contrib/tcpdump/print-isakmp.c

   1 /*
   2  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  * 3. Neither the name of the project nor the names of its contributors
  14  *    may be used to endorse or promote products derived from this software
  15  *    without specific prior written permission.
  16  *
  17  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  27  * SUCH DAMAGE.
  28  *
  29  */
  30
  31 /* \summary: Internet Security Association and Key Management Protocol (ISAKMP) printer */
  32
  33 #ifdef HAVE_CONFIG_H
  34 #include "config.h"
  35 #endif
  36
  37 /* The functions from print-esp.c used in this file are only defined when both
  38  * OpenSSL and evp.h are detected. Employ the same preprocessor device here.
  39  */
  40 #ifndef HAVE_OPENSSL_EVP_H
  41 #undef HAVE_LIBCRYPTO
  42 #endif
  43
  44 #include <netdissect-stdinc.h>
  45
  46 #include <string.h>
  47
  48 #include "netdissect.h"
  49 #include "addrtoname.h"
  50 #include "extract.h"
  51
  52 #include "ip.h"
  53 #include "ip6.h"
  54 #include "ipproto.h"
  55
  56 /* refer to RFC 2408 */
  57
  58 typedef u_char cookie_t[8];
  59 typedef u_char msgid_t[4];
  60
  61 #define PORT_ISAKMP 500
  62
  63 /* 3.1 ISAKMP Header Format (IKEv1 and IKEv2)
  64          0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
  65         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  66         !                          Initiator                            !
  67         !                            Cookie                             !
  68         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  69         !                          Responder                            !
  70         !                            Cookie                             !
  71         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  72         !  Next Payload ! MjVer ! MnVer ! Exchange Type !     Flags     !
  73         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  74         !                          Message ID                           !
  75         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  76         !                            Length                             !
  77         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  78 */
  79 struct isakmp {
  80         cookie_t i_ck;          /* Initiator Cookie */
  81         cookie_t r_ck;          /* Responder Cookie */
  82         uint8_t np;             /* Next Payload Type */
  83         uint8_t vers;
  84 #define ISAKMP_VERS_MAJOR       0xf0
  85 #define ISAKMP_VERS_MAJOR_SHIFT 4
  86 #define ISAKMP_VERS_MINOR       0x0f
  87 #define ISAKMP_VERS_MINOR_SHIFT 0
  88         uint8_t etype;          /* Exchange Type */
  89         uint8_t flags;          /* Flags */
  90         msgid_t msgid;
  91         uint32_t len;           /* Length */
  92 };
  93
  94 /* Next Payload Type */
  95 #define ISAKMP_NPTYPE_NONE   0 /* NONE*/
  96 #define ISAKMP_NPTYPE_SA     1 /* Security Association */
  97 #define ISAKMP_NPTYPE_P      2 /* Proposal */
  98 #define ISAKMP_NPTYPE_T      3 /* Transform */
  99 #define ISAKMP_NPTYPE_KE     4 /* Key Exchange */
 100 #define ISAKMP_NPTYPE_ID     5 /* Identification */
 101 #define ISAKMP_NPTYPE_CERT   6 /* Certificate */
 102 #define ISAKMP_NPTYPE_CR     7 /* Certificate Request */
 103 #define ISAKMP_NPTYPE_HASH   8 /* Hash */
 104 #define ISAKMP_NPTYPE_SIG    9 /* Signature */
 105 #define ISAKMP_NPTYPE_NONCE 10 /* Nonce */
 106 #define ISAKMP_NPTYPE_N     11 /* Notification */
 107 #define ISAKMP_NPTYPE_D     12 /* Delete */
 108 #define ISAKMP_NPTYPE_VID   13 /* Vendor ID */
 109 #define ISAKMP_NPTYPE_v2E   46 /* v2 Encrypted payload */
 110
 111 #define IKEv1_MAJOR_VERSION  1
 112 #define IKEv1_MINOR_VERSION  0
 113
 114 #define IKEv2_MAJOR_VERSION  2
 115 #define IKEv2_MINOR_VERSION  0
 116
 117 /* Flags */
 118 #define ISAKMP_FLAG_E 0x01 /* Encryption Bit */
 119 #define ISAKMP_FLAG_C 0x02 /* Commit Bit */
 120 #define ISAKMP_FLAG_extra 0x04
 121
 122 /* IKEv2 */
 123 #define ISAKMP_FLAG_I (1 << 3)  /* (I)nitiator */
 124 #define ISAKMP_FLAG_V (1 << 4)  /* (V)ersion   */
 125 #define ISAKMP_FLAG_R (1 << 5)  /* (R)esponse  */
 126
 127
 128 /* 3.2 Payload Generic Header
 129          0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 130         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 131         ! Next Payload  !   RESERVED    !         Payload Length        !
 132         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 133 */
 134 struct isakmp_gen {
 135         uint8_t  np;       /* Next Payload */
 136         uint8_t  critical; /* bit 7 - critical, rest is RESERVED */
 137         uint16_t len;      /* Payload Length */
 138 };
 139
 140 /* 3.3 Data Attributes
 141          0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 142         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 143         !A!       Attribute Type        !    AF=0  Attribute Length     !
 144         !F!                             !    AF=1  Attribute Value      !
 145         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 146         .                   AF=0  Attribute Value                       .
 147         .                   AF=1  Not Transmitted                       .
 148         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 149 */
 150 struct isakmp_data {
 151         uint16_t type;     /* defined by DOI-spec, and Attribute Format */
 152         uint16_t lorv;     /* if f equal 1, Attribute Length */
 153                           /* if f equal 0, Attribute Value */
 154         /* if f equal 1, Attribute Value */
 155 };
 156
 157 /* 3.4 Security Association Payload */
 158         /* MAY NOT be used, because of being defined in ipsec-doi. */
 159         /*
 160         If the current payload is the last in the message,
 161         then the value of the next payload field will be 0.
 162         This field MUST NOT contain the
 163         values for the Proposal or Transform payloads as they are considered
 164         part of the security association negotiation.  For example, this
 165         field would contain the value "10" (Nonce payload) in the first
 166         message of a Base Exchange (see Section 4.4) and the value "0" in the
 167         first message of an Identity Protect Exchange (see Section 4.5).
 168         */
 169 struct ikev1_pl_sa {
 170         struct isakmp_gen h;
 171         uint32_t doi; /* Domain of Interpretation */
 172         uint32_t sit; /* Situation */
 173 };
 174
 175 /* 3.5 Proposal Payload */
 176         /*
 177         The value of the next payload field MUST only contain the value "2"
 178         or "0".  If there are additional Proposal payloads in the message,
 179         then this field will be 2.  If the current Proposal payload is the
 180         last within the security association proposal, then this field will
 181         be 0.
 182         */
 183 struct ikev1_pl_p {
 184         struct isakmp_gen h;
 185         uint8_t p_no;      /* Proposal # */
 186         uint8_t prot_id;   /* Protocol */
 187         uint8_t spi_size;  /* SPI Size */
 188         uint8_t num_t;     /* Number of Transforms */
 189         /* SPI */
 190 };
 191
 192 /* 3.6 Transform Payload */
 193         /*
 194         The value of the next payload field MUST only contain the value "3"
 195         or "0".  If there are additional Transform payloads in the proposal,
 196         then this field will be 3.  If the current Transform payload is the
 197         last within the proposal, then this field will be 0.
 198         */
 199 struct ikev1_pl_t {
 200         struct isakmp_gen h;
 201         uint8_t  t_no;     /* Transform # */
 202         uint8_t  t_id;     /* Transform-Id */
 203         uint16_t reserved; /* RESERVED2 */
 204         /* SA Attributes */
 205 };
 206
 207 /* 3.7 Key Exchange Payload */
 208 struct ikev1_pl_ke {
 209         struct isakmp_gen h;
 210         /* Key Exchange Data */
 211 };
 212
 213 /* 3.8 Identification Payload */
 214         /* MUST NOT to be used, because of being defined in ipsec-doi. */
 215 struct ikev1_pl_id {
 216         struct isakmp_gen h;
 217         union {
 218                 uint8_t  id_type;   /* ID Type */
 219                 uint32_t doi_data;  /* DOI Specific ID Data */
 220         } d;
 221         /* Identification Data */
 222 };
 223
 224 /* 3.9 Certificate Payload */
 225 struct ikev1_pl_cert {
 226         struct isakmp_gen h;
 227         uint8_t encode; /* Cert Encoding */
 228         char   cert;   /* Certificate Data */
 229                 /*
 230                 This field indicates the type of
 231                 certificate or certificate-related information contained in the
