+trunc:
+ ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_D)));
+ return NULL;
+}
+
+static const u_char *
+ikev1_vid_print(netdissect_options *ndo, u_char tpay _U_,
+ const struct isakmp_gen *ext,
+ u_int item_len _U_, const u_char *ep _U_,
+ uint32_t phase _U_, uint32_t doi _U_,
+ uint32_t proto _U_, int depth _U_)
+{
+ struct isakmp_gen e;
+
+ ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_VID)));
+
+ ND_TCHECK(*ext);
+ UNALIGNED_MEMCPY(&e, ext, sizeof(e));
+ ND_PRINT((ndo," len=%d", ntohs(e.len) - 4));
+ if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
+ ND_PRINT((ndo," "));
+ if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4))
+ goto trunc;
+ }
+ return (const u_char *)ext + ntohs(e.len);
+trunc:
+ ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_VID)));
+ return NULL;
+}
+
+/************************************************************/
+/* */
+/* IKE v2 - rfc4306 - dissector */
+/* */
+/************************************************************/
+
+static void
+ikev2_pay_print(netdissect_options *ndo, const char *payname, int critical)
+{
+ ND_PRINT((ndo,"%s%s:", payname, critical&0x80 ? "[C]" : ""));
+}
+
+static const u_char *
+ikev2_gen_print(netdissect_options *ndo, u_char tpay,
+ const struct isakmp_gen *ext)
+{
+ struct isakmp_gen e;
+
+ ND_TCHECK(*ext);
+ UNALIGNED_MEMCPY(&e, ext, sizeof(e));
+ ikev2_pay_print(ndo, NPSTR(tpay), e.critical);
+
+ ND_PRINT((ndo," len=%d", ntohs(e.len) - 4));
+ if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
+ ND_PRINT((ndo," "));
+ if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4))
+ goto trunc;
+ }
+ return (const u_char *)ext + ntohs(e.len);
+trunc:
+ ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
+ return NULL;
+}
+
+static const u_char *
+ikev2_t_print(netdissect_options *ndo, u_char tpay _U_, int pcount,
+ const struct isakmp_gen *ext, u_int item_len,
+ const u_char *ep, uint32_t phase _U_, uint32_t doi _U_,
+ uint32_t proto _U_, int depth _U_)
+{
+ const struct ikev2_t *p;
+ struct ikev2_t t;
+ uint16_t t_id;
+ const u_char *cp;
+ const char *idstr;
+ const struct attrmap *map;
+ size_t nmap;
+ const u_char *ep2;
+
+ p = (const struct ikev2_t *)ext;
+ ND_TCHECK(*p);
+ UNALIGNED_MEMCPY(&t, ext, sizeof(t));
+ ikev2_pay_print(ndo, NPSTR(ISAKMP_NPTYPE_T), t.h.critical);
+
+ t_id = ntohs(t.t_id);
+
+ map = NULL;
+ nmap = 0;
+
+ switch (t.t_type) {
+ case IV2_T_ENCR:
+ idstr = STR_OR_ID(t_id, esp_p_map);
+ map = encr_t_map;
+ nmap = sizeof(encr_t_map)/sizeof(encr_t_map[0]);
+ break;
+
+ case IV2_T_PRF:
+ idstr = STR_OR_ID(t_id, prf_p_map);
+ break;
+
+ case IV2_T_INTEG:
+ idstr = STR_OR_ID(t_id, integ_p_map);
+ break;
+
+ case IV2_T_DH:
+ idstr = STR_OR_ID(t_id, dh_p_map);
