X-Git-Url: https://git.tcpdump.org/tcpdump/blobdiff_plain/b6406a5d6077ea3f6ee9dce1689008658c2095bb..d511b994b9931460771dc56c70b791204178d157:/print-isakmp.c diff --git a/print-isakmp.c b/print-isakmp.c index 8d19c3a8..f1f53eeb 100644 --- a/print-isakmp.c +++ b/print-isakmp.c @@ -1,7 +1,7 @@ /* * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. * All rights reserved. - * + * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: @@ -13,7 +13,7 @@ * 3. Neither the name of the project nor the names of its contributors * may be used to endorse or promote products derived from this software * without specific prior written permission. - * + * * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE @@ -29,41 +29,19 @@ */ #ifndef lint -static const char rcsid[] = - "@(#) $Header: /tcpdump/master/tcpdump/print-isakmp.c,v 1.9 2000-01-07 14:09:02 itojun Exp $ (LBL)"; +static const char rcsid[] _U_ = + "@(#) $Header: /tcpdump/master/tcpdump/print-isakmp.c,v 1.38 2003-11-16 09:36:25 guy Exp $ (LBL)"; #endif #ifdef HAVE_CONFIG_H #include "config.h" #endif -#include -#include -#include -#include -#include - -#if __STDC__ -struct mbuf; -struct rtentry; -#endif -#include - -#include -#include -#include -#include -#include -#include -#include -#include +#include -#ifdef INET6 -#include -#endif +#include #include -#include #include "isakmp.h" #include "ipsec_doi.h" @@ -72,35 +50,47 @@ struct rtentry; #include "addrtoname.h" #include "extract.h" /* must come after interface.h */ +#include "ip.h" +#ifdef INET6 +#include "ip6.h" +#endif + #ifndef HAVE_SOCKADDR_STORAGE #define sockaddr_storage sockaddr #endif -static u_char *isakmp_sa_print __P((struct isakmp_gen *, u_char *, u_int32_t, - u_int32_t, u_int32_t)); -static u_char *isakmp_p_print __P((struct isakmp_gen *, u_char *, u_int32_t, - u_int32_t, u_int32_t)); -static u_char *isakmp_t_print __P((struct isakmp_gen *, u_char *, u_int32_t, - u_int32_t, u_int32_t)); -static u_char *isakmp_ke_print __P((struct isakmp_gen *, u_char *, u_int32_t, - u_int32_t, u_int32_t)); -static u_char *isakmp_id_print __P((struct isakmp_gen *, u_char *, u_int32_t, - u_int32_t, u_int32_t)); -static u_char *isakmp_hash_print __P((struct isakmp_gen *, u_char *, - u_int32_t, u_int32_t, u_int32_t)); -static u_char *isakmp_nonce_print __P((struct isakmp_gen *, u_char *, - u_int32_t, u_int32_t, u_int32_t)); -static u_char *isakmp_n_print __P((struct isakmp_gen *, u_char *, u_int32_t, - u_int32_t, u_int32_t)); -static u_char *isakmp_d_print __P((struct isakmp_gen *, u_char *, u_int32_t, - u_int32_t, u_int32_t)); -static u_char *isakmp_vid_print __P((struct isakmp_gen *, u_char *, u_int32_t, - u_int32_t, u_int32_t)); -static u_char *isakmp_sub0_print __P((u_char, struct isakmp_gen *, u_char *, - u_int32_t, u_int32_t, u_int32_t)); -static u_char *isakmp_sub_print __P((u_char, struct isakmp_gen *, u_char *, - u_int32_t, u_int32_t, u_int32_t)); -static char *numstr __P((int)); +static const u_char *isakmp_sa_print(const struct isakmp_gen *, + const u_char *, u_int32_t, u_int32_t, u_int32_t, int); +static const u_char *isakmp_p_print(const struct isakmp_gen *, + const u_char *, u_int32_t, u_int32_t, u_int32_t, int); +static const u_char *isakmp_t_print(const struct isakmp_gen *, + const u_char *, u_int32_t, u_int32_t, u_int32_t, int); +static const u_char *isakmp_ke_print(const struct isakmp_gen *, + const u_char *, u_int32_t, u_int32_t, u_int32_t, int); +static const u_char *isakmp_id_print(const struct isakmp_gen *, + const u_char *, u_int32_t, u_int32_t, u_int32_t, int); +static const u_char *isakmp_cert_print(const struct isakmp_gen *, + const u_char *, u_int32_t, u_int32_t, u_int32_t, int); +static const u_char *isakmp_cr_print(const struct isakmp_gen *, + const u_char *, u_int32_t, u_int32_t, u_int32_t, int); +static const u_char *isakmp_sig_print(const struct isakmp_gen *, + const u_char *, u_int32_t, u_int32_t, u_int32_t, int); +static const u_char *isakmp_hash_print(const struct isakmp_gen *, + const u_char *, u_int32_t, u_int32_t, u_int32_t, int); +static const u_char *isakmp_nonce_print(const struct isakmp_gen *, + const u_char *, u_int32_t, u_int32_t, u_int32_t, int); +static const u_char *isakmp_n_print(const struct isakmp_gen *, + const u_char *, u_int32_t, u_int32_t, u_int32_t, int); +static const u_char *isakmp_d_print(const struct isakmp_gen *, + const u_char *, u_int32_t, u_int32_t, u_int32_t, int); +static const u_char *isakmp_vid_print(const struct isakmp_gen *, + const u_char *, u_int32_t, u_int32_t, u_int32_t, int); +static