 232                 Certificate Data field.
 233                 */
 234 };
 235
 236 /* 3.10 Certificate Request Payload */
 237 struct ikev1_pl_cr {
 238         struct isakmp_gen h;
 239         uint8_t num_cert; /* # Cert. Types */
 240         /*
 241         Certificate Types (variable length)
 242           -- Contains a list of the types of certificates requested,
 243           sorted in order of preference.  Each individual certificate
 244           type is 1 octet.  This field is NOT requiredo
 245         */
 246         /* # Certificate Authorities (1 octet) */
 247         /* Certificate Authorities (variable length) */
 248 };
 249
 250 /* 3.11 Hash Payload */
 251         /* may not be used, because of having only data. */
 252 struct ikev1_pl_hash {
 253         struct isakmp_gen h;
 254         /* Hash Data */
 255 };
 256
 257 /* 3.12 Signature Payload */
 258         /* may not be used, because of having only data. */
 259 struct ikev1_pl_sig {
 260         struct isakmp_gen h;
 261         /* Signature Data */
 262 };
 263
 264 /* 3.13 Nonce Payload */
 265         /* may not be used, because of having only data. */
 266 struct ikev1_pl_nonce {
 267         struct isakmp_gen h;
 268         /* Nonce Data */
 269 };
 270
 271 /* 3.14 Notification Payload */
 272 struct ikev1_pl_n {
 273         struct isakmp_gen h;
 274         uint32_t doi;      /* Domain of Interpretation */
 275         uint8_t  prot_id;  /* Protocol-ID */
 276         uint8_t  spi_size; /* SPI Size */
 277         uint16_t type;     /* Notify Message Type */
 278         /* SPI */
 279         /* Notification Data */
 280 };
 281
 282 /* 3.14.1 Notify Message Types */
 283 /* NOTIFY MESSAGES - ERROR TYPES */
 284 #define ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE           1
 285 #define ISAKMP_NTYPE_DOI_NOT_SUPPORTED              2
 286 #define ISAKMP_NTYPE_SITUATION_NOT_SUPPORTED        3
 287 #define ISAKMP_NTYPE_INVALID_COOKIE                 4
 288 #define ISAKMP_NTYPE_INVALID_MAJOR_VERSION          5
 289 #define ISAKMP_NTYPE_INVALID_MINOR_VERSION          6
 290 #define ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE          7
 291 #define ISAKMP_NTYPE_INVALID_FLAGS                  8
 292 #define ISAKMP_NTYPE_INVALID_MESSAGE_ID             9
 293 #define ISAKMP_NTYPE_INVALID_PROTOCOL_ID            10
 294 #define ISAKMP_NTYPE_INVALID_SPI                    11
 295 #define ISAKMP_NTYPE_INVALID_TRANSFORM_ID           12
 296 #define ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED       13
 297 #define ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN             14
 298 #define ISAKMP_NTYPE_BAD_PROPOSAL_SYNTAX            15
 299 #define ISAKMP_NTYPE_PAYLOAD_MALFORMED              16
 300 #define ISAKMP_NTYPE_INVALID_KEY_INFORMATION        17
 301 #define ISAKMP_NTYPE_INVALID_ID_INFORMATION         18
 302 #define ISAKMP_NTYPE_INVALID_CERT_ENCODING          19
 303 #define ISAKMP_NTYPE_INVALID_CERTIFICATE            20
 304 #define ISAKMP_NTYPE_BAD_CERT_REQUEST_SYNTAX        21
 305 #define ISAKMP_NTYPE_INVALID_CERT_AUTHORITY         22
 306 #define ISAKMP_NTYPE_INVALID_HASH_INFORMATION       23
 307 #define ISAKMP_NTYPE_AUTHENTICATION_FAILED          24
 308 #define ISAKMP_NTYPE_INVALID_SIGNATURE              25
 309 #define ISAKMP_NTYPE_ADDRESS_NOTIFICATION           26
 310
 311 /* 3.15 Delete Payload */
 312 struct ikev1_pl_d {
 313         struct isakmp_gen h;
 314         uint32_t doi;      /* Domain of Interpretation */
 315         uint8_t  prot_id;  /* Protocol-Id */
 316         uint8_t  spi_size; /* SPI Size */
 317         uint16_t num_spi;  /* # of SPIs */
 318         /* SPI(es) */
 319 };
 320
 321 struct ikev1_ph1tab {
 322         struct ikev1_ph1 *head;
 323         struct ikev1_ph1 *tail;
 324         int len;
 325 };
 326
 327 struct isakmp_ph2tab {
 328         struct ikev1_ph2 *head;
 329         struct ikev1_ph2 *tail;
 330         int len;
 331 };
 332
 333 /* IKEv2 (RFC4306) */
 334
 335 /* 3.3  Security Association Payload -- generic header */
 336 /* 3.3.1.  Proposal Substructure */
 337 struct ikev2_p {
 338         struct isakmp_gen h;
 339         uint8_t p_no;      /* Proposal # */
 340         uint8_t prot_id;   /* Protocol */
 341         uint8_t spi_size;  /* SPI Size */
 342         uint8_t num_t;     /* Number of Transforms */
 343 };
 344
 345 /* 3.3.2.  Transform Substructure */
 346 struct ikev2_t {
 347         struct isakmp_gen h;
 348         uint8_t t_type;    /* Transform Type (ENCR,PRF,INTEG,etc.*/
 349         uint8_t res2;      /* reserved byte */
 350         uint16_t t_id;     /* Transform ID */
 351 };
 352
 353 enum ikev2_t_type {
 354         IV2_T_ENCR = 1,
 355         IV2_T_PRF  = 2,
 356         IV2_T_INTEG= 3,
 357         IV2_T_DH   = 4,
 358         IV2_T_ESN  = 5
 359 };
 360
 361 /* 3.4.  Key Exchange Payload */
 362 struct ikev2_ke {
 363         struct isakmp_gen h;
 364         uint16_t  ke_group;
 365         uint16_t  ke_res1;
 366         /* KE data */
 367 };
 368
 369
 370 /* 3.5.  Identification Payloads */
 371 enum ikev2_id_type {
 372         ID_IPV4_ADDR=1,
 373         ID_FQDN=2,
 374         ID_RFC822_ADDR=3,
 375         ID_IPV6_ADDR=5,
 376         ID_DER_ASN1_DN=9,
 377         ID_DER_ASN1_GN=10,
 378         ID_KEY_ID=11
 379 };
 380 struct ikev2_id {
 381         struct isakmp_gen h;
 382         uint8_t  type;        /* ID type */
 383         uint8_t  res1;
 384         uint16_t res2;
 385         /* SPI */
 386         /* Notification Data */
 387 };
 388
 389 /* 3.10 Notification Payload */
 390 struct ikev2_n {
 391         struct isakmp_gen h;
 392         uint8_t  prot_id;  /* Protocol-ID */
 393         uint8_t  spi_size; /* SPI Size */
 394         uint16_t type;     /* Notify Message Type */
 395 };
 396
 397 enum ikev2_n_type {
 398         IV2_NOTIFY_UNSUPPORTED_CRITICAL_PAYLOAD            = 1,
 399         IV2_NOTIFY_INVALID_IKE_SPI                         = 4,
 400         IV2_NOTIFY_INVALID_MAJOR_VERSION                   = 5,
 401         IV2_NOTIFY_INVALID_SYNTAX                          = 7,
 402         IV2_NOTIFY_INVALID_MESSAGE_ID                      = 9,
 403         IV2_NOTIFY_INVALID_SPI                             =11,
 404         IV2_NOTIFY_NO_PROPOSAL_CHOSEN                      =14,
