2 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. Neither the name of the project nor the names of its contributors
14 * may be used to endorse or promote products derived from this software
15 * without specific prior written permission.
17 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 static const char rcsid[] _U_ =
33 "@(#) $Header: /tcpdump/master/tcpdump/print-isakmp.c,v 1.56 2007-08-29 12:31:00 mcr Exp $ (LBL)";
36 #define NETDISSECT_REWORKED
41 #include <tcpdump-stdinc.h>
48 #include "ipsec_doi.h"
50 #include "interface.h"
51 #include "addrtoname.h"
52 #include "extract.h" /* must come after interface.h */
59 #ifndef HAVE_SOCKADDR_STORAGE
60 #define sockaddr_storage sockaddr
63 #define DECLARE_PRINTER(func) static const u_char *ike##func##_print( \
64 netdissect_options *ndo, u_char tpay, \
65 const struct isakmp_gen *ext, \
67 const u_char *end_pointer, \
70 u_int32_t proto0, int depth)
72 DECLARE_PRINTER(v1_sa);
73 DECLARE_PRINTER(v1_p);
74 DECLARE_PRINTER(v1_t);
75 DECLARE_PRINTER(v1_ke);
76 DECLARE_PRINTER(v1_id);
77 DECLARE_PRINTER(v1_cert);
78 DECLARE_PRINTER(v1_cr);
79 DECLARE_PRINTER(v1_sig);
80 DECLARE_PRINTER(v1_hash);
81 DECLARE_PRINTER(v1_nonce);
82 DECLARE_PRINTER(v1_n);
83 DECLARE_PRINTER(v1_d);
84 DECLARE_PRINTER(v1_vid);
86 DECLARE_PRINTER(v2_sa);
87 DECLARE_PRINTER(v2_ke);
88 DECLARE_PRINTER(v2_ID);
89 DECLARE_PRINTER(v2_cert);
90 DECLARE_PRINTER(v2_cr);
91 DECLARE_PRINTER(v2_auth);
92 DECLARE_PRINTER(v2_nonce);
93 DECLARE_PRINTER(v2_n);
94 DECLARE_PRINTER(v2_d);
95 DECLARE_PRINTER(v2_vid);
96 DECLARE_PRINTER(v2_TS);
97 DECLARE_PRINTER(v2_e);
98 DECLARE_PRINTER(v2_cp);
99 DECLARE_PRINTER(v2_eap);
101 static const u_char *ike_sub0_print(netdissect_options *ndo,u_char, const struct isakmp_gen *,
102 const u_char *, u_int32_t, u_int32_t, u_int32_t, int);
103 static const u_char *ikev1_sub_print(netdissect_options *ndo,u_char, const struct isakmp_gen *,
104 const u_char *, u_int32_t, u_int32_t, u_int32_t, int);
106 static const u_char *ikev2_sub_print(netdissect_options *ndo,
107 u_char np, const struct isakmp_gen *ext,
108 const u_char *ep, u_int32_t phase,
109 u_int32_t doi, u_int32_t proto,
113 static char *numstr(int);
114 static void safememcpy(void *, const void *, size_t);
117 ikev1_print(netdissect_options *ndo,
118 const u_char *bp, u_int length,
119 const u_char *bp2, struct isakmp *base);
121 #define MAXINITIATORS 20
125 struct sockaddr_storage iaddr;
126 struct sockaddr_storage raddr;
127 } cookiecache[MAXINITIATORS];
130 static const char *protoidstr[] = {
131 NULL, "isakmp", "ipsec-ah", "ipsec-esp", "ipcomp",
135 static const char *npstr[] = {
136 "none", "sa", "p", "t", "ke", "id", "cert", "cr", "hash", /* 0 - 8 */
137 "sig", "nonce", "n", "d", "vid", /* 9 - 13 */
138 "pay14", "pay15", "pay16", "pay17", "pay18", /* 14- 18 */
139 "pay19", "pay20", "pay21", "pay22", "pay23", /* 19- 23 */
140 "pay24", "pay25", "pay26", "pay27", "pay28", /* 24- 28 */
141 "pay29", "pay30", "pay31", "pay32", /* 29- 32 */
142 "v2sa", "v2ke", "v2IDi", "v2IDr", "v2cert",/* 33- 37 */
143 "v2cr", "v2auth","v2nonce", "v2n", "v2d", /* 38- 42 */
144 "v2vid", "v2TSi", "v2TSr", "v2e", "v2cp", /* 43- 47 */
150 static const u_char *(*npfunc[])(netdissect_options *ndo, u_char tpay,
151 const struct isakmp_gen *ext,
153 const u_char *end_pointer,
156 u_int32_t proto0, int depth) = {
170 ikev1_vid_print, /* 13 */
171 NULL, NULL, NULL, NULL, NULL, /* 14- 18 */
172 NULL, NULL, NULL, NULL, NULL, /* 19- 23 */
173 NULL, NULL, NULL, NULL, NULL, /* 24- 28 */
174 NULL, NULL, NULL, NULL, /* 29- 32 */
175 ikev2_sa_print, /* 33 */
176 ikev2_ke_print, /* 34 */
177 ikev2_ID_print, /* 35 */
178 ikev2_ID_print, /* 36 */
179 ikev2_cert_print, /* 37 */
180 ikev2_cr_print, /* 38 */
181 ikev2_auth_print, /* 39 */
182 ikev2_nonce_print, /* 40 */
183 ikev2_n_print, /* 41 */
184 ikev2_d_print, /* 42 */
185 ikev2_vid_print, /* 43 */
186 ikev2_TS_print, /* 44 */
187 ikev2_TS_print, /* 45 */
188 ikev2_e_print, /* 46 */
189 ikev2_cp_print, /* 47 */
190 ikev2_eap_print, /* 48 */
194 static const char *etypestr[] = {
195 /* IKEv1 exchange types */
196 "none", "base", "ident", "auth", "agg", "inf", NULL, NULL, /* 0-7 */
197 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, /* 8-15 */
198 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, /* 16-23 */
199 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, /* 24-31 */
200 "oakley-quick", "oakley-newgroup", /* 32-33 */
201 /* IKEv2 exchange types */
202 "ikev2_init", "ikev2_auth", "child_sa", "inf2" /* 34-37 */
205 #define STR_OR_ID(x, tab) \
206 (((x) < sizeof(tab)/sizeof(tab[0]) && tab[(x)]) ? tab[(x)] : numstr(x))
207 #define PROTOIDSTR(x) STR_OR_ID(x, protoidstr)
208 #define NPSTR(x) STR_OR_ID(x, npstr)
209 #define ETYPESTR(x) STR_OR_ID(x, etypestr)
211 #define CHECKLEN(p, np) \
212 if (ep < (u_char *)(p)) { \
213 ND_PRINT((ndo," [|%s]", NPSTR(np))); \
219 (((x) < sizeof(npfunc)/sizeof(npfunc[0]) && npfunc[(x)]) \
220 ? npfunc[(x)] : NULL)
223 iszero(u_char *p, size_t l)
232 /* find cookie from initiator cache */
234 cookie_find(cookie_t *in)
238 for (i = 0; i < MAXINITIATORS; i++) {
239 if (memcmp(in, &cookiecache[i].initiator, sizeof(*in)) == 0)
246 /* record initiator */
248 cookie_record(cookie_t *in, const u_char *bp2)
252 struct sockaddr_in *sin;
255 struct sockaddr_in6 *sin6;
260 ninitiator = (i + 1) % MAXINITIATORS;
264 ip = (struct ip *)bp2;
267 memset(&cookiecache[ninitiator].iaddr, 0,
268 sizeof(cookiecache[ninitiator].iaddr));
269 memset(&cookiecache[ninitiator].raddr, 0,
270 sizeof(cookiecache[ninitiator].raddr));
272 sin = (struct sockaddr_in *)&cookiecache[ninitiator].iaddr;
273 #ifdef HAVE_SOCKADDR_SA_LEN
274 sin->sin_len = sizeof(struct sockaddr_in);
276 sin->sin_family = AF_INET;
277 memcpy(&sin->sin_addr, &ip->ip_src, sizeof(ip->ip_src));
278 sin = (struct sockaddr_in *)&cookiecache[ninitiator].raddr;
279 #ifdef HAVE_SOCKADDR_SA_LEN
280 sin->sin_len = sizeof(struct sockaddr_in);
282 sin->sin_family = AF_INET;
283 memcpy(&sin->sin_addr, &ip->ip_dst, sizeof(ip->ip_dst));
287 memset(&cookiecache[ninitiator].iaddr, 0,
288 sizeof(cookiecache[ninitiator].iaddr));
289 memset(&cookiecache[ninitiator].raddr, 0,
290 sizeof(cookiecache[ninitiator].raddr));
292 ip6 = (struct ip6_hdr *)bp2;
293 sin6 = (struct sockaddr_in6 *)&cookiecache[ninitiator].iaddr;
294 #ifdef HAVE_SOCKADDR_SA_LEN
295 sin6->sin6_len = sizeof(struct sockaddr_in6);