const u_char *isakmp_sub0_print(u_char, const struct isakmp_gen *, + const u_char *, u_int32_t, u_int32_t, u_int32_t, int); +static const u_char *isakmp_sub_print(u_char, const struct isakmp_gen *, + const u_char *, u_int32_t, u_int32_t, u_int32_t, int); +static char *numstr(int); +static void safememcpy(void *, const void *, size_t); #define MAXINITIATORS 20 int ninitiator = 0; @@ -111,29 +101,29 @@ struct { } cookiecache[MAXINITIATORS]; /* protocol id */ -static char *protoidstr[] = { +static const char *protoidstr[] = { NULL, "isakmp", "ipsec-ah", "ipsec-esp", "ipcomp", }; /* isakmp->np */ -static char *npstr[] = { +static const char *npstr[] = { "none", "sa", "p", "t", "ke", "id", "cert", "cr", "hash", "sig", "nonce", "n", "d", "vid" }; /* isakmp->np */ -static u_char *(*npfunc[]) __P((struct isakmp_gen *, u_char *, u_int32_t, - u_int32_t, u_int32_t)) = { +static const u_char *(*npfunc[])(const struct isakmp_gen *, const u_char *, + u_int32_t, u_int32_t, u_int32_t, int) = { NULL, isakmp_sa_print, isakmp_p_print, isakmp_t_print, isakmp_ke_print, isakmp_id_print, - NULL, - NULL, + isakmp_cert_print, + isakmp_cr_print, isakmp_hash_print, - NULL, + isakmp_sig_print, isakmp_nonce_print, isakmp_n_print, isakmp_d_print, @@ -141,7 +131,7 @@ static u_char *(*npfunc[]) __P((struct isakmp_gen *, u_char *, u_int32_t, }; /* isakmp->etype */ -static char *etypestr[] = { +static const char *etypestr[] = { "none", "base", "ident", "auth", "agg", "inf", NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, @@ -202,7 +192,7 @@ cookie_record(cookie_t *in, const u_char *bp2) } ip = (struct ip *)bp2; - switch (ip->ip_v) { + switch (IP_V(ip)) { case 4: memset(&cookiecache[ninitiator].iaddr, 0, sizeof(cookiecache[ninitiator].iaddr)); @@ -268,7 +258,7 @@ cookie_sidecheck(int i, const u_char *bp2, int initiator) memset(&ss, 0, sizeof(ss)); ip = (struct ip *)bp2; - switch (ip->ip_v) { + switch (IP_V(ip)) { case 4: sin = (struct sockaddr_in *)&ss; #ifdef HAVE_SOCKADDR_SA_LEN @@ -335,7 +325,7 @@ static void rawprint(caddr_t loc, size_t len) { static u_char *p; - int i; + size_t i; p = (u_char *)loc; for (i = 0; i < len; i++) @@ -343,240 +333,254 @@ rawprint(caddr_t loc, size_t len) } struct attrmap { - char *type; - int nvalue; - char *value[30]; /*XXX*/ + const char *type; + u_int nvalue; + const char *value[30]; /*XXX*/ }; -static u_char * -isakmp_attrmap_print(u_char *p, u_char *ep, struct attrmap *map, size_t nmap) +static const u_char * +isakmp_attrmap_print(const u_char *p, const u_char *ep, + const struct attrmap *map, size_t nmap) { - u_short *q; + u_int16_t *q; int totlen; u_int32_t t, v; - q = (u_short *)p; + q = (u_int16_t *)p; if (p[0] & 0x80) totlen = 4; else - totlen = 4 + ntohs(q[1]); + totlen = 4 + EXTRACT_16BITS(&q[1]); if (ep < p + totlen) { printf("[|attr]"); return ep + 1; } printf("("); - t = ntohs(q[0]) & 0x7fff; + t = EXTRACT_16BITS(&q[0]) & 0x7fff; if (map && t < nmap && map[t].type) printf("type=%s ", map[t].type); else printf("type=#%d ", t); if (p[0] & 0x80) { printf("value="); - v = ntohs(q[1]); + v = EXTRACT_16BITS(&q[1]); if (map && t < nmap && v < map[t].nvalue && map[t].value[v]) printf("%s", map[t].value[v]); else rawprint((caddr_t)&q[1], 2); } else { - printf("len=%d value=", ntohs(q[1])); - rawprint((caddr_t)&p[4], ntohs(q[1])); + printf("len=%d value=", EXTRACT_16BITS(&q[1])); + rawprint((caddr_t)&p[4], EXTRACT_16BITS(&q[1])); } printf(")"); return p + totlen; } -static u_char * -isakmp_attr_print(u_char *p, u_char *ep) +static const u_char * +isakmp_attr_print(const u_char *p, const u_char *ep) { - u_short *q; + u_int16_t *q; int totlen; u_int32_t t; - q = (u_short *)p; + q = (u_int16_t *)p; if (p[0] & 0x80) totlen = 4; else - totlen = 4 + ntohs(q[1]); + totlen = 4 + EXTRACT_16BITS(&q[1]); if (ep < p + totlen) { printf("[|attr]"); return ep + 1; } printf("("); - t = ntohs(q[0]) & 0x7fff; + t = EXTRACT_16BITS(&q[0]) & 0x7fff; printf("type=#%d ", t); if (p[0] & 0x80) { printf("value="); t = q[1]; rawprint((caddr_t)&q[1], 2); } else { - printf("len=%d value=", ntohs(q[1])); - rawprint((caddr_t)&p[2], ntohs(q[1])); + printf("len=%d value=", EXTRACT_16BITS(&q[1])); + rawprint((caddr_t)&p[2], EXTRACT_16BITS(&q[1])); } printf(")"); return p + totlen; } -static u_char * -isakmp_sa_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, - u_int32_t doi0, u_int32_t proto0) +static const u_char * +isakmp_sa_print(const struct isakmp_gen *ext, const u_char *ep, u_int32_t phase, + u_int32_t doi0 _U_, u_int32_t proto0, int