#ifndef lint
static const char rcsid[] _U_ =
- "@(#) $Header: /tcpdump/master/tcpdump/print-isakmp.c,v 1.46 2004-03-12 02:17:18 guy Exp $ (LBL)";
+ "@(#) $Header: /tcpdump/master/tcpdump/print-isakmp.c,v 1.53 2006-08-27 18:48:29 mcr Exp $ (LBL)";
#endif
#ifdef HAVE_CONFIG_H
}
static const u_char *
-isakmp_sa_print(const struct isakmp_gen *ext, u_int item_len,
- const u_char *ep, u_int32_t phase, u_int32_t doi0 _U_,
- u_int32_t proto0, int depth)
+isakmp_sa_print(const struct isakmp_gen *ext,
+ u_int item_len _U_,
+ const u_char *ep, u_int32_t phase, u_int32_t doi0 _U_,
+ u_int32_t proto0, int depth)
{
const struct isakmp_pl_sa *p;
struct isakmp_pl_sa sa;
}
static const u_char *
-isakmp_p_print(const struct isakmp_gen *ext, u_int item_len,
- const u_char *ep, u_int32_t phase, u_int32_t doi0,
- u_int32_t proto0 _U_, int depth)
+isakmp_p_print(const struct isakmp_gen *ext, u_int item_len _U_,
+ const u_char *ep, u_int32_t phase, u_int32_t doi0,
+ u_int32_t proto0 _U_, int depth)
{
const struct isakmp_pl_p *p;
struct isakmp_pl_p prop;
{ NULL, 0, { NULL } },
{ "lifetype", 3, { NULL, "sec", "kb", }, },
{ "life", 0, { NULL } },
- { "group desc", 5, { NULL, "modp768", "modp1024", "EC2N 2^155",
- "EC2N 2^185", }, },
+ { "group desc", 18, { NULL, "modp768",
+ "modp1024", /* group 2 */
+ "EC2N 2^155", /* group 3 */
+ "EC2N 2^185", /* group 4 */
+ "modp1536", /* group 5 */
+ "iana-grp06", "iana-grp07", /* reserved */
+ "iana-grp08", "iana-grp09",
+ "iana-grp10", "iana-grp11",
+ "iana-grp12", "iana-grp13",
+ "modp2048", /* group 14 */
+ "modp3072", /* group 15 */
+ "modp4096", /* group 16 */
+ "modp6144", /* group 17 */
+ "modp8192", /* group 18 */
+ }, },
{ "enc mode", 3, { NULL, "tunnel", "transport", }, },
{ "auth", 5, { NULL, "hmac-md5", "hmac-sha1", "1des-mac", "keyed", }, },
{ "keylen", 0, { NULL } },
"sha2-256", "sha2-384", "sha2-512", }, },
{ "auth", 6, { NULL, "preshared", "dss", "rsa sig", "rsa enc",
"rsa enc revised", }, },
- { "group desc", 5, { NULL, "modp768", "modp1024", "EC2N 2^155",
- "EC2N 2^185", }, },
+ { "group desc", 18, { NULL, "modp768",
+ "modp1024", /* group 2 */
+ "EC2N 2^155", /* group 3 */
+ "EC2N 2^185", /* group 4 */
+ "modp1536", /* group 5 */
+ "iana-grp06", "iana-grp07", /* reserved */
+ "iana-grp08", "iana-grp09",
+ "iana-grp10", "iana-grp11",
+ "iana-grp12", "iana-grp13",
+ "modp2048", /* group 14 */
+ "modp3072", /* group 15 */
+ "modp4096", /* group 16 */
+ "modp6144", /* group 17 */
+ "modp8192", /* group 18 */
+ }, },
{ "group type", 4, { NULL, "MODP", "ECP", "EC2N", }, },
{ "group prime", 0, { NULL } },
{ "group gen1", 0, { NULL } },
}
static const u_char *
-isakmp_ke_print(const struct isakmp_gen *ext, u_int item_len,
- const u_char *ep, u_int32_t phase _U_, u_int32_t doi _U_,
- u_int32_t proto _U_, int depth _U_)
+isakmp_ke_print(const struct isakmp_gen *ext, u_int item_len _U_,
+ const u_char *ep _U_, u_int32_t phase _U_, u_int32_t doi _U_,
+ u_int32_t proto _U_, int depth _U_)
{
struct isakmp_gen e;
}
static const u_char *
-isakmp_id_print(const struct isakmp_gen *ext, u_int item_len,
- const u_char *ep, u_int32_t phase, u_int32_t doi _U_,
- u_int32_t proto _U_, int depth _U_)
+isakmp_id_print(const struct isakmp_gen *ext, u_int item_len _U_,
+ const u_char *ep _U_, u_int32_t phase, u_int32_t doi _U_,
+ u_int32_t proto _U_, int depth _U_)
{
#define USE_IPSECDOI_IN_PHASE1 1