297 sin6->sin6_family = AF_INET6;
298 memcpy(&sin6->sin6_addr, &ip6->ip6_src, sizeof(ip6->ip6_src));
299 sin6 = (struct sockaddr_in6 *)&cookiecache[ninitiator].raddr;
300 #ifdef HAVE_SOCKADDR_SA_LEN
301 sin6->sin6_len = sizeof(struct sockaddr_in6);
303 sin6->sin6_family = AF_INET6;
304 memcpy(&sin6->sin6_addr, &ip6->ip6_dst, sizeof(ip6->ip6_dst));
310 memcpy(&cookiecache[ninitiator].initiator, in, sizeof(*in));
311 ninitiator = (ninitiator + 1) % MAXINITIATORS;
314 #define cookie_isinitiator(x, y) cookie_sidecheck((x), (y), 1)
315 #define cookie_isresponder(x, y) cookie_sidecheck((x), (y), 0)
317 cookie_sidecheck(int i, const u_char *bp2, int initiator)
319 struct sockaddr_storage ss;
322 struct sockaddr_in *sin;
325 struct sockaddr_in6 *sin6;
329 memset(&ss, 0, sizeof(ss));
330 ip = (struct ip *)bp2;
333 sin = (struct sockaddr_in *)&ss;
334 #ifdef HAVE_SOCKADDR_SA_LEN
335 sin->sin_len = sizeof(struct sockaddr_in);
337 sin->sin_family = AF_INET;
338 memcpy(&sin->sin_addr, &ip->ip_src, sizeof(ip->ip_src));
342 ip6 = (struct ip6_hdr *)bp2;
343 sin6 = (struct sockaddr_in6 *)&ss;
344 #ifdef HAVE_SOCKADDR_SA_LEN
345 sin6->sin6_len = sizeof(struct sockaddr_in6);
347 sin6->sin6_family = AF_INET6;
348 memcpy(&sin6->sin6_addr, &ip6->ip6_src, sizeof(ip6->ip6_src));
355 sa = (struct sockaddr *)&ss;
357 if (sa->sa_family != ((struct sockaddr *)&cookiecache[i].iaddr)->sa_family)
359 #ifdef HAVE_SOCKADDR_SA_LEN
363 if (sa->sa_family == AF_INET6)
364 salen = sizeof(struct sockaddr_in6);
366 salen = sizeof(struct sockaddr);
368 salen = sizeof(struct sockaddr);
371 if (memcmp(&ss, &cookiecache[i].iaddr, salen) == 0)
374 if (sa->sa_family != ((struct sockaddr *)&cookiecache[i].raddr)->sa_family)
376 #ifdef HAVE_SOCKADDR_SA_LEN
380 if (sa->sa_family == AF_INET6)
381 salen = sizeof(struct sockaddr_in6);
383 salen = sizeof(struct sockaddr);
385 salen = sizeof(struct sockaddr);
388 if (memcmp(&ss, &cookiecache[i].raddr, salen) == 0)
395 rawprint(netdissect_options *ndo, caddr_t loc, size_t len)
400 ND_TCHECK2(*loc, len);
403 for (i = 0; i < len; i++)
404 ND_PRINT((ndo,"%02x", p[i] & 0xff));
411 * returns false if we run out of data buffer
413 static int ike_show_somedata(struct netdissect_options *ndo,
414 const u_char *cp, const u_char *ep)
416 /* there is too much data, just show some of it */
417 const u_char *end = ep - 20;
424 /* really shouldn't happen because of above */
430 ND_PRINT((ndo," data=("));
431 if(!rawprint(ndo, (caddr_t)(cp), len)) goto trunc;
432 ND_PRINT((ndo, "..."));
434 if(!rawprint(ndo, (caddr_t)(end), elen)) goto trunc;
446 const char *value[30]; /*XXX*/
449 static const u_char *
450 ikev1_attrmap_print(netdissect_options *ndo,
451 const u_char *p, const u_char *ep,
452 const struct attrmap *map, size_t nmap)
462 totlen = 4 + EXTRACT_16BITS(&q[1]);
463 if (ep < p + totlen) {
464 ND_PRINT((ndo,"[|attr]"));
469 t = EXTRACT_16BITS(&q[0]) & 0x7fff;
470 if (map && t < nmap && map[t].type)
471 ND_PRINT((ndo,"type=%s ", map[t].type));
473 ND_PRINT((ndo,"type=#%d ", t));
475 ND_PRINT((ndo,"value="));
476 v = EXTRACT_16BITS(&q[1]);
477 if (map && t < nmap && v < map[t].nvalue && map[t].value[v])
478 ND_PRINT((ndo,"%s", map[t].value[v]));
480 rawprint(ndo, (caddr_t)&q[1], 2);
482 ND_PRINT((ndo,"len=%d value=", EXTRACT_16BITS(&q[1])));
483 rawprint(ndo, (caddr_t)&p[4], EXTRACT_16BITS(&q[1]));
489 static const u_char *
490 ikev1_attr_print(netdissect_options *ndo, const u_char *p, const u_char *ep)
500 totlen = 4 + EXTRACT_16BITS(&q[1]);
501 if (ep < p + totlen) {
502 ND_PRINT((ndo,"[|attr]"));
507 t = EXTRACT_16BITS(&q[0]) & 0x7fff;
508 ND_PRINT((ndo,"type=#%d ", t));
510 ND_PRINT((ndo,"value="));
512 rawprint(ndo, (caddr_t)&q[1], 2);
514 ND_PRINT((ndo,"len=%d value=", EXTRACT_16BITS(&q[1])));
515 rawprint(ndo, (caddr_t)&p[2], EXTRACT_16BITS(&q[1]));
521 static const u_char *
522 ikev1_sa_print(netdissect_options *ndo, u_char tpay _U_,
523 const struct isakmp_gen *ext,
525 const u_char *ep, u_int32_t phase, u_int32_t doi0 _U_,
526 u_int32_t proto0, int depth)
528 const struct ikev1_pl_sa *p;
529 struct ikev1_pl_sa sa;
531 u_int32_t doi, sit, ident;
532 const u_char *cp, *np;
535 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_SA)));
537 p = (struct ikev1_pl_sa *)ext;
539 safememcpy(&sa, ext, sizeof(sa));
543 ND_PRINT((ndo," doi=%d", doi));
544 ND_PRINT((ndo," situation=%u", (u_int32_t)ntohl(sa.sit)));
545 return (u_char *)(p + 1);
548 ND_PRINT((ndo," doi=ipsec"));
549 q = (u_int32_t *)&sa.sit;
550 ND_PRINT((ndo," situation="));
553 ND_PRINT((ndo,"identity"));
557 ND_PRINT((ndo,"%ssecrecy", t ? "+" : ""));
561 ND_PRINT((ndo,"%sintegrity", t ? "+" : ""));
563 np = (u_char *)ext + sizeof(sa);
565 ND_TCHECK2(*(ext + 1), sizeof(ident));
566 safememcpy(&ident, ext + 1, sizeof(ident));
567 ND_PRINT((ndo," ident=%u", (u_int32_t)ntohl(ident)));
571 ext = (struct isakmp_gen *)np;
574 cp = ikev1_sub_print(ndo, ISAKMP_NPTYPE_P, ext, ep, phase, doi, proto0,
579 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_SA)));
583 static const u_char *
584 ikev1_p_print(netdissect_options *ndo, u_char tpay _U_,
585 const struct isakmp_gen *ext, u_int item_len _U_,
586 const u_char *ep, u_int32_t phase, u_int32_t doi0,
587 u_int32_t proto0 _U_, int depth)
589 const struct ikev1_pl_p *p;
590 struct ikev1_pl_p prop;
593 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_P)));
595 p = (struct ikev1_pl_p *)ext;
597 safememcpy(&prop, ext, sizeof(prop));
598 ND_PRINT((ndo," #%d protoid=%s transform=%d",
599 prop.p_no, PROTOIDSTR(prop.prot_id), prop.num_t));
601 ND_PRINT((ndo," spi="));
602 if (!rawprint(ndo, (caddr_t)(p + 1), prop.spi_size))
606 ext = (struct isakmp_gen *)((u_char *)(p + 1) + prop.spi_size);
609 cp = ikev1_sub_print(ndo, ISAKMP_NPTYPE_T, ext, ep, phase, doi0,
610 prop.prot_id, depth);
614 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_P)));
618 static const char *ikev1_p_map[] = {
622 static const char *ikev2_t_type_map[]={
623 NULL, "encr", "prf", "integ", "dh", "esn"
626 static const char *ah_p_map[] = {
627 NULL, "(reserved)", "md5", "sha", "1des",
628 "sha2-256", "sha2-384", "sha2-512",
631 static const char *prf_p_map[] = {
632 NULL, "hmac-md5", "hmac-sha", "hmac-tiger",
636 static const char *integ_p_map[] = {
637 NULL, "hmac-md5", "hmac-sha", "dec-mac",
638 "kpdk-md5", "aes-xcbc"
641 static const char *esn_p_map[] = {
645 static const char *dh_p_map[] = {
