_int32_t, u_int32_t, int);
+static const u_char *isakmp_t_print(const struct isakmp_gen *,
+ u_int, const u_char *, u_int32_t, u_int32_t, u_int32_t, int);
+static const u_char *isakmp_ke_print(const struct isakmp_gen *,
+ u_int, const u_char *, u_int32_t, u_int32_t, u_int32_t, int);
+static const u_char *isakmp_id_print(const struct isakmp_gen *,
+ u_int, const u_char *, u_int32_t, u_int32_t, u_int32_t, int);
+static const u_char *isakmp_cert_print(const struct isakmp_gen *,
+ u_int, const u_char *, u_int32_t, u_int32_t, u_int32_t, int);
+static const u_char *isakmp_cr_print(const struct isakmp_gen *,
+ u_int, const u_char *, u_int32_t, u_int32_t, u_int32_t, int);
+static const u_char *isakmp_sig_print(const struct isakmp_gen *,
+ u_int, const u_char *, u_int32_t, u_int32_t, u_int32_t, int);
+static const u_char *isakmp_hash_print(const struct isakmp_gen *,
+ u_int, const u_char *, u_int32_t, u_int32_t, u_int32_t, int);
+static const u_char *isakmp_nonce_print(const struct isakmp_gen *,
+ u_int, const u_char *, u_int32_t, u_int32_t, u_int32_t, int);
+static const u_char *isakmp_n_print(const struct isakmp_gen *,
+ u_int, const u_char *, u_int32_t, u_int32_t, u_int32_t, int);
+static const u_char *isakmp_d_print(const struct isakmp_gen *,
+ u_int, const u_char *, u_int32_t, u_int32_t, u_int32_t, int);
+static const u_char *isakmp_vid_print(const struct isakmp_gen *,
+ u_int, const u_char *, u_int32_t, u_int32_t, u_int32_t, int);
+static const u_char *isakmp_sub0_print(u_char, const struct isakmp_gen *,
+ const u_char *, u_int32_t, u_int32_t, u_int32_t, int);
+static const u_char *isakmp_sub_print(u_char, const struct isakmp_gen *,
+ const u_char *, u_int32_t, u_int32_t, u_int32_t, int);
+static char *numstr(int);
+static void safememcpy(void *, const void *, size_t);
+
+#define MAXINITIATORS 20
+int ninitiator = 0;
+struct {
+ cookie_t initiator;
+ struct sockaddr_storage iaddr;
+ struct sockaddr_storage raddr;
+} cookiecache[MAXINITIATORS];
+
+/* protocol id */
+static const char *protoidstr[] = {
+ NULL, "isakmp", "ipsec-ah", "ipsec-esp", "ipcomp",
+};
+
+/* isakmp->np */
+static const char *npstr[] = {
+ "none", "sa", "p", "t", "ke", "id", "cert", "cr", "hash",
+ "sig", "nonce", "n", "d", "vid"
+};
+
+/* isakmp->np */
+static const u_char *(*npfunc[])(const struct isakmp_gen *, u_int,
+ const u_char *, u_int32_t, u_int32_t, u_int32_t, int) = {
+ NULL,
+ isakmp_sa_print,
+ isakmp_p_print,
+ isakmp_t_print,
+ isakmp_ke_print,
+ isakmp_id_print,
+ isakmp_cert_print,
+ isakmp_cr_print,
+ isakmp_hash_print,
+ isakmp_sig_print,
+ isakmp_nonce_print,
+ isakmp_n_print,
+ isakmp_d_print,
+ isakmp_vid_print,
+};
+
+/* isakmp->etype */
+static const char *etypestr[] = {
+ "none", "base", "ident", "auth", "agg", "inf", NULL, NULL,
+ NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
+ NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
+ NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
+ "oakley-quick", "oakley-newgroup",
+};
+
+#define STR_OR_ID(x, tab) \
+ (((x) < sizeof(tab)/sizeof(tab[0]) && tab[(x)]) ? tab[(x)] : numstr(x))
+#define PROTOIDSTR(x) STR_OR_ID(x, protoidstr)
+#define NPSTR(x) STR_OR_ID(x, npstr)
+#define ETYPESTR(x) STR_OR_ID(x, etypestr)
+
+#define NPFUNC(x) \
+ (((x) < sizeof(npfunc)/sizeof(npfunc[0]) && npfunc[(x)]) \
+ ? npfunc[(x)] : NULL)
+
+static int
+iszero(u_char *p, size_t l)
+{
+ while (l--) {
+ if (*p++)
+ return 0;
+ }
+ return 1;
+}
+
+/* find cookie from initiator cache */
+static int
+cookie_find(cookie_t *in)
+{
+ int i;
+
+ for (i = 0; i < MAXINITIATORS; i++) {
+ if (memcmp(in, &cookiecache[i].initiator, sizeof(*in)) == 0)
+ return i;
+ }
+
+ return -1;
+}
+
+/* record initiator */
+static void
+cookie_record(cookie_t *in, const u_char *bp2)
+{
+ int i;
+ struct ip *ip;
+ struct sockaddr_in *sin;
+#ifdef INET6
+ struct ip6_hdr *ip6;
+ struct sockaddr_in6 *sin6;
+#endif
+
+ i = cookie_find(in);
+ if (0 <= i) {
+ ninitiator = (i + 1) % MAXINITIATORS;
+ return;
+ }
+
+ ip = (struct ip *)bp2;
+ switch (IP_V(ip)) {
+ case 4:
+ memset(&cookiecache[ninitiator].iaddr, 0,
+ sizeof(cookiecache[ninitiator].iaddr));
+ memset(&cookiecache[ninitiator].raddr, 0,
+ sizeof(cookiecache[ninitiator].raddr));
+
+ sin = (struct sockaddr_in *)&cookiecache[ninitiator].iaddr;
+#ifdef HAVE_SOCKADDR_SA_LEN
+ sin->sin_len = sizeof(struct sockaddr_in);
+#endif
+ sin->sin_family = AF_INET;
+ memcpy(&sin->sin_addr, &ip->ip_src, sizeof(ip->ip_src));
+ sin = (struct sockaddr_in *)&cookiecache[ninitiator].raddr;
+#ifdef HAVE_SOCKADDR_SA_LEN
+ sin->sin_len = sizeof(struct sockaddr_in);
+#endif
+ sin->sin_family = AF_INET;
+ memcpy(&sin->sin_addr, &ip->ip_dst, sizeof(ip->ip_dst));
+ break;
+#ifdef INET6
+ case 6:
+ memset(&cookiecache[ninitiator].iaddr, 0,
+ sizeof(cookiecache[ninitiator].iaddr));
+ memset(&cookiecache[ninitiator].raddr, 0,
+ sizeof(cookiecache[ninitiator].raddr));
+
+ ip6 = (struct ip6_hdr *)bp2;
+ sin6 = (struct sockaddr_in6 *)&cookiecache[ninitiator].iaddr;
+#ifdef HAVE_SOCKADDR_SA_LEN
+ sin6->sin6_len = sizeof(struct sockaddr_in6);
+#endif
+ sin6->sin6_family = AF_INET6;
+ memcpy(&sin6->sin6_addr, &ip6->ip6_src, sizeof(ip6->ip6_src));
+ sin6 = (struct sockaddr_in6 *)&cookiecache[ninitiator].raddr;
+#ifdef HAVE_SOCKADDR_SA_LEN
+ sin6->sin6_len = sizeof(struct sockaddr_in6);
+#endif
+ sin6->sin6_family = AF_INET6;
+ memcpy(&sin6->sin6_addr, &ip6->ip6_dst, sizeof(ip6->ip6_dst));
+ break;
+#endif
+ default:
+ return;
+ }
+ memcpy(&cookiecache[ninitiator].initiator, in, sizeof(*in));
+ ninitiator = (ninitiator + 1) % MAXINITIATORS;
+}
+