const struct isakmp_pl_id *p;
TCHECK2(*data, len);
switch (id.type) {
case IPSECDOI_ID_IPV4_ADDR:
- printf(" len=%d %s", len, ipaddr_string(data));
+ if (len < 4)
+ printf(" len=%d [bad: < 4]", len);
+ else
+ printf(" len=%d %s", len, ipaddr_string(data));
len = 0;
break;
case IPSECDOI_ID_FQDN:
case IPSECDOI_ID_IPV4_ADDR_SUBNET:
{
const u_char *mask;
- mask = data + sizeof(struct in_addr);
- printf(" len=%d %s/%u.%u.%u.%u", len,
- ipaddr_string(data),
- mask[0], mask[1], mask[2], mask[3]);
+ if (len < 8)
+ printf(" len=%d [bad: < 8]", len);
+ else {
+ mask = data + sizeof(struct in_addr);
+ printf(" len=%d %s/%u.%u.%u.%u", len,
+ ipaddr_string(data),
+ mask[0], mask[1], mask[2], mask[3]);
+ }
len = 0;
break;
}
#ifdef INET6
case IPSECDOI_ID_IPV6_ADDR:
- printf(" len=%d %s", len, ip6addr_string(data));
+ if (len < 16)
+ printf(" len=%d [bad: < 16]", len);
+ else
+ printf(" len=%d %s", len, ip6addr_string(data));
len = 0;
break;
case IPSECDOI_ID_IPV6_ADDR_SUBNET:
{
const u_int32_t *mask;
- mask = (u_int32_t *)(data + sizeof(struct in6_addr));
- /*XXX*/
- printf(" len=%d %s/0x%08x%08x%08x%08x", len,
- ip6addr_string(data),
- mask[0], mask[1], mask[2], mask[3]);
+ if (len < 20)
+ printf(" len=%d [bad: < 20]", len);
+ else {
+ mask = (u_int32_t *)(data + sizeof(struct in6_addr));
+ /*XXX*/
+ printf(" len=%d %s/0x%08x%08x%08x%08x", len,
+ ip6addr_string(data),
+ mask[0], mask[1], mask[2], mask[3]);
+ }
len = 0;
break;
}
#endif /*INET6*/
case IPSECDOI_ID_IPV4_ADDR_RANGE:
- printf(" len=%d %s-%s", len, ipaddr_string(data),
- ipaddr_string(data + sizeof(struct in_addr)));
+ if (len < 8)
+ printf(" len=%d [bad: < 8]", len);
+ else {
+ printf(" len=%d %s-%s", len,
+ ipaddr_string(data),
+ ipaddr_string(data + sizeof(struct in_addr)));
+ }
len = 0;
break;
#ifdef INET6
case IPSECDOI_ID_IPV6_ADDR_RANGE:
- printf(" len=%d %s-%s", len, ip6addr_string(data),
- ip6addr_string(data + sizeof(struct in6_addr)));
+ if (len < 32)
+ printf(" len=%d [bad: < 32]", len);
+ else {
+ printf(" len=%d %s-%s", len,
+ ip6addr_string(data),
+ ip6addr_string(data + sizeof(struct in6_addr)));
+ }
len = 0;
break;
#endif /*INET6*/
}
static const u_char *
-isakmp_cert_print(const struct isakmp_gen *ext, u_int item_len,
- const u_char *ep, u_int32_t phase _U_, u_int32_t doi0 _U_,
- u_int32_t proto0 _U_, int depth _U_)
+isakmp_cert_print(const struct isakmp_gen *ext, u_int item_len _U_,
+ const u_char *ep _U_, u_int32_t phase _U_,
+ u_int32_t doi0 _U_,
+ u_int32_t proto0 _U_, int depth _U_)
{
const struct isakmp_pl_cert *p;
struct isakmp_pl_cert cert;
}
static const u_char *
-isakmp_cr_print(const struct isakmp_gen *ext, u_int item_len,
- const u_char *ep, u_int32_t phase _U_, u_int32_t doi0 _U_,
- u_int32_t proto0 _U_, int depth _U_)
+isakmp_cr_print(const struct isakmp_gen *ext, u_int item_len _U_,
+ const u_char *ep _U_, u_int32_t phase _U_, u_int32_t doi0 _U_,
+ u_int32_t proto0 _U_, int depth _U_)
{
const struct isakmp_pl_cert *p;
struct isakmp_pl_cert cert;
}
static const u_char *
-isakmp_hash_print(const struct isakmp_gen *ext, u_int item_len,
- const u_char *ep, u_int32_t phase _U_, u_int32_t doi _U_,
- u_int32_t proto _U_, int depth _U_)
+isakmp_hash_print(const struct isakmp_gen *ext, u_int item_len _U_,
+ const u_char *ep _U_, u_int32_t phase _U_, u_int32_t doi _U_,
+ u_int32_t proto _U_, int depth _U_)
{
struct isakmp_gen e;
