X-Git-Url: https://git.tcpdump.org/tcpdump/blobdiff_plain/2882d13530741dd64755e968df1c8595b610bbb1..d7b497cac78b6e22a66a6bae9bdec60a8044f67a:/print-isakmp.c diff --git a/print-isakmp.c b/print-isakmp.c index f3714b80..fa9fa239 100644 --- a/print-isakmp.c +++ b/print-isakmp.c @@ -28,7 +28,8 @@ * */ -#define NETDISSECT_REWORKED +/* \summary: Internet Security Association and Key Management Protocol (ISAKMP) printer */ + #ifdef HAVE_CONFIG_H #include "config.h" #endif @@ -40,20 +41,17 @@ #undef HAVE_LIBCRYPTO #endif -#include +#include #include -#include - -#include "interface.h" +#include "netdissect.h" #include "addrtoname.h" -#include "extract.h" /* must come after interface.h */ +#include "extract.h" #include "ip.h" -#ifdef INET6 #include "ip6.h" -#endif +#include "ipproto.h" /* refer to RFC 2408 */ @@ -81,16 +79,16 @@ typedef u_char msgid_t[4]; struct isakmp { cookie_t i_ck; /* Initiator Cookie */ cookie_t r_ck; /* Responder Cookie */ - u_int8_t np; /* Next Payload Type */ - u_int8_t vers; + uint8_t np; /* Next Payload Type */ + uint8_t vers; #define ISAKMP_VERS_MAJOR 0xf0 #define ISAKMP_VERS_MAJOR_SHIFT 4 #define ISAKMP_VERS_MINOR 0x0f #define ISAKMP_VERS_MINOR_SHIFT 0 - u_int8_t etype; /* Exchange Type */ - u_int8_t flags; /* Flags */ + uint8_t etype; /* Exchange Type */ + uint8_t flags; /* Flags */ msgid_t msgid; - u_int32_t len; /* Length */ + uint32_t len; /* Length */ }; /* Next Payload Type */ @@ -134,9 +132,9 @@ struct isakmp { +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ */ struct isakmp_gen { - u_int8_t np; /* Next Payload */ - u_int8_t critical; /* bit 7 - critical, rest is RESERVED */ - u_int16_t len; /* Payload Length */ + uint8_t np; /* Next Payload */ + uint8_t critical; /* bit 7 - critical, rest is RESERVED */ + uint16_t len; /* Payload Length */ }; /* 3.3 Data Attributes @@ -150,8 +148,8 @@ struct isakmp_gen { +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ */ struct isakmp_data { - u_int16_t type; /* defined by DOI-spec, and Attribute Format */ - u_int16_t lorv; /* if f equal 1, Attribute Length */ + uint16_t type; /* defined by DOI-spec, and Attribute Format */ + uint16_t lorv; /* if f equal 1, Attribute Length */ /* if f equal 0, Attribute Value */ /* if f equal 1, Attribute Value */ }; @@ -170,8 +168,8 @@ struct isakmp_data { */ struct ikev1_pl_sa { struct isakmp_gen h; - u_int32_t doi; /* Domain of Interpretation */ - u_int32_t sit; /* Situation */ + uint32_t doi; /* Domain of Interpretation */ + uint32_t sit; /* Situation */ }; /* 3.5 Proposal Payload */ @@ -184,10 +182,10 @@ struct ikev1_pl_sa { */ struct ikev1_pl_p { struct isakmp_gen h; - u_int8_t p_no; /* Proposal # */ - u_int8_t prot_id; /* Protocol */ - u_int8_t spi_size; /* SPI Size */ - u_int8_t num_t; /* Number of Transforms */ + uint8_t p_no; /* Proposal # */ + uint8_t prot_id; /* Protocol */ + uint8_t spi_size; /* SPI Size */ + uint8_t num_t; /* Number of Transforms */ /* SPI */ }; @@ -200,9 +198,9 @@ struct ikev1_pl_p { */ struct ikev1_pl_t { struct isakmp_gen h; - u_int8_t t_no; /* Transform # */ - u_int8_t t_id; /* Transform-Id */ - u_int16_t reserved; /* RESERVED2 */ + uint8_t t_no; /* Transform # */ + uint8_t t_id; /* Transform-Id */ + uint16_t reserved; /* RESERVED2 */ /* SA Attributes */ }; @@ -217,8 +215,8 @@ struct ikev1_pl_ke { struct ikev1_pl_id { struct isakmp_gen h; union { - u_int8_t id_type; /* ID Type */ - u_int32_t doi_data; /* DOI Specific ID Data */ + uint8_t id_type; /* ID Type */ + uint32_t doi_data; /* DOI Specific ID Data */ } d; /* Identification Data */ }; @@ -226,7 +224,7 @@ struct ikev1_pl_id { /* 3.9 Certificate Payload */ struct ikev1_pl_cert { struct isakmp_gen h; - u_int8_t encode; /* Cert Encoding */ + uint8_t encode; /* Cert Encoding */ char cert; /* Certificate Data */ /* This field indicates the type of @@ -238,7 +236,7 @@ struct ikev1_pl_cert { /* 3.10 Certificate Request Payload */ struct ikev1_pl_cr { struct isakmp_gen h; - u_int8_t num_cert; /* # Cert. Types */ + uint8_t num_cert; /* # Cert. Types */ /* Certificate Types (variable length) -- Contains a list of the types of certificates requested, @@ -273,10 +271,10 @@ struct ikev1_pl_nonce { /* 3.14 Notification Payload */ struct ikev1_pl_n { struct isakmp_gen h; - u_int32_t doi; /* Domain of Interpretation */ - u_int8_t prot_id; /* Protocol-ID */ - u_int8_t spi_size; /* SPI Size */ - u_int16_t type; /* Notify Message Type */ + uint32_t doi; /* Domain of Interpretation */ + uint8_t prot_id; /* Protocol-ID */ + uint8_t spi_size; /* SPI Size */ + uint16_t type; /* Notify Message Type */ /* SPI */ /* Notification Data */ }; @@ -313,10 +311,10 @@ struct ikev1_pl_n { /* 3.15 Delete Payload */ struct ikev1_pl_d { struct isakmp_gen h; - u_int32_t doi; /* Domain of Interpretation */ - u_int8_t prot_id; /* Protocol-Id */ - u_int8_t spi_size; /* SPI Size */ - u_int16_t num_spi; /* # of SPIs */ + uint32_t doi; /* Domain of Interpretation */ + uint8_t prot_id; /* Protocol-Id */ + uint8_t spi_size; /* SPI Size */ + uint16_t num_spi; /* # of SPIs */ /* SPI(es) */ }; @@ -338,18 +336,18 @@ struct isakmp_ph2tab { /* 3.3.1. Proposal Substructure */ struct ikev2_p { struct isakmp_gen h; - u_int8_t p_no; /* Proposal # */ - u_int8_t prot_id; /* Protocol */ - u_int8_t spi_size; /* SPI Size */ - u_int8_t num_t; /* Number of Transforms */ + uint8_t p_no; /* Proposal # */ + uint8_t prot_id; /* Protocol */ + uint8_t spi_size; /* SPI Size */ + uint8_t num_t; /* Number of Transforms */ }; /* 3.3.2. Transform Substructure */ struct ikev2_t { struct isakmp_gen h; - u_int8_t t_type; /* Transform Type (ENCR,PRF,INTEG,etc.*/ - u_int8_t res2; /* reserved byte */ - u_int16_t t_id; /* Transform ID */ + uint8_t t_type; /* Transform Type (ENCR,PRF,INTEG,etc.*/ + uint8_t res2; /* reserved byte */ + uint16_t t_id; /* Transform ID */ }; enum ikev2_t_type { @@ -357,14 +355,14 @@ enum ikev2_t_type { IV2_T_PRF = 2, IV2_T_INTEG= 3, IV2_T_DH = 4, - IV2_T_ESN = 5, + IV2_T_ESN = 5 }; /* 3.4. Key Exchange Payload */ struct ikev2_ke { struct isakmp_gen h; - u_int16_t ke_group; - u_int16_t ke_res1; + uint16_t ke_group; + uint16_t ke_res1; /* KE data */ }; @@ -377,13 +375,13 @@ enum ikev2_id_type { ID_IPV6_ADDR=5, ID_DER_ASN1_DN=9, ID_DER_ASN1_GN=10, - ID_KEY_ID=11, + ID_KEY_ID=11 }; struct ikev2_id { struct isakmp_gen h; - u_int8_t type; /* ID type */ - u_int8_t res1; - u_int16_t res2; + uint8_t type; /* ID type */ + uint8_t res1; + uint16_t res2; /* SPI */ /* Notification Data */ }; @@ -391,9 +389,9 @@ struct ikev2_id { /* 3.10 Notification Payload */ struct ikev2_n { struct isakmp_gen h; - u_int8_t prot_id; /* Protocol-ID */ - u_int8_t spi_size; /* SPI Size */ - u_int16_t type; /* Notify Message Type */ + uint8_t prot_id; /* Protocol-ID */ + uint8_t spi_size; /* SPI Size */ + uint16_t type; /* Notify Message Type */ }; enum ikev2_n_type { @@ -426,22 +424,22 @@ enum ikev2_n_type { }; struct notify_messages { - u_int16_t type; + uint16_t type; char *msg; }; -/* 3.8 Notification Payload */ +/* 3.8 Authentication Payload */ struct ikev2_auth { struct isakmp_gen h; - u_int8_t auth_method; /* Protocol-ID */ - u_int8_t reserved[3]; + uint8_t auth_method; /* Protocol-ID */ + uint8_t reserved[3]; /* authentication data */ }; enum ikev2_auth_type { IV2_RSA_SIG = 1, IV2_SHARED = 2, - IV2_DSS_SIG = 3, + IV2_DSS_SIG = 3 }; /* refer to RFC 2409 */ @@ -449,15 +447,15 @@ enum ikev2_auth_type { #if 0 /* isakmp sa structure */ struct oakley_sa { - u_int8_t proto_id; /* OAKLEY */ + uint8_t proto_id; /* OAKLEY */ vchar_t *spi; /* spi */ - u_int8_t dhgrp; /* DH; group */ - u_int8_t auth_t; /* method of authentication */ - u_int8_t prf_t; /* type of prf */ - u_int8_t hash_t; /* type of hash */ - u_int8_t enc_t; /* type of cipher */ - u_int8_t life_t; /* type of duration of lifetime */ - u_int32_t ldur; /* life duration */ + uint8_t dhgrp; /* DH; group */ + uint8_t auth_t; /* method of authentication */ + uint8_t prf_t; /* type of prf */ + uint8_t hash_t; /* type of hash */ + uint8_t enc_t; /* type of cipher */ + uint8_t life_t; /* type of duration of lifetime */ + uint32_t ldur; /* life duration */ }; #endif @@ -542,21 +540,21 @@ struct oakley_sa { /* 4.6.1 Security Association Payload */ struct