+ break;
+
+ case IV2_T_ESN:
+ idstr = STR_OR_ID(t_id, esn_p_map);
+ break;
+
+ default:
+ idstr = NULL;
+ break;
+ }
+
+ if (idstr)
+ ND_PRINT((ndo," #%u type=%s id=%s ", pcount,
+ STR_OR_ID(t.t_type, ikev2_t_type_map),
+ idstr));
+ else
+ ND_PRINT((ndo," #%u type=%s id=%u ", pcount,
+ STR_OR_ID(t.t_type, ikev2_t_type_map),
+ t.t_id));
+ cp = (const u_char *)(p + 1);
+ ep2 = (const u_char *)p + item_len;
+ while (cp < ep && cp < ep2) {
+ if (map && nmap) {
+ cp = ikev1_attrmap_print(ndo, cp, (ep < ep2) ? ep : ep2,
+ map, nmap);
+ } else
+ cp = ikev1_attr_print(ndo, cp, (ep < ep2) ? ep : ep2);
+ }
+ if (ep < ep2)
+ ND_PRINT((ndo,"..."));
+ return cp;
+trunc:
+ ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_T)));
+ return NULL;
+}
+
+static const u_char *
+ikev2_p_print(netdissect_options *ndo, u_char tpay _U_, int pcount _U_,
+ const struct isakmp_gen *ext, u_int item_len _U_,
+ const u_char *ep, uint32_t phase, uint32_t doi0,
+ uint32_t proto0 _U_, int depth)
+{
+ const struct ikev2_p *p;
+ struct ikev2_p prop;
+ const u_char *cp;
+
+ p = (const struct ikev2_p *)ext;
+ ND_TCHECK(*p);
+ UNALIGNED_MEMCPY(&prop, ext, sizeof(prop));
+ ikev2_pay_print(ndo, NPSTR(ISAKMP_NPTYPE_P), prop.h.critical);
+
+ ND_PRINT((ndo," #%u protoid=%s transform=%d len=%u",
+ prop.p_no, PROTOIDSTR(prop.prot_id),
+ prop.num_t, ntohs(prop.h.len)));
+ if (prop.spi_size) {
+ ND_PRINT((ndo," spi="));
+ if (!rawprint(ndo, (const uint8_t *)(p + 1), prop.spi_size))
+ goto trunc;
+ }
+
+ ext = (const struct isakmp_gen *)((const u_char *)(p + 1) + prop.spi_size);
+ ND_TCHECK(*ext);
+
+ cp = ikev2_sub_print(ndo, NULL, ISAKMP_NPTYPE_T, ext, ep, phase, doi0,
+ prop.prot_id, depth);
+
+ return cp;
+trunc:
+ ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_P)));
+ return NULL;
+}
+
+static const u_char *
+ikev2_sa_print(netdissect_options *ndo, u_char tpay,
+ const struct isakmp_gen *ext1,
+ u_int item_len _U_, const u_char *ep _U_,
+ uint32_t phase _U_, uint32_t doi _U_,
+ uint32_t proto _U_, int depth _U_)
+{
+ struct isakmp_gen e;
+ int osa_length, sa_length;
+
+ ND_TCHECK(*ext1);
+ UNALIGNED_MEMCPY(&e, ext1, sizeof(e));
+ ikev2_pay_print(ndo, "sa", e.critical);
+
+ osa_length= ntohs(e.len);
+ sa_length = osa_length - 4;
+ ND_PRINT((ndo," len=%d", sa_length));
+
+ ikev2_sub_print(ndo, NULL, ISAKMP_NPTYPE_P,
+ ext1+1, ep,
+ 0, 0, 0, depth);
+
+ return (const u_char *)ext1 + osa_length;
+trunc:
+ ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
+ return NULL;
+}
+
+static const u_char *
+ikev2_ke_print(netdissect_options *ndo, u_char tpay,
+ const struct isakmp_gen *ext,
+ u_int item_len _U_, const u_char *ep _U_,
+ uint32_t phase _U_, uint32_t doi _U_,