647 "modp1024", /* group 2 */
648 "EC2N 2^155", /* group 3 */
649 "EC2N 2^185", /* group 4 */
650 "modp1536", /* group 5 */
651 "iana-grp06", "iana-grp07", /* reserved */
652 "iana-grp08", "iana-grp09",
653 "iana-grp10", "iana-grp11",
654 "iana-grp12", "iana-grp13",
655 "modp2048", /* group 14 */
656 "modp3072", /* group 15 */
657 "modp4096", /* group 16 */
658 "modp6144", /* group 17 */
659 "modp8192", /* group 18 */
662 static const char *esp_p_map[] = {
663 NULL, "1des-iv64", "1des", "3des", "rc5", "idea", "cast",
664 "blowfish", "3idea", "1des-iv32", "rc4", "null", "aes"
667 static const char *ipcomp_p_map[] = {
668 NULL, "oui", "deflate", "lzs",
671 const struct attrmap ipsec_t_map[] = {
672 { NULL, 0, { NULL } },
673 { "lifetype", 3, { NULL, "sec", "kb", }, },
674 { "life", 0, { NULL } },
675 { "group desc", 18, { NULL, "modp768",
676 "modp1024", /* group 2 */
677 "EC2N 2^155", /* group 3 */
678 "EC2N 2^185", /* group 4 */
679 "modp1536", /* group 5 */
680 "iana-grp06", "iana-grp07", /* reserved */
681 "iana-grp08", "iana-grp09",
682 "iana-grp10", "iana-grp11",
683 "iana-grp12", "iana-grp13",
684 "modp2048", /* group 14 */
685 "modp3072", /* group 15 */
686 "modp4096", /* group 16 */
687 "modp6144", /* group 17 */
688 "modp8192", /* group 18 */
690 { "enc mode", 3, { NULL, "tunnel", "transport", }, },
691 { "auth", 5, { NULL, "hmac-md5", "hmac-sha1", "1des-mac", "keyed", }, },
692 { "keylen", 0, { NULL } },
693 { "rounds", 0, { NULL } },
694 { "dictsize", 0, { NULL } },
695 { "privalg", 0, { NULL } },
698 const struct attrmap encr_t_map[] = {
699 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 0, 1 */
700 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 2, 3 */
701 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 4, 5 */
702 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 6, 7 */
703 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 8, 9 */
704 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 10,11*/
705 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 12,13*/
706 { "keylen", 14, { NULL }},
709 const struct attrmap oakley_t_map[] = {
710 { NULL, 0, { NULL } },
711 { "enc", 8, { NULL, "1des", "idea", "blowfish", "rc5",
712 "3des", "cast", "aes", }, },
713 { "hash", 7, { NULL, "md5", "sha1", "tiger",
714 "sha2-256", "sha2-384", "sha2-512", }, },
715 { "auth", 6, { NULL, "preshared", "dss", "rsa sig", "rsa enc",
716 "rsa enc revised", }, },
717 { "group desc", 18, { NULL, "modp768",
718 "modp1024", /* group 2 */
719 "EC2N 2^155", /* group 3 */
720 "EC2N 2^185", /* group 4 */
721 "modp1536", /* group 5 */
722 "iana-grp06", "iana-grp07", /* reserved */
723 "iana-grp08", "iana-grp09",
724 "iana-grp10", "iana-grp11",
725 "iana-grp12", "iana-grp13",
726 "modp2048", /* group 14 */
727 "modp3072", /* group 15 */
728 "modp4096", /* group 16 */
729 "modp6144", /* group 17 */
730 "modp8192", /* group 18 */
732 { "group type", 4, { NULL, "MODP", "ECP", "EC2N", }, },
733 { "group prime", 0, { NULL } },
734 { "group gen1", 0, { NULL } },
735 { "group gen2", 0, { NULL } },
736 { "group curve A", 0, { NULL } },
737 { "group curve B", 0, { NULL } },
738 { "lifetype", 3, { NULL, "sec", "kb", }, },
739 { "lifeduration", 0, { NULL } },
740 { "prf", 0, { NULL } },
741 { "keylen", 0, { NULL } },
742 { "field", 0, { NULL } },
743 { "order", 0, { NULL } },
746 static const u_char *
747 ikev1_t_print(netdissect_options *ndo, u_char tpay _U_,
748 const struct isakmp_gen *ext, u_int item_len,
749 const u_char *ep, u_int32_t phase _U_, u_int32_t doi _U_,
750 u_int32_t proto, int depth _U_)
752 const struct ikev1_pl_t *p;
756 const struct attrmap *map;
760 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_T)));
762 p = (struct ikev1_pl_t *)ext;
764 safememcpy(&t, ext, sizeof(t));
768 idstr = STR_OR_ID(t.t_id, ikev1_p_map);
770 nmap = sizeof(oakley_t_map)/sizeof(oakley_t_map[0]);
773 idstr = STR_OR_ID(t.t_id, ah_p_map);
775 nmap = sizeof(ipsec_t_map)/sizeof(ipsec_t_map[0]);
778 idstr = STR_OR_ID(t.t_id, esp_p_map);
780 nmap = sizeof(ipsec_t_map)/sizeof(ipsec_t_map[0]);
783 idstr = STR_OR_ID(t.t_id, ipcomp_p_map);
785 nmap = sizeof(ipsec_t_map)/sizeof(ipsec_t_map[0]);
795 ND_PRINT((ndo," #%d id=%s ", t.t_no, idstr));
797 ND_PRINT((ndo," #%d id=%d ", t.t_no, t.t_id));
798 cp = (u_char *)(p + 1);
799 ep2 = (u_char *)p + item_len;
800 while (cp < ep && cp < ep2) {
802 cp = ikev1_attrmap_print(ndo, cp, (ep < ep2) ? ep : ep2,
805 cp = ikev1_attr_print(ndo, cp, (ep < ep2) ? ep : ep2);
808 ND_PRINT((ndo,"..."));
811 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_T)));
815 static const u_char *
816 ikev1_ke_print(netdissect_options *ndo, u_char tpay _U_,
817 const struct isakmp_gen *ext, u_int item_len _U_,
818 const u_char *ep _U_, u_int32_t phase _U_, u_int32_t doi _U_,
819 u_int32_t proto _U_, int depth _U_)
823 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_KE)));
826 safememcpy(&e, ext, sizeof(e));
827 ND_PRINT((ndo," key len=%d", ntohs(e.len) - 4));
828 if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
830 if (!rawprint(ndo, (caddr_t)(ext + 1), ntohs(e.len) - 4))
833 return (u_char *)ext + ntohs(e.len);
835 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_KE)));
839 static const u_char *
840 ikev1_id_print(netdissect_options *ndo, u_char tpay _U_,
841 const struct isakmp_gen *ext, u_int item_len _U_,
842 const u_char *ep _U_, u_int32_t phase, u_int32_t doi _U_,
843 u_int32_t proto _U_, int depth _U_)
845 #define USE_IPSECDOI_IN_PHASE1 1
846 const struct ikev1_pl_id *p;
847 struct ikev1_pl_id id;
848 static const char *idtypestr[] = {
849 "IPv4", "IPv4net", "IPv6", "IPv6net",
851 static const char *ipsecidtypestr[] = {
852 NULL, "IPv4", "FQDN", "user FQDN", "IPv4net", "IPv6",
853 "IPv6net", "IPv4range", "IPv6range", "ASN1 DN", "ASN1 GN",
859 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_ID)));
861 p = (struct ikev1_pl_id *)ext;
863 safememcpy(&id, ext, sizeof(id));
864 if (sizeof(*p) < item_len) {
865 data = (u_char *)(p + 1);
866 len = item_len - sizeof(*p);
873 ND_PRINT((ndo," [phase=%d doi=%d proto=%d]", phase, doi, proto));
876 #ifndef USE_IPSECDOI_IN_PHASE1
880 ND_PRINT((ndo," idtype=%s", STR_OR_ID(id.d.id_type, idtypestr)));
881 ND_PRINT((ndo," doi_data=%u",
882 (u_int32_t)(ntohl(id.d.doi_data) & 0xffffff)));
885 #ifdef USE_IPSECDOI_IN_PHASE1
890 const struct ipsecdoi_id *p;
891 struct ipsecdoi_id id;
894 p = (struct ipsecdoi_id *)ext;