depth) { - struct isakmp_pl_sa *p; - u_int32_t *q; - u_int32_t doi; - u_int32_t sit; - u_char *cp; + const struct isakmp_pl_sa *p; + struct isakmp_pl_sa sa; + const u_int32_t *q; + u_int32_t doi, sit, ident; + const u_char *cp, *np; int t; printf("%s:", NPSTR(ISAKMP_NPTYPE_SA)); p = (struct isakmp_pl_sa *)ext; - doi = ntohl(p->doi); + safememcpy(&sa, ext, sizeof(sa)); + doi = ntohl(sa.doi); + sit = ntohl(sa.sit); if (doi != 1) { printf(" doi=%d", doi); - printf(" situation=%u", (u_int32_t)ntohl(p->sit)); + printf(" situation=%u", (u_int32_t)ntohl(sa.sit)); return (u_char *)(p + 1); } printf(" doi=ipsec"); - q = (u_int32_t *)&p->sit; + q = (u_int32_t *)&sa.sit; printf(" situation="); t = 0; - if (ntohl(*q) & 0x01) { + if (sit & 0x01) { printf("identity"); t++; } - if (ntohl(*q) & 0x02) { + if (sit & 0x02) { printf("%ssecrecy", t ? "+" : ""); t++; } - if (ntohl(*q) & 0x04) + if (sit & 0x04) printf("%sintegrity", t ? "+" : ""); - sit = htonl(*q++); - if (sit != 0x01) - printf(" ident=%u", (u_int32_t)ntohl(*q++)); + np = (u_char *)ext + sizeof(sa); + if (sit != 0x01) { + safememcpy(&ident, ext + 1, sizeof(ident)); + printf(" ident=%u", (u_int32_t)ntohl(ident)); + np += sizeof(ident); + } - ext = (struct isakmp_gen *)q; + ext = (struct isakmp_gen *)np; - cp = isakmp_sub_print(ISAKMP_NPTYPE_P, ext, ep, phase, doi, proto0); + cp = isakmp_sub_print(ISAKMP_NPTYPE_P, ext, ep, phase, doi, proto0, + depth); return cp; } -static u_char * -isakmp_p_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, - u_int32_t doi0, u_int32_t proto0) +static const u_char * +isakmp_p_print(const struct isakmp_gen *ext, const u_char *ep, u_int32_t phase, + u_int32_t doi0, u_int32_t proto0 _U_, int depth) { - struct isakmp_pl_p *p; - u_char *cp; + const struct isakmp_pl_p *p; + struct isakmp_pl_p prop; + const u_char *cp; printf("%s:", NPSTR(ISAKMP_NPTYPE_P)); p = (struct isakmp_pl_p *)ext; + safememcpy(&prop, ext, sizeof(prop)); printf(" #%d protoid=%s transform=%d", - p->p_no, PROTOIDSTR(p->prot_id), p->num_t); - if (p->spi_size) { + prop.p_no, PROTOIDSTR(prop.prot_id), prop.num_t); + if (prop.spi_size) { printf(" spi="); - rawprint((caddr_t)(p + 1), p->spi_size); + rawprint((caddr_t)(p + 1), prop.spi_size); } - ext = (struct isakmp_gen *)((u_char *)(p + 1) + p->spi_size); + ext = (struct isakmp_gen *)((u_char *)(p + 1) + prop.spi_size); cp = isakmp_sub_print(ISAKMP_NPTYPE_T, ext, ep, phase, doi0, - p->prot_id); + prop.prot_id, depth); return cp; } -static char *isakmp_p_map[] = { +static const char *isakmp_p_map[] = { NULL, "ike", }; -static char *ah_p_map[] = { - NULL, "md5", "sha", "1des", +static const char *ah_p_map[] = { + NULL, "(reserved)", "md5", "sha", "1des", + "sha2-256", "sha2-384", "sha2-512", }; -static char *esp_p_map[] = { +static const char *esp_p_map[] = { NULL, "1des-iv64", "1des", "3des", "rc5", "idea", "cast", - "blowfish", "3idea", "1des-iv32", "rc4", "null" + "blowfish", "3idea", "1des-iv32", "rc4", "null", "aes" }; -static char *ipcomp_p_map[] = { +static const char *ipcomp_p_map[] = { NULL, "oui", "deflate", "lzs", }; -struct attrmap ipsec_t_map[] = { - { NULL, 0, }, +const struct attrmap ipsec_t_map[] = { + { NULL, 0, { NULL } }, { "lifetype", 3, { NULL, "sec", "kb", }, }, - { "life", 0, }, + { "life", 0, { NULL } }, { "group desc", 5, { NULL, "modp768", "modp1024", "EC2N 2^155", "EC2N 2^185", }, }, { "enc mode", 3, { NULL, "tunnel", "transport", }, }, { "auth", 5, { NULL, "hmac-md5", "hmac-sha1", "1des-mac", "keyed", }, }, - { "keylen", 0, }, - { "rounds", 0, }, - { "dictsize", 0, }, - { "privalg", 0, }, + { "keylen", 0, { NULL } }, + { "rounds", 0, { NULL } }, + { "dictsize", 0, { NULL } }, + { "privalg", 0, { NULL } }, }; -struct attrmap oakley_t_map[] = { - { NULL, 0 }, - { "enc", 7, { NULL, "1des", "idea", "blowfish", "rc5", - "3des", "cast"}, }, - { "hash", 4, { NULL, "md5", "sha1", "tiger", }, }, +const struct attrmap oakley_t_map[] = { + { NULL, 0, { NULL } }, + { "enc", 8, { NULL, "1des", "idea", "blowfish", "rc5", + "3des", "cast", "aes", }, }, + { "hash", 7, { NULL, "md5", "sha1", "tiger", + "sha2-256", "sha2-384", "sha2-512", }, }, { "auth", 6, { NULL, "preshared", "dss", "rsa sig", "rsa enc", "rsa enc revised", }, }, { "group desc", 5, { NULL, "modp768", "modp1024", "EC2N 2^155", "EC2N 2^185", }, }, { "group type", 4, { NULL, "MODP", "ECP", "EC2N", }, }, - { "group prime", 0, }, - { "group gen1", 0, }, - { "group gen2", 0, }, - { "group curve A", 0, }, - { "group curve B", 0, }, + { "group prime", 0, { NULL } }, + { "group gen1", 