+ uint32_t proto _U_, int depth _U_)
+{
+ struct ikev2_ke ke;
+ const struct ikev2_ke *k;
+
+ k = (const struct ikev2_ke *)ext;
+ ND_TCHECK(*ext);
+ UNALIGNED_MEMCPY(&ke, ext, sizeof(ke));
+ ikev2_pay_print(ndo, NPSTR(tpay), ke.h.critical);
+
+ ND_PRINT((ndo," len=%u group=%s", ntohs(ke.h.len) - 8,
+ STR_OR_ID(ntohs(ke.ke_group), dh_p_map)));
+
+ if (2 < ndo->ndo_vflag && 8 < ntohs(ke.h.len)) {
+ ND_PRINT((ndo," "));
+ if (!rawprint(ndo, (const uint8_t *)(k + 1), ntohs(ke.h.len) - 8))
+ goto trunc;
+ }
+ return (const u_char *)ext + ntohs(ke.h.len);
+trunc:
+ ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
+ return NULL;
+}
+
+static const u_char *
+ikev2_ID_print(netdissect_options *ndo, u_char tpay,
+ const struct isakmp_gen *ext,
+ u_int item_len _U_, const u_char *ep _U_,
+ uint32_t phase _U_, uint32_t doi _U_,
+ uint32_t proto _U_, int depth _U_)
+{
+ struct ikev2_id id;
+ int id_len, idtype_len, i;
+ unsigned int dumpascii, dumphex;
+ const unsigned char *typedata;
+
+ ND_TCHECK(*ext);
+ UNALIGNED_MEMCPY(&id, ext, sizeof(id));
+ ikev2_pay_print(ndo, NPSTR(tpay), id.h.critical);
+
+ id_len = ntohs(id.h.len);
+
+ ND_PRINT((ndo," len=%d", id_len - 4));
+ if (2 < ndo->ndo_vflag && 4 < id_len) {
+ ND_PRINT((ndo," "));
+ if (!rawprint(ndo, (const uint8_t *)(ext + 1), id_len - 4))
+ goto trunc;
+ }
+
+ idtype_len =id_len - sizeof(struct ikev2_id);
+ dumpascii = 0;
+ dumphex = 0;
+ typedata = (const unsigned char *)(ext)+sizeof(struct ikev2_id);
+
+ switch(id.type) {
+ case ID_IPV4_ADDR:
+ ND_PRINT((ndo, " ipv4:"));
+ dumphex=1;
+ break;
+ case ID_FQDN:
+ ND_PRINT((ndo, " fqdn:"));
+ dumpascii=1;
+ break;
+ case ID_RFC822_ADDR:
+ ND_PRINT((ndo, " rfc822:"));
+ dumpascii=1;
+ break;
+ case ID_IPV6_ADDR:
+ ND_PRINT((ndo, " ipv6:"));
+ dumphex=1;
+ break;
+ case ID_DER_ASN1_DN:
+ ND_PRINT((ndo, " dn:"));
+ dumphex=1;
+ break;
+ case ID_DER_ASN1_GN:
+ ND_PRINT((ndo, " gn:"));
+ dumphex=1;
+ break;
+ case ID_KEY_ID:
+ ND_PRINT((ndo, " keyid:"));
+ dumphex=1;
+ break;
+ }
+
+ if(dumpascii) {
+ ND_TCHECK2(*typedata, idtype_len);
+ for(i=0; i<idtype_len; i++) {
+ if(ND_ISPRINT(typedata[i])) {
+ ND_PRINT((ndo, "%c", typedata[i]));
+ } else {
+ ND_PRINT((ndo, "."));
+ }
+ }
+ }
+ if(dumphex) {
+ if (!rawprint(ndo, (const uint8_t *)typedata, idtype_len))
+ goto trunc;
+ }
+
+ return (const u_char *)ext + id_len;
+trunc:
+ ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
+ return NULL;
+}
+
+static const u_char *
+ikev2_cert_print(netdissect_options *ndo, u_char tpay,
+ const struct isakmp_gen *ext,
+ u_int item_len _U_, const u_char *ep _U_,
+ uint32_t phase _U_, uint32_t doi _U_,
+ uint32_t proto _U_, int depth _U_)
+{
+ return ikev2_gen_print(ndo, tpay, ext);
+}
+
+static const u_char *