 405         IV2_NOTIFY_INVALID_KE_PAYLOAD                      =17,
 406         IV2_NOTIFY_AUTHENTICATION_FAILED                   =24,
 407         IV2_NOTIFY_SINGLE_PAIR_REQUIRED                    =34,
 408         IV2_NOTIFY_NO_ADDITIONAL_SAS                       =35,
 409         IV2_NOTIFY_INTERNAL_ADDRESS_FAILURE                =36,
 410         IV2_NOTIFY_FAILED_CP_REQUIRED                      =37,
 411         IV2_NOTIFY_INVALID_SELECTORS                       =39,
 412         IV2_NOTIFY_INITIAL_CONTACT                         =16384,
 413         IV2_NOTIFY_SET_WINDOW_SIZE                         =16385,
 414         IV2_NOTIFY_ADDITIONAL_TS_POSSIBLE                  =16386,
 415         IV2_NOTIFY_IPCOMP_SUPPORTED                        =16387,
 416         IV2_NOTIFY_NAT_DETECTION_SOURCE_IP                 =16388,
 417         IV2_NOTIFY_NAT_DETECTION_DESTINATION_IP            =16389,
 418         IV2_NOTIFY_COOKIE                                  =16390,
 419         IV2_NOTIFY_USE_TRANSPORT_MODE                      =16391,
 420         IV2_NOTIFY_HTTP_CERT_LOOKUP_SUPPORTED              =16392,
 421         IV2_NOTIFY_REKEY_SA                                =16393,
 422         IV2_NOTIFY_ESP_TFC_PADDING_NOT_SUPPORTED           =16394,
 423         IV2_NOTIFY_NON_FIRST_FRAGMENTS_ALSO                =16395
 424 };
 425
 426 struct notify_messages {
 427         uint16_t type;
 428         char     *msg;
 429 };
 430
 431 /* 3.8 Authentication Payload */
 432 struct ikev2_auth {
 433         struct isakmp_gen h;
 434         uint8_t  auth_method;  /* Protocol-ID */
 435         uint8_t  reserved[3];
 436         /* authentication data */
 437 };
 438
 439 enum ikev2_auth_type {
 440         IV2_RSA_SIG = 1,
 441         IV2_SHARED  = 2,
 442         IV2_DSS_SIG = 3
 443 };
 444
 445 /* refer to RFC 2409 */
 446
 447 #if 0
 448 /* isakmp sa structure */
 449 struct oakley_sa {
 450         uint8_t  proto_id;            /* OAKLEY */
 451         vchar_t   *spi;                /* spi */
 452         uint8_t  dhgrp;               /* DH; group */
 453         uint8_t  auth_t;              /* method of authentication */
 454         uint8_t  prf_t;               /* type of prf */
 455         uint8_t  hash_t;              /* type of hash */
 456         uint8_t  enc_t;               /* type of cipher */
 457         uint8_t  life_t;              /* type of duration of lifetime */
 458         uint32_t ldur;                /* life duration */
 459 };
 460 #endif
 461
 462 /* refer to RFC 2407 */
 463
 464 #define IPSEC_DOI 1
 465
 466 /* 4.2 IPSEC Situation Definition */
 467 #define IPSECDOI_SIT_IDENTITY_ONLY           0x00000001
 468 #define IPSECDOI_SIT_SECRECY                 0x00000002
 469 #define IPSECDOI_SIT_INTEGRITY               0x00000004
 470
 471 /* 4.4.1 IPSEC Security Protocol Identifiers */
 472   /* 4.4.2 IPSEC ISAKMP Transform Values */
 473 #define IPSECDOI_PROTO_ISAKMP                        1
 474 #define   IPSECDOI_KEY_IKE                             1
 475
 476 /* 4.4.1 IPSEC Security Protocol Identifiers */
 477 #define IPSECDOI_PROTO_IPSEC_AH                      2
 478   /* 4.4.3 IPSEC AH Transform Values */
 479 #define   IPSECDOI_AH_MD5                              2
 480 #define   IPSECDOI_AH_SHA                              3
 481 #define   IPSECDOI_AH_DES                              4
 482 #define   IPSECDOI_AH_SHA2_256                         5
 483 #define   IPSECDOI_AH_SHA2_384                         6
 484 #define   IPSECDOI_AH_SHA2_512                         7
 485
 486 /* 4.4.1 IPSEC Security Protocol Identifiers */
 487 #define IPSECDOI_PROTO_IPSEC_ESP                     3
 488   /* 4.4.4 IPSEC ESP Transform Identifiers */
 489 #define   IPSECDOI_ESP_DES_IV64                        1
 490 #define   IPSECDOI_ESP_DES                             2
 491 #define   IPSECDOI_ESP_3DES                            3
 492 #define   IPSECDOI_ESP_RC5                             4
 493 #define   IPSECDOI_ESP_IDEA                            5
 494 #define   IPSECDOI_ESP_CAST                            6
 495 #define   IPSECDOI_ESP_BLOWFISH                        7
 496 #define   IPSECDOI_ESP_3IDEA                           8
 497 #define   IPSECDOI_ESP_DES_IV32                        9
 498 #define   IPSECDOI_ESP_RC4                            10
 499 #define   IPSECDOI_ESP_NULL                           11
 500 #define   IPSECDOI_ESP_RIJNDAEL                         12
 501 #define   IPSECDOI_ESP_AES                              12
 502
 503 /* 4.4.1 IPSEC Security Protocol Identifiers */
 504 #define IPSECDOI_PROTO_IPCOMP                        4
 505   /* 4.4.5 IPSEC IPCOMP Transform Identifiers */
 506 #define   IPSECDOI_IPCOMP_OUI                          1
 507 #define   IPSECDOI_IPCOMP_DEFLATE                      2
 508 #define   IPSECDOI_IPCOMP_LZS                          3
 509
 510 /* 4.5 IPSEC Security Association Attributes */
 511 #define IPSECDOI_ATTR_SA_LTYPE                1 /* B */
 512 #define   IPSECDOI_ATTR_SA_LTYPE_DEFAULT        1
 513 #define   IPSECDOI_ATTR_SA_LTYPE_SEC            1
 514 #define   IPSECDOI_ATTR_SA_LTYPE_KB             2
 515 #define IPSECDOI_ATTR_SA_LDUR                 2 /* V */
 516 #define   IPSECDOI_ATTR_SA_LDUR_DEFAULT         28800 /* 8 hours */
 517 #define IPSECDOI_ATTR_GRP_DESC                3 /* B */
 518 #define IPSECDOI_ATTR_ENC_MODE                4 /* B */
 519         /* default value: host dependent */
 520 #define   IPSECDOI_ATTR_ENC_MODE_TUNNEL         1
 521 #define   IPSECDOI_ATTR_ENC_MODE_TRNS           2
 522 #define IPSECDOI_ATTR_AUTH                    5 /* B */
 523         /* 0 means not to use authentication. */
 524 #define   IPSECDOI_ATTR_AUTH_HMAC_MD5           1
 525 #define   IPSECDOI_ATTR_AUTH_HMAC_SHA1          2
 526 #define   IPSECDOI_ATTR_AUTH_DES_MAC            3
 527 #define   IPSECDOI_ATTR_AUTH_KPDK               4 /*RFC-1826(Key/Pad/Data/Key)*/
 528         /*
 529          * When negotiating ESP without authentication, the Auth
 530          * Algorithm attribute MUST NOT be included in the proposal.
 531          * When negotiating ESP without confidentiality, the Auth
 532          * Algorithm attribute MUST be included in the proposal and
 533          * the ESP transform ID must be ESP_NULL.