+#define cookie_isinitiator(x, y) cookie_sidecheck((x), (y), 1)
+#define cookie_isresponder(x, y) cookie_sidecheck((x), (y), 0)
+static int
+cookie_sidecheck(int i, const u_char *bp2, int initiator)
+{
+ struct sockaddr_storage ss;
+ struct sockaddr *sa;
+ struct ip *ip;
+ struct sockaddr_in *sin;
+#ifdef INET6
+ struct ip6_hdr *ip6;
+ struct sockaddr_in6 *sin6;
+#endif
+ int salen;
+
+ memset(&ss, 0, sizeof(ss));
+ ip = (struct ip *)bp2;
+ switch (IP_V(ip)) {
+ case 4:
+ sin = (struct sockaddr_in *)&ss;
+#ifdef HAVE_SOCKADDR_SA_LEN
+ sin->sin_len = sizeof(struct sockaddr_in);
+#endif
+ sin->sin_family = AF_INET;
+ memcpy(&sin->sin_addr, &ip->ip_src, sizeof(ip->ip_src));
+ break;
+#ifdef INET6
+ case 6:
+ ip6 = (struct ip6_hdr *)bp2;
+ sin6 = (struct sockaddr_in6 *)&ss;
+#ifdef HAVE_SOCKADDR_SA_LEN
+ sin6->sin6_len = sizeof(struct sockaddr_in6);
+#endif
+ sin6->sin6_family = AF_INET6;
+ memcpy(&sin6->sin6_addr, &ip6->ip6_src, sizeof(ip6->ip6_src));
+ break;
+#endif
+ default:
+ return 0;
+ }
+
+ sa = (struct sockaddr *)&ss;
+ if (initiator) {
+ if (sa->sa_family != ((struct sockaddr *)&cookiecache[i].iaddr)->sa_family)
+ return 0;
+#ifdef HAVE_SOCKADDR_SA_LEN
+ salen = sa->sa_len;
+#else
+#ifdef INET6
+ if (sa->sa_family == AF_INET6)
+ salen = sizeof(struct sockaddr_in6);
+ else
+ salen = sizeof(struct sockaddr);
+#else
+ salen = sizeof(struct sockaddr);
+#endif
+#endif
+ if (memcmp(&ss, &cookiecache[i].iaddr, salen) == 0)
+ return 1;
+ } else {
+ if (sa->sa_family != ((struct sockaddr *)&cookiecache[i].raddr)->sa_family)
+ return 0;
+#ifdef HAVE_SOCKADDR_SA_LEN
+ salen = sa->sa_len;
+#else
+#ifdef INET6
+ if (sa->sa_family == AF_INET6)
+ salen = sizeof(struct sockaddr_in6);
+ else
+ salen = sizeof(struct sockaddr);
+#else
+ salen = sizeof(struct sockaddr);
+#endif
+#endif
+ if (memcmp(&ss, &cookiecache[i].raddr, salen) == 0)
+ return 1;
+ }
+ return 0;
+}
+
+static int
+rawprint(caddr_t loc, size_t len)
+{
+ static u_char *p;
+ size_t i;
+
+ TCHECK2(*loc, len);
+
+ p = (u_char *)loc;
+ for (i = 0; i < len; i++)
+ printf("%02x", p[i] & 0xff);
+ return 1;
+trunc:
+ return 0;
+}
+
+struct attrmap {
+ const char *type;
+ u_int nvalue;
+ const char *value[30]; /*XXX*/
+};
+
+static const u_char *
+isakmp_attrmap_print(const u_char *p, const u_char *ep,
+ const struct attrmap *map, size_t nmap)
+{
+ u_int16_t *q;
+ int totlen;
+ u_int32_t t, v;
+
+ q = (u_int16_t *)p;
+ if (p[0] & 0x80)
+ totlen = 4;
+ else
+ totlen = 4 + EXTRACT_16BITS(&q[1]);
+ if (ep < p + totlen) {
+ printf("[|attr]");
+ return ep + 1;
+ }
+
+ printf("(");
+ t = EXTRACT_16BITS(&q[0]) & 0x7fff;
+ if (map && t < nmap && map[t].type)
+ printf("type=%s ", map[t].type);
+ else
+ printf("type=#%d ", t);
+ if (p[0] & 0x80) {
+ printf("value=");
+ v = EXTRACT_16BITS(&q[1]);