0, { NULL } }, + { "group gen2", 0, { NULL } }, + { "group curve A", 0, { NULL } }, + { "group curve B", 0, { NULL } }, { "lifetype", 3, { NULL, "sec", "kb", }, }, - { "lifeduration", 0, }, - { "prf", 0, }, - { "keylen", 0, }, - { "field", 0, }, - { "order", 0, }, + { "lifeduration", 0, { NULL } }, + { "prf", 0, { NULL } }, + { "keylen", 0, { NULL } }, + { "field", 0, { NULL } }, + { "order", 0, { NULL } }, }; -static u_char * -isakmp_t_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, - u_int32_t doi, u_int32_t proto) +static const u_char * +isakmp_t_print(const struct isakmp_gen *ext, const u_char *ep, + u_int32_t phase _U_, u_int32_t doi _U_, u_int32_t proto, + int depth _U_) { - struct isakmp_pl_t *p; - u_char *cp; - char *idstr; - struct attrmap *map; + const struct isakmp_pl_t *p; + struct isakmp_pl_t t; + const u_char *cp; + const char *idstr; + const struct attrmap *map; size_t nmap; - u_char *ep2; + const u_char *ep2; printf("%s:", NPSTR(ISAKMP_NPTYPE_T)); p = (struct isakmp_pl_t *)ext; + safememcpy(&t, ext, sizeof(t)); switch (proto) { case 1: - idstr = STR_OR_ID(p->t_id, isakmp_p_map); + idstr = STR_OR_ID(t.t_id, isakmp_p_map); map = oakley_t_map; nmap = sizeof(oakley_t_map)/sizeof(oakley_t_map[0]); break; case 2: - idstr = STR_OR_ID(p->t_id, ah_p_map); + idstr = STR_OR_ID(t.t_id, ah_p_map); map = ipsec_t_map; nmap = sizeof(ipsec_t_map)/sizeof(ipsec_t_map[0]); break; case 3: - idstr = STR_OR_ID(p->t_id, esp_p_map); + idstr = STR_OR_ID(t.t_id, esp_p_map); map = ipsec_t_map; nmap = sizeof(ipsec_t_map)/sizeof(ipsec_t_map[0]); break; case 4: - idstr = STR_OR_ID(p->t_id, ipcomp_p_map); + idstr = STR_OR_ID(t.t_id, ipcomp_p_map); map = ipsec_t_map; nmap = sizeof(ipsec_t_map)/sizeof(ipsec_t_map[0]); break; @@ -588,11 +592,11 @@ isakmp_t_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, } if (idstr) - printf(" #%d id=%s ", p->t_no, idstr); + printf(" #%d id=%s ", t.t_no, idstr); else - printf(" #%d id=%d ", p->t_no, p->t_id); + printf(" #%d id=%d ", t.t_no, t.t_id); cp = (u_char *)(p + 1); - ep2 = (u_char *)p + ntohs(ext->len); + ep2 = (u_char *)p + ntohs(t.h.len); while (cp < ep && cp < ep2) { if (map && nmap) { cp = isakmp_attrmap_print(cp, (ep < ep2) ? ep : ep2, @@ -605,45 +609,52 @@ isakmp_t_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, return cp; } -static u_char * -isakmp_ke_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, - u_int32_t doi, u_int32_t proto) +static const u_char * +isakmp_ke_print(const struct isakmp_gen *ext, const u_char *ep _U_, + u_int32_t phase _U_, u_int32_t doi _U_, u_int32_t proto _U_, + int depth _U_) { + struct isakmp_gen e; + printf("%s:", NPSTR(ISAKMP_NPTYPE_KE)); - printf(" key len=%d", ntohs(ext->len) - 4); - if (2 < vflag && 4 < ntohs(ext->len)) { + safememcpy(&e, ext, sizeof(e)); + printf(" key len=%d", ntohs(e.len) - 4); + if (2 < vflag && 4 < ntohs(e.len)) { printf(" "); - rawprint((caddr_t)(ext + 1), ntohs(ext->len) - 4); + rawprint((caddr_t)(ext + 1), ntohs(e.len) - 4); } - return (u_char *)ext + ntohs(ext->len); + return (u_char *)ext + ntohs(e.len); } -static u_char * -isakmp_id_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, - u_int32_t doi, u_int32_t proto) +static const u_char * +isakmp_id_print(const struct isakmp_gen *ext, const u_char *ep _U_, + u_int32_t phase, u_int32_t doi _U_, u_int32_t proto _U_, + int depth _U_) { #define USE_IPSECDOI_IN_PHASE1 1 - struct isakmp_pl_id *p; - static char *idtypestr[] = { + const struct isakmp_pl_id *p; + struct isakmp_pl_id id; + static const char *idtypestr[] = { "IPv4", "IPv4net", "IPv6", "IPv6net", }; - static char *ipsecidtypestr[] = { + static const char *ipsecidtypestr[] = { NULL, "IPv4", "FQDN", "user FQDN", "IPv4net", "IPv6", "IPv6net", "IPv4range", "IPv6range", "ASN1 DN", "ASN1 GN", "keyid", }; int len; - u_char *data; + const u_char *data; printf("%s:", NPSTR(ISAKMP_NPTYPE_ID)); p = (struct isakmp_pl_id *)ext; - if (sizeof(*p) < ext->len) + safememcpy(&id, ext, sizeof(id)); + if (sizeof(*p) < id.h.len) data = (u_char *)(p + 1); else data = NULL; - len = ntohs(ext->len) - sizeof(*p); + len = ntohs(id.h.len) - sizeof(*p); #if 0 /*debug*/ printf(" [phase=%d doi=%d proto=%d]", phase, doi, proto); @@ -653,9 +664,9 @@ isakmp_id_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, case 1: #endif default: - printf(" idtype=%s", STR_OR_ID(p->d.id_type, idtypestr)); + printf(" idtype=%s", STR_OR_ID(id.d.id_type, idtypestr)); printf(" doi_data=%u", - (u_int32_t)(ntohl(p->d.doi_data) & 0xffffff)); + (u_int32_t)(ntohl(id.d.doi_data) & 