ipsecdoi_sa { struct isakmp_gen h; - u_int32_t doi; /* Domain of Interpretation */ - u_int32_t sit; /* Situation */ + uint32_t doi; /* Domain of Interpretation */ + uint32_t sit; /* Situation */ }; struct ipsecdoi_secrecy_h { - u_int16_t len; - u_int16_t reserved; + uint16_t len; + uint16_t reserved; }; /* 4.6.2.1 Identification Type Values */ struct ipsecdoi_id { struct isakmp_gen h; - u_int8_t type; /* ID Type */ - u_int8_t proto_id; /* Protocol ID */ - u_int16_t port; /* Port */ + uint8_t type; /* ID Type */ + uint8_t proto_id; /* Protocol ID */ + uint16_t port; /* Port */ /* Identification Data */ }; @@ -583,9 +581,9 @@ struct ipsecdoi_id { const struct isakmp_gen *ext, \ u_int item_len, \ const u_char *end_pointer, \ - u_int32_t phase,\ - u_int32_t doi0, \ - u_int32_t proto0, int depth) + uint32_t phase,\ + uint32_t doi0, \ + uint32_t proto0, int depth) DECLARE_PRINTER(v1_sa); DECLARE_PRINTER(v1_p); @@ -621,21 +619,21 @@ static const u_char *ikev2_e_print(netdissect_options *ndo, const struct isakmp_gen *ext, u_int item_len, const u_char *end_pointer, - u_int32_t phase, - u_int32_t doi0, - u_int32_t proto0, int depth); + uint32_t phase, + uint32_t doi0, + uint32_t proto0, int depth); static const u_char *ike_sub0_print(netdissect_options *ndo,u_char, const struct isakmp_gen *, - const u_char *, u_int32_t, u_int32_t, u_int32_t, int); + const u_char *, uint32_t, uint32_t, uint32_t, int); static const u_char *ikev1_sub_print(netdissect_options *ndo,u_char, const struct isakmp_gen *, - const u_char *, u_int32_t, u_int32_t, u_int32_t, int); + const u_char *, uint32_t, uint32_t, uint32_t, int); static const u_char *ikev2_sub_print(netdissect_options *ndo, struct isakmp *base, u_char np, const struct isakmp_gen *ext, - const u_char *ep, u_int32_t phase, - u_int32_t doi, u_int32_t proto, + const u_char *ep, uint32_t phase, + uint32_t doi, uint32_t proto, int depth); @@ -647,14 +645,12 @@ ikev1_print(netdissect_options *ndo, const u_char *bp2, struct isakmp *base); #define MAXINITIATORS 20 -int ninitiator = 0; +static int ninitiator = 0; union inaddr_u { struct in_addr in4; -#ifdef INET6 struct in6_addr in6; -#endif }; -struct { +static struct { cookie_t initiator; u_int version; union inaddr_u iaddr; @@ -686,9 +682,9 @@ static const u_char *(*npfunc[])(netdissect_options *ndo, u_char tpay, const struct isakmp_gen *ext, u_int item_len, const u_char *end_pointer, - u_int32_t phase, - u_int32_t doi0, - u_int32_t proto0, int depth) = { + uint32_t phase, + uint32_t doi0, + uint32_t proto0, int depth) = { NULL, ikev1_sa_print, ikev1_p_print, @@ -744,7 +740,7 @@ static const char *etypestr[] = { #define ETYPESTR(x) STR_OR_ID(x, etypestr) #define CHECKLEN(p, np) \ - if (ep < (u_char *)(p)) { \ + if (ep < (const u_char *)(p)) { \ ND_PRINT((ndo," [|%s]", NPSTR(np))); \ goto done; \ } @@ -755,7 +751,7 @@ static const char *etypestr[] = { ? npfunc[(x)] : NULL) static int -iszero(u_char *p, size_t l) +iszero(const u_char *p, size_t l) { while (l--) { if (*p++) @@ -783,10 +779,8 @@ static void cookie_record(cookie_t *in, const u_char *bp2) { int i; - struct ip *ip; -#ifdef INET6 - struct ip6_hdr *ip6; -#endif + const struct ip *ip; + const struct ip6_hdr *ip6; i = cookie_find(in); if (0 <= i) { @@ -794,25 +788,23 @@ cookie_record(cookie_t *in, const u_char *bp2) return; } - ip = (struct ip *)bp2; + ip = (const struct ip *)bp2; switch (IP_V(ip)) { case 4: cookiecache[ninitiator].version = 4; - unaligned_memcpy(&cookiecache[ninitiator].iaddr.in4, &ip->ip_src, sizeof(struct in_addr)); - unaligned_memcpy(&cookiecache[ninitiator].raddr.in4, &ip->ip_dst, sizeof(struct in_addr)); + UNALIGNED_MEMCPY(&cookiecache[ninitiator].iaddr.in4, &ip->ip_src, sizeof(struct in_addr)); + UNALIGNED_MEMCPY(&cookiecache[ninitiator].raddr.in4, &ip->ip_dst, sizeof(struct in_addr)); break; -#ifdef INET6 case 6: - ip6 = (struct ip6_hdr *)bp2; + ip6 = (const struct ip6_hdr *)bp2; cookiecache[ninitiator].version = 6; - unaligned_memcpy(&cookiecache[ninitiator].iaddr.in6, &ip6->ip6_src, sizeof(struct in6_addr)); - unaligned_memcpy(&cookiecache[ninitiator].raddr.in6, &ip6->ip6_dst, sizeof(struct in6_addr)); + UNALIGNED_MEMCPY(&cookiecache[ninitiator].iaddr.in6, &ip6->ip6_src, sizeof(struct in6_addr)); + UNALIGNED_MEMCPY(&cookiecache[ninitiator].raddr.in6, &ip6->ip6_dst, sizeof(struct in6_addr)); break; -#endif default: return; } - unaligned_memcpy(&cookiecache[ninitiator].initiator, in, sizeof(*in)); + UNALIGNED_MEMCPY(&cookiecache[ninitiator].initiator, in, sizeof(*in)); ninitiator = (ninitiator + 1) % MAXINITIATORS; } @@ -821,38 +813,34 @@ cookie_record(cookie_t *in, const u_char *bp2) static int cookie_sidecheck(int i, const u_char *bp2, int initiator) { - struct ip *ip; -#ifdef INET6 - struct ip6_hdr *ip6; -#endif + const struct ip *ip; + const struct ip6_hdr *ip6; - ip = (struct ip *)bp2; + ip = (const struct ip *)bp2; switch (IP_V(ip)) { case 4: if (cookiecache[i].version != 4) return 0; if (initiator) { - if (unaligned_memcmp(&ip->ip_src, &cookiecache[i].iaddr.in4, sizeof(struct in_addr)) == 0) + if (UNALIGNED_MEMCMP(&ip->ip_src, &cookiecache[i].iaddr.in4, sizeof(struct in_addr)) == 0) return 1; } else { - if (unaligned_memcmp(&ip->ip_src, &cookiecache[i].raddr.in4, sizeof(struct in_addr)) == 0) + if (UNALIGNED_MEMCMP(&ip->ip_src, &cookiecache[i].raddr.in4, sizeof(struct in_addr)) == 0) return 1; } break; -#ifdef INET6 case 6: if (cookiecache[i].version != 6) return 0; - ip6 = (struct ip6_hdr *)bp2; + ip6 = (const struct ip6_hdr *)bp2; if (initiator) { - if (unaligned_memcmp(&ip6->ip6_src, &cookiecache[i].iaddr.in6, sizeof(struct in6_addr)) == 0) + if (UNALIGNED_MEMCMP(&ip6->ip6_src, &cookiecache[i].iaddr.in6, sizeof(struct in6_addr)) == 0) return 1; } else { - if (unaligned_memcmp(&ip6->ip6_src, &cookiecache[i].raddr.in6, sizeof(struct in6_addr)) == 0) + if (UNALIGNED_MEMCMP(&ip6->ip6_src, &cookiecache[i].raddr.in6, sizeof(struct in6_addr)) == 0) return 1; } break; -#endif /* INET6 */ default: break; } @@ -861,18 +849,18 @@ cookie_sidecheck(int i, const u_char *bp2, int initiator) } static void -hexprint(netdissect_options *ndo, caddr_t loc, size_t len) +hexprint(netdissect_options *ndo, const uint8_t *loc, size_t len) { - u_char *p; + const uint8_t *p; size_t i; - p = (u_char *)loc; + p = loc; for (i = 0; i < len; i++) ND_PRINT((ndo,"%02x", p[i] & 0xff)); } static int -rawprint(netdissect_options *ndo, caddr_t loc, size_t len) +rawprint(netdissect_options *ndo, const uint8_t *loc, size_t len) { ND_TCHECK2(*loc, len); @@ -886,7 +874,7 @@ trunc: /* * returns false if we run out of data buffer */ -static int ike_show_somedata(struct netdissect_options *ndo, +static int ike_show_somedata(netdissect_options *ndo, const u_char *cp, const u_char *ep) { /* there is too much data, just show some of it */ @@ -904,10 +892,10 @@ static int ike_show_somedata(struct netdissect_options *ndo, } ND_PRINT((ndo," data=(")); - if(!rawprint(ndo, (caddr_t)(cp), len)) goto trunc; + if(!rawprint(ndo, (const uint8_t *)(cp), len)) goto trunc; ND_PRINT((ndo, "...")); if(elen) { - if(!rawprint(ndo, (caddr_t)(end), elen)) goto trunc; + if(!rawprint(ndo, (const uint8_t *)(end), elen)) goto trunc; } ND_PRINT((ndo,")")); return 1; @@ -924,96 +912,124 @@ struct attrmap { static const u_char * ikev1_attrmap_print(netdissect_options *ndo, - const u_char *p, const u_char *ep, + const u_char *p, const u_char *ep2, const struct attrmap *map, size_t nmap) { int totlen; - u_int32_t t, v; + uint32_t t, v; + ND_TCHECK(p[0]); if (p[0] & 0x80) totlen = 4; - else - totlen = 4 + EXTRACT_16BITS(&p[2]); - if (ep < p + totlen) { + else { + ND_TCHECK_2(p + 2); + totlen = 4 + EXTRACT_BE_U_2(p + 2); + } + if (ep2 < p + totlen) { ND_PRINT((ndo,"[|attr]")); - return ep + 1; + return ep2 + 1; } + ND_TCHECK_2(p); ND_PRINT((ndo,"(")); - t = EXTRACT_16BITS(&p[0]) & 0x7fff; + t = EXTRACT_BE_U_2(p) & 0x7fff; if (map && t < nmap && map[t].type) ND_PRINT((ndo,"type=%s ", map[t].type)); else ND_PRINT((ndo,"type=#%d ", t)); if (p[0] & 0x80) { ND_PRINT((ndo,"value=")); - v = EXTRACT_16BITS(&p[2]); + ND_TCHECK_2(p + 2); + v = EXTRACT_BE_U_2(p + 2); if (map && t < nmap && v < map[t].nvalue && map[t].value[v]) ND_PRINT((ndo,"%s", map[t].value[v])); - else - rawprint(ndo, (caddr_t)&p[2], 2); + else { + if (!rawprint(ndo, (const uint8_t *)&p[2], 2)) { + ND_PRINT((ndo,")")); + goto trunc; + } + } } else { - ND_PRINT((ndo,"len=%d value=", EXTRACT_16BITS(&p[2]))); - rawprint(ndo, (caddr_t)&p[4], EXTRACT_16BITS(&p[2])); + ND_PRINT((ndo,"len=%d value=", totlen - 4)); + if (!rawprint(ndo, (const uint8_t *)&p[4], totlen - 4)) { + ND_PRINT((ndo,")")); + goto trunc; + } } ND_PRINT((ndo,")")); return p + totlen; + +trunc: + return NULL; } static const u_char * -ikev1_attr_print(netdissect_options *ndo, const u_char *p, const u_char *ep) +ikev1_attr_print(netdissect_options *ndo, const u_char *p, const u_char *ep2) { int totlen; - u_int32_t t; + uint32_t t; + ND_TCHECK(p[0]); if (p[0] & 0x80) totlen = 4; - else - totlen = 4 + EXTRACT_16BITS(&p[2]); - if (ep < p + totlen) { + else { + ND_TCHECK_2(p + 2); + totlen = 4 + EXTRACT_BE_U_2(p + 2); + } + if (ep2 < p + totlen) { ND_PRINT((ndo,"[|attr]")); - return ep + 1; + return ep2 + 1; } + ND_TCHECK_2(p); ND_PRINT((ndo,"(")); - t = EXTRACT_16BITS(&p[0]) & 0x7fff; + t = EXTRACT_BE_U_2(p) & 0x7fff; ND_PRINT((ndo,"type=#%d ", t)); if (p[0] & 0x80) { ND_PRINT((ndo,"value=")); t = p[2]; - rawprint(ndo, (caddr_t)&p[2], 2); + if (!rawprint(ndo, (const uint8_t *)&p[2], 2)) { + ND_PRINT((ndo,")")); + goto trunc; + } } else { - ND_PRINT((ndo,"len=%d value=", EXTRACT_16BITS(&p[2]))); - rawprint(ndo, (caddr_t)&p[4], EXTRACT_16BITS(&p[2])); + ND_PRINT((ndo,"len=%d value=", totlen - 4)); + if (!rawprint(ndo, (const uint8_t *)&p[4], totlen - 4)) { + ND_PRINT((ndo,")")); + goto trunc; + } } ND_PRINT((ndo,")")); return p + totlen; + +trunc: + return NULL; } static const u_char * ikev1_sa_print(netdissect_options *ndo, u_char tpay _U_, const struct isakmp_gen *ext, u_int item_len _U_, - const u_char *ep, u_int32_t phase, u_int32_t doi0 _U_, - u_int32_t proto0, int depth) + const u_char *ep, uint32_t phase, uint32_t doi0 _U_, + uint32_t proto0, int depth) { const struct ikev1_pl_sa *p; struct ikev1_pl_sa sa; - u_int32_t doi, sit, ident; + uint32_t doi, sit, ident; const u_char *cp, *np; int t; ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_SA))); - p = (struct ikev1_pl_sa *)ext; + p = (const struct ikev1_pl_sa *)ext; ND_TCHECK(*p); - unaligned_memcpy(&sa, ext, sizeof(sa)); + UNALIGNED_MEMCPY(&sa, ext, sizeof(sa)); doi = ntohl(sa.doi); sit = ntohl(sa.sit); if (doi != 1) { ND_PRINT((ndo," doi=%d", doi)); - ND_PRINT((ndo," situation=%u", (u_int32_t)ntohl(sa.sit))); - return (u_char *)(p + 1); + ND_PRINT((ndo," situation=%u", (uint32_t)ntohl(sa.sit))); + return (const u_char *)(p + 1); } ND_PRINT((ndo," doi=ipsec")); @@ -1030,15 +1046,15 @@ ikev1_sa_print(netdissect_options *ndo, u_char tpay _U_, if (sit & 0x04) ND_PRINT((ndo,"%sintegrity", t ? "+" : "")); - np = (u_char *)ext + sizeof(sa); + np = (const u_char *)ext + sizeof(sa); if (sit != 0x01) { ND_TCHECK2(*(ext + 1), sizeof(ident)); - unaligned_memcpy(&ident, ext + 1, sizeof(ident)); - ND_PRINT((ndo," ident=%u", (u_int32_t)ntohl(ident))); + UNALIGNED_MEMCPY(&ident, ext + 1, sizeof(ident)); + ND_PRINT((ndo," ident=%u", (uint32_t)ntohl(ident))); np += sizeof(ident); } - ext = (struct isakmp_gen *)np; + ext = (const struct isakmp_gen *)np; ND_TCHECK(*ext); cp = ikev1_sub_print(ndo, ISAKMP_NPTYPE_P, ext, ep, phase, doi, proto0, @@ -1053,8 +1069,8 @@ trunc: static const u_char * ikev1_p_print(netdissect_options *ndo, u_char tpay _U_, const struct isakmp_gen *ext, u_int item_len _U_, - const u_char *ep, u_int32_t phase, u_int32_t doi0, - u_int32_t proto0 _U_, int depth) + const u_char *ep, uint32_t phase, uint32_t doi0, + uint32_t proto0 _U_, int depth) { const struct ikev1_pl_p *p; struct ikev1_pl_p prop; @@ -1062,18 +1078,18 @@ ikev1_p_print(netdissect_options *ndo, u_char tpay _U_, ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_P))); - p = (struct ikev1_pl_p *)ext; + p = (const struct ikev1_pl_p *)ext; ND_TCHECK(*p); - unaligned_memcpy(&prop, ext, sizeof(prop)); + UNALIGNED_MEMCPY(&prop, ext, sizeof(prop)); ND_PRINT((ndo," #%d protoid=%s transform=%d", prop.p_no, PROTOIDSTR(prop.prot_id), prop.num_t)); if (prop.spi_size) { ND_PRINT((ndo," spi=")); - if (!rawprint(ndo, (caddr_t)(p + 1), prop.spi_size)) + if (!rawprint(ndo, (const uint8_t *)(p + 1), prop.spi_size)) goto trunc; } - ext = (struct isakmp_gen *)((u_char *)(p + 1) + prop.spi_size); + ext = (const struct isakmp_gen *)((const u_char *)(p + 1) + prop.spi_size); ND_TCHECK(*ext); cp = ikev1_sub_print(ndo, ISAKMP_NPTYPE_T, ext, ep, phase, doi0, @@ -1216,8 +1232,8 @@ static const struct attrmap oakley_t_map[] = { static const u_char * ikev1_t_print(netdissect_options *ndo, u_char tpay _U_, const struct isakmp_gen *ext, u_int item_len, - const u_char *ep, u_int32_t phase _U_, u_int32_t doi _U_, - u_int32_t proto, int depth _U_) + const u_char *ep, uint32_t phase _U_, uint32_t doi _U_, + uint32_t proto, int depth _U_) { const struct ikev1_pl_t *p; struct ikev1_pl_t t; @@ -1229,9 +1245,9 @@ ikev1_t_print(netdissect_options *ndo, u_char tpay _U_, ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_T))); - p = (struct ikev1_pl_t *)ext; + p = (const struct ikev1_pl_t *)ext; ND_TCHECK(*p); - unaligned_memcpy(&t, ext, sizeof(t)); + UNALIGNED_MEMCPY(&t, ext, sizeof(t)); switch (proto) { case 1: @@ -1265,14 +1281,15 @@ ikev1_t_print(netdissect_options *ndo, u_char tpay _U_, ND_PRINT((ndo," #%d id=%s ", t.t_no, idstr)); else ND_PRINT((ndo," #%d id=%d ", t.t_no, t.t_id)); - cp = (u_char *)(p + 1); - ep2 = (u_char *)p + item_len; + cp = (const u_char *)(p + 1); + ep2 = (const u_char *)p + item_len; while (cp < ep && cp < ep2) { - if (map && nmap) { - cp = ikev1_attrmap_print(ndo, cp, (ep < ep2) ? ep : ep2, - map, nmap); - } else - cp = ikev1_attr_print(ndo, cp, (ep < ep2) ? ep : ep2); + if (map && nmap) + cp = ikev1_attrmap_print(ndo, cp, ep2, map, nmap); + else + cp = ikev1_attr_print(ndo, cp, ep2); + if (cp == NULL) + goto trunc; } if (ep < ep2) ND_PRINT((ndo,"...")); @@ -1285,22 +1302,23 @@ trunc: static const u_char * ikev1_ke_print(netdissect_options *ndo, u_char tpay _U_, const struct isakmp_gen *ext, u_int item_len _U_, - const u_char *ep _U_, u_int32_t phase _U_, u_int32_t doi _U_, - u_int32_t proto _U_, int depth _U_) + const u_char *ep _U_, uint32_t phase _U_, uint32_t doi _U_, + uint32_t proto _U_, int depth _U_) { struct isakmp_gen e; ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_KE))); ND_TCHECK(*ext); - unaligned_memcpy(&e, ext, sizeof(e)); + UNALIGNED_MEMCPY(&e, ext, sizeof(e)); ND_PRINT((ndo," key len=%d", ntohs(e.len) - 4)); if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) { + /* Print the entire payload in hex */ ND_PRINT((ndo," ")); - if (!rawprint(ndo, (caddr_t)(ext + 1), ntohs(e.len) - 4)) + if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4)) goto trunc; } - return (u_char *)ext + ntohs(e.len); + return (const u_char *)ext + ntohs(e.len); trunc: ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_KE))); return NULL; @@ -1308,9 +1326,9 @@ trunc: static const u_char * ikev1_id_print(netdissect_options *ndo, u_char tpay _U_, - const struct isakmp_gen *ext, u_int item_len _U_, - const u_char *ep _U_, u_int32_t phase, u_int32_t doi _U_, - u_int32_t proto _U_, int depth _U_) + const struct isakmp_gen *ext, u_int item_len, + const u_char *ep _U_, uint32_t phase, uint32_t doi _U_, + uint32_t proto _U_, int depth _U_) { #define USE_IPSECDOI_IN_PHASE1 1 const struct ikev1_pl_id *p; @@ -1328,11 +1346,11 @@ ikev1_id_print(netdissect_options *ndo, u_char tpay _U_, ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_ID))); - p = (struct ikev1_pl_id *)ext; + p = (const struct ikev1_pl_id *)ext; ND_TCHECK(*p); - unaligned_memcpy(&id, ext, sizeof(id)); + UNALIGNED_MEMCPY(&id, ext, sizeof(id)); if (sizeof(*p) < item_len) { - data = (u_char *)(p + 1); + data = (const u_char *)(p + 1); len = item_len - sizeof(*p); } else { data = NULL; @@ -1349,7 +1367,7 @@ ikev1_id_print(netdissect_options *ndo, u_char tpay _U_, default: ND_PRINT((ndo," idtype=%s", STR_OR_ID(id.d.id_type, idtypestr))); ND_PRINT((ndo," doi_data=%u", - (u_int32_t)(ntohl(id.d.doi_data) & 0xffffff))); + (uint32_t)(ntohl(id.d.doi_data) & 