+ if (map && t < nmap && v < map[t].nvalue && map[t].value[v])
+ printf("%s", map[t].value[v]);
+ else
+ rawprint((caddr_t)&q[1], 2);
+ } else {
+ printf("len=%d value=", EXTRACT_16BITS(&q[1]));
+ rawprint((caddr_t)&p[4], EXTRACT_16BITS(&q[1]));
+ }
+ printf(")");
+ return p + totlen;
+}
+
+static const u_char *
+isakmp_attr_print(const u_char *p, const u_char *ep)
+{
+ u_int16_t *q;
+ int totlen;
+ u_int32_t t;
+
+ q = (u_int16_t *)p;
+ if (p[0] & 0x80)
+ totlen = 4;
+ else
+ totlen = 4 + EXTRACT_16BITS(&q[1]);
+ if (ep < p + totlen) {
+ printf("[|attr]");
+ return ep + 1;
+ }
+
+ printf("(");
+ t = EXTRACT_16BITS(&q[0]) & 0x7fff;
+ printf("type=#%d ", t);
+ if (p[0] & 0x80) {
+ printf("value=");
+ t = q[1];
+ rawprint((caddr_t)&q[1], 2);
+ } else {
+ printf("len=%d value=", EXTRACT_16BITS(&q[1]));
+ rawprint((caddr_t)&p[2], EXTRACT_16BITS(&q[1]));
+ }
+ printf(")");
+ return p + totlen;
+}
+
+static const u_char *
+isakmp_sa_print(const struct isakmp_gen *ext,
+ u_int item_len _U_,
+ const u_char *ep, u_int32_t phase, u_int32_t doi0 _U_,
+ u_int32_t proto0, int depth)
+{
+ const struct isakmp_pl_sa *p;
+ struct isakmp_pl_sa sa;
+ const u_int32_t *q;
+ u_int32_t doi, sit, ident;
+ const u_char *cp, *np;
+ int t;
+
+ printf("%s:", NPSTR(ISAKMP_NPTYPE_SA));
+
+ p = (struct isakmp_pl_sa *)ext;
+ TCHECK(*p);
+ safememcpy(&sa, ext, sizeof(sa));
+ doi = ntohl(sa.doi);
+ sit = ntohl(sa.sit);
+ if (doi != 1) {
+ printf(" doi=%d", doi);
+ printf(" situation=%u", (u_int32_t)ntohl(sa.sit));
+ return (u_char *)(p + 1);
+ }
+
+ printf(" doi=ipsec");
+ q = (u_int32_t *)&sa.sit;
+ printf(" situation=");
+ t = 0;
+ if (sit & 0x01) {
+ printf("identity");
+ t++;
+ }
+ if (sit & 0x02) {
+ printf("%ssecrecy", t ? "+" : "");
+ t++;
+ }
+ if (sit & 0x04)
+ printf("%sintegrity", t ? "+" : "");
+
+ np = (u_char *)ext + sizeof(sa);
+ if (sit != 0x01) {
+ TCHECK2(*(ext + 1), sizeof(ident));
+ safememcpy(&ident, ext + 1, sizeof(ident));
+ printf(" ident=%u", (u_int32_t)ntohl(ident));
+ np += sizeof(ident);
+ }
+
+ ext = (struct isakmp_gen *)np;
+ TCHECK(*ext);
+
+ cp = isakmp_sub_print(ISAKMP_NPTYPE_P, ext, ep, phase, doi, proto0,
+ depth);
+
+ return cp;
+trunc:
+ printf(" [|%s]", NPSTR(ISAKMP_NPTYPE_SA));
+ return NULL;
+}
+
+static const u_char *
+isakmp_p_print(const struct isakmp_gen *ext, u_int item_len _U_,
+ const u_char *ep, u_int32_t phase, u_int32_t doi0,
+ u_int32_t proto0 _U_, int depth)
+{
+ const struct isakmp_pl_p *p;
+ struct isakmp_pl_p prop;
+ const u_char *cp;
+
+ printf("%s:", NPSTR(ISAKMP_NPTYPE_P));
+
+ p = (struct isakmp_pl_p *)ext;
+ TCHECK(*p);
+ safememcpy(&prop, ext, sizeof(prop));
+ printf(" #%d protoid=%s transform=%d",
+ prop.p_no, PROTOIDSTR(prop.prot_id), prop.num_t);
+ if (prop.spi_size) {
+ printf(" spi=");
+ if (!rawprint((caddr_t)(p + 1), prop.spi_size))