896 safememcpy(&id, ext, sizeof(id));
897 ND_PRINT((ndo," idtype=%s", STR_OR_ID(id.type, ipsecidtypestr)));
902 pe = getprotobynumber(id.proto_id);
904 ND_PRINT((ndo," protoid=%s", pe->p_name));
909 /* it DOES NOT mean IPPROTO_IP! */
910 ND_PRINT((ndo," protoid=%s", "0"));
912 ND_PRINT((ndo," port=%d", ntohs(id.port)));
917 ND_TCHECK2(*data, len);
919 case IPSECDOI_ID_IPV4_ADDR:
921 ND_PRINT((ndo," len=%d [bad: < 4]", len));
923 ND_PRINT((ndo," len=%d %s", len, ipaddr_string(data)));
926 case IPSECDOI_ID_FQDN:
927 case IPSECDOI_ID_USER_FQDN:
930 ND_PRINT((ndo," len=%d ", len));
931 for (i = 0; i < len; i++)
932 safeputchar(data[i]);
936 case IPSECDOI_ID_IPV4_ADDR_SUBNET:
940 ND_PRINT((ndo," len=%d [bad: < 8]", len));
942 mask = data + sizeof(struct in_addr);
943 ND_PRINT((ndo," len=%d %s/%u.%u.%u.%u", len,
945 mask[0], mask[1], mask[2], mask[3]));
951 case IPSECDOI_ID_IPV6_ADDR:
953 ND_PRINT((ndo," len=%d [bad: < 16]", len));
955 ND_PRINT((ndo," len=%d %s", len, ip6addr_string(data)));
958 case IPSECDOI_ID_IPV6_ADDR_SUBNET:
960 const u_int32_t *mask;
962 ND_PRINT((ndo," len=%d [bad: < 20]", len));
964 mask = (u_int32_t *)(data + sizeof(struct in6_addr));
966 ND_PRINT((ndo," len=%d %s/0x%08x%08x%08x%08x", len,
967 ip6addr_string(data),
968 mask[0], mask[1], mask[2], mask[3]));
974 case IPSECDOI_ID_IPV4_ADDR_RANGE:
976 ND_PRINT((ndo," len=%d [bad: < 8]", len));
978 ND_PRINT((ndo," len=%d %s-%s", len,
980 ipaddr_string(data + sizeof(struct in_addr))));
985 case IPSECDOI_ID_IPV6_ADDR_RANGE:
987 ND_PRINT((ndo," len=%d [bad: < 32]", len));
989 ND_PRINT((ndo," len=%d %s-%s", len,
990 ip6addr_string(data),
991 ip6addr_string(data + sizeof(struct in6_addr))));
996 case IPSECDOI_ID_DER_ASN1_DN:
997 case IPSECDOI_ID_DER_ASN1_GN:
998 case IPSECDOI_ID_KEY_ID:
1005 ND_PRINT((ndo," len=%d", len));
1006 if (2 < ndo->ndo_vflag) {
1007 ND_PRINT((ndo," "));
1008 if (!rawprint(ndo, (caddr_t)data, len))
1012 return (u_char *)ext + item_len;
1014 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_ID)));
1018 static const u_char *
1019 ikev1_cert_print(netdissect_options *ndo, u_char tpay _U_,
1020 const struct isakmp_gen *ext, u_int item_len _U_,
1021 const u_char *ep _U_, u_int32_t phase _U_,
1023 u_int32_t proto0 _U_, int depth _U_)
1025 const struct ikev1_pl_cert *p;
1026 struct ikev1_pl_cert cert;
1027 static const char *certstr[] = {
1028 "none", "pkcs7", "pgp", "dns",
1029 "x509sign", "x509ke", "kerberos", "crl",
1030 "arl", "spki", "x509attr",
1033 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_CERT)));
1035 p = (struct ikev1_pl_cert *)ext;
1037 safememcpy(&cert, ext, sizeof(cert));
1038 ND_PRINT((ndo," len=%d", item_len - 4));
1039 ND_PRINT((ndo," type=%s", STR_OR_ID((cert.encode), certstr)));
1040 if (2 < ndo->ndo_vflag && 4 < item_len) {
1041 ND_PRINT((ndo," "));
1042 if (!rawprint(ndo, (caddr_t)(ext + 1), item_len - 4))
1045 return (u_char *)ext + item_len;
1047 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_CERT)));
1051 static const u_char *
1052 ikev1_cr_print(netdissect_options *ndo, u_char tpay _U_,
1053 const struct isakmp_gen *ext, u_int item_len _U_,
1054 const u_char *ep _U_, u_int32_t phase _U_, u_int32_t doi0 _U_,
1055 u_int32_t proto0 _U_, int depth _U_)
1057 const struct ikev1_pl_cert *p;
1058 struct ikev1_pl_cert cert;
1059 static const char *certstr[] = {
1060 "none", "pkcs7", "pgp", "dns",
1061 "x509sign", "x509ke", "kerberos", "crl",
1062 "arl", "spki", "x509attr",
1065 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_CR)));
1067 p = (struct ikev1_pl_cert *)ext;
1069 safememcpy(&cert, ext, sizeof(cert));
1070 ND_PRINT((ndo," len=%d", item_len - 4));
1071 ND_PRINT((ndo," type=%s", STR_OR_ID((cert.encode), certstr)));
1072 if (2 < ndo->ndo_vflag && 4 < item_len) {
1073 ND_PRINT((ndo," "));
1074 if (!rawprint(ndo, (caddr_t)(ext + 1), item_len - 4))
1077 return (u_char *)ext + item_len;
1079 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_CR)));
1083 static const u_char *
1084 ikev1_hash_print(netdissect_options *ndo, u_char tpay _U_,
1085 const struct isakmp_gen *ext, u_int item_len _U_,
1086 const u_char *ep _U_, u_int32_t phase _U_, u_int32_t doi _U_,
1087 u_int32_t proto _U_, int depth _U_)
1089 struct isakmp_gen e;
1091 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_HASH)));
1094 safememcpy(&e, ext, sizeof(e));
1095 ND_PRINT((ndo," len=%d", ntohs(e.len) - 4));
1096 if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1097 ND_PRINT((ndo," "));
1098 if (!rawprint(ndo, (caddr_t)(ext + 1), ntohs(e.len) - 4))
1101 return (u_char *)ext + ntohs(e.len);
1103 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_HASH)));
1107 static const u_char *
1108 ikev1_sig_print(netdissect_options *ndo, u_char tpay _U_,
1109 const struct isakmp_gen *ext, u_int item_len _U_,
1110 const u_char *ep _U_, u_int32_t phase _U_, u_int32_t doi _U_,
1111 u_int32_t proto _U_, int depth _U_)
1113 struct isakmp_gen e;
1115 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_SIG)));
1118 safememcpy(&e, ext, sizeof(e));
1119 ND_PRINT((ndo," len=%d", ntohs(e.len) - 4));
1120 if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1121 ND_PRINT((ndo," "));
1122 if (!rawprint(ndo, (caddr_t)(ext + 1), ntohs(e.len) - 4))
1125 return (u_char *)ext + ntohs(e.len);
1127 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_SIG)));
1131 static const u_char *
1132 ikev1_nonce_print(netdissect_options *ndo, u_char tpay _U_,
1133 const struct isakmp_gen *ext,
1135 const u_char *ep _U_,
1136 u_int32_t phase _U_, u_int32_t doi _U_,
1137 u_int32_t proto _U_, int depth _U_)
1139 struct isakmp_gen e;
1141 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_NONCE)));
1144 safememcpy(&e, ext, sizeof(e));
1145 ND_PRINT((ndo," n len=%d", ntohs(e.len) - 4));
1146 if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1147 ND_PRINT((ndo," "));
1148 if (!rawprint(ndo, (caddr_t)(ext + 1), ntohs(e.len) - 4))
1150 } else if (1 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1151 ND_PRINT((ndo," "));
1152 if (!ike_show_somedata(ndo, (u_char *)(caddr_t)(ext + 1), ep))
1155 return (u_char *)ext + ntohs(e.len);
1157 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_NONCE)));
1161 static const u_char *
1162 ikev1_n_print(netdissect_options *ndo, u_char tpay _U_,
1163 const struct isakmp_gen *ext, u_int item_len,
1164 const u_char *ep, u_int32_t phase, u_int32_t doi0 _U_,