 534         */
 535 #define IPSECDOI_ATTR_KEY_LENGTH              6 /* B */
 536 #define IPSECDOI_ATTR_KEY_ROUNDS              7 /* B */
 537 #define IPSECDOI_ATTR_COMP_DICT_SIZE          8 /* B */
 538 #define IPSECDOI_ATTR_COMP_PRIVALG            9 /* V */
 539
 540 /* 4.6.1 Security Association Payload */
 541 struct ipsecdoi_sa {
 542         struct isakmp_gen h;
 543         uint32_t doi; /* Domain of Interpretation */
 544         uint32_t sit; /* Situation */
 545 };
 546
 547 struct ipsecdoi_secrecy_h {
 548         uint16_t len;
 549         uint16_t reserved;
 550 };
 551
 552 /* 4.6.2.1 Identification Type Values */
 553 struct ipsecdoi_id {
 554         struct isakmp_gen h;
 555         uint8_t  type;          /* ID Type */
 556         uint8_t  proto_id;      /* Protocol ID */
 557         uint16_t port;          /* Port */
 558         /* Identification Data */
 559 };
 560
 561 #define IPSECDOI_ID_IPV4_ADDR                        1
 562 #define IPSECDOI_ID_FQDN                             2
 563 #define IPSECDOI_ID_USER_FQDN                        3
 564 #define IPSECDOI_ID_IPV4_ADDR_SUBNET                 4
 565 #define IPSECDOI_ID_IPV6_ADDR                        5
 566 #define IPSECDOI_ID_IPV6_ADDR_SUBNET                 6
 567 #define IPSECDOI_ID_IPV4_ADDR_RANGE                  7
 568 #define IPSECDOI_ID_IPV6_ADDR_RANGE                  8
 569 #define IPSECDOI_ID_DER_ASN1_DN                      9
 570 #define IPSECDOI_ID_DER_ASN1_GN                      10
 571 #define IPSECDOI_ID_KEY_ID                           11
 572
 573 /* 4.6.3 IPSEC DOI Notify Message Types */
 574 /* Notify Messages - Status Types */
 575 #define IPSECDOI_NTYPE_RESPONDER_LIFETIME                  24576
 576 #define IPSECDOI_NTYPE_REPLAY_STATUS                       24577
 577 #define IPSECDOI_NTYPE_INITIAL_CONTACT                     24578
 578
 579 #define DECLARE_PRINTER(func) static const u_char *ike##func##_print( \
 580                 netdissect_options *ndo, u_char tpay,                 \
 581                 const struct isakmp_gen *ext,                         \
 582                 u_int item_len, \
 583                 const u_char *end_pointer, \
 584                 uint32_t phase,\
 585                 uint32_t doi0, \
 586                 uint32_t proto0, int depth)
 587
 588 DECLARE_PRINTER(v1_sa);
 589 DECLARE_PRINTER(v1_p);
 590 DECLARE_PRINTER(v1_t);
 591 DECLARE_PRINTER(v1_ke);
 592 DECLARE_PRINTER(v1_id);
 593 DECLARE_PRINTER(v1_cert);
 594 DECLARE_PRINTER(v1_cr);
 595 DECLARE_PRINTER(v1_sig);
 596 DECLARE_PRINTER(v1_hash);
 597 DECLARE_PRINTER(v1_nonce);
 598 DECLARE_PRINTER(v1_n);
 599 DECLARE_PRINTER(v1_d);
 600 DECLARE_PRINTER(v1_vid);
 601
 602 DECLARE_PRINTER(v2_sa);
 603 DECLARE_PRINTER(v2_ke);
 604 DECLARE_PRINTER(v2_ID);
 605 DECLARE_PRINTER(v2_cert);
 606 DECLARE_PRINTER(v2_cr);
 607 DECLARE_PRINTER(v2_auth);
 608 DECLARE_PRINTER(v2_nonce);
 609 DECLARE_PRINTER(v2_n);
 610 DECLARE_PRINTER(v2_d);
 611 DECLARE_PRINTER(v2_vid);
 612 DECLARE_PRINTER(v2_TS);
 613 DECLARE_PRINTER(v2_cp);
 614 DECLARE_PRINTER(v2_eap);
 615
 616 static const u_char *ikev2_e_print(netdissect_options *ndo,
 617                                    struct isakmp *base,
 618                                    u_char tpay,
 619                                    const struct isakmp_gen *ext,
 620                                    u_int item_len,
 621                                    const u_char *end_pointer,
 622                                    uint32_t phase,
 623                                    uint32_t doi0,
 624                                    uint32_t proto0, int depth);
 625
 626
 627 static const u_char *ike_sub0_print(netdissect_options *ndo,u_char, const struct isakmp_gen *,
 628         const u_char *, uint32_t, uint32_t, uint32_t, int);
 629 static const u_char *ikev1_sub_print(netdissect_options *ndo,u_char, const struct isakmp_gen *,
 630         const u_char *, uint32_t, uint32_t, uint32_t, int);
 631
 632 static const u_char *ikev2_sub_print(netdissect_options *ndo,
 633                                      struct isakmp *base,
 634                                      u_char np, const struct isakmp_gen *ext,
 635                                      const u_char *ep, uint32_t phase,
 636                                      uint32_t doi, uint32_t proto,
 637                                      int depth);
 638
 639
 640 static char *numstr(int);
 641
 642 static void
 643 ikev1_print(netdissect_options *ndo,
 644             const u_char *bp,  u_int length,
 645             const u_char *bp2, struct isakmp *base);
 646
 647 #define MAXINITIATORS   20
 648 static int ninitiator = 0;
 649 union inaddr_u {
 650         struct in_addr in4;
 651         struct in6_addr in6;
 652 };
 653 static struct {
 654         cookie_t initiator;
 655         u_int version;
 656         union inaddr_u iaddr;
 657         union inaddr_u raddr;
 658 } cookiecache[MAXINITIATORS];
 659
 660 /* protocol id */
 661 static const char *protoidstr[] = {
 662         NULL, "isakmp", "ipsec-ah", "ipsec-esp", "ipcomp",
 663 };
 664
 665 /* isakmp->np */
 666 static const char *npstr[] = {
 667         "none", "sa", "p", "t", "ke", "id", "cert", "cr", "hash", /* 0 - 8 */
 668         "sig", "nonce", "n", "d", "vid",      /* 9 - 13 */
 669         "pay14", "pay15", "pay16", "pay17", "pay18", /* 14- 18 */
 670         "pay19", "pay20", "pay21", "pay22", "pay23", /* 19- 23 */
 671         "pay24", "pay25", "pay26", "pay27", "pay28", /* 24- 28 */
 672         "pay29", "pay30", "pay31", "pay32",          /* 29- 32 */
 673         "v2sa",  "v2ke",  "v2IDi", "v2IDr", "v2cert",/* 33- 37 */
 674         "v2cr",  "v2auth","v2nonce", "v2n",   "v2d",   /* 38- 42 */
 675         "v2vid", "v2TSi", "v2TSr", "v2e",   "v2cp",  /* 43- 47 */
 676         "v2eap",                                     /* 48 */
 677
 678 };
 679
 680 /* isakmp->np */
 681 static const u_char *(*npfunc[])(netdissect_options *ndo, u_char tpay,
 682                                  const struct isakmp_gen *ext,
 683                                  u_int item_len,
 684                                  const u_char *end_pointer,
 685                                  uint32_t phase,
 686                                  uint32_t doi0,
 687                                  uint32_t proto0, int depth) = {
 688         NULL,
 689         ikev1_sa_print,
 690         ikev1_p_print,
 691         ikev1_t_print,
 692         ikev1_ke_print,
 693         ikev1_id_print,
 694         ikev1_cert_print,
 695         ikev1_cr_print,
 696         ikev1_hash_print,
 697         ikev1_sig_print,
 698         ikev1_nonce_print,
 699         ikev1_n_print,
 700         ikev1_d_print,
 701         ikev1_vid_print,                  /* 13 */
 702         NULL, NULL, NULL, NULL, NULL,     /* 14- 18 */
 703         NULL, NULL, NULL, NULL, NULL,     /* 19- 23 */
 704         NULL, NULL, NULL, NULL, NULL,     /* 24- 28 */
 705         NULL, NULL, NULL, NULL,           /* 29- 32 */
 706         ikev2_sa_print,                 /* 33 */
 707         ikev2_ke_print,                 /* 34 */
 708         ikev2_ID_print,                 /* 35 */
 709         ikev2_ID_print,                 /* 36 */
 710         ikev2_cert_print,               /* 37 */
 711         ikev2_cr_print,                 /* 38 */
 712         ikev2_auth_print,               /* 39 */
 713         ikev2_nonce_print,              /* 40 */
 714         ikev2_n_print,                  /* 41 */
 715         ikev2_d_print,                  /* 42 */
 716         ikev2_vid_print,                /* 43 */
 717         ikev2_TS_print,                 /* 44 */
 718         ikev2_TS_print,                 /* 45 */
 719         NULL, /* ikev2_e_print,*/       /* 46 - special */
 720         ikev2_cp_print,                 /* 47 */
 721         ikev2_eap_print,                /* 48 */
 722 };
 723
 724 /* isakmp->etype */
 725 static const char *etypestr[] = {
 726 /* IKEv1 exchange types */
 727         "none", "base", "ident", "auth", "agg", "inf", NULL, NULL,  /* 0-7 */
 728         NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,  /*  8-15 */
 729         NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,  /* 16-23 */
 730         NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,  /* 24-31 */
 731         "oakley-quick", "oakley-newgroup",               /* 32-33 */
 732 /* IKEv2 exchange types */
 733         "ikev2_init", "ikev2_auth", "child_sa", "inf2"   /* 34-37 */
 734 };
 735
 736 #define STR_OR_ID(x, tab) \
 737         (((x) < sizeof(tab)/sizeof(tab[0]) && tab[(x)]) ? tab[(x)] : numstr(x))
 738 #define PROTOIDSTR(x)   STR_OR_ID(x, protoidstr)
 739 #define NPSTR(x)        STR_OR_ID(x, npstr)
 740 #define ETYPESTR(x)     STR_OR_ID(x, etypestr)