0xffffff))); break; #ifdef USE_IPSECDOI_IN_PHASE1 @@ -1357,40 +1375,31 @@ ikev1_id_print(netdissect_options *ndo, u_char tpay _U_, #endif case 2: { - const struct ipsecdoi_id *p; - struct ipsecdoi_id id; - struct protoent *pe; - - p = (struct ipsecdoi_id *)ext; - ND_TCHECK(*p); - unaligned_memcpy(&id, ext, sizeof(id)); - ND_PRINT((ndo," idtype=%s", STR_OR_ID(id.type, ipsecidtypestr))); - if (id.proto_id) { -#ifndef WIN32 - setprotoent(1); -#endif /* WIN32 */ - pe = getprotobynumber(id.proto_id); - if (pe) - ND_PRINT((ndo," protoid=%s", pe->p_name)); -#ifndef WIN32 - endprotoent(); -#endif /* WIN32 */ - } else { - /* it DOES NOT mean IPPROTO_IP! */ - ND_PRINT((ndo," protoid=%s", "0")); - } - ND_PRINT((ndo," port=%d", ntohs(id.port))); + const struct ipsecdoi_id *doi_p; + struct ipsecdoi_id doi_id; + const char *p_name; + + doi_p = (const struct ipsecdoi_id *)ext; + ND_TCHECK(*doi_p); + UNALIGNED_MEMCPY(&doi_id, ext, sizeof(doi_id)); + ND_PRINT((ndo," idtype=%s", STR_OR_ID(doi_id.type, ipsecidtypestr))); + /* A protocol ID of 0 DOES NOT mean IPPROTO_IP! */ + if (!ndo->ndo_nflag && doi_id.proto_id && (p_name = netdb_protoname(doi_id.proto_id)) != NULL) + ND_PRINT((ndo," protoid=%s", p_name)); + else + ND_PRINT((ndo," protoid=%u", doi_id.proto_id)); + ND_PRINT((ndo," port=%d", ntohs(doi_id.port))); if (!len) break; if (data == NULL) goto trunc; ND_TCHECK2(*data, len); - switch (id.type) { + switch (doi_id.type) { case IPSECDOI_ID_IPV4_ADDR: if (len < 4) ND_PRINT((ndo," len=%d [bad: < 4]", len)); else - ND_PRINT((ndo," len=%d %s", len, ipaddr_string(data))); + ND_PRINT((ndo," len=%d %s", len, ipaddr_string(ndo, data))); len = 0; break; case IPSECDOI_ID_FQDN: @@ -1399,7 +1408,7 @@ ikev1_id_print(netdissect_options *ndo, u_char tpay _U_, int i; ND_PRINT((ndo," len=%d ", len)); for (i = 0; i < len; i++) - safeputchar(data[i]); + safeputchar(ndo, EXTRACT_U_1(data + i)); len = 0; break; } @@ -1411,61 +1420,58 @@ ikev1_id_print(netdissect_options *ndo, u_char tpay _U_, else { mask = data + sizeof(struct in_addr); ND_PRINT((ndo," len=%d %s/%u.%u.%u.%u", len, - ipaddr_string(data), - mask[0], mask[1], mask[2], mask[3])); + ipaddr_string(ndo, data), + EXTRACT_U_1(mask), EXTRACT_U_1(mask + 1), + EXTRACT_U_1(mask + 2), EXTRACT_U_1(mask + 3))); } len = 0; break; } -#ifdef INET6 case IPSECDOI_ID_IPV6_ADDR: if (len < 16) ND_PRINT((ndo," len=%d [bad: < 16]", len)); else - ND_PRINT((ndo," len=%d %s", len, ip6addr_string(data))); + ND_PRINT((ndo," len=%d %s", len, ip6addr_string(ndo, data))); len = 0; break; case IPSECDOI_ID_IPV6_ADDR_SUBNET: { const u_char *mask; - if (len < 20) - ND_PRINT((ndo," len=%d [bad: < 20]", len)); + if (len < 32) + ND_PRINT((ndo," len=%d [bad: < 32]", len)); else { - mask = (u_char *)(data + sizeof(struct in6_addr)); + mask = (const u_char *)(data + sizeof(struct in6_addr)); /*XXX*/ ND_PRINT((ndo," len=%d %s/0x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x", len, - ip6addr_string(data), - mask[0], mask[1], mask[2], mask[3], - mask[4], mask[5], mask[6], mask[7], - mask[8], mask[9], mask[10], mask[11], - mask[12], mask[13], mask[14], mask[15])); + ip6addr_string(ndo, data), + EXTRACT_U_1(mask), EXTRACT_U_1(mask + 1), EXTRACT_U_1(mask + 2), EXTRACT_U_1(mask + 3), + EXTRACT_U_1(mask + 4), EXTRACT_U_1(mask + 5), EXTRACT_U_1(mask + 6), EXTRACT_U_1(mask + 7), + EXTRACT_U_1(mask + 8), EXTRACT_U_1(mask + 9), EXTRACT_U_1(mask + 10), EXTRACT_U_1(mask + 11), + EXTRACT_U_1(mask + 12), EXTRACT_U_1(mask + 13), EXTRACT_U_1(mask + 14), EXTRACT_U_1(mask + 15))); } len = 0; break; } -#endif /*INET6*/ case IPSECDOI_ID_IPV4_ADDR_RANGE: if (len < 8) ND_PRINT((ndo," len=%d [bad: < 8]", len)); else { ND_PRINT((ndo," len=%d %s-%s", len, - ipaddr_string(data), - ipaddr_string(data + sizeof(struct in_addr)))); + ipaddr_string(ndo, data), + ipaddr_string(ndo, data + sizeof(struct in_addr)))); } len = 0; break; -#ifdef INET6 case IPSECDOI_ID_IPV6_ADDR_RANGE: if (len < 32) ND_PRINT((ndo," len=%d [bad: < 32]", len)); else { ND_PRINT((ndo," len=%d %s-%s", len, - ip6addr_string(data), - ip6addr_string(data + sizeof(struct in6_addr)))); + ip6addr_string(ndo, data), + ip6addr_string(ndo, data + sizeof(struct in6_addr)))); } len = 0; break; -#endif /*INET6*/ case IPSECDOI_ID_DER_ASN1_DN: case IPSECDOI_ID_DER_ASN1_GN: case IPSECDOI_ID_KEY_ID: @@ -1478,11 +1484,11 @@ ikev1_id_print(netdissect_options *ndo, u_char tpay _U_, ND_PRINT((ndo," len=%d", len)); if (2 < ndo->ndo_vflag) { ND_PRINT((ndo," ")); - if (!rawprint(ndo, (caddr_t)data, len)) + if (!rawprint(ndo, (const uint8_t *)data, len)) goto trunc; } } - return (u_char *)ext + item_len; + return (const u_char *)ext + item_len; trunc: ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_ID))); return NULL; @@ -1490,10 +1496,10 @@ trunc: static const u_char * ikev1_cert_print(netdissect_options *ndo, u_char tpay _U_, - const struct isakmp_gen *ext, u_int item_len _U_, - const u_char *ep _U_, u_int32_t phase _U_, - u_int32_t doi0 _U_, - u_int32_t proto0 _U_, int depth _U_) + const struct isakmp_gen *ext, u_int item_len, + const u_char *ep _U_, uint32_t phase _U_, + uint32_t doi0 _U_, + uint32_t proto0 _U_, int depth _U_) { const struct ikev1_pl_cert *p; struct ikev1_pl_cert cert; @@ -1505,17 +1511,18 @@ ikev1_cert_print(netdissect_options *ndo, u_char tpay _U_, ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_CERT))); - p = (struct ikev1_pl_cert *)ext; + p = (const struct ikev1_pl_cert *)ext; ND_TCHECK(*p); - unaligned_memcpy(&cert, ext, sizeof(cert)); + UNALIGNED_MEMCPY(&cert, ext, sizeof(cert)); ND_PRINT((ndo," len=%d", item_len - 4)); ND_PRINT((ndo," type=%s", STR_OR_ID((cert.encode), certstr))); if (2 < ndo->ndo_vflag && 4 < item_len) { + /* Print the entire payload in hex */ ND_PRINT((ndo," ")); - if (!rawprint(ndo, (caddr_t)(ext + 1), item_len - 4)) + if (!rawprint(ndo, (const uint8_t *)(ext + 1), item_len - 4)) goto trunc; } - return (u_char *)ext + item_len; + return (const u_char *)ext + item_len; trunc: ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_CERT))); return NULL; @@ -1523,9 +1530,9 @@ trunc: static const u_char * ikev1_cr_print(netdissect_options *ndo, u_char tpay _U_, - const struct isakmp_gen *ext, u_int item_len _U_, - const u_char *ep _U_, u_int32_t phase _U_, u_int32_t doi0 _U_, - u_int32_t proto0 _U_, int depth _U_) + const struct isakmp_gen *ext, u_int item_len, + const u_char *ep _U_, uint32_t phase _U_, uint32_t doi0 _U_, + uint32_t proto0 _U_, int depth _U_) { const struct ikev1_pl_cert *p; struct ikev1_pl_cert cert; @@ -1537,17 +1544,18 @@ ikev1_cr_print(netdissect_options *ndo, u_char tpay _U_, ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_CR))); - p = (struct ikev1_pl_cert *)ext; + p = (const struct ikev1_pl_cert *)ext; ND_TCHECK(*p); - unaligned_memcpy(&cert, ext, sizeof(cert)); + UNALIGNED_MEMCPY(&cert, ext, sizeof(cert)); ND_PRINT((ndo," len=%d", item_len - 4)); ND_PRINT((ndo," type=%s", STR_OR_ID((cert.encode), certstr))); if (2 < ndo->ndo_vflag && 4 < item_len) { + /* Print the entire payload in hex */ ND_PRINT((ndo," ")); - if (!rawprint(ndo, (caddr_t)(ext + 1), item_len - 4)) + if (!rawprint(ndo, (const uint8_t *)(ext + 1), item_len - 4)) goto trunc; } - return (u_char *)ext + item_len; + return (const u_char *)ext + item_len; trunc: ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_CR))); return NULL; @@ -1556,22 +1564,23 @@ trunc: static const u_char * ikev1_hash_print(netdissect_options *ndo, u_char tpay _U_, const struct isakmp_gen *ext, u_int item_len _U_, - const u_char *ep _U_, u_int32_t phase _U_, u_int32_t doi _U_, - u_int32_t proto _U_, int depth _U_) + const u_char *ep _U_, uint32_t phase _U_, uint32_t doi _U_, + uint32_t proto _U_, int depth _U_) { struct isakmp_gen e; ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_HASH))); ND_TCHECK(*ext); - unaligned_memcpy(&e, ext, sizeof(e)); + UNALIGNED_MEMCPY(&e, ext, sizeof(e)); ND_PRINT((ndo," len=%d", ntohs(e.len) - 4)); if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) { + /* Print the entire payload in hex */ ND_PRINT((ndo," ")); - if (!rawprint(ndo, (caddr_t)(ext + 1), ntohs(e.len) - 4)) + if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4)) goto