}
static const u_char *
-isakmp_sig_print(const struct isakmp_gen *ext, u_int item_len,
- const u_char *ep, u_int32_t phase _U_, u_int32_t doi _U_,
- u_int32_t proto _U_, int depth _U_)
+isakmp_sig_print(const struct isakmp_gen *ext, u_int item_len _U_,
+ const u_char *ep _U_, u_int32_t phase _U_, u_int32_t doi _U_,
+ u_int32_t proto _U_, int depth _U_)
{
struct isakmp_gen e;
}
static const u_char *
-isakmp_nonce_print(const struct isakmp_gen *ext, u_int item_len,
- const u_char *ep, u_int32_t phase _U_, u_int32_t doi _U_,
- u_int32_t proto _U_, int depth _U_)
+isakmp_nonce_print(const struct isakmp_gen *ext,
+ u_int item_len _U_,
+ const u_char *ep _U_,
+ u_int32_t phase _U_, u_int32_t doi _U_,
+ u_int32_t proto _U_, int depth _U_)
{
struct isakmp_gen e;
break;
default:
/* NULL is dummy */
- isakmp_print(cp, item_len - sizeof(*p) - n.spi_size,
- NULL);
+ isakmp_print(gndo, cp,
+ item_len - sizeof(*p) - n.spi_size,
+ NULL);
}
printf(")");
}
}
static const u_char *
-isakmp_d_print(const struct isakmp_gen *ext, u_int item_len,
- const u_char *ep, u_int32_t phase _U_, u_int32_t doi0 _U_,
- u_int32_t proto0 _U_, int depth _U_)
+isakmp_d_print(const struct isakmp_gen *ext, u_int item_len _U_,
+ const u_char *ep _U_, u_int32_t phase _U_, u_int32_t doi0 _U_,
+ u_int32_t proto0 _U_, int depth _U_)
{
const struct isakmp_pl_d *p;
struct isakmp_pl_d d;
}
static const u_char *
-isakmp_vid_print(const struct isakmp_gen *ext, u_int item_len,
- const u_char *ep, u_int32_t phase _U_, u_int32_t doi _U_,
- u_int32_t proto _U_, int depth _U_)
+isakmp_vid_print(const struct isakmp_gen *ext,
+ u_int item_len _U_, const u_char *ep _U_,
+ u_int32_t phase _U_, u_int32_t doi _U_,
+ u_int32_t proto _U_, int depth _U_)
{
struct isakmp_gen e;
* XXX - what if item_len is too short, or too long,
* for this payload type?
*/
- cp = (*NPFUNC(np))(ext, item_len, ep, phase, doi, proto, depth);
+ cp = (*npfunc[np])(ext, item_len, ep, phase, doi, proto, depth);
} else {
printf("%s", NPSTR(np));
cp += item_len;
}
void
-isakmp_print(const u_char *bp, u_int length, const u_char *bp2)
+isakmp_print(netdissect_options *ndo,
+ const u_char *bp, u_int length,
+ const u_char *bp2)
{
const struct isakmp *p;
struct isakmp base;
int major, minor;
p = (const struct isakmp *)bp;
- ep = snapend;
+ ep = ndo->ndo_snapend;
if ((struct isakmp *)ep < p + 1) {
printf("[|isakmp]");
}
}
}
+
+void
+isakmp_rfc3948_print(netdissect_options *ndo,
+ const u_char *bp, u_int length,
+ const u_char *bp2)
+{
+ const u_char *ep;
+ ep = ndo->ndo_snapend;
+
+ if(length == 1 && bp[0]==0xff) {
+ ND_PRINT((ndo, "isakmp-nat-keep-alive"));
+ return;
+ }
+
+ if(length < 4) {
+ goto trunc;
+ }
+
+ /*
+ * see if this is an IKE packet
+ */
+ if(bp[0]==0 && bp[1]==0 && bp[2]==0 && bp[3]==0) {
+ ND_PRINT((ndo, "NONESP-encap: "));
+ isakmp_print(ndo, bp+4, length-4, bp2);
+ return;
+ }
+
+ /* must be an ESP packet */
+ {
+ int nh, enh, padlen;
+ int advance;
+
+ ND_PRINT((ndo, "UDP-encap: "));
+
+ advance = esp_print(ndo, bp, length, bp2, &enh, &padlen);
+ if(advance <= 0)
+ return;
+
+ bp += advance;
+ length -= advance + padlen;
+ nh = enh & 0xff;
+
+ ip_print_inner(ndo, bp, length, nh, bp2);
+ return;
+ }
+
+trunc:
+ printf("[|isakmp]");
+ return;
+}
+
+/*
+ * Local Variables:
+ * c-style: whitesmith
+ * c-basic-offset: 8
+ * End:
+ */
+
+
+
+
projects / tcpdump / blobdiff