 741
 742 #define CHECKLEN(p, np)                                                 \
 743                 if (ep < (const u_char *)(p)) {                         \
 744                         ND_PRINT((ndo," [|%s]", NPSTR(np)));            \
 745                         goto done;                                      \
 746                 }
 747
 748
 749 #define NPFUNC(x) \
 750         (((x) < sizeof(npfunc)/sizeof(npfunc[0]) && npfunc[(x)]) \
 751                 ? npfunc[(x)] : NULL)
 752
 753 static int
 754 iszero(const u_char *p, size_t l)
 755 {
 756         while (l--) {
 757                 if (*p++)
 758                         return 0;
 759         }
 760         return 1;
 761 }
 762
 763 /* find cookie from initiator cache */
 764 static int
 765 cookie_find(cookie_t *in)
 766 {
 767         int i;
 768
 769         for (i = 0; i < MAXINITIATORS; i++) {
 770                 if (memcmp(in, &cookiecache[i].initiator, sizeof(*in)) == 0)
 771                         return i;
 772         }
 773
 774         return -1;
 775 }
 776
 777 /* record initiator */
 778 static void
 779 cookie_record(cookie_t *in, const u_char *bp2)
 780 {
 781         int i;
 782         const struct ip *ip;
 783         const struct ip6_hdr *ip6;
 784
 785         i = cookie_find(in);
 786         if (0 <= i) {
 787                 ninitiator = (i + 1) % MAXINITIATORS;
 788                 return;
 789         }
 790
 791         ip = (const struct ip *)bp2;
 792         switch (IP_V(ip)) {
 793         case 4:
 794                 cookiecache[ninitiator].version = 4;
 795                 UNALIGNED_MEMCPY(&cookiecache[ninitiator].iaddr.in4, &ip->ip_src, sizeof(struct in_addr));
 796                 UNALIGNED_MEMCPY(&cookiecache[ninitiator].raddr.in4, &ip->ip_dst, sizeof(struct in_addr));
 797                 break;
 798         case 6:
 799                 ip6 = (const struct ip6_hdr *)bp2;
 800                 cookiecache[ninitiator].version = 6;
 801                 UNALIGNED_MEMCPY(&cookiecache[ninitiator].iaddr.in6, &ip6->ip6_src, sizeof(struct in6_addr));
 802                 UNALIGNED_MEMCPY(&cookiecache[ninitiator].raddr.in6, &ip6->ip6_dst, sizeof(struct in6_addr));
 803                 break;
 804         default:
 805                 return;
 806         }
 807         UNALIGNED_MEMCPY(&cookiecache[ninitiator].initiator, in, sizeof(*in));
 808         ninitiator = (ninitiator + 1) % MAXINITIATORS;
 809 }
 810
 811 #define cookie_isinitiator(x, y)        cookie_sidecheck((x), (y), 1)
 812 #define cookie_isresponder(x, y)        cookie_sidecheck((x), (y), 0)
 813 static int
 814 cookie_sidecheck(int i, const u_char *bp2, int initiator)
 815 {
 816         const struct ip *ip;
 817         const struct ip6_hdr *ip6;
 818
 819         ip = (const struct ip *)bp2;
 820         switch (IP_V(ip)) {
 821         case 4:
 822                 if (cookiecache[i].version != 4)
 823                         return 0;
 824                 if (initiator) {
 825                         if (UNALIGNED_MEMCMP(&ip->ip_src, &cookiecache[i].iaddr.in4, sizeof(struct in_addr)) == 0)
 826                                 return 1;
 827                 } else {
 828                         if (UNALIGNED_MEMCMP(&ip->ip_src, &cookiecache[i].raddr.in4, sizeof(struct in_addr)) == 0)
 829                                 return 1;
 830                 }
 831                 break;
 832         case 6:
 833                 if (cookiecache[i].version != 6)
 834                         return 0;
 835                 ip6 = (const struct ip6_hdr *)bp2;
 836                 if (initiator) {
 837                         if (UNALIGNED_MEMCMP(&ip6->ip6_src, &cookiecache[i].iaddr.in6, sizeof(struct in6_addr)) == 0)
 838                                 return 1;
 839                 } else {
 840                         if (UNALIGNED_MEMCMP(&ip6->ip6_src, &cookiecache[i].raddr.in6, sizeof(struct in6_addr)) == 0)
 841                                 return 1;
 842                 }
 843                 break;
 844         default:
 845                 break;
 846         }
 847
 848         return 0;
 849 }
 850
 851 static void
 852 hexprint(netdissect_options *ndo, const uint8_t *loc, size_t len)
 853 {
 854         const uint8_t *p;
 855         size_t i;
 856
 857         p = loc;
 858         for (i = 0; i < len; i++)
 859                 ND_PRINT((ndo,"%02x", p[i] & 0xff));
 860 }
 861
 862 static int
 863 rawprint(netdissect_options *ndo, const uint8_t *loc, size_t len)
 864 {
 865         ND_TCHECK2(*loc, len);
 866
 867         hexprint(ndo, loc, len);
 868         return 1;
 869 trunc:
 870         return 0;
 871 }
 872
 873
 874 /*
 875  * returns false if we run out of data buffer
 876  */
 877 static int ike_show_somedata(netdissect_options *ndo,
 878                              const u_char *cp, const u_char *ep)
 879 {
 880         /* there is too much data, just show some of it */
 881         const u_char *end = ep - 20;
 882         int  elen = 20;
 883         int   len = ep - cp;
 884         if(len > 10) {
 885                 len = 10;
 886         }
 887
 888         /* really shouldn't happen because of above */
 889         if(end < cp + len) {
 890                 end = cp+len;
 891                 elen = ep - end;
 892         }
 893
 894         ND_PRINT((ndo," data=("));
 895         if(!rawprint(ndo, (const uint8_t *)(cp), len)) goto trunc;
 896         ND_PRINT((ndo, "..."));
 897         if(elen) {
 898                 if(!rawprint(ndo, (const uint8_t *)(end), elen)) goto trunc;
 899         }
 900         ND_PRINT((ndo,")"));
 901         return 1;
 902
 903 trunc:
 904         return 0;
 905 }
 906
 907 struct attrmap {
 908         const char *type;
 909         u_int nvalue;
 910         const char *value[30];  /*XXX*/
 911 };
 912
 913 static const u_char *
 914 ikev1_attrmap_print(netdissect_options *ndo,
 915                     const u_char *p, const u_char *ep2,
 916                     const struct attrmap *map, size_t nmap)
 917 {
 918         int totlen;
 919         uint32_t t, v;
 920
 921         ND_TCHECK(p[0]);
 922         if (p[0] & 0x80)
 923                 totlen = 4;
 924         else {
 925                 ND_TCHECK_16BITS(&p[2]);
 926                 totlen = 4 + EXTRACT_16BITS(&p[2]);
 927         }
 928         if (ep2 < p + totlen) {
 929                 ND_PRINT((ndo,"[|attr]"));
 930                 return ep2 + 1;
 931         }
 932
 933         ND_TCHECK_16BITS(&p[0]);
 934         ND_PRINT((ndo,"("));
 935         t = EXTRACT_16BITS(&p[0]) & 0x7fff;
 936         if (map && t < nmap && map[t].type)
 937                 ND_PRINT((ndo,"type=%s ", map[t].type));
 938         else
 939                 ND_PRINT((ndo,"type=#%d ", t));
 940         if (p[0] & 0x80) {
 941                 ND_PRINT((ndo,"value="));
 942                 ND_TCHECK_16BITS(&p[2]);
 943                 v = EXTRACT_16BITS(&p[2]);
 944                 if (map && t < nmap && v < map[t].nvalue && map[t].value[v])
 945                         ND_PRINT((ndo,"%s", map[t].value[v]));
 946                 else {
 947                         if (!rawprint(ndo, (const uint8_t *)&p[2], 2)) {
 948                                 ND_PRINT((ndo,")"));
 949                                 goto trunc;
 950                         }
 951                 }
 952         } else {
 953                 ND_PRINT((ndo,"len=%d value=", totlen - 4));
 954                 if (!rawprint(ndo, (const uint8_t *)&p[4], totlen - 4)) {
 955                         ND_PRINT((ndo,")"));
 956                         goto trunc;
 957                 }
 958         }
 959         ND_PRINT((ndo,")"));
 960         return p + totlen;
 961
 962 trunc:
 963         return NULL;
 964 }
 965
 966 static const u_char *
 967 ikev1_attr_print(netdissect_options *ndo, const u_char *p, const u_char *ep2)
 968 {
 969         int totlen;
 970         uint32_t t;
 971
 972         ND_TCHECK(p[0]);
 973         if (p[0] & 0x80)
 974                 totlen = 4;
 975         else {
 976                 ND_TCHECK_16BITS(&p[2]);
 977                 totlen = 4 + EXTRACT_16BITS(&p[2]);
 978         }
 979         if (ep2 < p + totlen) {
 980                 ND_PRINT((ndo,"[|attr]"));
 981                 return ep2 + 1;
 982         }
 983
 984         ND_TCHECK_16BITS(&p[0]);
 985         ND_PRINT((ndo,"("));
 986         t = EXTRACT_16BITS(&p[0]) & 0x7fff;
 987         ND_PRINT((ndo,"type=#%d ", t));
 988         if (p[0] & 0x80) {
 989                 ND_PRINT((ndo,"value="));
 990                 t = p[2];
 991                 if (!rawprint(ndo, (const uint8_t *)&p[2], 2)) {
 992                         ND_PRINT((ndo,")"));
 993                         goto trunc;
 994                 }
 995         } else {