trunc; } - return (u_char *)ext + ntohs(e.len); + return (const u_char *)ext + ntohs(e.len); trunc: ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_HASH))); return NULL; @@ -1580,22 +1589,23 @@ trunc: static const u_char * ikev1_sig_print(netdissect_options *ndo, u_char tpay _U_, const struct isakmp_gen *ext, u_int item_len _U_, - const u_char *ep _U_, u_int32_t phase _U_, u_int32_t doi _U_, - u_int32_t proto _U_, int depth _U_) + const u_char *ep _U_, uint32_t phase _U_, uint32_t doi _U_, + uint32_t proto _U_, int depth _U_) { struct isakmp_gen e; ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_SIG))); ND_TCHECK(*ext); - unaligned_memcpy(&e, ext, sizeof(e)); + UNALIGNED_MEMCPY(&e, ext, sizeof(e)); ND_PRINT((ndo," len=%d", ntohs(e.len) - 4)); if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) { + /* Print the entire payload in hex */ ND_PRINT((ndo," ")); - if (!rawprint(ndo, (caddr_t)(ext + 1), ntohs(e.len) - 4)) + if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4)) goto trunc; } - return (u_char *)ext + ntohs(e.len); + return (const u_char *)ext + ntohs(e.len); trunc: ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_SIG))); return NULL; @@ -1605,27 +1615,32 @@ static const u_char * ikev1_nonce_print(netdissect_options *ndo, u_char tpay _U_, const struct isakmp_gen *ext, u_int item_len _U_, - const u_char *ep _U_, - u_int32_t phase _U_, u_int32_t doi _U_, - u_int32_t proto _U_, int depth _U_) + const u_char *ep, + uint32_t phase _U_, uint32_t doi _U_, + uint32_t proto _U_, int depth _U_) { struct isakmp_gen e; ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_NONCE))); ND_TCHECK(*ext); - unaligned_memcpy(&e, ext, sizeof(e)); - ND_PRINT((ndo," n len=%d", ntohs(e.len) - 4)); - if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) { - ND_PRINT((ndo," ")); - if (!rawprint(ndo, (caddr_t)(ext + 1), ntohs(e.len) - 4)) - goto trunc; - } else if (1 < ndo->ndo_vflag && 4 < ntohs(e.len)) { - ND_PRINT((ndo," ")); - if (!ike_show_somedata(ndo, (u_char *)(caddr_t)(ext + 1), ep)) - goto trunc; + UNALIGNED_MEMCPY(&e, ext, sizeof(e)); + /* + * Our caller has ensured that the length is >= 4. + */ + ND_PRINT((ndo," n len=%u", ntohs(e.len) - 4)); + if (ntohs(e.len) > 4) { + if (ndo->ndo_vflag > 2) { + ND_PRINT((ndo, " ")); + if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4)) + goto trunc; + } else if (ndo->ndo_vflag > 1) { + ND_PRINT((ndo, " ")); + if (!ike_show_somedata(ndo, (const u_char *)(ext + 1), ep)) + goto trunc; + } } - return (u_char *)ext + ntohs(e.len); + return (const u_char *)ext + ntohs(e.len); trunc: ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_NONCE))); return NULL; @@ -1634,14 +1649,15 @@ trunc: static const u_char * ikev1_n_print(netdissect_options *ndo, u_char tpay _U_, const struct isakmp_gen *ext, u_int item_len, - const u_char *ep, u_int32_t phase, u_int32_t doi0 _U_, - u_int32_t proto0 _U_, int depth) + const u_char *ep, uint32_t phase _U_, uint32_t doi0 _U_, + uint32_t proto0 _U_, int depth _U_) { - struct ikev1_pl_n *p, n; + const struct ikev1_pl_n *p; + struct ikev1_pl_n n; const u_char *cp; - u_char *ep2; - u_int32_t doi; - u_int32_t proto; + const u_char *ep2; + uint32_t doi; + uint32_t proto; static const char *notify_error_str[] = { NULL, "INVALID-PAYLOAD-TYPE", "DOI-NOT-SUPPORTED", "SITUATION-NOT-SUPPORTED", @@ -1690,9 +1706,9 @@ ikev1_n_print(netdissect_options *ndo, u_char tpay _U_, ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_N))); - p = (struct ikev1_pl_n *)ext; + p = (const struct ikev1_pl_n *)ext; ND_TCHECK(*p); - unaligned_memcpy(&n, ext, sizeof(n)); + UNALIGNED_MEMCPY(&n, ext, sizeof(n)); doi = ntohl(n.doi); proto = n.prot_id; if (doi != 1) { @@ -1708,10 +1724,10 @@ ikev1_n_print(netdissect_options *ndo, u_char tpay _U_, ND_PRINT((ndo," type=%s", numstr(ntohs(n.type)))); if (n.spi_size) { ND_PRINT((ndo," spi=")); - if (!rawprint(ndo, (caddr_t)(p + 1), n.spi_size)) + if (!rawprint(ndo, (const uint8_t *)(p + 1), n.spi_size)) goto trunc; } - return (u_char *)(p + 1) + n.spi_size; + return (const u_char *)(p + 1) + n.spi_size; } ND_PRINT((ndo," doi=ipsec")); @@ -1728,45 +1744,54 @@ ikev1_n_print(netdissect_options *ndo, u_char tpay _U_, ND_PRINT((ndo," type=%s", numstr(ntohs(n.type)))); if (n.spi_size) { ND_PRINT((ndo," spi=")); - if (!rawprint(ndo, (caddr_t)(p + 1), n.spi_size)) + if (!rawprint(ndo, (const uint8_t *)(p + 1), n.spi_size)) goto trunc; } - cp = (u_char *)(p + 1) + n.spi_size; - ep2 = (u_char *)p + item_len; + cp = (const u_char *)(p + 1) + n.spi_size; + ep2 = (const u_char *)p + item_len; if (cp < ep) { - ND_PRINT((ndo," orig=(")); switch (ntohs(n.type)) { case IPSECDOI_NTYPE_RESPONDER_LIFETIME: { const struct attrmap *map = oakley_t_map; size_t nmap = sizeof(oakley_t_map)/sizeof(oakley_t_map[0]); + ND_PRINT((ndo," attrs=(")); while (cp < ep && cp < ep2) { - cp = ikev1_attrmap_print(ndo, cp, - (ep < ep2) ? ep : ep2, map, nmap); + cp = ikev1_attrmap_print(ndo, cp, ep2, map, nmap); + if (cp == NULL) { + ND_PRINT((ndo,")")); + goto trunc; + } } + ND_PRINT((ndo,")")); break; } case IPSECDOI_NTYPE_REPLAY_STATUS: + ND_PRINT((ndo," status=(")); ND_PRINT((ndo,"replay detection %sabled", - EXTRACT_32BITS(cp) ? "en" : "dis")); - break; - case ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN: - if (ikev1_sub_print(ndo, ISAKMP_NPTYPE_SA, - (struct isakmp_gen *)cp, ep, phase, doi, proto, - depth) == NULL) - return NULL; + EXTRACT_BE_U_4(cp) ? "en" : "dis")); + ND_PRINT((ndo,")")); break; default: - /* NULL is dummy */ - isakmp_print(ndo, cp, - item_len - sizeof(*p) - n.spi_size, - NULL); + /* + * XXX - fill in more types here; see, for example, + * draft-ietf-ipsec-notifymsg-04. + */ + if (ndo->ndo_vflag > 3) { + ND_PRINT((ndo," data=(")); + if (!rawprint(ndo, (const uint8_t *)(cp), ep - cp)) + goto trunc; + ND_PRINT((ndo,")")); + } else { + if (!ike_show_somedata(ndo, cp, ep)) + goto trunc; + } + break; } - ND_PRINT((ndo,")")); } - return (u_char *)ext + item_len; + return (const u_char *)ext + item_len; trunc: ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_N))); return NULL; @@ -1775,21 +1800,21 @@ trunc: static const u_char * ikev1_d_print(netdissect_options *ndo, u_char tpay _U_, const struct isakmp_gen *ext, u_int item_len _U_, - const u_char *ep _U_, u_int32_t phase _U_, u_int32_t doi0 _U_, - u_int32_t proto0 _U_, int depth _U_) + const u_char *ep _U_, uint32_t phase _U_, uint32_t doi0 _U_, + uint32_t proto0 _U_, int depth _U_) { const struct ikev1_pl_d *p; struct ikev1_pl_d d; - const u_int8_t *q; - u_int32_t doi; - u_int32_t proto; + const uint8_t *q; + uint32_t doi; + uint32_t proto; int i; ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_D))); - p = (struct ikev1_pl_d *)ext; + p = (const struct ikev1_pl_d *)ext; ND_TCHECK(*p); - unaligned_memcpy(&d, ext, sizeof(d)); + UNALIGNED_MEMCPY(&d, ext, sizeof(d)); doi = ntohl(d.doi); proto = d.prot_id; if (doi != 1) { @@ -1802,11 +1827,11 @@ ikev1_d_print(netdissect_options *ndo, u_char tpay _U_, ND_PRINT((ndo," spilen=%u", d.spi_size)); ND_PRINT((ndo," nspi=%u", ntohs(d.num_spi))); ND_PRINT((ndo," spi=")); - q = (u_int8_t *)(p + 1); + q = (const uint8_t *)(p + 1); for (i = 0; i < ntohs(d.num_spi); i++) { if (i != 0) ND_PRINT((ndo,",")); - if (!rawprint(ndo, (caddr_t)q, d.spi_size)) + if (!rawprint(ndo, (const uint8_t *)q, d.spi_size)) goto trunc; q += d.spi_size; } @@ -1820,22 +1845,23 @@ static const u_char * ikev1_vid_print(netdissect_options *ndo, u_char tpay _U_, const struct isakmp_gen *ext, u_int item_len _U_, const u_char *ep _U_, - u_int32_t phase _U_, u_int32_t doi _U_, - u_int32_t proto _U_, int depth _U_) + uint32_t phase _U_, uint32_t doi _U_, + uint32_t proto _U_, int depth _U_) { struct isakmp_gen e; ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_VID))); ND_TCHECK(*ext); - unaligned_memcpy(&e, ext, sizeof(e)); + UNALIGNED_MEMCPY(&e, ext, sizeof(e)); ND_PRINT((ndo," len=%d", ntohs(e.len) - 4)); if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) { + /* Print the entire payload in hex */ ND_PRINT((ndo," ")); - if (!rawprint(ndo, (caddr_t)(ext + 1), ntohs(e.len) - 4)) + if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4)) goto