1165 u_int32_t proto0 _U_, int depth)
1167 struct ikev1_pl_n *p, n;
1172 static const char *notify_error_str[] = {
1173 NULL, "INVALID-PAYLOAD-TYPE",
1174 "DOI-NOT-SUPPORTED", "SITUATION-NOT-SUPPORTED",
1175 "INVALID-COOKIE", "INVALID-MAJOR-VERSION",
1176 "INVALID-MINOR-VERSION", "INVALID-EXCHANGE-TYPE",
1177 "INVALID-FLAGS", "INVALID-MESSAGE-ID",
1178 "INVALID-PROTOCOL-ID", "INVALID-SPI",
1179 "INVALID-TRANSFORM-ID", "ATTRIBUTES-NOT-SUPPORTED",
1180 "NO-PROPOSAL-CHOSEN", "BAD-PROPOSAL-SYNTAX",
1181 "PAYLOAD-MALFORMED", "INVALID-KEY-INFORMATION",
1182 "INVALID-ID-INFORMATION", "INVALID-CERT-ENCODING",
1183 "INVALID-CERTIFICATE", "CERT-TYPE-UNSUPPORTED",
1184 "INVALID-CERT-AUTHORITY", "INVALID-HASH-INFORMATION",
1185 "AUTHENTICATION-FAILED", "INVALID-SIGNATURE",
1186 "ADDRESS-NOTIFICATION", "NOTIFY-SA-LIFETIME",
1187 "CERTIFICATE-UNAVAILABLE", "UNSUPPORTED-EXCHANGE-TYPE",
1188 "UNEQUAL-PAYLOAD-LENGTHS",
1190 static const char *ipsec_notify_error_str[] = {
1193 static const char *notify_status_str[] = {
1196 static const char *ipsec_notify_status_str[] = {
1197 "RESPONDER-LIFETIME", "REPLAY-STATUS",
1200 /* NOTE: these macro must be called with x in proper range */
1203 #define NOTIFY_ERROR_STR(x) \
1204 STR_OR_ID((x), notify_error_str)
1207 #define IPSEC_NOTIFY_ERROR_STR(x) \
1208 STR_OR_ID((u_int)((x) - 8192), ipsec_notify_error_str)
1211 #define NOTIFY_STATUS_STR(x) \
1212 STR_OR_ID((u_int)((x) - 16384), notify_status_str)
1215 #define IPSEC_NOTIFY_STATUS_STR(x) \
1216 STR_OR_ID((u_int)((x) - 24576), ipsec_notify_status_str)
1218 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_N)));
1220 p = (struct ikev1_pl_n *)ext;
1222 safememcpy(&n, ext, sizeof(n));
1226 ND_PRINT((ndo," doi=%d", doi));
1227 ND_PRINT((ndo," proto=%d", proto));
1228 if (ntohs(n.type) < 8192)
1229 ND_PRINT((ndo," type=%s", NOTIFY_ERROR_STR(ntohs(n.type))));
1230 else if (ntohs(n.type) < 16384)
1231 ND_PRINT((ndo," type=%s", numstr(ntohs(n.type))));
1232 else if (ntohs(n.type) < 24576)
1233 ND_PRINT((ndo," type=%s", NOTIFY_STATUS_STR(ntohs(n.type))));
1235 ND_PRINT((ndo," type=%s", numstr(ntohs(n.type))));
1237 ND_PRINT((ndo," spi="));
1238 if (!rawprint(ndo, (caddr_t)(p + 1), n.spi_size))
1241 return (u_char *)(p + 1) + n.spi_size;
1244 ND_PRINT((ndo," doi=ipsec"));
1245 ND_PRINT((ndo," proto=%s", PROTOIDSTR(proto)));
1246 if (ntohs(n.type) < 8192)
1247 ND_PRINT((ndo," type=%s", NOTIFY_ERROR_STR(ntohs(n.type))));
1248 else if (ntohs(n.type) < 16384)
1249 ND_PRINT((ndo," type=%s", IPSEC_NOTIFY_ERROR_STR(ntohs(n.type))));
1250 else if (ntohs(n.type) < 24576)
1251 ND_PRINT((ndo," type=%s", NOTIFY_STATUS_STR(ntohs(n.type))));
1252 else if (ntohs(n.type) < 32768)
1253 ND_PRINT((ndo," type=%s", IPSEC_NOTIFY_STATUS_STR(ntohs(n.type))));
1255 ND_PRINT((ndo," type=%s", numstr(ntohs(n.type))));
1257 ND_PRINT((ndo," spi="));
1258 if (!rawprint(ndo, (caddr_t)(p + 1), n.spi_size))
1262 cp = (u_char *)(p + 1) + n.spi_size;
1263 ep2 = (u_char *)p + item_len;
1266 ND_PRINT((ndo," orig=("));
1267 switch (ntohs(n.type)) {
1268 case IPSECDOI_NTYPE_RESPONDER_LIFETIME:
1270 const struct attrmap *map = oakley_t_map;
1271 size_t nmap = sizeof(oakley_t_map)/sizeof(oakley_t_map[0]);
1272 while (cp < ep && cp < ep2) {
1273 cp = ikev1_attrmap_print(ndo, cp,
1274 (ep < ep2) ? ep : ep2, map, nmap);
1278 case IPSECDOI_NTYPE_REPLAY_STATUS:
1279 ND_PRINT((ndo,"replay detection %sabled",
1280 (*(u_int32_t *)cp) ? "en" : "dis"));
1282 case ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN:
1283 if (ikev1_sub_print(ndo, ISAKMP_NPTYPE_SA,
1284 (struct isakmp_gen *)cp, ep, phase, doi, proto,
1290 isakmp_print(ndo, cp,
1291 item_len - sizeof(*p) - n.spi_size,
1294 ND_PRINT((ndo,")"));
1296 return (u_char *)ext + item_len;
1298 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_N)));
1302 static const u_char *
1303 ikev1_d_print(netdissect_options *ndo, u_char tpay _U_,
1304 const struct isakmp_gen *ext, u_int item_len _U_,
1305 const u_char *ep _U_, u_int32_t phase _U_, u_int32_t doi0 _U_,
1306 u_int32_t proto0 _U_, int depth _U_)
1308 const struct ikev1_pl_d *p;
1309 struct ikev1_pl_d d;
1315 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_D)));
1317 p = (struct ikev1_pl_d *)ext;
1319 safememcpy(&d, ext, sizeof(d));
1323 ND_PRINT((ndo," doi=%u", doi));
1324 ND_PRINT((ndo," proto=%u", proto));
1326 ND_PRINT((ndo," doi=ipsec"));
1327 ND_PRINT((ndo," proto=%s", PROTOIDSTR(proto)));
1329 ND_PRINT((ndo," spilen=%u", d.spi_size));
1330 ND_PRINT((ndo," nspi=%u", ntohs(d.num_spi)));
1331 ND_PRINT((ndo," spi="));
1332 q = (u_int8_t *)(p + 1);
1333 for (i = 0; i < ntohs(d.num_spi); i++) {
1335 ND_PRINT((ndo,","));
1336 if (!rawprint(ndo, (caddr_t)q, d.spi_size))
1342 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_D)));
1346 static const u_char *
1347 ikev1_vid_print(netdissect_options *ndo, u_char tpay _U_,
1348 const struct isakmp_gen *ext,
1349 u_int item_len _U_, const u_char *ep _U_,
1350 u_int32_t phase _U_, u_int32_t doi _U_,
1351 u_int32_t proto _U_, int depth _U_)
1353 struct isakmp_gen e;
1355 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_VID)));
1358 safememcpy(&e, ext, sizeof(e));
1359 ND_PRINT((ndo," len=%d", ntohs(e.len) - 4));
1360 if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1361 ND_PRINT((ndo," "));
1362 if (!rawprint(ndo, (caddr_t)(ext + 1), ntohs(e.len) - 4))
1365 return (u_char *)ext + ntohs(e.len);
1367 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_VID)));
1371 /************************************************************/
1373 /* IKE v2 - rfc4306 - dissector */
1375 /************************************************************/
1378 ikev2_pay_print(netdissect_options *ndo, const char *payname, int critical)
1380 ND_PRINT((ndo,"%s%s:", payname, critical&0x80 ? "[C]" : ""));
1383 static const u_char *
1384 ikev2_gen_print(netdissect_options *ndo, u_char tpay,
1385 const struct isakmp_gen *ext)
1387 struct isakmp_gen e;
1390 safememcpy(&e, ext, sizeof(e));
1391 ikev2_pay_print(ndo, NPSTR(tpay), e.critical);
1393 ND_PRINT((ndo," len=%d", ntohs(e.len) - 4));
1394 if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1395 ND_PRINT((ndo," "));
1396 if (!rawprint(ndo, (caddr_t)(ext + 1), ntohs(e.len) - 4))
1399 return (u_char *)ext + ntohs(e.len);
1401 ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
1405 static const u_char *
1406 ikev2_t_print(netdissect_options *ndo, u_char tpay _U_, int pcount,