 996                 ND_PRINT((ndo,"len=%d value=", totlen - 4));
 997                 if (!rawprint(ndo, (const uint8_t *)&p[4], totlen - 4)) {
 998                         ND_PRINT((ndo,")"));
 999                         goto trunc;
1000                 }
1001         }
1002         ND_PRINT((ndo,")"));
1003         return p + totlen;
1004
1005 trunc:
1006         return NULL;
1007 }
1008
1009 static const u_char *
1010 ikev1_sa_print(netdissect_options *ndo, u_char tpay _U_,
1011                const struct isakmp_gen *ext,
1012                 u_int item_len _U_,
1013                 const u_char *ep, uint32_t phase, uint32_t doi0 _U_,
1014                 uint32_t proto0, int depth)
1015 {
1016         const struct ikev1_pl_sa *p;
1017         struct ikev1_pl_sa sa;
1018         uint32_t doi, sit, ident;
1019         const u_char *cp, *np;
1020         int t;
1021
1022         ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_SA)));
1023
1024         p = (const struct ikev1_pl_sa *)ext;
1025         ND_TCHECK(*p);
1026         UNALIGNED_MEMCPY(&sa, ext, sizeof(sa));
1027         doi = ntohl(sa.doi);
1028         sit = ntohl(sa.sit);
1029         if (doi != 1) {
1030                 ND_PRINT((ndo," doi=%d", doi));
1031                 ND_PRINT((ndo," situation=%u", (uint32_t)ntohl(sa.sit)));
1032                 return (const u_char *)(p + 1);
1033         }
1034
1035         ND_PRINT((ndo," doi=ipsec"));
1036         ND_PRINT((ndo," situation="));
1037         t = 0;
1038         if (sit & 0x01) {
1039                 ND_PRINT((ndo,"identity"));
1040                 t++;
1041         }
1042         if (sit & 0x02) {
1043                 ND_PRINT((ndo,"%ssecrecy", t ? "+" : ""));
1044                 t++;
1045         }
1046         if (sit & 0x04)
1047                 ND_PRINT((ndo,"%sintegrity", t ? "+" : ""));
1048
1049         np = (const u_char *)ext + sizeof(sa);
1050         if (sit != 0x01) {
1051                 ND_TCHECK2(*(ext + 1), sizeof(ident));
1052                 UNALIGNED_MEMCPY(&ident, ext + 1, sizeof(ident));
1053                 ND_PRINT((ndo," ident=%u", (uint32_t)ntohl(ident)));
1054                 np += sizeof(ident);
1055         }
1056
1057         ext = (const struct isakmp_gen *)np;
1058         ND_TCHECK(*ext);
1059
1060         cp = ikev1_sub_print(ndo, ISAKMP_NPTYPE_P, ext, ep, phase, doi, proto0,
1061                 depth);
1062
1063         return cp;
1064 trunc:
1065         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_SA)));
1066         return NULL;
1067 }
1068
1069 static const u_char *
1070 ikev1_p_print(netdissect_options *ndo, u_char tpay _U_,
1071               const struct isakmp_gen *ext, u_int item_len _U_,
1072                const u_char *ep, uint32_t phase, uint32_t doi0,
1073                uint32_t proto0 _U_, int depth)
1074 {
1075         const struct ikev1_pl_p *p;
1076         struct ikev1_pl_p prop;
1077         const u_char *cp;
1078
1079         ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_P)));
1080
1081         p = (const struct ikev1_pl_p *)ext;
1082         ND_TCHECK(*p);
1083         UNALIGNED_MEMCPY(&prop, ext, sizeof(prop));
1084         ND_PRINT((ndo," #%d protoid=%s transform=%d",
1085                   prop.p_no, PROTOIDSTR(prop.prot_id), prop.num_t));
1086         if (prop.spi_size) {
1087                 ND_PRINT((ndo," spi="));
1088                 if (!rawprint(ndo, (const uint8_t *)(p + 1), prop.spi_size))
1089                         goto trunc;
1090         }
1091
1092         ext = (const struct isakmp_gen *)((const u_char *)(p + 1) + prop.spi_size);
1093         ND_TCHECK(*ext);
1094
1095         cp = ikev1_sub_print(ndo, ISAKMP_NPTYPE_T, ext, ep, phase, doi0,
1096                              prop.prot_id, depth);
1097
1098         return cp;
1099 trunc:
1100         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_P)));
1101         return NULL;
1102 }
1103
1104 static const char *ikev1_p_map[] = {
1105         NULL, "ike",
1106 };
1107
1108 static const char *ikev2_t_type_map[]={
1109         NULL, "encr", "prf", "integ", "dh", "esn"
1110 };
1111
1112 static const char *ah_p_map[] = {
1113         NULL, "(reserved)", "md5", "sha", "1des",
1114         "sha2-256", "sha2-384", "sha2-512",
1115 };
1116
1117 static const char *prf_p_map[] = {
1118         NULL, "hmac-md5", "hmac-sha", "hmac-tiger",
1119         "aes128_xcbc"
1120 };
1121
1122 static const char *integ_p_map[] = {
1123         NULL, "hmac-md5", "hmac-sha", "dec-mac",
1124         "kpdk-md5", "aes-xcbc"
1125 };
1126
1127 static const char *esn_p_map[] = {
1128         "no-esn", "esn"
1129 };
1130
1131 static const char *dh_p_map[] = {
1132         NULL, "modp768",
1133         "modp1024",    /* group 2 */
1134         "EC2N 2^155",  /* group 3 */
1135         "EC2N 2^185",  /* group 4 */
1136         "modp1536",    /* group 5 */
1137         "iana-grp06", "iana-grp07", /* reserved */
1138         "iana-grp08", "iana-grp09",
1139         "iana-grp10", "iana-grp11",
1140         "iana-grp12", "iana-grp13",
1141         "modp2048",    /* group 14 */
1142         "modp3072",    /* group 15 */
1143         "modp4096",    /* group 16 */
1144         "modp6144",    /* group 17 */
1145         "modp8192",    /* group 18 */
1146 };
1147
1148 static const char *esp_p_map[] = {
1149         NULL, "1des-iv64", "1des", "3des", "rc5", "idea", "cast",
1150         "blowfish", "3idea", "1des-iv32", "rc4", "null", "aes"
1151 };
1152
1153 static const char *ipcomp_p_map[] = {
1154         NULL, "oui", "deflate", "lzs",
1155 };
1156
1157 static const struct attrmap ipsec_t_map[] = {
1158         { NULL, 0, { NULL } },
1159         { "lifetype", 3, { NULL, "sec", "kb", }, },
1160         { "life", 0, { NULL } },
1161         { "group desc", 18,     { NULL, "modp768",
1162                                   "modp1024",    /* group 2 */
1163                                   "EC2N 2^155",  /* group 3 */
1164                                   "EC2N 2^185",  /* group 4 */
1165                                   "modp1536",    /* group 5 */
1166                                   "iana-grp06", "iana-grp07", /* reserved */
1167                                   "iana-grp08", "iana-grp09",
1168                                   "iana-grp10", "iana-grp11",
1169                                   "iana-grp12", "iana-grp13",
1170                                   "modp2048",    /* group 14 */
1171                                   "modp3072",    /* group 15 */
1172                                   "modp4096",    /* group 16 */
1173                                   "modp6144",    /* group 17 */
1174                                   "modp8192",    /* group 18 */
1175                 }, },
1176         { "enc mode", 3, { NULL, "tunnel", "transport", }, },
1177         { "auth", 5, { NULL, "hmac-md5", "hmac-sha1", "1des-mac", "keyed", }, },
1178         { "keylen", 0, { NULL } },
1179         { "rounds", 0, { NULL } },
1180         { "dictsize", 0, { NULL } },
1181         { "privalg", 0, { NULL } },
1182 };
1183
1184 static const struct attrmap encr_t_map[] = {
1185         { NULL, 0, { NULL } },  { NULL, 0, { NULL } },  /* 0, 1 */
1186         { NULL, 0, { NULL } },  { NULL, 0, { NULL } },  /* 2, 3 */
1187         { NULL, 0, { NULL } },  { NULL, 0, { NULL } },  /* 4, 5 */
1188         { NULL, 0, { NULL } },  { NULL, 0, { NULL } },  /* 6, 7 */
1189         { NULL, 0, { NULL } },  { NULL, 0, { NULL } },  /* 8, 9 */
1190         { NULL, 0, { NULL } },  { NULL, 0, { NULL } },  /* 10,11*/
1191         { NULL, 0, { NULL } },  { NULL, 0, { NULL } },  /* 12,13*/
1192         { "keylen", 14, { NULL }},
1193 };
1194
1195 static const struct attrmap oakley_t_map[] = {
1196         { NULL, 0, { NULL } },
1197         { "enc", 8,     { NULL, "1des", "idea", "blowfish", "rc5",
1198                           "3des", "cast", "aes", }, },
1199         { "hash", 7,    { NULL, "md5", "sha1", "tiger",
1200                           "sha2-256", "sha2-384", "sha2-512", }, },
1201         { "auth", 6,    { NULL, "preshared", "dss", "rsa sig", "rsa enc",
1202                           "rsa enc revised", }, },
1203         { "group desc", 18,     { NULL, "modp768",
1204                                   "modp1024",    /* group 2 */
1205                                   "EC2N 2^155",  /* group 3 */
1206                                   "EC2N 2^185",  /* group 4 */
1207                                   "modp1536",    /* group 5 */
1208                                   "iana-grp06", "iana-grp07", /* reserved */
1209                                   "iana-grp08", "iana-grp09",
1210                                   "iana-grp10", "iana-grp11",
1211                                   "iana-grp12", "iana-grp13",