0xffffff)); break; #ifdef USE_IPSECDOI_IN_PHASE1 @@ -663,22 +674,31 @@ isakmp_id_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, #endif case 2: { - struct ipsecdoi_id *p; + const struct ipsecdoi_id *p; + struct ipsecdoi_id id; struct protoent *pe; p = (struct ipsecdoi_id *)ext; - printf(" idtype=%s", STR_OR_ID(p->type, ipsecidtypestr)); - setprotoent(1); - pe = getprotobynumber(p->proto_id); - if (pe) - printf(" protoid=%s", pe->p_name); - else - printf(" protoid=%s", PROTOIDSTR(p->proto_id)); - endprotoent(); - printf(" port=%d", ntohs(p->port)); + safememcpy(&id, ext, sizeof(id)); + printf(" idtype=%s", STR_OR_ID(id.type, ipsecidtypestr)); + if (id.proto_id) { +#ifndef WIN32 + setprotoent(1); +#endif /* WIN32 */ + pe = getprotobynumber(id.proto_id); + if (pe) + printf(" protoid=%s", pe->p_name); +#ifndef WIN32 + endprotoent(); +#endif /* WIN32 */ + } else { + /* it DOES NOT mean IPPROTO_IP! */ + printf(" protoid=%s", "0"); + } + printf(" port=%d", ntohs(id.port)); if (!len) break; - switch (p->type) { + switch (id.type) { case IPSECDOI_ID_IPV4_ADDR: printf(" len=%d %s", len, ipaddr_string(data)); len = 0; @@ -688,18 +708,14 @@ isakmp_id_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, { int i; printf(" len=%d ", len); - for (i = 0; i < len; i++) { - if (isprint(data[i])) - printf("%c", data[i]); - else - printf("\\%03o", data[i]); - } + for (i = 0; i < len; i++) + safeputchar(data[i]); len = 0; break; } case IPSECDOI_ID_IPV4_ADDR_SUBNET: { - u_char *mask; + const u_char *mask; mask = data + sizeof(struct in_addr); printf(" len=%d %s/%u.%u.%u.%u", len, ipaddr_string(data), @@ -714,7 +730,7 @@ isakmp_id_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, break; case IPSECDOI_ID_IPV6_ADDR_SUBNET: { - u_int32_t *mask; + const u_int32_t *mask; mask = (u_int32_t *)(data + sizeof(struct in6_addr)); /*XXX*/ printf(" len=%d %s/0x%08x%08x%08x%08x", len, @@ -745,54 +761,131 @@ isakmp_id_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, } } if (data && len) { - len -= sizeof(*p); printf(" len=%d", len); if (2 < vflag) { printf(" "); rawprint((caddr_t)data, len); } } - return (u_char *)ext + ntohs(ext->len); + return (u_char *)ext + ntohs(id.h.len); +} + +static const u_char * +isakmp_cert_print(const struct isakmp_gen *ext, const u_char *ep _U_, + u_int32_t phase _U_, u_int32_t doi0 _U_, u_int32_t proto0 _U_, + int depth _U_) +{ + const struct isakmp_pl_cert *p; + struct isakmp_pl_cert cert; + static const char *certstr[] = { + "none", "pkcs7", "pgp", "dns", + "x509sign", "x509ke", "kerberos", "crl", + "arl", "spki", "x509attr", + }; + + printf("%s:", NPSTR(ISAKMP_NPTYPE_CERT)); + + p = (struct isakmp_pl_cert *)ext; + safememcpy(&cert, ext, sizeof(cert)); + printf(" len=%d", ntohs(cert.h.len) - 4); + printf(" type=%s", STR_OR_ID((cert.encode), certstr)); + if (2 < vflag && 4 < ntohs(cert.h.len)) { + printf(" "); + rawprint((caddr_t)(ext + 1), ntohs(cert.h.len) - 4); + } + return (u_char *)ext + ntohs(cert.h.len); +} + +static const u_char * +isakmp_cr_print(const struct isakmp_gen *ext, const u_char *ep _U_, + u_int32_t phase _U_, u_int32_t doi0 _U_, u_int32_t proto0 _U_, + int depth _U_) +{ + const struct isakmp_pl_cert *p; + struct isakmp_pl_cert cert; + static const char *certstr[] = { + "none", "pkcs7", "pgp", "dns", + "x509sign", "x509ke", "kerberos", "crl", + "arl", "spki", "x509attr", + }; + + printf("%s:", NPSTR(ISAKMP_NPTYPE_CR)); + + p = (struct isakmp_pl_cert *)ext; + safememcpy(&cert, ext, sizeof(cert)); + printf(" len=%d", ntohs(cert.h.len) - 4); + printf(" type=%s", STR_OR_ID((cert.encode), certstr)); + if (2 < vflag && 4 < ntohs(cert.h.len)) { + printf(" "); + rawprint((caddr_t)(ext + 1), ntohs(cert.h.len) - 4); + } + return (u_char *)ext + ntohs(cert.h.len); } -static u_char * -isakmp_hash_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, - u_int32_t doi, u_int32_t proto) +static const u_char * +isakmp_hash_print(const struct isakmp_gen *ext, const u_char *ep _U_, + u_int32_t phase _U_, u_int32_t doi _U_, u_int32_t proto _U_, + int depth _U_) { + struct isakmp_gen e; + printf("%s:", NPSTR(ISAKMP_NPTYPE_HASH)); - printf(" len=%d", ntohs(ext->len) - 4); - if (2 < vflag && 4 < ntohs(ext->len)) { + safememcpy(&e, ext, sizeof(e)); + printf(" len=%d", ntohs(e.len) - 4); + if (2 < vflag && 4 < ntohs(e.len)) { printf(" "); - rawprint((caddr_t)(ext + 1), ntohs(ext->len) - 4); + rawprint((caddr_t)(ext + 1), ntohs(e.len) - 4); } - return (u_char *)ext + ntohs(ext->len); + return (u_char *)ext + ntohs(e.len); } -static u_char * -isakmp_nonce_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, - u_int32_t doi, u_int32_t proto) +static const u_char * +isakmp_sig_print(const struct isakmp_gen *ext, const u_char *ep _U_, + u_int32_t phase _U_, u_int32_t doi _U_, u_int32_t proto _U_, + int depth _U_) { + struct isakmp_gen e; + + printf("%s:", NPSTR(ISAKMP_NPTYPE_SIG)); + + safememcpy(&e, ext, sizeof(e)); + printf(" len=%d", ntohs(e.len) - 4); + if (2 < vflag && 4 < ntohs(e.len)) { + printf(" "); + rawprint((caddr_t)(ext + 1), ntohs(e.len) - 4); + } + return (u_char *)ext + ntohs(e.len); +} + +static const u_char * +isakmp_nonce_print(const struct isakmp_gen *ext, const u_char *ep _U_, + u_int32_t phase _U_, u_int32_t doi _U_, u_int32_t proto _U_, + int depth _U_) +{ + struct isakmp_gen e; + printf("%s:", NPSTR(ISAKMP_NPTYPE_NONCE)); - printf(" n len=%d", ntohs(ext->len) - 4); - if (2 < vflag && 4 < ntohs(ext->len)) { + safememcpy(&e, ext, sizeof(e)); + printf(" n len=%d", ntohs(e.len) - 4); + if (2 < vflag && 4 < ntohs(e.len)) { printf(" "); - rawprint((caddr_t)(ext + 1), ntohs(ext->len) - 4); + rawprint((caddr_t)(ext + 1), ntohs(e.len) - 4); } - return (u_char *)ext + ntohs(ext->len); + return (u_char *)ext + ntohs(e.len); } -static u_char * -isakmp_n_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, - u_int32_t doi0, u_int32_t proto0) +static const u_char * +isakmp_n_print(const struct isakmp_gen *ext, const u_char *ep, u_int32_t phase, + u_int32_t doi0 _U_, u_int32_t proto0 _U_, int depth) { - struct isakmp_pl_n *p; - u_char *cp; + struct isakmp_pl_n *p, n; + const u_char *cp; u_char *ep2; u_int32_t doi; u_int32_t proto; - static char *notifystr[] = { + static const char *notify_error_str[] = { NULL, "INVALID-PAYLOAD-TYPE", "DOI-NOT-SUPPORTED", "SITUATION-NOT-SUPPORTED", "INVALID-COOKIE", "INVALID-MAJOR-VERSION", @@ -810,58 +903,84 @@ isakmp_n_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, "CERTIFICATE-UNAVAILABLE", "UNSUPPORTED-EXCHANGE-TYPE", "UNEQUAL-PAYLOAD-LENGTHS", }; - static char *ipsecnotifystr[] = { + static const char *ipsec_notify_error_str[] = { + "RESERVED", + }; + static const char *notify_status_str[] = { + "CONNECTED", + }; + static const char *ipsec_notify_status_str[] = { "RESPONDER-LIFETIME", "REPLAY-STATUS", "INITIAL-CONTACT", }; /* NOTE: these macro must be called with x in proper range */ -#define NOTIFYSTR(x) \ - (((x) == 16384) ? "CONNECTED" : STR_OR_ID((x), notifystr)) -#define IPSECNOTIFYSTR(x) \ - (((x) == 8192) ? "RESERVED" : STR_OR_ID(((x) - 24576), ipsecnotifystr)) + +/* 0 - 8191 */ +#define NOTIFY_ERROR_STR(x) \ + STR_OR_ID((x), notify_error_str) + +/* 8192 - 16383 */ +#define IPSEC_NOTIFY_ERROR_STR(x) \ + STR_OR_ID((u_int)((x) - 8192), ipsec_notify_error_str) + +/* 16384 - 24575 */ +#define NOTIFY_STATUS_STR(x) \ + STR_OR_ID((u_int)((x) - 16384), notify_status_str) + +/* 24576 - 32767 */ +#define IPSEC_NOTIFY_STATUS_STR(x) \ + STR_OR_ID((u_int)((x) - 24576), ipsec_notify_status_str) printf("%s:", NPSTR(ISAKMP_NPTYPE_N)); p = (struct isakmp_pl_n *)ext; - doi = ntohl(p->doi); - proto = p->prot_id; + safememcpy(&n, ext, sizeof(n)); + doi = ntohl(n.doi); + proto = n.prot_id; if (doi != 1) { printf(" doi=%d", doi); printf(" proto=%d", proto); - printf(" type=%s", NOTIFYSTR(ntohs(p->type))); - if (p->spi_size) { + if (ntohs(n.type) < 8192) + printf(" type=%s", NOTIFY_ERROR_STR(ntohs(n.type))); + else if (ntohs(n.type) < 16384) + printf(" type=%s", numstr(ntohs(n.type))); + else if (ntohs(n.type) < 24576) + printf(" type=%s", NOTIFY_STATUS_STR(ntohs(n.type))); + else + printf(" type=%s", numstr(ntohs(n.type))); + if (n.spi_size) { printf(" spi="); - rawprint((caddr_t)(p + 1), p->spi_size); + rawprint((caddr_t)(p + 1), n.spi_size); } - return (u_char *)(p + 1) + p->spi_size; + return (u_char *)(p + 1) + n.spi_size; } printf(" doi=ipsec"); printf(" proto=%s", PROTOIDSTR(proto)); - if (ntohs(p->type) < 8192) - printf(" type=%s", NOTIFYSTR(ntohs(p->type))); - else if (ntohs(p->type) < 16384) - printf(" type=%s", IPSECNOTIFYSTR(ntohs(p->type))); - else if (ntohs(p->type) < 24576) - printf(" type=%s", NOTIFYSTR(ntohs(p->type))); - else if (ntohs(p->type) < 40960) - printf(" type=%s", IPSECNOTIFYSTR(ntohs(p->type))); + if (ntohs(n.type) < 8192) + printf(" type=%s", NOTIFY_ERROR_STR(ntohs(n.type))); + else if (ntohs(n.type) < 16384) + printf(" type=%s", IPSEC_NOTIFY_ERROR_STR(ntohs(n.type))); + else if (ntohs(n.type) < 24576) + printf(" type=%s", NOTIFY_STATUS_STR(ntohs(n.type))); + else if (ntohs(n.type) < 