+ikev2_cr_print(netdissect_options *ndo, u_char tpay,
+ const struct isakmp_gen *ext,
+ u_int item_len _U_, const u_char *ep _U_,
+ uint32_t phase _U_, uint32_t doi _U_,
+ uint32_t proto _U_, int depth _U_)
+{
+ return ikev2_gen_print(ndo, tpay, ext);
+}
+
+static const u_char *
+ikev2_auth_print(netdissect_options *ndo, u_char tpay,
+ const struct isakmp_gen *ext,
+ u_int item_len _U_, const u_char *ep _U_,
+ uint32_t phase _U_, uint32_t doi _U_,
+ uint32_t proto _U_, int depth _U_)
+{
+ struct ikev2_auth a;
+ const char *v2_auth[]={ "invalid", "rsasig",
+ "shared-secret", "dsssig" };
+ const u_char *authdata = (const u_char*)ext + sizeof(a);
+ unsigned int len;
+
+ ND_TCHECK(*ext);
+ UNALIGNED_MEMCPY(&a, ext, sizeof(a));
+ ikev2_pay_print(ndo, NPSTR(tpay), a.h.critical);
+ len = ntohs(a.h.len);
+
+ ND_PRINT((ndo," len=%d method=%s", len-4,
+ STR_OR_ID(a.auth_method, v2_auth)));
+
+ if (1 < ndo->ndo_vflag && 4 < len) {
+ ND_PRINT((ndo," authdata=("));
+ if (!rawprint(ndo, (const uint8_t *)authdata, len - sizeof(a)))
+ goto trunc;
+ ND_PRINT((ndo,") "));
+ } else if(ndo->ndo_vflag && 4 < len) {
+ if(!ike_show_somedata(ndo, authdata, ep)) goto trunc;
+ }
+
+ return (const u_char *)ext + len;
+trunc:
+ ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
+ return NULL;
+}
+
+static const u_char *
+ikev2_nonce_print(netdissect_options *ndo, u_char tpay,
+ const struct isakmp_gen *ext,
+ u_int item_len _U_, const u_char *ep _U_,
+ uint32_t phase _U_, uint32_t doi _U_,
+ uint32_t proto _U_, int depth _U_)
+{
+ struct isakmp_gen e;
+
+ ND_TCHECK(*ext);
+ UNALIGNED_MEMCPY(&e, ext, sizeof(e));
+ ikev2_pay_print(ndo, "nonce", e.critical);
+
+ ND_PRINT((ndo," len=%d", ntohs(e.len) - 4));
+ if (1 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
+ ND_PRINT((ndo," nonce=("));
+ if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4))
+ goto trunc;
+ ND_PRINT((ndo,") "));
+ } else if(ndo->ndo_vflag && 4 < ntohs(e.len)) {
+ if(!ike_show_somedata(ndo, (const u_char *)(ext+1), ep)) goto trunc;
+ }
+
+ return (const u_char *)ext + ntohs(e.len);
+trunc:
+ ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
+ return NULL;
+}
+
+/* notify payloads */
+static const u_char *
+ikev2_n_print(netdissect_options *ndo, u_char tpay _U_,
+ const struct isakmp_gen *ext,
+ u_int item_len _U_, const u_char *ep _U_,
+ uint32_t phase _U_, uint32_t doi _U_,
+ uint32_t proto _U_, int depth _U_)
+{
+ const struct ikev2_n *p;
+ struct ikev2_n n;
+ const u_char *cp;
+ u_char showspi, showdata, showsomedata;
+ const char *notify_name;
+ uint32_t type;
+
+ p = (const struct ikev2_n *)ext;
+ ND_TCHECK(*p);
+ UNALIGNED_MEMCPY(&n, ext, sizeof(n));
+ ikev2_pay_print(ndo, NPSTR(ISAKMP_NPTYPE_N), n.h.critical);