1407 const struct isakmp_gen *ext, u_int item_len,
1408 const u_char *ep, u_int32_t phase _U_, u_int32_t doi _U_,
1409 u_int32_t proto _U_, int depth _U_)
1411 const struct ikev2_t *p;
1416 const struct attrmap *map;
1420 p = (struct ikev2_t *)ext;
1422 safememcpy(&t, ext, sizeof(t));
1423 ikev2_pay_print(ndo, NPSTR(ISAKMP_NPTYPE_T), t.h.critical);
1425 t_id = ntohs(t.t_id);
1432 idstr = STR_OR_ID(t_id, esp_p_map);
1434 nmap = sizeof(encr_t_map)/sizeof(encr_t_map[0]);
1438 idstr = STR_OR_ID(t_id, prf_p_map);
1442 idstr = STR_OR_ID(t_id, integ_p_map);
1446 idstr = STR_OR_ID(t_id, dh_p_map);
1450 idstr = STR_OR_ID(t_id, esn_p_map);
1459 ND_PRINT((ndo," #%u type=%s id=%s ", pcount,
1460 STR_OR_ID(t.t_type, ikev2_t_type_map),
1463 ND_PRINT((ndo," #%u type=%s id=%u ", pcount,
1464 STR_OR_ID(t.t_type, ikev2_t_type_map),
1466 cp = (u_char *)(p + 1);
1467 ep2 = (u_char *)p + item_len;
1468 while (cp < ep && cp < ep2) {
1470 cp = ikev1_attrmap_print(ndo, cp, (ep < ep2) ? ep : ep2,
1473 cp = ikev1_attr_print(ndo, cp, (ep < ep2) ? ep : ep2);
1476 ND_PRINT((ndo,"..."));
1479 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_T)));
1483 static const u_char *
1484 ikev2_p_print(netdissect_options *ndo, u_char tpay _U_, int pcount _U_,
1485 const struct isakmp_gen *ext, u_int item_len _U_,
1486 const u_char *ep, u_int32_t phase, u_int32_t doi0,
1487 u_int32_t proto0 _U_, int depth)
1489 const struct ikev2_p *p;
1490 struct ikev2_p prop;
1493 p = (struct ikev2_p *)ext;
1495 safememcpy(&prop, ext, sizeof(prop));
1496 ikev2_pay_print(ndo, NPSTR(ISAKMP_NPTYPE_P), prop.h.critical);
1498 ND_PRINT((ndo," #%u protoid=%s transform=%d",
1499 prop.p_no, PROTOIDSTR(prop.prot_id), prop.num_t));
1500 if (prop.spi_size) {
1501 ND_PRINT((ndo," spi="));
1502 if (!rawprint(ndo, (caddr_t)(p + 1), prop.spi_size))
1506 ext = (struct isakmp_gen *)((u_char *)(p + 1) + prop.spi_size);
1509 cp = ikev2_sub_print(ndo, ISAKMP_NPTYPE_T, ext, ep, phase, doi0,
1510 prop.prot_id, depth);
1514 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_P)));
1518 static const u_char *
1519 ikev2_sa_print(netdissect_options *ndo, u_char tpay,
1520 const struct isakmp_gen *ext1,
1521 u_int item_len _U_, const u_char *ep _U_,
1522 u_int32_t phase _U_, u_int32_t doi _U_,
1523 u_int32_t proto _U_, int depth _U_)
1525 struct isakmp_gen e;
1526 int osa_len, sa_len;
1529 safememcpy(&e, ext1, sizeof(e));
1530 ikev2_pay_print(ndo, "sa", e.critical);
1532 osa_len= ntohs(e.len);
1533 sa_len = osa_len - 4;
1534 ND_PRINT((ndo," len=%d", sa_len));
1536 ikev2_sub_print(ndo, ISAKMP_NPTYPE_P,
1540 return (u_char *)ext1 + osa_len;
1542 ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
1546 static const u_char *
1547 ikev2_ke_print(netdissect_options *ndo, u_char tpay,
1548 const struct isakmp_gen *ext,
1549 u_int item_len _U_, const u_char *ep _U_,
1550 u_int32_t phase _U_, u_int32_t doi _U_,
1551 u_int32_t proto _U_, int depth _U_)
1556 k = (struct ikev2_ke *)ext;
1558 safememcpy(&ke, ext, sizeof(ke));
1559 ikev2_pay_print(ndo, NPSTR(tpay), ke.h.critical);
1561 ND_PRINT((ndo," len=%u group=%s", ntohs(ke.h.len) - 8,
1562 STR_OR_ID(ntohs(ke.ke_group), dh_p_map)));
1564 if (2 < ndo->ndo_vflag && 8 < ntohs(ke.h.len)) {
1565 ND_PRINT((ndo," "));
1566 if (!rawprint(ndo, (caddr_t)(k + 1), ntohs(ke.h.len) - 8))
1569 return (u_char *)ext + ntohs(ke.h.len);
1571 ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
1575 static const u_char *
1576 ikev2_ID_print(netdissect_options *ndo, u_char tpay,
1577 const struct isakmp_gen *ext,
1578 u_int item_len _U_, const u_char *ep _U_,
1579 u_int32_t phase _U_, u_int32_t doi _U_,
1580 u_int32_t proto _U_, int depth _U_)
1582 return ikev2_gen_print(ndo, tpay, ext);
1585 static const u_char *
1586 ikev2_cert_print(netdissect_options *ndo, u_char tpay,
1587 const struct isakmp_gen *ext,
1588 u_int item_len _U_, const u_char *ep _U_,
1589 u_int32_t phase _U_, u_int32_t doi _U_,
1590 u_int32_t proto _U_, int depth _U_)
1592 return ikev2_gen_print(ndo, tpay, ext);
1595 static const u_char *
1596 ikev2_cr_print(netdissect_options *ndo, u_char tpay,
1597 const struct isakmp_gen *ext,
1598 u_int item_len _U_, const u_char *ep _U_,
1599 u_int32_t phase _U_, u_int32_t doi _U_,
1600 u_int32_t proto _U_, int depth _U_)
1602 return ikev2_gen_print(ndo, tpay, ext);
1605 static const u_char *
1606 ikev2_auth_print(netdissect_options *ndo, u_char tpay,
1607 const struct isakmp_gen *ext,
1608 u_int item_len _U_, const u_char *ep _U_,
1609 u_int32_t phase _U_, u_int32_t doi _U_,
1610 u_int32_t proto _U_, int depth _U_)
1612 struct ikev2_auth e;
1613 const char *v2_auth[]={ "invalid", "rsasig",
1614 "shared-secret", "dsssig" };
1617 safememcpy(&e, ext, sizeof(e));
1618 ikev2_pay_print(ndo, NPSTR(tpay), e.h.critical);
1620 ND_PRINT((ndo," len=%d method=%s", ntohs(e.h.len) - 4,
1621 STR_OR_ID(e.auth_method, v2_auth)));
1623 if (1 < ndo->ndo_vflag && 4 < ntohs(e.h.len)) {
1624 ND_PRINT((ndo," authdata=("));
1625 if (!rawprint(ndo, (caddr_t)(ext + 1), ntohs(e.h.len) - 4))
1627 ND_PRINT((ndo,") "));
1628 } else if(ndo->ndo_vflag && 4 < ntohs(e.h.len)) {
1629 if(!ike_show_somedata(ndo, (const u_char *)(ext+1), ep)) goto trunc;
1632 return (u_char *)ext + ntohs(e.h.len);
1634 ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
1638 static const u_char *
1639 ikev2_nonce_print(netdissect_options *ndo, u_char tpay,
1640 const struct isakmp_gen *ext,
1641 u_int item_len _U_, const u_char *ep _U_,
1642 u_int32_t phase _U_, u_int32_t doi _U_,
1643 u_int32_t proto _U_, int depth _U_)
1645 struct isakmp_gen e;
1648 safememcpy(&e, ext, sizeof(e));
1649 ikev2_pay_print(ndo, "nonce", e.critical);
1651 ND_PRINT((ndo," len=%d", ntohs(e.len) - 4));
1652 if (1 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1653 ND_PRINT((ndo," nonce=("));
1654 if (!rawprint(ndo, (caddr_t)(ext + 1), ntohs(e.len) - 4))
1656 ND_PRINT((ndo,") "));
1657 } else if(ndo->ndo_vflag && 4 < ntohs(e.len)) {
1658 if(!ike_show_somedata(ndo, (const u_char *)(ext+1), ep)) goto trunc;
1661 return (u_char *)ext + ntohs(e.len);
1663 ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
1667 /* notify payloads */
1668 static const u_char *
1669 ikev2_n_print(netdissect_options *ndo, u_char tpay _U_,
1670 const struct isakmp_gen *ext,
1671 u_int item_len _U_, const u_char *ep _U_,
1672 u_int32_t phase _U_, u_int32_t doi _U_,
1673 u_int32_t proto _U_, int depth _U_)