1212                                   "modp2048",    /* group 14 */
1213                                   "modp3072",    /* group 15 */
1214                                   "modp4096",    /* group 16 */
1215                                   "modp6144",    /* group 17 */
1216                                   "modp8192",    /* group 18 */
1217                 }, },
1218         { "group type", 4,      { NULL, "MODP", "ECP", "EC2N", }, },
1219         { "group prime", 0, { NULL } },
1220         { "group gen1", 0, { NULL } },
1221         { "group gen2", 0, { NULL } },
1222         { "group curve A", 0, { NULL } },
1223         { "group curve B", 0, { NULL } },
1224         { "lifetype", 3,        { NULL, "sec", "kb", }, },
1225         { "lifeduration", 0, { NULL } },
1226         { "prf", 0, { NULL } },
1227         { "keylen", 0, { NULL } },
1228         { "field", 0, { NULL } },
1229         { "order", 0, { NULL } },
1230 };
1231
1232 static const u_char *
1233 ikev1_t_print(netdissect_options *ndo, u_char tpay _U_,
1234               const struct isakmp_gen *ext, u_int item_len,
1235               const u_char *ep, uint32_t phase _U_, uint32_t doi _U_,
1236               uint32_t proto, int depth _U_)
1237 {
1238         const struct ikev1_pl_t *p;
1239         struct ikev1_pl_t t;
1240         const u_char *cp;
1241         const char *idstr;
1242         const struct attrmap *map;
1243         size_t nmap;
1244         const u_char *ep2;
1245
1246         ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_T)));
1247
1248         p = (const struct ikev1_pl_t *)ext;
1249         ND_TCHECK(*p);
1250         UNALIGNED_MEMCPY(&t, ext, sizeof(t));
1251
1252         switch (proto) {
1253         case 1:
1254                 idstr = STR_OR_ID(t.t_id, ikev1_p_map);
1255                 map = oakley_t_map;
1256                 nmap = sizeof(oakley_t_map)/sizeof(oakley_t_map[0]);
1257                 break;
1258         case 2:
1259                 idstr = STR_OR_ID(t.t_id, ah_p_map);
1260                 map = ipsec_t_map;
1261                 nmap = sizeof(ipsec_t_map)/sizeof(ipsec_t_map[0]);
1262                 break;
1263         case 3:
1264                 idstr = STR_OR_ID(t.t_id, esp_p_map);
1265                 map = ipsec_t_map;
1266                 nmap = sizeof(ipsec_t_map)/sizeof(ipsec_t_map[0]);
1267                 break;
1268         case 4:
1269                 idstr = STR_OR_ID(t.t_id, ipcomp_p_map);
1270                 map = ipsec_t_map;
1271                 nmap = sizeof(ipsec_t_map)/sizeof(ipsec_t_map[0]);
1272                 break;
1273         default:
1274                 idstr = NULL;
1275                 map = NULL;
1276                 nmap = 0;
1277                 break;
1278         }
1279
1280         if (idstr)
1281                 ND_PRINT((ndo," #%d id=%s ", t.t_no, idstr));
1282         else
1283                 ND_PRINT((ndo," #%d id=%d ", t.t_no, t.t_id));
1284         cp = (const u_char *)(p + 1);
1285         ep2 = (const u_char *)p + item_len;
1286         while (cp < ep && cp < ep2) {
1287                 if (map && nmap)
1288                         cp = ikev1_attrmap_print(ndo, cp, ep2, map, nmap);
1289                 else
1290                         cp = ikev1_attr_print(ndo, cp, ep2);
1291                 if (cp == NULL)
1292                         goto trunc;
1293         }
1294         if (ep < ep2)
1295                 ND_PRINT((ndo,"..."));
1296         return cp;
1297 trunc:
1298         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_T)));
1299         return NULL;
1300 }
1301
1302 static const u_char *
1303 ikev1_ke_print(netdissect_options *ndo, u_char tpay _U_,
1304                const struct isakmp_gen *ext, u_int item_len _U_,
1305                const u_char *ep _U_, uint32_t phase _U_, uint32_t doi _U_,
1306                uint32_t proto _U_, int depth _U_)
1307 {
1308         struct isakmp_gen e;
1309
1310         ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_KE)));
1311
1312         ND_TCHECK(*ext);
1313         UNALIGNED_MEMCPY(&e, ext, sizeof(e));
1314         ND_PRINT((ndo," key len=%d", ntohs(e.len) - 4));
1315         if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1316                 /* Print the entire payload in hex */
1317                 ND_PRINT((ndo," "));
1318                 if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4))
1319                         goto trunc;
1320         }
1321         return (const u_char *)ext + ntohs(e.len);
1322 trunc:
1323         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_KE)));
1324         return NULL;
1325 }
1326
1327 static const u_char *
1328 ikev1_id_print(netdissect_options *ndo, u_char tpay _U_,
1329                const struct isakmp_gen *ext, u_int item_len,
1330                const u_char *ep _U_, uint32_t phase, uint32_t doi _U_,
1331                uint32_t proto _U_, int depth _U_)
1332 {
1333 #define USE_IPSECDOI_IN_PHASE1  1
1334         const struct ikev1_pl_id *p;
1335         struct ikev1_pl_id id;
1336         static const char *idtypestr[] = {
1337                 "IPv4", "IPv4net", "IPv6", "IPv6net",
1338         };
1339         static const char *ipsecidtypestr[] = {
1340                 NULL, "IPv4", "FQDN", "user FQDN", "IPv4net", "IPv6",
1341                 "IPv6net", "IPv4range", "IPv6range", "ASN1 DN", "ASN1 GN",
1342                 "keyid",
1343         };
1344         int len;
1345         const u_char *data;
1346
1347         ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_ID)));
1348
1349         p = (const struct ikev1_pl_id *)ext;
1350         ND_TCHECK(*p);
1351         UNALIGNED_MEMCPY(&id, ext, sizeof(id));
1352         if (sizeof(*p) < item_len) {
1353                 data = (const u_char *)(p + 1);
1354                 len = item_len - sizeof(*p);
1355         } else {
1356                 data = NULL;
1357                 len = 0;
1358         }
1359
1360 #if 0 /*debug*/
1361         ND_PRINT((ndo," [phase=%d doi=%d proto=%d]", phase, doi, proto));
1362 #endif
1363         switch (phase) {
1364 #ifndef USE_IPSECDOI_IN_PHASE1
1365         case 1:
1366 #endif
1367         default:
1368                 ND_PRINT((ndo," idtype=%s", STR_OR_ID(id.d.id_type, idtypestr)));
1369                 ND_PRINT((ndo," doi_data=%u",
1370                           (uint32_t)(ntohl(id.d.doi_data) & 0xffffff)));
1371                 break;
1372
1373 #ifdef USE_IPSECDOI_IN_PHASE1
1374         case 1:
1375 #endif
1376         case 2:
1377             {
1378                 const struct ipsecdoi_id *doi_p;
1379                 struct ipsecdoi_id doi_id;
1380                 const char *p_name;
1381
1382                 doi_p = (const struct ipsecdoi_id *)ext;
1383                 ND_TCHECK(*doi_p);
1384                 UNALIGNED_MEMCPY(&doi_id, ext, sizeof(doi_id));
1385                 ND_PRINT((ndo," idtype=%s", STR_OR_ID(doi_id.type, ipsecidtypestr)));
1386                 /* A protocol ID of 0 DOES NOT mean IPPROTO_IP! */
1387                 if (!ndo->ndo_nflag && doi_id.proto_id && (p_name = netdb_protoname(doi_id.proto_id)) != NULL)
1388                         ND_PRINT((ndo," protoid=%s", p_name));
1389                 else
1390                         ND_PRINT((ndo," protoid=%u", doi_id.proto_id));
1391                 ND_PRINT((ndo," port=%d", ntohs(doi_id.port)));
1392                 if (!len)
1393                         break;
1394                 if (data == NULL)
1395                         goto trunc;
1396                 ND_TCHECK2(*data, len);
1397                 switch (doi_id.type) {
1398                 case IPSECDOI_ID_IPV4_ADDR:
1399                         if (len < 4)
1400                                 ND_PRINT((ndo," len=%d [bad: < 4]", len));
1401                         else
1402                                 ND_PRINT((ndo," len=%d %s", len, ipaddr_string(ndo, data)));
1403                         len = 0;
1404                         break;
1405                 case IPSECDOI_ID_FQDN:
1406                 case IPSECDOI_ID_USER_FQDN:
1407                     {
1408                         int i;
1409                         ND_PRINT((ndo," len=%d ", len));
1410                         for (i = 0; i < len; i++)
1411                                 safeputchar(ndo, data[i]);
1412                         len = 0;
1413                         break;
1414                     }
1415                 case IPSECDOI_ID_IPV4_ADDR_SUBNET:
1416                     {
1417                         const u_char *mask;
1418                         if (len < 8)
1419                                 ND_PRINT((ndo," len=%d [bad: < 8]", len));
1420                         else {
1421                                 mask = data + sizeof(struct in_addr);
1422                                 ND_PRINT((ndo," len=%d %s/%u.%u.%u.%u", len,