+
+ showspi = 1;
+ showdata = 0;
+ showsomedata=0;
+ notify_name=NULL;
+
+ ND_PRINT((ndo," prot_id=%s", PROTOIDSTR(n.prot_id)));
+
+ type = ntohs(n.type);
+
+ /* notify space is annoying sparse */
+ switch(type) {
+ case IV2_NOTIFY_UNSUPPORTED_CRITICAL_PAYLOAD:
+ notify_name = "unsupported_critical_payload";
+ showspi = 0;
+ break;
+
+ case IV2_NOTIFY_INVALID_IKE_SPI:
+ notify_name = "invalid_ike_spi";
+ showspi = 1;
+ break;
+
+ case IV2_NOTIFY_INVALID_MAJOR_VERSION:
+ notify_name = "invalid_major_version";
+ showspi = 0;
+ break;
+
+ case IV2_NOTIFY_INVALID_SYNTAX:
+ notify_name = "invalid_syntax";
+ showspi = 1;
+ break;
+
+ case IV2_NOTIFY_INVALID_MESSAGE_ID:
+ notify_name = "invalid_message_id";
+ showspi = 1;
+ break;
+
+ case IV2_NOTIFY_INVALID_SPI:
+ notify_name = "invalid_spi";
+ showspi = 1;
+ break;
+
+ case IV2_NOTIFY_NO_PROPOSAL_CHOSEN:
+ notify_name = "no_protocol_chosen";
+ showspi = 1;
+ break;
+
+ case IV2_NOTIFY_INVALID_KE_PAYLOAD:
+ notify_name = "invalid_ke_payload";
+ showspi = 1;
+ break;
+
+ case IV2_NOTIFY_AUTHENTICATION_FAILED:
+ notify_name = "authentication_failed";
+ showspi = 1;
+ break;
+
+ case IV2_NOTIFY_SINGLE_PAIR_REQUIRED:
+ notify_name = "single_pair_required";
+ showspi = 1;
+ break;
+
+ case IV2_NOTIFY_NO_ADDITIONAL_SAS:
+ notify_name = "no_additional_sas";
+ showspi = 0;
+ break;
+
+ case IV2_NOTIFY_INTERNAL_ADDRESS_FAILURE:
+ notify_name = "internal_address_failure";
+ showspi = 0;
+ break;
+
+ case IV2_NOTIFY_FAILED_CP_REQUIRED:
+ notify_name = "failed:cp_required";
+ showspi = 0;
+ break;
+
+ case IV2_NOTIFY_INVALID_SELECTORS:
+ notify_name = "invalid_selectors";
+ showspi = 0;
+ break;
+
+ case IV2_NOTIFY_INITIAL_CONTACT:
+ notify_name = "initial_contact";
+ showspi = 0;
+ break;
+
+ case IV2_NOTIFY_SET_WINDOW_SIZE:
+ notify_name = "set_window_size";
+ showspi = 0;
+ break;
+
+ case IV2_NOTIFY_ADDITIONAL_TS_POSSIBLE:
+ notify_name = "additional_ts_possible";
+ showspi = 0;
+ break;
+
+ case IV2_NOTIFY_IPCOMP_SUPPORTED:
+ notify_name = "ipcomp_supported";
+ showspi = 0;
+ break;
+
+ case IV2_NOTIFY_NAT_DETECTION_SOURCE_IP:
+ notify_name = "nat_detection_source_ip";
+ showspi = 1;
+ break;
+
+ case IV2_NOTIFY_NAT_DETECTION_DESTINATION_IP:
+ notify_name = "nat_detection_destination_ip";
+ showspi = 1;
+ break;
+
+ case IV2_NOTIFY_COOKIE:
+ notify_name = "cookie";
+ showspi = 1;
+ showsomedata= 1;
+ showdata= 0;
+ break;
+
+ case IV2_NOTIFY_USE_TRANSPORT_MODE:
+ notify_name = "use_transport_mode";
+ showspi = 0;
+ break;
+
+ case IV2_NOTIFY_HTTP_CERT_LOOKUP_SUPPORTED:
+ notify_name = "http_cert_lookup_supported";
+ showspi = 0;
+ break;
+
+ case IV2_NOTIFY_REKEY_SA:
+ notify_name = "rekey_sa";