1675 struct ikev2_n *p, n;
1678 u_char showspi, showdata, showsomedata;
1679 const char *notify_name;
1682 p = (struct ikev2_n *)ext;
1684 safememcpy(&n, ext, sizeof(n));
1685 ikev2_pay_print(ndo, NPSTR(ISAKMP_NPTYPE_N), n.h.critical);
1692 ND_PRINT((ndo," prot_id=%s", PROTOIDSTR(n.prot_id)));
1694 type = ntohs(n.type);
1696 /* notify space is annoying sparse */
1698 case IV2_NOTIFY_UNSUPPORTED_CRITICAL_PAYLOAD:
1699 notify_name = "unsupported_critical_payload";
1703 case IV2_NOTIFY_INVALID_IKE_SPI:
1704 notify_name = "invalid_ike_spi";
1708 case IV2_NOTIFY_INVALID_MAJOR_VERSION:
1709 notify_name = "invalid_major_version";
1713 case IV2_NOTIFY_INVALID_SYNTAX:
1714 notify_name = "invalid_syntax";
1718 case IV2_NOTIFY_INVALID_MESSAGE_ID:
1719 notify_name = "invalid_message_id";
1723 case IV2_NOTIFY_INVALID_SPI:
1724 notify_name = "invalid_spi";
1728 case IV2_NOTIFY_NO_PROPOSAL_CHOSEN:
1729 notify_name = "no_protocol_chosen";
1733 case IV2_NOTIFY_INVALID_KE_PAYLOAD:
1734 notify_name = "invalid_ke_payload";
1738 case IV2_NOTIFY_AUTHENTICATION_FAILED:
1739 notify_name = "authentication_failed";
1743 case IV2_NOTIFY_SINGLE_PAIR_REQUIRED:
1744 notify_name = "single_pair_required";
1748 case IV2_NOTIFY_NO_ADDITIONAL_SAS:
1749 notify_name = "no_additional_sas";
1753 case IV2_NOTIFY_INTERNAL_ADDRESS_FAILURE:
1754 notify_name = "internal_address_failure";
1758 case IV2_NOTIFY_FAILED_CP_REQUIRED:
1759 notify_name = "failed:cp_required";
1763 case IV2_NOTIFY_INVALID_SELECTORS:
1764 notify_name = "invalid_selectors";
1768 case IV2_NOTIFY_INITIAL_CONTACT:
1769 notify_name = "initial_contact";
1773 case IV2_NOTIFY_SET_WINDOW_SIZE:
1774 notify_name = "set_window_size";
1778 case IV2_NOTIFY_ADDITIONAL_TS_POSSIBLE:
1779 notify_name = "additional_ts_possible";
1783 case IV2_NOTIFY_IPCOMP_SUPPORTED:
1784 notify_name = "ipcomp_supported";
1788 case IV2_NOTIFY_NAT_DETECTION_SOURCE_IP:
1789 notify_name = "nat_detection_source_ip";
1793 case IV2_NOTIFY_NAT_DETECTION_DESTINATION_IP:
1794 notify_name = "nat_detection_destination_ip";
1798 case IV2_NOTIFY_COOKIE:
1799 notify_name = "cookie";
1805 case IV2_NOTIFY_USE_TRANSPORT_MODE:
1806 notify_name = "use_transport_mode";
1810 case IV2_NOTIFY_HTTP_CERT_LOOKUP_SUPPORTED:
1811 notify_name = "http_cert_lookup_supported";
1815 case IV2_NOTIFY_REKEY_SA:
1816 notify_name = "rekey_sa";
1820 case IV2_NOTIFY_ESP_TFC_PADDING_NOT_SUPPORTED:
1821 notify_name = "tfc_padding_not_supported";
1825 case IV2_NOTIFY_NON_FIRST_FRAGMENTS_ALSO:
1826 notify_name = "non_first_fragment_also";
1832 notify_name="error";
1833 } else if(type < 16384) {
1834 notify_name="private-error";
1835 } else if(type < 40960) {
1836 notify_name="status";
1838 notify_name="private-status";
1843 ND_PRINT((ndo," type=%u(%s)", type, notify_name));
1847 if (showspi && n.spi_size) {
1848 ND_PRINT((ndo," spi="));
1849 if (!rawprint(ndo, (caddr_t)(p + 1), n.spi_size))
1853 cp = (u_char *)(p + 1) + n.spi_size;
1854 ep2 = (u_char *)p + item_len;
1856 if(3 < ndo->ndo_vflag) {
1860 if ((showdata || (showsomedata && ep-cp < 30)) && cp < ep) {
1861 ND_PRINT((ndo," data=("));
1862 if (!rawprint(ndo, (caddr_t)(cp), ep - cp))
1865 ND_PRINT((ndo,")"));
1867 } else if(showsomedata && cp < ep) {
1868 if(!ike_show_somedata(ndo, cp, ep)) goto trunc;
1871 return (u_char *)ext + item_len;
1873 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_N)));
1877 static const u_char *
1878 ikev2_d_print(netdissect_options *ndo, u_char tpay,
1879 const struct isakmp_gen *ext,
1880 u_int item_len _U_, const u_char *ep _U_,
1881 u_int32_t phase _U_, u_int32_t doi _U_,
1882 u_int32_t proto _U_, int depth _U_)
1884 return ikev2_gen_print(ndo, tpay, ext);
1887 static const u_char *
1888 ikev2_vid_print(netdissect_options *ndo, u_char tpay,
1889 const struct isakmp_gen *ext,
1890 u_int item_len _U_, const u_char *ep _U_,
1891 u_int32_t phase _U_, u_int32_t doi _U_,
1892 u_int32_t proto _U_, int depth _U_)
1894 struct isakmp_gen e;
1899 safememcpy(&e, ext, sizeof(e));
1900 ikev2_pay_print(ndo, NPSTR(tpay), e.critical);
1901 ND_PRINT((ndo," len=%d vid=", ntohs(e.len) - 4));
1903 vid = (const u_char *)(ext+1);
1904 len = ntohs(e.len) - 4;
1905 ND_TCHECK2(*vid, len);
1906 for(i=0; i<len; i++) {
1907 if(isprint(vid[i])) ND_PRINT((ndo, "%c", vid[i]));
1908 else ND_PRINT((ndo, ".", vid[i]));
1910 if (2 < ndo->ndo_vflag && 4 < len) {
1911 ND_PRINT((ndo," "));
1912 if (!rawprint(ndo, (caddr_t)(ext + 1), ntohs(e.len) - 4))
1915 return (u_char *)ext + ntohs(e.len);
1917 ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
1921 static const u_char *
1922 ikev2_TS_print(netdissect_options *ndo, u_char tpay,
1923 const struct isakmp_gen *ext,
1924 u_int item_len _U_, const u_char *ep _U_,
1925 u_int32_t phase _U_, u_int32_t doi _U_,
1926 u_int32_t proto _U_, int depth _U_)
1928 return ikev2_gen_print(ndo, tpay, ext);
1931 static const u_char *
1932 ikev2_e_print(netdissect_options *ndo, u_char tpay,
1933 const struct isakmp_gen *ext,
1934 u_int item_len _U_, const u_char *ep _U_,
1935 u_int32_t phase _U_, u_int32_t doi _U_,
1936 u_int32_t proto _U_, int depth _U_)
1938 return ikev2_gen_print(ndo, tpay, ext);
1941 static const u_char *
1942 ikev2_cp_print(netdissect_options *ndo, u_char tpay,
1943 const struct isakmp_gen *ext,
1944 u_int item_len _U_, const u_char *ep _U_,
1945 u_int32_t phase _U_, u_int32_t doi _U_,
1946 u_int32_t proto _U_, int depth _U_)
1948 return ikev2_gen_print(ndo, tpay, ext);
1951 static const u_char *
1952 ikev2_eap_print(netdissect_options *ndo, u_char tpay,
1953 const struct isakmp_gen *ext,
1954 u_int item_len _U_, const u_char *ep _U_,
1955 u_int32_t phase _U_, u_int32_t doi _U_,
1956 u_int32_t proto _U_, int depth _U_)
1958 return ikev2_gen_print(ndo, tpay, ext);
1961 static const u_char *
1962 ike_sub0_print(netdissect_options *ndo,
1963 u_char np, const struct isakmp_gen *ext, const u_char *ep,
1964 u_int32_t phase, u_int32_t doi, u_int32_t proto, int depth)
1967 struct isakmp_gen e;
1972 safememcpy(&e, ext, sizeof(e));
1975 * Since we can't have a payload length of less than 4 bytes,
1976 * we need to bail out here if the generic header is nonsensical
1977 * or truncated, otherwise we could loop forever processing
1978 * zero-length items or otherwise misdissect the packet.
1980 item_len = ntohs(e.len);
1986 * XXX - what if item_len is too short, or too long,
1987 * for this payload type?