+ goto trunc;
+ }
+
+ ext = (struct isakmp_gen *)((u_char *)(p + 1) + prop.spi_size);
+ TCHECK(*ext);
+
+ cp = isakmp_sub_print(ISAKMP_NPTYPE_T, ext, ep, phase, doi0,
+ prop.prot_id, depth);
+
+ return cp;
+trunc:
+ printf(" [|%s]", NPSTR(ISAKMP_NPTYPE_P));
+ return NULL;
+}
+
+static const char *isakmp_p_map[] = {
+ NULL, "ike",
+};
+
+static const char *ah_p_map[] = {
+ NULL, "(reserved)", "md5", "sha", "1des",
+ "sha2-256", "sha2-384", "sha2-512",
+};
+
+static const char *esp_p_map[] = {
+ NULL, "1des-iv64", "1des", "3des", "rc5", "idea", "cast",
+ "blowfish", "3idea", "1des-iv32", "rc4", "null", "aes"
+};
+
+static const char *ipcomp_p_map[] = {
+ NULL, "oui", "deflate", "lzs",
+};
+
+const struct attrmap ipsec_t_map[] = {
+ { NULL, 0, { NULL } },
+ { "lifetype", 3, { NULL, "sec", "kb", }, },
+ { "life", 0, { NULL } },
+ { "group desc", 18, { NULL, "modp768",
+ "modp1024", /* group 2 */
+ "EC2N 2^155", /* group 3 */
+ "EC2N 2^185", /* group 4 */
+ "modp1536", /* group 5 */
+ "iana-grp06", "iana-grp07", /* reserved */
+ "iana-grp08", "iana-grp09",
+ "iana-grp10", "iana-grp11",
+ "iana-grp12", "iana-grp13",
+ "modp2048", /* group 14 */
+ "modp3072", /* group 15 */
+ "modp4096", /* group 16 */
+ "modp6144", /* group 17 */
+ "modp8192", /* group 18 */
+ }, },
+ { "enc mode", 3, { NULL, "tunnel", "transport", }, },
+ { "auth", 5, { NULL, "hmac-md5", "hmac-sha1", "1des-mac", "keyed", }, },
+ { "keylen", 0, { NULL } },
+ { "rounds", 0, { NULL } },
+ { "dictsize", 0, { NULL } },
+ { "privalg", 0, { NULL } },
+};
+
+const struct attrmap oakley_t_map[] = {
+ { NULL, 0, { NULL } },
+ { "enc", 8, { NULL, "1des", "idea", "blowfish", "rc5",
+ "3des", "cast", "aes", }, },
+ { "hash", 7, { NULL, "md5", "sha1", "tiger",
+ "sha2-256", "sha2-384", "sha2-512", }, },
+ { "auth", 6, { NULL, "preshared", "dss", "rsa sig", "rsa enc",
+ "rsa enc revised", }, },
+ { "group desc", 18, { NULL, "modp768",
+ "modp1024", /* group 2 */
+ "EC2N 2^155", /* group 3 */
+ "EC2N 2^185", /* group 4 */
+ "modp1536", /* group 5 */
+ "iana-grp06", "iana-grp07", /* reserved */
+ "iana-grp08", "iana-grp09",
+ "iana-grp10", "iana-grp11",
+ "iana-grp12", "iana-grp13",
+ "modp2048", /* group 14 */
+ "modp3072", /* group 15 */
+ "modp4096", /* group 16 */
+ "modp6144", /* group 17 */
+ "modp8192", /* group 18 */
+ }, },
+ { "group type", 4, { NULL, "MODP", "ECP", "EC2N", }, },
+ { "group prime", 0, { NULL } },
+ { "group gen1", 0, { NULL } },
+ { "group gen2", 0, { NULL } },
+ { "group curve A", 0, { NULL } },
+ { "group curve B", 0, { NULL } },
+ { "lifetype", 3, { NULL, "sec", "kb", }, },
+ { "lifeduration", 0, { NULL } },
+ { "prf", 0, { NULL } },
+ { "keylen", 0, { NULL } },
+ { "field", 0, { NULL } },
+ { "order", 0, { NULL } },
projects / tcpdump / blobdiff