trunc; } - return (u_char *)ext + ntohs(e.len); + return (const u_char *)ext + ntohs(e.len); trunc: ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_VID))); return NULL; @@ -1860,39 +1886,39 @@ ikev2_gen_print(netdissect_options *ndo, u_char tpay, struct isakmp_gen e; ND_TCHECK(*ext); - unaligned_memcpy(&e, ext, sizeof(e)); + UNALIGNED_MEMCPY(&e, ext, sizeof(e)); ikev2_pay_print(ndo, NPSTR(tpay), e.critical); ND_PRINT((ndo," len=%d", ntohs(e.len) - 4)); if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) { + /* Print the entire payload in hex */ ND_PRINT((ndo," ")); - if (!rawprint(ndo, (caddr_t)(ext + 1), ntohs(e.len) - 4)) + if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4)) goto trunc; } - return (u_char *)ext + ntohs(e.len); + return (const u_char *)ext + ntohs(e.len); trunc: ND_PRINT((ndo," [|%s]", NPSTR(tpay))); return NULL; } static const u_char * -ikev2_t_print(netdissect_options *ndo, u_char tpay _U_, int pcount, +ikev2_t_print(netdissect_options *ndo, int tcount, const struct isakmp_gen *ext, u_int item_len, - const u_char *ep, u_int32_t phase _U_, u_int32_t doi _U_, - u_int32_t proto _U_, int depth _U_) + const u_char *ep) { const struct ikev2_t *p; struct ikev2_t t; - u_int16_t t_id; + uint16_t t_id; const u_char *cp; const char *idstr; const struct attrmap *map; size_t nmap; const u_char *ep2; - p = (struct ikev2_t *)ext; + p = (const struct ikev2_t *)ext; ND_TCHECK(*p); - unaligned_memcpy(&t, ext, sizeof(t)); + UNALIGNED_MEMCPY(&t, ext, sizeof(t)); ikev2_pay_print(ndo, NPSTR(ISAKMP_NPTYPE_T), t.h.critical); t_id = ntohs(t.t_id); @@ -1929,21 +1955,22 @@ ikev2_t_print(netdissect_options *ndo, u_char tpay _U_, int pcount, } if (idstr) - ND_PRINT((ndo," #%u type=%s id=%s ", pcount, + ND_PRINT((ndo," #%u type=%s id=%s ", tcount, STR_OR_ID(t.t_type, ikev2_t_type_map), idstr)); else - ND_PRINT((ndo," #%u type=%s id=%u ", pcount, + ND_PRINT((ndo," #%u type=%s id=%u ", tcount, STR_OR_ID(t.t_type, ikev2_t_type_map), t.t_id)); - cp = (u_char *)(p + 1); - ep2 = (u_char *)p + item_len; + cp = (const u_char *)(p + 1); + ep2 = (const u_char *)p + item_len; while (cp < ep && cp < ep2) { if (map && nmap) { - cp = ikev1_attrmap_print(ndo, cp, (ep < ep2) ? ep : ep2, - map, nmap); + cp = ikev1_attrmap_print(ndo, cp, ep2, map, nmap); } else - cp = ikev1_attr_print(ndo, cp, (ep < ep2) ? ep : ep2); + cp = ikev1_attr_print(ndo, cp, ep2); + if (cp == NULL) + goto trunc; } if (ep < ep2) ND_PRINT((ndo,"...")); @@ -1955,34 +1982,96 @@ trunc: static const u_char * ikev2_p_print(netdissect_options *ndo, u_char tpay _U_, int pcount _U_, - const struct isakmp_gen *ext, u_int item_len _U_, - const u_char *ep, u_int32_t phase, u_int32_t doi0, - u_int32_t proto0 _U_, int depth) + const struct isakmp_gen *ext, u_int oprop_length, + const u_char *ep, int depth) { const struct ikev2_p *p; struct ikev2_p prop; + u_int prop_length; const u_char *cp; + int i; + int tcount; + u_char np; + struct isakmp_gen e; + u_int item_len; - p = (struct ikev2_p *)ext; + p = (const struct ikev2_p *)ext; ND_TCHECK(*p); - unaligned_memcpy(&prop, ext, sizeof(prop)); + UNALIGNED_MEMCPY(&prop, ext, sizeof(prop)); + ikev2_pay_print(ndo, NPSTR(ISAKMP_NPTYPE_P), prop.h.critical); + /* + * ikev2_sa_print() guarantees that this is >= 4. + */ + prop_length = oprop_length - 4; ND_PRINT((ndo," #%u protoid=%s transform=%d len=%u", prop.p_no, PROTOIDSTR(prop.prot_id), - prop.num_t, ntohs(prop.h.len))); + prop.num_t, oprop_length)); + cp = (const u_char *)(p + 1); + if (prop.spi_size) { + if (prop_length < prop.spi_size) + goto toolong; ND_PRINT((ndo," spi=")); - if (!rawprint(ndo, (caddr_t)(p + 1), prop.spi_size)) + if (!rawprint(ndo, (const uint8_t *)cp, prop.spi_size)) goto trunc; + cp += prop.spi_size; + prop_length -= prop.spi_size; } - ext = (struct isakmp_gen *)((u_char *)(p + 1) + prop.spi_size); - ND_TCHECK(*ext); + /* + * Print the transforms. + */ + tcount = 0; + for (np = ISAKMP_NPTYPE_T; np != 0; np = e.np) { + tcount++; + ext = (const struct isakmp_gen *)cp; + if (prop_length < sizeof(*ext)) + goto toolong; + ND_TCHECK(*ext); + UNALIGNED_MEMCPY(&e, ext, sizeof(e)); - cp = ikev2_sub_print(ndo, NULL, ISAKMP_NPTYPE_T, ext, ep, phase, doi0, - prop.prot_id, depth); + /* + * Since we can't have a payload length of less than 4 bytes, + * we need to bail out here if the generic header is nonsensical + * or truncated, otherwise we could loop forever processing + * zero-length items or otherwise misdissect the packet. + */ + item_len = ntohs(e.len); + if (item_len <= 4) + goto trunc; + if (prop_length < item_len) + goto toolong; + ND_TCHECK2(*cp, item_len); + + depth++; + ND_PRINT((ndo,"\n")); + for (i = 0; i < depth; i++) + ND_PRINT((ndo," ")); + ND_PRINT((ndo,"(")); + if (np == ISAKMP_NPTYPE_T) { + cp = ikev2_t_print(ndo, tcount, ext, item_len, ep); + if (cp == NULL) { + /* error, already reported */ + return NULL; + } + } else { + ND_PRINT((ndo, "%s", NPSTR(np))); + cp += item_len; + } + ND_PRINT((ndo,")")); + depth--; + prop_length -= item_len; + } + return cp; +toolong: + /* + * Skip the rest of the proposal. + */ + cp += prop_length; + ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_P))); return cp; trunc: ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_P))); @@ -1992,26 +2081,85 @@ trunc: static const u_char * ikev2_sa_print(netdissect_options *ndo, u_char tpay, const struct isakmp_gen *ext1, - u_int item_len _U_, const u_char *ep _U_, - u_int32_t phase _U_, u_int32_t doi _U_, - u_int32_t proto _U_, int depth _U_) + u_int osa_length, const u_char *ep, + uint32_t phase _U_, uint32_t doi _U_, + uint32_t proto _U_, int depth) { + const struct isakmp_gen *ext; struct isakmp_gen e; - int osa_length, sa_length; + u_int sa_length; + const u_char *cp; + int i; + int pcount; + u_char np; + u_int item_len; ND_TCHECK(*ext1); - unaligned_memcpy(&e, ext1, sizeof(e)); + UNALIGNED_MEMCPY(&e, ext1, sizeof(e)); ikev2_pay_print(ndo, "sa", e.critical); + /* + * ikev2_sub0_print() guarantees that this is >= 4. + */ osa_length= ntohs(e.len); sa_length = osa_length - 4; ND_PRINT((ndo," len=%d", sa_length)); - ikev2_sub_print(ndo, NULL, ISAKMP_NPTYPE_P, - ext1+1, ep, - 0, 0, 0, depth); + /* + * Print the payloads. + */ + cp = (const u_char *)(ext1 + 1); + pcount = 0; + for (np = ISAKMP_NPTYPE_P; np != 0; np = e.np) { + pcount++; + ext = (const struct isakmp_gen *)cp; + if (sa_length < sizeof(*ext)) + goto toolong; + ND_TCHECK(*ext); + UNALIGNED_MEMCPY(&e, ext, sizeof(e)); + + /* + * Since we can't have a payload length of less than 4 bytes, + * we need to bail out here if the generic header is nonsensical + * or truncated, otherwise we could loop forever processing + * zero-length items or otherwise misdissect the packet. + */ + item_len = ntohs(e.len); + if (item_len <= 4) + goto trunc; + + if (sa_length < item_len) + goto toolong; + ND_TCHECK2(*cp, item_len); - return (u_char *)ext1 + osa_length; + depth++; + ND_PRINT((ndo,"\n")); + for (i = 0; i < depth; i++) + ND_PRINT((ndo," ")); + ND_PRINT((ndo,"(")); + if (np == ISAKMP_NPTYPE_P) { + cp = ikev2_p_print(ndo, np, pcount, ext, item_len, + ep, depth); + if (cp == NULL) { + /* error, already reported */ + return NULL; + } + } else { + ND_PRINT((ndo, "%s", NPSTR(np))); + cp += item_len; + } + ND_PRINT((ndo,")")); + depth--; + sa_length -= item_len; + } + return cp; +toolong: + /* + * Skip the rest of the SA. + */ + cp += sa_length; + ND_PRINT((ndo," [|%s]", NPSTR(tpay))); + return cp; trunc: ND_PRINT((ndo," [|%s]", NPSTR(tpay))); return NULL; @@ -2021,15 +2169,15 @@ static const u_char * ikev2_ke_print(netdissect_options *ndo, u_char tpay, const struct isakmp_gen *ext, u_int item_len _U_, const u_char *ep _U_, - u_int32_t phase _U_, u_int32_t doi _U_, - u_int32_t proto _U_, int depth _U_) + uint32_t phase _U_, uint32_t doi _U_, + uint32_t proto _U_, int depth _U_) { struct ikev2_ke ke; - struct ikev2_ke *k; + const struct ikev2_ke *k; - k = (struct ikev2_ke *)ext; - ND_TCHECK(*ext); - unaligned_memcpy(&ke, ext, sizeof(ke)); + k = (const struct ikev2_ke *)ext; + ND_TCHECK(*k); + UNALIGNED_MEMCPY(&ke, ext, sizeof(ke)); ikev2_pay_print(ndo, NPSTR(tpay), ke.h.critical); ND_PRINT((ndo," len=%u group=%s", ntohs(ke.h.len) - 