1989 cp = (*npfunc[np])(ndo, np, ext, item_len, ep, phase, doi, proto, depth);
1991 ND_PRINT((ndo,"%s", NPSTR(np)));
1997 ND_PRINT((ndo," [|isakmp]"));
2001 static const u_char *
2002 ikev1_sub_print(netdissect_options *ndo,
2003 u_char np, const struct isakmp_gen *ext, const u_char *ep,
2004 u_int32_t phase, u_int32_t doi, u_int32_t proto, int depth)
2008 struct isakmp_gen e;
2010 cp = (const u_char *)ext;
2015 safememcpy(&e, ext, sizeof(e));
2017 ND_TCHECK2(*ext, ntohs(e.len));
2020 ND_PRINT((ndo,"\n"));
2021 for (i = 0; i < depth; i++)
2022 ND_PRINT((ndo," "));
2023 ND_PRINT((ndo,"("));
2024 cp = ike_sub0_print(ndo, np, ext, ep, phase, doi, proto, depth);
2025 ND_PRINT((ndo,")"));
2029 /* Zero-length subitem */
2034 ext = (struct isakmp_gen *)cp;
2038 ND_PRINT((ndo," [|%s]", NPSTR(np)));
2045 static char buf[20];
2046 snprintf(buf, sizeof(buf), "#%d", x);
2051 * some compiler tries to optimize memcpy(), using the alignment constraint
2052 * on the argument pointer type. by using this function, we try to avoid the
2056 safememcpy(void *p, const void *q, size_t l)
2062 ikev1_print(netdissect_options *ndo,
2063 const u_char *bp, u_int length,
2064 const u_char *bp2, struct isakmp *base)
2066 const struct isakmp *p;
2072 p = (const struct isakmp *)bp;
2073 ep = ndo->ndo_snapend;
2075 phase = (*(u_int32_t *)base->msgid == 0) ? 1 : 2;
2077 ND_PRINT((ndo," phase %d", phase));
2079 ND_PRINT((ndo," phase %d/others", phase));
2081 i = cookie_find(&base->i_ck);
2083 if (iszero((u_char *)&base->r_ck, sizeof(base->r_ck))) {
2084 /* the first packet */
2085 ND_PRINT((ndo," I"));
2087 cookie_record(&base->i_ck, bp2);
2089 ND_PRINT((ndo," ?"));
2091 if (bp2 && cookie_isinitiator(i, bp2))
2092 ND_PRINT((ndo," I"));
2093 else if (bp2 && cookie_isresponder(i, bp2))
2094 ND_PRINT((ndo," R"));
2096 ND_PRINT((ndo," ?"));
2099 ND_PRINT((ndo," %s", ETYPESTR(base->etype)));
2101 ND_PRINT((ndo,"[%s%s]", base->flags & ISAKMP_FLAG_E ? "E" : "",
2102 base->flags & ISAKMP_FLAG_C ? "C" : ""));
2105 if (ndo->ndo_vflag) {
2106 const struct isakmp_gen *ext;
2109 ND_PRINT((ndo,":"));
2111 /* regardless of phase... */
2112 if (base->flags & ISAKMP_FLAG_E) {
2114 * encrypted, nothing we can do right now.
2115 * we hope to decrypt the packet in the future...
2117 ND_PRINT((ndo," [encrypted %s]", NPSTR(base->np)));
2122 CHECKLEN(p + 1, base->np);
2124 ext = (struct isakmp_gen *)(p + 1);
2125 ikev1_sub_print(ndo, np, ext, ep, phase, 0, 0, 0);
2129 if (ndo->ndo_vflag) {
2130 if (ntohl(base->len) != length) {
2131 ND_PRINT((ndo," (len mismatch: isakmp %u/ip %u)",
2132 (u_int32_t)ntohl(base->len), length));
2137 static const u_char *
2138 ikev2_sub0_print(netdissect_options *ndo, u_char np, int pcount,
2139 const struct isakmp_gen *ext, const u_char *ep,
2140 u_int32_t phase, u_int32_t doi, u_int32_t proto, int depth)
2143 struct isakmp_gen e;
2148 safememcpy(&e, ext, sizeof(e));
2151 * Since we can't have a payload length of less than 4 bytes,
2152 * we need to bail out here if the generic header is nonsensical
2153 * or truncated, otherwise we could loop forever processing
2154 * zero-length items or otherwise misdissect the packet.
2156 item_len = ntohs(e.len);
2160 if(np == ISAKMP_NPTYPE_P) {
2161 cp = ikev2_p_print(ndo, np, pcount, ext, item_len,
2162 ep, phase, doi, proto, depth);
2163 } else if(np == ISAKMP_NPTYPE_T) {
2164 cp = ikev2_t_print(ndo, np, pcount, ext, item_len,
2165 ep, phase, doi, proto, depth);
2166 } else if (NPFUNC(np)) {
2168 * XXX - what if item_len is too short, or too long,
2169 * for this payload type?
2171 cp = (*npfunc[np])(ndo, np, /*pcount,*/ ext, item_len,
2172 ep, phase, doi, proto, depth);
2174 ND_PRINT((ndo,"%s", NPSTR(np)));
2180 ND_PRINT((ndo," [|isakmp]"));
2184 static const u_char *
2185 ikev2_sub_print(netdissect_options *ndo,
2186 u_char np, const struct isakmp_gen *ext, const u_char *ep,
2187 u_int32_t phase, u_int32_t doi, u_int32_t proto, int depth)
2192 struct isakmp_gen e;
2194 cp = (const u_char *)ext;
2200 safememcpy(&e, ext, sizeof(e));
2202 ND_TCHECK2(*ext, ntohs(e.len));
2205 ND_PRINT((ndo,"\n"));
2206 for (i = 0; i < depth; i++)
2207 ND_PRINT((ndo," "));
2208 ND_PRINT((ndo,"("));
2209 cp = ikev2_sub0_print(ndo, np, pcount,
2210 ext, ep, phase, doi, proto, depth);
2211 ND_PRINT((ndo,")"));
2215 /* Zero-length subitem */
2220 ext = (struct isakmp_gen *)cp;
2224 ND_PRINT((ndo," [|%s]", NPSTR(np)));
2229 ikev2_print(netdissect_options *ndo,
2230 const u_char *bp, u_int length,
2231 const u_char *bp2 _U_, struct isakmp *base)
2233 const struct isakmp *p;
2238 p = (const struct isakmp *)bp;
2239 ep = ndo->ndo_snapend;
2241 phase = (*(u_int32_t *)base->msgid == 0) ? 1 : 2;
2243 ND_PRINT((ndo, " parent_sa"));
2245 ND_PRINT((ndo, " child_sa "));
2247 ND_PRINT((ndo, " %s", ETYPESTR(base->etype)));
2249 ND_PRINT((ndo, "[%s%s]",
2250 base->flags & ISAKMP_FLAG_I ? "I" : "",
2251 base->flags & ISAKMP_FLAG_V ? "V" : "",
2252 base->flags & ISAKMP_FLAG_R ? "R" : ""));
2255 if (ndo->ndo_vflag) {
2256 const struct isakmp_gen *ext;
2259 ND_PRINT((ndo, ":"));
2261 /* regardless of phase... */
2262 if (base->flags & ISAKMP_FLAG_E) {
2264 * encrypted, nothing we can do right now.
2265 * we hope to decrypt the packet in the future...
2267 ND_PRINT((ndo, " [encrypted %s]", NPSTR(base->np)));
2272 CHECKLEN(p + 1, base->np)
2275 ext = (struct isakmp_gen *)(p + 1);
2276 ikev2_sub_print(ndo, np, ext, ep, phase, 0, 0, 0);
2280 if (ndo->ndo_vflag) {
2281 if (ntohl(base->len) != length) {
2282 ND_PRINT((ndo, " (len mismatch: isakmp %u/ip %u)",
2283 (u_int32_t)ntohl(base->len), length));
2289 isakmp_print(netdissect_options *ndo,
2290 const u_char *bp, u_int length,
2293 const struct isakmp *p;
2298 p = (const struct isakmp *)bp;
2299 ep = ndo->ndo_snapend;
2301 if ((struct isakmp *)ep < p + 1) {
2302 ND_PRINT((ndo,"[|isakmp]"));
2306 safememcpy(&base, p, sizeof(base));
2308 ND_PRINT((ndo,"isakmp"));
2309 major = (base.vers & ISAKMP_VERS_MAJOR)
2310 >> ISAKMP_VERS_MAJOR_SHIFT;
2311 minor = (base.vers & ISAKMP_VERS_MINOR)
2312 >> ISAKMP_VERS_MINOR_SHIFT;
2314 if (ndo->ndo_vflag) {
2315 ND_PRINT((ndo," %d.%d", major, minor));
2318 if (ndo->ndo_vflag) {
2319 ND_PRINT((ndo," msgid "));
2320 rawprint(ndo, (caddr_t)&base.msgid, sizeof(base.msgid));
2323 if (1 < ndo->ndo_vflag) {
2324 ND_PRINT((ndo," cookie "));
2325 rawprint(ndo, (caddr_t)&base.i_ck, sizeof(base.i_ck));
2326 ND_PRINT((ndo,"->"));
2327 rawprint(ndo, (caddr_t)&base.r_ck, sizeof(base.r_ck));
2329 ND_PRINT((ndo,":"));
2332 case IKEv1_MAJOR_VERSION:
2333 ikev1_print(ndo, bp, length, bp2, &base);
2336 case IKEv2_MAJOR_VERSION:
2337 ikev2_print(ndo, bp, length, bp2, &base);
2343 isakmp_rfc3948_print(netdissect_options *ndo,
2344 const u_char *bp, u_int length,
2348 ep = ndo->ndo_snapend;
2350 if(length == 1 && bp[0]==0xff) {
2351 ND_PRINT((ndo, "isakmp-nat-keep-alive"));
2360 * see if this is an IKE packet
2362 if(bp[0]==0 && bp[1]==0 && bp[2]==0 && bp[3]==0) {
2363 ND_PRINT((ndo, "NONESP-encap: "));
2364 isakmp_print(ndo, bp+4, length-4, bp2);
2368 /* must be an ESP packet */
2370 int nh, enh, padlen;
2373 ND_PRINT((ndo, "UDP-encap: "));
2375 advance = esp_print(ndo, bp, length, bp2, &enh, &padlen);
2380 length -= advance + padlen;
2383 ip_print_inner(ndo, bp, length, nh, bp2);
2388 ND_PRINT((ndo,"[|isakmp]"));
2394 * c-style: whitesmith