32768) + printf(" type=%s", IPSEC_NOTIFY_STATUS_STR(ntohs(n.type))); else - printf(" type=%s", NOTIFYSTR(ntohs(p->type))); - if (p->spi_size) { + printf(" type=%s", numstr(ntohs(n.type))); + if (n.spi_size) { printf(" spi="); - rawprint((caddr_t)(p + 1), p->spi_size); + rawprint((caddr_t)(p + 1), n.spi_size); } - cp = (u_char *)(p + 1) + p->spi_size; - ep2 = (u_char *)p + ntohs(ext->len); + cp = (u_char *)(p + 1) + n.spi_size; + ep2 = (u_char *)p + ntohs(n.h.len); if (cp < ep) { printf(" orig=("); - switch (ntohs(p->type)) { + switch (ntohs(n.type)) { case IPSECDOI_NTYPE_RESPONDER_LIFETIME: { - struct attrmap *map = oakley_t_map; + const struct attrmap *map = oakley_t_map; size_t nmap = sizeof(oakley_t_map)/sizeof(oakley_t_map[0]); while (cp < ep && cp < ep2) { cp = isakmp_attrmap_print(cp, @@ -874,26 +993,30 @@ isakmp_n_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, (*(u_int32_t *)cp) ? "en" : "dis"); break; case ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN: - isakmp_sub_print(ISAKMP_NPTYPE_SA, - (struct isakmp_gen *)cp, ep, phase, doi, proto); + if (isakmp_sub_print(ISAKMP_NPTYPE_SA, + (struct isakmp_gen *)cp, ep, phase, doi, proto, + depth) == NULL) + return NULL; break; default: /* NULL is dummy */ isakmp_print(cp, - ntohs(ext->len) - sizeof(*p) - p->spi_size, + ntohs(n.h.len) - sizeof(*p) - n.spi_size, NULL); } printf(")"); } - return (u_char *)ext + ntohs(ext->len); + return (u_char *)ext + ntohs(n.h.len); } -static u_char * -isakmp_d_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, - u_int32_t doi0, u_int32_t proto0) +static const u_char * +isakmp_d_print(const struct isakmp_gen *ext, const u_char *ep _U_, + u_int32_t phase _U_, u_int32_t doi0 _U_, u_int32_t proto0 _U_, + int depth _U_) { - struct isakmp_pl_d *p; - u_int8_t *q; + const struct isakmp_pl_d *p; + struct isakmp_pl_d d; + const u_int8_t *q; u_int32_t doi; u_int32_t proto; int i; @@ -901,8 +1024,9 @@ isakmp_d_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, printf("%s:", NPSTR(ISAKMP_NPTYPE_D)); p = (struct isakmp_pl_d *)ext; - doi = ntohl(p->doi); - proto = p->prot_id; + safememcpy(&d, ext, sizeof(d)); + doi = ntohl(d.doi); + proto = d.prot_id; if (doi != 1) { printf(" doi=%u", doi); printf(" proto=%u", proto); @@ -910,62 +1034,81 @@ isakmp_d_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, printf(" doi=ipsec"); printf(" proto=%s", PROTOIDSTR(proto)); } - printf(" spilen=%u", p->spi_size); - printf(" nspi=%u", ntohs(p->num_spi)); + printf(" spilen=%u", d.spi_size); + printf(" nspi=%u", ntohs(d.num_spi)); printf(" spi="); q = (u_int8_t *)(p + 1); - for (i = 0; i < ntohs(p->num_spi); i++) { + for (i = 0; i < ntohs(d.num_spi); i++) { if (i != 0) printf(","); - rawprint((caddr_t)q, p->spi_size); - q += p->spi_size; + rawprint((caddr_t)q, d.spi_size); + q += d.spi_size; } return q; } -static u_char * -isakmp_vid_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, - u_int32_t doi, u_int32_t proto) +static const u_char * +isakmp_vid_print(const struct isakmp_gen *ext, const u_char *ep _U_, + u_int32_t phase _U_, u_int32_t doi _U_, u_int32_t proto _U_, + int depth _U_) { + struct isakmp_gen e; + printf("%s:", NPSTR(ISAKMP_NPTYPE_VID)); - printf(" len=%d", ntohs(ext->len) - 4); - if (2 < vflag && 4 < ntohs(ext->len)) { + safememcpy(&e, ext, sizeof(e)); + printf(" len=%d", ntohs(e.len) - 4); + if (2 < vflag && 4 < ntohs(e.len)) { printf(" "); - rawprint((caddr_t)(ext + 1), ntohs(ext->len) - 4); + rawprint((caddr_t)(ext + 1), ntohs(e.len) - 4); } - return (u_char *)ext + ntohs(ext->len); + return (u_char *)ext + ntohs(e.len); } -static u_char * -isakmp_sub0_print(u_char np, struct isakmp_gen *ext, u_char *ep, - u_int32_t phase, u_int32_t doi, u_int32_t proto) +static const u_char * +isakmp_sub0_print(u_char np, const struct isakmp_gen *ext, const u_char *ep, + u_int32_t phase, u_int32_t doi, u_int32_t proto, int depth) { - u_char *cp; + const u_char *cp; + struct isakmp_gen e; + u_int item_len; cp = (u_char *)ext; + safememcpy(&e, ext, sizeof(e)); if (NPFUNC(np)) - cp = (*NPFUNC(np))(ext, ep, phase, doi, proto); + cp = (*NPFUNC(np))(ext, ep, phase, doi, proto, depth); else { printf("%s", NPSTR(np)); - cp += ntohs(ext->len); + item_len = ntohs(e.len); + if (item_len == 0) { + /* + * We don't want to loop forever processing this + * bogus (zero-length) item; return NULL so that + * we stop dissecting. + */ + cp = NULL; + } else + cp += item_len; } + return cp; } -static u_char * -isakmp_sub_print(u_char np, struct isakmp_gen *ext, u_char *ep, - u_int32_t phase, u_int32_t doi, u_int32_t proto) +static const u_char * +isakmp_sub_print(u_char np, const struct isakmp_gen *ext, const u_char *ep, + u_int32_t phase, u_int32_t doi, u_int32_t proto, int depth) { - u_char *cp; - static int depth = 0; + const u_char *cp; int i; + struct isakmp_gen e; - cp = (u_char *)ext; + cp = (const u_char *)ext; while (np) { - if (ep < (u_char *)ext + ntohs(ext->len)) { + safememcpy(&e, ext, sizeof(e)); + + if (ep < (u_char *)ext + ntohs(e.len)) { printf(" [|%s]", NPSTR(np)); cp = ep + 1; break; @@ -975,11 +1118,16 @@ isakmp_sub_print(u_char np, struct isakmp_gen *ext, u_char *ep, for (i = 0; i < depth; i++) printf(" "); printf("("); - cp = isakmp_sub0_print(np, ext, ep, phase, doi, proto); + cp = isakmp_sub0_print(np, ext, ep, phase, doi, proto, depth); printf(")"); depth--; - np = ext->np; + if (cp == NULL) { + /* Zero-length subitem */ + return NULL; + } + + np = e.np; ext = (struct isakmp_gen *)cp; } return cp; @@ -989,63 +1137,77 @@ static char * numstr(int x) { static char buf[20]; - sprintf(buf, "#%d", x); + snprintf(buf, sizeof(buf), "#%d", x); return buf; } +/* + * some compiler tries to optimize memcpy(), using the alignment constraint + * on the argument pointer type. by using this function, we try to avoid the + * optimization. + */ +static void +safememcpy(void *p, const void *q, size_t l) +{ + memcpy(p, q, l); +} + void isakmp_print(const u_char *bp, u_int length, const u_char *bp2) { - struct isakmp *base; - u_char *ep; + const struct isakmp *p; + struct isakmp base; + const u_char *ep; u_char np; int i; int phase; int major, minor; - base = (struct isakmp *)bp; - ep = (u_char *)snapend; + p = (const struct isakmp *)bp; + ep = snapend; - if ((struct isakmp *)ep < base + 1) { + if ((struct isakmp *)ep < p + 1) { printf("[|isakmp]"); return; } + safememcpy(&base, p, sizeof(base)); + printf("isakmp"); if (vflag) { - major = (base->vers & ISAKMP_VERS_MAJOR) + major = (base.vers & ISAKMP_VERS_MAJOR) >> ISAKMP_VERS_MAJOR_SHIFT; - minor = (base->vers & ISAKMP_VERS_MINOR) + minor = (base.vers & ISAKMP_VERS_MINOR) >> ISAKMP_VERS_MINOR_SHIFT; printf(" %d.%d", major, minor); } if (vflag) { printf(" msgid "); - rawprint((caddr_t)&base->msgid, sizeof(base->msgid)); + rawprint((caddr_t)&base.msgid, sizeof(base.msgid)); } if (1 < vflag) { printf(" cookie "); - rawprint((caddr_t)&base->i_ck, sizeof(base->i_ck)); + rawprint((caddr_t)&base.i_ck, sizeof(base.i_ck)); printf("->"); - rawprint((caddr_t)&base->r_ck, sizeof(base->r_ck)); + rawprint((caddr_t)&base.r_ck, sizeof(base.r_ck)); } printf(":"); - phase = (*(u_int32_t *)base->msgid == 0) ? 1 : 2; + phase = (*(u_int32_t *)base.msgid == 0) ? 1 : 2; if (phase == 1) printf(" phase %d", phase); else printf(" phase %d/others", phase); - i = cookie_find(&base->i_ck); + i = cookie_find(&base.i_ck); if (i < 0) { - if (iszero((u_char *)&base->r_ck, sizeof(base->r_ck))) { + if (iszero((u_char *)&base.r_ck, sizeof(base.r_ck))) { /* the first packet */ printf(" I"); if (bp2) - cookie_record(&base->i_ck, bp2); + cookie_record(&base.i_ck, bp2); } else printf(" ?"); } else { @@ -1057,15 +1219,15 @@ isakmp_print(const u_char *bp, u_int length, const u_char *bp2) printf(" ?"); } - printf(" %s", ETYPESTR(base->etype)); - if (base->flags) { - printf("[%s%s]", base->flags & ISAKMP_FLAG_E ? "E" : "", - base->flags & ISAKMP_FLAG_C ? "C" : ""); + printf(" %s", ETYPESTR(base.etype)); + if (base.flags) { + printf("[%s%s]", base.flags & ISAKMP_FLAG_E ? "E" : "", + base.flags & ISAKMP_FLAG_C ? "C" : ""); } printf(":"); { - struct isakmp_gen *ext; + const struct isakmp_gen *ext; int nparen; #define CHECKLEN(p, np) \ @@ -1075,28 +1237,28 @@ isakmp_print(const u_char *bp, u_int length, const u_char *bp2) } /* regardless of phase... */ - if (base->flags & ISAKMP_FLAG_E) { + if (base.flags & ISAKMP_FLAG_E) { /* * encrypted, nothing we can do right now. * we hope to decrypt the packet in the future... */ - printf(" [|%s]", NPSTR(base->np)); + printf(" [encrypted %s]", NPSTR(base.np)); goto done; } nparen = 0; - CHECKLEN(base + 1, base->np) + CHECKLEN(p + 1, base.np) - np = base->np; - ext = (struct isakmp_gen *)(base + 1); - isakmp_sub_print(np, ext, ep, phase, 0, 0); + np = base.np; + ext = (struct isakmp_gen *)(p + 1); + isakmp_sub_print(np, ext, ep, phase, 0, 0, 0); } done: if (vflag) { - if (ntohl(base->len) != length) { + if (ntohl(base.len) != length) { printf(" (len mismatch: isakmp %u/ip %d)", - (u_int32_t)ntohl(base->len), length); + (u_int32_t)ntohl(base.len), length); } } }