8, @@ -2037,10 +2185,10 @@ ikev2_ke_print(netdissect_options *ndo, u_char tpay, if (2 < ndo->ndo_vflag && 8 < ntohs(ke.h.len)) { ND_PRINT((ndo," ")); - if (!rawprint(ndo, (caddr_t)(k + 1), ntohs(ke.h.len) - 8)) + if (!rawprint(ndo, (const uint8_t *)(k + 1), ntohs(ke.h.len) - 8)) goto trunc; } - return (u_char *)ext + ntohs(ke.h.len); + return (const u_char *)ext + ntohs(ke.h.len); trunc: ND_PRINT((ndo," [|%s]", NPSTR(tpay))); return NULL; @@ -2050,31 +2198,34 @@ static const u_char * ikev2_ID_print(netdissect_options *ndo, u_char tpay, const struct isakmp_gen *ext, u_int item_len _U_, const u_char *ep _U_, - u_int32_t phase _U_, u_int32_t doi _U_, - u_int32_t proto _U_, int depth _U_) + uint32_t phase _U_, uint32_t doi _U_, + uint32_t proto _U_, int depth _U_) { + const struct ikev2_id *idp; struct ikev2_id id; int id_len, idtype_len, i; unsigned int dumpascii, dumphex; - unsigned char *typedata; + const unsigned char *typedata; - ND_TCHECK(*ext); - unaligned_memcpy(&id, ext, sizeof(id)); + idp = (const struct ikev2_id *)ext; + ND_TCHECK(*idp); + UNALIGNED_MEMCPY(&id, ext, sizeof(id)); ikev2_pay_print(ndo, NPSTR(tpay), id.h.critical); id_len = ntohs(id.h.len); ND_PRINT((ndo," len=%d", id_len - 4)); if (2 < ndo->ndo_vflag && 4 < id_len) { + /* Print the entire payload in hex */ ND_PRINT((ndo," ")); - if (!rawprint(ndo, (caddr_t)(ext + 1), id_len - 4)) + if (!rawprint(ndo, (const uint8_t *)(ext + 1), id_len - 4)) goto trunc; } idtype_len =id_len - sizeof(struct ikev2_id); dumpascii = 0; dumphex = 0; - typedata = (unsigned char *)(ext)+sizeof(struct ikev2_id); + typedata = (const unsigned char *)(ext)+sizeof(struct ikev2_id); switch(id.type) { case ID_IPV4_ADDR: @@ -2110,19 +2261,19 @@ ikev2_ID_print(netdissect_options *ndo, u_char tpay, if(dumpascii) { ND_TCHECK2(*typedata, idtype_len); for(i=0; i= 4. + */ + ND_PRINT((ndo," len=%u method=%s", len-4, STR_OR_ID(a.auth_method, v2_auth))); - - if (1 < ndo->ndo_vflag && 4 < len) { - ND_PRINT((ndo," authdata=(")); - if (!rawprint(ndo, (caddr_t)authdata, len - sizeof(a))) - goto trunc; - ND_PRINT((ndo,") ")); - } else if(ndo->ndo_vflag && 4 < len) { - if(!ike_show_somedata(ndo, authdata, ep)) goto trunc; + if (len > 4) { + if (ndo->ndo_vflag > 1) { + ND_PRINT((ndo, " authdata=(")); + if (!rawprint(ndo, (const uint8_t *)authdata, len - sizeof(a))) + goto trunc; + ND_PRINT((ndo, ") ")); + } else if (ndo->ndo_vflag) { + if (!ike_show_somedata(ndo, authdata, ep)) + goto trunc; + } } - return (u_char *)ext + len; + return (const u_char *)ext + len; trunc: ND_PRINT((ndo," [|%s]", NPSTR(tpay))); return NULL; @@ -2187,27 +2343,27 @@ trunc: static const u_char * ikev2_nonce_print(netdissect_options *ndo, u_char tpay, const struct isakmp_gen *ext, - u_int item_len _U_, const u_char *ep _U_, - u_int32_t phase _U_, u_int32_t doi _U_, - u_int32_t proto _U_, int depth _U_) + u_int item_len _U_, const u_char *ep, + uint32_t phase _U_, uint32_t doi _U_, + uint32_t proto _U_, int depth _U_) { struct isakmp_gen e; ND_TCHECK(*ext); - unaligned_memcpy(&e, ext, sizeof(e)); + UNALIGNED_MEMCPY(&e, ext, sizeof(e)); ikev2_pay_print(ndo, "nonce", e.critical); ND_PRINT((ndo," len=%d", ntohs(e.len) - 4)); if (1 < ndo->ndo_vflag && 4 < ntohs(e.len)) { ND_PRINT((ndo," nonce=(")); - if (!rawprint(ndo, (caddr_t)(ext + 1), ntohs(e.len) - 4)) + if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4)) goto trunc; ND_PRINT((ndo,") ")); } else if(ndo->ndo_vflag && 4 < ntohs(e.len)) { if(!ike_show_somedata(ndo, (const u_char *)(ext+1), ep)) goto trunc; } - return (u_char *)ext + ntohs(e.len); + return (const u_char *)ext + ntohs(e.len); trunc: ND_PRINT((ndo," [|%s]", NPSTR(tpay))); return NULL; @@ -2217,23 +2373,23 @@ trunc: static const u_char * ikev2_n_print(netdissect_options *ndo, u_char tpay _U_, const struct isakmp_gen *ext, - u_int item_len _U_, const u_char *ep _U_, - u_int32_t phase _U_, u_int32_t doi _U_, - u_int32_t proto _U_, int depth _U_) + u_int item_len, const u_char *ep, + uint32_t phase _U_, uint32_t doi _U_, + uint32_t proto _U_, int depth _U_) { - struct ikev2_n *p, n; + const struct ikev2_n *p; + struct ikev2_n n; const u_char *cp; - u_char showspi, showdata, showsomedata; + u_char showspi, showsomedata; const char *notify_name; - u_int32_t type; + uint32_t type; - p = (struct ikev2_n *)ext; + p = (const struct ikev2_n *)ext; ND_TCHECK(*p); - unaligned_memcpy(&n, ext, sizeof(n)); + UNALIGNED_MEMCPY(&n, ext, sizeof(n)); ikev2_pay_print(ndo, NPSTR(ISAKMP_NPTYPE_N), n.h.critical); showspi = 1; - showdata = 0; showsomedata=0; notify_name=NULL; @@ -2347,7 +2503,6 @@ ikev2_n_print(netdissect_options *ndo, u_char tpay _U_, notify_name = "cookie"; showspi = 1; showsomedata= 1; - showdata= 0; break; case IV2_NOTIFY_USE_TRANSPORT_MODE: @@ -2394,28 +2549,26 @@ ikev2_n_print(netdissect_options *ndo, u_char tpay _U_, if (showspi && n.spi_size) { ND_PRINT((ndo," spi=")); - if (!rawprint(ndo, (caddr_t)(p + 1), n.spi_size)) + if (!rawprint(ndo, (const uint8_t *)(p + 1), n.spi_size)) goto trunc; } - cp = (u_char *)(p + 1) + n.spi_size; + cp = (const u_char *)(p + 1) + n.spi_size; - if(3 < ndo->ndo_vflag) { - showdata = 1; - } - - if ((showdata || (showsomedata && ep-cp < 30)) && cp < ep) { - ND_PRINT((ndo," data=(")); - if (!rawprint(ndo, (caddr_t)(cp), ep - cp)) - goto trunc; - - ND_PRINT((ndo,")")); + if (cp < ep) { + if (ndo->ndo_vflag > 3 || (showsomedata && ep-cp < 30)) { + ND_PRINT((ndo," data=(")); + if (!rawprint(ndo, (const uint8_t *)(cp), ep - cp)) + goto trunc; - } else if(showsomedata && cp < ep) { - if(!ike_show_somedata(ndo, cp, ep)) goto trunc; + ND_PRINT((ndo,")")); + } else if (showsomedata) { + if (!ike_show_somedata(ndo, cp, ep)) + goto trunc; + } } - return (u_char *)ext + item_len; + return (const u_char *)ext + item_len; trunc: ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_N))); return NULL; @@ -2425,8 +2578,8 @@ static const u_char * ikev2_d_print(netdissect_options *ndo, u_char tpay, const struct isakmp_gen *ext, u_int item_len _U_, const u_char *ep _U_, - u_int32_t phase _U_, u_int32_t doi _U_, - u_int32_t proto _U_, int depth _U_) + uint32_t phase _U_, uint32_t doi _U_, + uint32_t proto _U_, int depth _U_) { return ikev2_gen_print(ndo, tpay, ext); } @@ -2435,15 +2588,15 @@ static const u_char * ikev2_vid_print(netdissect_options *ndo, u_char tpay, const struct isakmp_gen *ext, u_int item_len _U_, const u_char *ep _U_, - u_int32_t phase _U_, u_int32_t doi _U_, - u_int32_t proto _U_, int depth _U_) + uint32_t phase _U_, uint32_t doi _U_, + uint32_t proto _U_, int depth _U_) { struct isakmp_gen e; const u_char *vid; int i, len; ND_TCHECK(*ext); - unaligned_memcpy(&e, ext, sizeof(e)); + UNALIGNED_MEMCPY(&e, ext, sizeof(e)); ikev2_pay_print(ndo, NPSTR(tpay), e.critical); ND_PRINT((ndo," len=%d vid=", ntohs(e.len) - 4)); @@ -2451,15 +2604,17 @@ ikev2_vid_print(netdissect_options *ndo, u_char tpay, len = ntohs(e.len) - 4; ND_TCHECK2(*vid, len); for(i=0; indo_vflag && 4 < len) { + /* Print the entire payload in hex */ ND_PRINT((ndo," ")); - if (!rawprint(ndo, (caddr_t)(ext + 1), ntohs(e.len) - 4)) + if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4)) goto trunc; } - return (u_char *)ext + ntohs(e.len); + return (const u_char *)ext + ntohs(e.len); trunc: ND_PRINT((ndo," [|%s]", NPSTR(tpay))); return NULL; @@ -2469,8 +2624,8 @@ static const u_char * ikev2_TS_print(netdissect_options *ndo, u_char tpay, const struct isakmp_gen *ext, u_int item_len _U_, const u_char *ep _U_, - u_int32_t phase _U_, u_int32_t doi _U_, - u_int32_t proto _U_, int depth _U_) + uint32_t phase _U_, uint32_t doi _U_, + uint32_t proto _U_, int depth _U_) { return ikev2_gen_print(ndo, tpay, ext); } @@ -2487,26 +2642,26 @@ ikev2_e_print(netdissect_options *ndo, #ifndef HAVE_LIBCRYPTO _U_ #endif - u_int32_t phase, + uint32_t phase, #ifndef HAVE_LIBCRYPTO _U_ #endif - u_int32_t doi, + uint32_t doi, #ifndef HAVE_LIBCRYPTO _U_ #endif - u_int32_t proto, + uint32_t proto, #ifndef HAVE_LIBCRYPTO _U_ #endif int depth) { struct isakmp_gen e; - u_char *dat; + const u_char *dat; volatile int dlen; ND_TCHECK(*ext); - unaligned_memcpy(&e, ext, sizeof(e)); + UNALIGNED_MEMCPY(&e, ext, sizeof(e)); ikev2_pay_print(ndo, NPSTR(tpay), e.critical); dlen = ntohs(e.len)-4; @@ -2514,11 +2669,11 @@ ikev2_e_print(netdissect_options *ndo, ND_PRINT((ndo," len=%d", dlen)); if (2 < ndo->ndo_vflag && 4 < dlen) { ND_PRINT((ndo," ")); - if (!rawprint(ndo, (caddr_t)(ext + 1), dlen)) + if (!rawprint(ndo, (const uint8_t *)(ext + 1), dlen)) goto trunc; } - dat = (u_char *)(ext+1); + dat = (const u_char *)(ext+1); ND_TCHECK2(*dat, dlen); #ifdef HAVE_LIBCRYPTO @@ -2550,8 +2705,8 @@ static const u_char * ikev2_cp_print(netdissect_options *ndo, u_char tpay, const struct isakmp_gen *ext, u_int item_len _U_, const u_char *ep _U_, - u_int32_t phase _U_, u_int32_t doi _U_, - u_int32_t proto _U_, int depth _U_) + uint32_t phase _U_, uint32_t doi _U_, + uint32_t proto _U_, int depth _U_) { return ikev2_gen_print(ndo, tpay, ext); } @@ -2560,8 +2715,8 @@ static const u_char * ikev2_eap_print(netdissect_options *ndo, u_char tpay, const struct isakmp_gen *ext, u_int item_len _U_, const u_char *ep _U_, - u_int32_t phase _U_, u_int32_t doi _U_, - u_int32_t proto _U_, int depth _U_) + uint32_t phase _U_, uint32_t doi _U_, + uint32_t proto _U_, int depth _U_) { return ikev2_gen_print(ndo, tpay, ext); } @@ -2570,15 +2725,15 @@ static const u_char * ike_sub0_print(netdissect_options *ndo, u_char np, const struct isakmp_gen *ext, const u_char *ep, - u_int32_t phase, u_int32_t doi, u_int32_t proto, int depth) + uint32_t phase, uint32_t doi, uint32_t proto, int depth) { const u_char *cp; struct isakmp_gen e; u_int item_len; - cp = (u_char *)ext; + cp = (const u_char *)ext; ND_TCHECK(*ext); - unaligned_memcpy(&e, ext, sizeof(e)); + UNALIGNED_MEMCPY(&e, ext, sizeof(e)); /* * Since we can't have a payload length of less than 4 bytes, @@ -2610,7 +2765,7 @@ trunc: static const u_char * ikev1_sub_print(netdissect_options *ndo, u_char np, const struct isakmp_gen *ext, const u_char *ep, - u_int32_t phase, u_int32_t doi, u_int32_t proto, int depth) + uint32_t phase, uint32_t doi, uint32_t proto, int depth) { const u_char *cp; int i; @@ -2620,8 +2775,7 @@ ikev1_sub_print(netdissect_options *ndo, while (np) { ND_TCHECK(*ext); - - unaligned_memcpy(&e, ext, sizeof(e)); + UNALIGNED_MEMCPY(&e, ext, sizeof(e)); ND_TCHECK2(*ext, ntohs(e.len)); @@ -2640,7 +2794,7 @@ ikev1_sub_print(netdissect_options *ndo, } np = e.np; - ext = (struct isakmp_gen *)cp; + ext = (const struct isakmp_gen *)cp; } return cp; trunc: @@ -2670,7 +2824,7 @@ ikev1_print(netdissect_options *ndo, p = (const struct isakmp *)bp; ep = ndo->ndo_snapend; - phase = (EXTRACT_32BITS(base->msgid) == 0) ? 1 : 2; + phase = (EXTRACT_BE_U_4(base->msgid) == 0) ? 1 : 2; if (phase == 1) ND_PRINT((ndo," phase %d", phase)); else @@ -2678,7 +2832,7 @@ ikev1_print(netdissect_options *ndo, i = cookie_find(&base->i_ck); if (i < 0) { - if (iszero((u_char *)&base->r_ck, sizeof(base->r_ck))) { + if (iszero((const u_char *)&base->r_ck, sizeof(base->r_ck))) { /* the first packet */ ND_PRINT((ndo," I")); if (bp2) @@ -2717,7 +2871,7 @@ ikev1_print(netdissect_options *ndo, CHECKLEN(p + 1, base->np); np = base->np; - ext = (struct isakmp_gen *)(p + 1); + ext = (const struct isakmp_gen *)(p + 1); ikev1_sub_print(ndo, np, ext, ep, phase, 0, 0, 0); } @@ -2725,24 +2879,24 @@ done: if (ndo->ndo_vflag) { if (ntohl(base->len) != length) { ND_PRINT((ndo," (len mismatch: isakmp %u/ip %u)", - (u_int32_t)ntohl(base->len), length)); + (uint32_t)ntohl(base->len), length)); } } } static const u_char * ikev2_sub0_print(netdissect_options *ndo, struct isakmp *base, - u_char np, int pcount, + u_char np, const struct isakmp_gen *ext, const u_char *ep, - u_int32_t phase, u_int32_t doi, u_int32_t proto, int depth) + uint32_t phase, uint32_t doi, uint32_t proto, int depth) { const u_char *cp; struct isakmp_gen e; u_int item_len; - cp = (u_char *)ext; + cp = (const u_char *)ext; ND_TCHECK(*ext); - unaligned_memcpy(&e, ext, sizeof(e)); + UNALIGNED_MEMCPY(&e, ext, sizeof(e)); /* * Since we can't have a payload length of less than 4 bytes, @@ -2754,13 +2908,7 @@ ikev2_sub0_print(netdissect_options *ndo, struct isakmp *base, if (item_len <= 4) return NULL; - if(np == ISAKMP_NPTYPE_P) { - cp = ikev2_p_print(ndo, np, pcount, ext, item_len, - ep, phase, doi, proto, depth); - } else if(np == ISAKMP_NPTYPE_T) { - cp = ikev2_t_print(ndo, np, pcount, ext, item_len, - ep, phase, doi, proto, depth); - } else if(np == ISAKMP_NPTYPE_v2E) { + if (np == ISAKMP_NPTYPE_v2E) { cp = ikev2_e_print(ndo, base, np, ext, item_len, ep, phase, doi, proto, depth); } else if (NPFUNC(np)) { @@ -2768,7 +2916,7 @@ ikev2_sub0_print(netdissect_options *ndo, struct isakmp *base, * XXX - what if item_len is too short, or too long, * for this payload type? */ - cp = (*npfunc[np])(ndo, np, /*pcount,*/ ext, item_len, + cp = (*npfunc[np])(ndo, np, ext, item_len, ep, phase, doi, proto, depth); } else { ND_PRINT((ndo,"%s", NPSTR(np))); @@ -2785,20 +2933,16 @@ static const u_char * ikev2_sub_print(netdissect_options *ndo, struct isakmp *base, u_char np, const struct isakmp_gen *ext, const u_char *ep, - u_int32_t phase, u_int32_t doi, u_int32_t proto, int depth) + uint32_t phase, uint32_t doi, uint32_t proto, int depth) { const u_char *cp; int i; - int pcount; struct isakmp_gen e; cp = (const u_char *)ext; - pcount = 0; while (np) { - pcount++; ND_TCHECK(*ext); - - unaligned_memcpy(&e, ext, sizeof(e)); + UNALIGNED_MEMCPY(&e, ext, sizeof(e)); ND_TCHECK2(*ext, ntohs(e.len)); @@ -2807,7 +2951,7 @@ ikev2_sub_print(netdissect_options *ndo, for (i = 0; i < depth; i++) ND_PRINT((ndo," ")); ND_PRINT((ndo,"(")); - cp = ikev2_sub0_print(ndo, base, np, pcount, + cp = ikev2_sub0_print(ndo, base, np, ext, ep, phase, doi, proto, depth); ND_PRINT((ndo,")")); depth--; @@ -2818,7 +2962,7 @@ ikev2_sub_print(netdissect_options *ndo, } np = e.np; - ext = (struct isakmp_gen *)cp; + ext = (const struct isakmp_gen *)cp; } return cp; trunc: @@ -2839,7 +2983,7 @@ ikev2_print(netdissect_options *ndo, p = (const struct isakmp *)bp; ep = ndo->ndo_snapend; - phase = (EXTRACT_32BITS(base->msgid) == 0) ? 1 : 2; + phase = (EXTRACT_BE_U_4(base->msgid) == 0) ? 1 : 2; if (phase == 1) ND_PRINT((ndo, " parent_sa")); else @@ -2871,7 +3015,7 @@ ikev2_print(netdissect_options *ndo, CHECKLEN(p + 1, base->np) np = base->np; - ext = (struct isakmp_gen *)(p + 1); + ext = (const struct isakmp_gen *)(p + 1); ikev2_sub_print(ndo, base, np, ext, ep, phase, 0, 0, 0); } @@ -2879,7 +3023,7 @@ done: if (ndo->ndo_vflag) { if (ntohl(base->len) != length) { ND_PRINT((ndo, " (len mismatch: isakmp %u/ip %u)", - (u_int32_t)ntohl(base->len), length)); + (uint32_t)ntohl(base->len), length)); } } } @@ -2905,12 +3049,12 @@ isakmp_print(netdissect_options *ndo, p = (const struct isakmp *)bp; ep = ndo->ndo_snapend; - if ((struct isakmp *)ep < p + 1) { + if ((const struct isakmp *)ep < p + 1) { ND_PRINT((ndo,"[|isakmp]")); return; } - unaligned_memcpy(&base, p, sizeof(base)); + UNALIGNED_MEMCPY(&base, p, sizeof(base)); ND_PRINT((ndo,"isakmp")); major = (base.vers & ISAKMP_VERS_MAJOR) @@ -2924,14 +3068,14 @@ isakmp_print(netdissect_options *ndo, if (ndo->ndo_vflag) { ND_PRINT((ndo," msgid ")); - hexprint(ndo, (caddr_t)&base.msgid, sizeof(base.msgid)); + hexprint(ndo, (const uint8_t *)&base.msgid, sizeof(base.msgid)); } if (1 < ndo->ndo_vflag) { ND_PRINT((ndo," cookie ")); - hexprint(ndo, (caddr_t)&base.i_ck, sizeof(base.i_ck)); + hexprint(ndo, (const uint8_t *)&base.i_ck, sizeof(base.i_ck)); ND_PRINT((ndo,"->")); - hexprint(ndo, (caddr_t)&base.r_ck, sizeof(base.r_ck)); + hexprint(ndo, (const uint8_t *)&base.r_ck, sizeof(base.r_ck)); } ND_PRINT((ndo,":")); @@ -2951,7 +3095,7 @@ isakmp_rfc3948_print(netdissect_options *ndo, const u_char *bp, u_int length, const u_char *bp2) { - + ND_TCHECK(bp[0]); if(length == 1 && bp[0]==0xff) { ND_PRINT((ndo, "isakmp-nat-keep-alive")); return; @@ -2960,6 +3104,7 @@ isakmp_rfc3948_print(netdissect_options *ndo, if(length < 4) { goto trunc; } + ND_TCHECK(bp[3]); /* * see if this is an IKE packet @@ -2972,7 +3117,7 @@ isakmp_rfc3948_print(netdissect_options *ndo, /* must be an ESP packet */ { - int nh, enh, padlen; + u_int nh, enh, padlen; int advance; ND_PRINT((ndo, "UDP-encap: ")); @@ -3000,7 +3145,3 @@ trunc: * c-basic-offset: 8 * End: */ - - - -