+ showspi = 1;
+ break;
+
+ case IV2_NOTIFY_ESP_TFC_PADDING_NOT_SUPPORTED:
+ notify_name = "tfc_padding_not_supported";
+ showspi = 0;
+ break;
+
+ case IV2_NOTIFY_NON_FIRST_FRAGMENTS_ALSO:
+ notify_name = "non_first_fragment_also";
+ showspi = 0;
+ break;
+
+ default:
+ if (type < 8192) {
+ notify_name="error";
+ } else if(type < 16384) {
+ notify_name="private-error";
+ } else if(type < 40960) {
+ notify_name="status";
+ } else {
+ notify_name="private-status";
+ }
+ }
+
+ if(notify_name) {
+ ND_PRINT((ndo," type=%u(%s)", type, notify_name));
+ }
+
+
+ if (showspi && n.spi_size) {
+ ND_PRINT((ndo," spi="));
+ if (!rawprint(ndo, (const uint8_t *)(p + 1), n.spi_size))
+ goto trunc;
+ }
+
+ cp = (const u_char *)(p + 1) + n.spi_size;
+
+ if(3 < ndo->ndo_vflag) {
+ showdata = 1;
+ }
+
+ if ((showdata || (showsomedata && ep-cp < 30)) && cp < ep) {
+ ND_PRINT((ndo," data=("));
+ if (!rawprint(ndo, (const uint8_t *)(cp), ep - cp))
+ goto trunc;
+
+ ND_PRINT((ndo,")"));
+
+ } else if(showsomedata && cp < ep) {
+ if(!ike_show_somedata(ndo, cp, ep)) goto trunc;
+ }
+
+ return (const u_char *)ext + item_len;
+trunc:
+ ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_N)));
+ return NULL;
+}
+
+static const u_char *
+ikev2_d_print(netdissect_options *ndo, u_char tpay,
+ const struct isakmp_gen *ext,
+ u_int item_len _U_, const u_char *ep _U_,
+ uint32_t phase _U_, uint32_t doi _U_,
+ uint32_t proto _U_, int depth _U_)
+{
+ return ikev2_gen_print(ndo, tpay, ext);
+}
+
+static const u_char *
+ikev2_vid_print(netdissect_options *ndo, u_char tpay,
+ const struct isakmp_gen *ext,
+ u_int item_len _U_, const u_char *ep _U_,
+ uint32_t phase _U_, uint32_t doi _U_,
+ uint32_t proto _U_, int depth _U_)
+{
+ struct isakmp_gen e;
+ const u_char *vid;
+ int i, len;
+
+ ND_TCHECK(*ext);
+ UNALIGNED_MEMCPY(&e, ext, sizeof(e));
+ ikev2_pay_print(ndo, NPSTR(tpay), e.critical);
+ ND_PRINT((ndo," len=%d vid=", ntohs(e.len) - 4));
+
+ vid = (const u_char *)(ext+1);
+ len = ntohs(e.len) - 4;
+ ND_TCHECK2(*vid, len);
+ for(i=0; i<len; i++) {
+ if(ND_ISPRINT(vid[i])) ND_PRINT((ndo, "%c", vid[i]));
+ else ND_PRINT((ndo, "."));
+ }
+ if (2 < ndo->ndo_vflag && 4 < len) {
+ ND_PRINT((ndo," "));
+ if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4))
+ goto trunc;
+ }
+ return (const u_char *)ext + ntohs(e.len);
+trunc:
+ ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
+ return NULL;
+}
+
+static const u_char *
+ikev2_TS_print(netdissect_options *ndo, u_char tpay,
+ const struct isakmp_gen *ext,
+ u_int item_len _U_, const u_char *ep _U_,
+ uint32_t phase _U_, uint32_t doi _U_,
+ uint32_t proto _U_, int depth _U_)
+{
+ return ikev2_gen_print(ndo, tpay, ext);
projects / tcpdump / blobdiff