1423                                           ipaddr_string(ndo, data),
1424                                           mask[0], mask[1], mask[2], mask[3]));
1425                         }
1426                         len = 0;
1427                         break;
1428                     }
1429                 case IPSECDOI_ID_IPV6_ADDR:
1430                         if (len < 16)
1431                                 ND_PRINT((ndo," len=%d [bad: < 16]", len));
1432                         else
1433                                 ND_PRINT((ndo," len=%d %s", len, ip6addr_string(ndo, data)));
1434                         len = 0;
1435                         break;
1436                 case IPSECDOI_ID_IPV6_ADDR_SUBNET:
1437                     {
1438                         const u_char *mask;
1439                         if (len < 32)
1440                                 ND_PRINT((ndo," len=%d [bad: < 32]", len));
1441                         else {
1442                                 mask = (const u_char *)(data + sizeof(struct in6_addr));
1443                                 /*XXX*/
1444                                 ND_PRINT((ndo," len=%d %s/0x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x", len,
1445                                           ip6addr_string(ndo, data),
1446                                           mask[0], mask[1], mask[2], mask[3],
1447                                           mask[4], mask[5], mask[6], mask[7],
1448                                           mask[8], mask[9], mask[10], mask[11],
1449                                           mask[12], mask[13], mask[14], mask[15]));
1450                         }
1451                         len = 0;
1452                         break;
1453                     }
1454                 case IPSECDOI_ID_IPV4_ADDR_RANGE:
1455                         if (len < 8)
1456                                 ND_PRINT((ndo," len=%d [bad: < 8]", len));
1457                         else {
1458                                 ND_PRINT((ndo," len=%d %s-%s", len,
1459                                           ipaddr_string(ndo, data),
1460                                           ipaddr_string(ndo, data + sizeof(struct in_addr))));
1461                         }
1462                         len = 0;
1463                         break;
1464                 case IPSECDOI_ID_IPV6_ADDR_RANGE:
1465                         if (len < 32)
1466                                 ND_PRINT((ndo," len=%d [bad: < 32]", len));
1467                         else {
1468                                 ND_PRINT((ndo," len=%d %s-%s", len,
1469                                           ip6addr_string(ndo, data),
1470                                           ip6addr_string(ndo, data + sizeof(struct in6_addr))));
1471                         }
1472                         len = 0;
1473                         break;
1474                 case IPSECDOI_ID_DER_ASN1_DN:
1475                 case IPSECDOI_ID_DER_ASN1_GN:
1476                 case IPSECDOI_ID_KEY_ID:
1477                         break;
1478                 }
1479                 break;
1480             }
1481         }
1482         if (data && len) {
1483                 ND_PRINT((ndo," len=%d", len));
1484                 if (2 < ndo->ndo_vflag) {
1485                         ND_PRINT((ndo," "));
1486                         if (!rawprint(ndo, (const uint8_t *)data, len))
1487                                 goto trunc;
1488                 }
1489         }
1490         return (const u_char *)ext + item_len;
1491 trunc:
1492         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_ID)));
1493         return NULL;
1494 }
1495
1496 static const u_char *
1497 ikev1_cert_print(netdissect_options *ndo, u_char tpay _U_,
1498                  const struct isakmp_gen *ext, u_int item_len,
1499                  const u_char *ep _U_, uint32_t phase _U_,
1500                  uint32_t doi0 _U_,
1501                  uint32_t proto0 _U_, int depth _U_)
1502 {
1503         const struct ikev1_pl_cert *p;
1504         struct ikev1_pl_cert cert;
1505         static const char *certstr[] = {
1506                 "none", "pkcs7", "pgp", "dns",
1507                 "x509sign", "x509ke", "kerberos", "crl",
1508                 "arl", "spki", "x509attr",
1509         };
1510
1511         ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_CERT)));
1512
1513         p = (const struct ikev1_pl_cert *)ext;
1514         ND_TCHECK(*p);
1515         UNALIGNED_MEMCPY(&cert, ext, sizeof(cert));
1516         ND_PRINT((ndo," len=%d", item_len - 4));
1517         ND_PRINT((ndo," type=%s", STR_OR_ID((cert.encode), certstr)));
1518         if (2 < ndo->ndo_vflag && 4 < item_len) {
1519                 /* Print the entire payload in hex */
1520                 ND_PRINT((ndo," "));
1521                 if (!rawprint(ndo, (const uint8_t *)(ext + 1), item_len - 4))
1522                         goto trunc;
1523         }
1524         return (const u_char *)ext + item_len;
1525 trunc:
1526         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_CERT)));
1527         return NULL;
1528 }
1529
1530 static const u_char *
1531 ikev1_cr_print(netdissect_options *ndo, u_char tpay _U_,
1532                const struct isakmp_gen *ext, u_int item_len,
1533                const u_char *ep _U_, uint32_t phase _U_, uint32_t doi0 _U_,
1534                uint32_t proto0 _U_, int depth _U_)
1535 {
1536         const struct ikev1_pl_cert *p;
1537         struct ikev1_pl_cert cert;
1538         static const char *certstr[] = {
1539                 "none", "pkcs7", "pgp", "dns",
1540                 "x509sign", "x509ke", "kerberos", "crl",
1541                 "arl", "spki", "x509attr",
1542         };
1543
1544         ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_CR)));
1545
1546         p = (const struct ikev1_pl_cert *)ext;
1547         ND_TCHECK(*p);
1548         UNALIGNED_MEMCPY(&cert, ext, sizeof(cert));
1549         ND_PRINT((ndo," len=%d", item_len - 4));
1550         ND_PRINT((ndo," type=%s", STR_OR_ID((cert.encode), certstr)));
1551         if (2 < ndo->ndo_vflag && 4 < item_len) {
1552                 /* Print the entire payload in hex */
1553                 ND_PRINT((ndo," "));
1554                 if (!rawprint(ndo, (const uint8_t *)(ext + 1), item_len - 4))
1555                         goto trunc;
1556         }
1557         return (const u_char *)ext + item_len;
1558 trunc:
1559         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_CR)));
1560         return NULL;
1561 }
1562
1563 static const u_char *
1564 ikev1_hash_print(netdissect_options *ndo, u_char tpay _U_,
1565                  const struct isakmp_gen *ext, u_int item_len _U_,
1566                  const u_char *ep _U_, uint32_t phase _U_, uint32_t doi _U_,
1567                  uint32_t proto _U_, int depth _U_)
1568 {
1569         struct isakmp_gen e;
1570
1571         ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_HASH)));
1572
1573         ND_TCHECK(*ext);
1574         UNALIGNED_MEMCPY(&e, ext, sizeof(e));
1575         ND_PRINT((ndo," len=%d", ntohs(e.len) - 4));
1576         if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1577                 /* Print the entire payload in hex */
1578                 ND_PRINT((ndo," "));
1579                 if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4))
1580                         goto trunc;
1581         }
1582         return (const u_char *)ext + ntohs(e.len);
1583 trunc:
1584         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_HASH)));
1585         return NULL;
1586 }
1587
1588 static const u_char *
1589 ikev1_sig_print(netdissect_options *ndo, u_char tpay _U_,
1590                 const struct isakmp_gen *ext, u_int item_len _U_,
1591                 const u_char *ep _U_, uint32_t phase _U_, uint32_t doi _U_,
1592                 uint32_t proto _U_, int depth _U_)
1593 {
1594         struct isakmp_gen e;
1595
1596         ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_SIG)));
1597
1598         ND_TCHECK(*ext);
1599         UNALIGNED_MEMCPY(&e, ext, sizeof(e));
1600         ND_PRINT((ndo," len=%d", ntohs(e.len) - 4));
1601         if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1602                 /* Print the entire payload in hex */
1603                 ND_PRINT((ndo," "));
1604                 if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4))
1605                         goto trunc;
1606         }
1607         return (const u_char *)ext + ntohs(e.len);
1608 trunc:
1609         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_SIG)));
1610         return NULL;
1611 }
1612
1613 static const u_char *
1614 ikev1_nonce_print(netdissect_options *ndo, u_char tpay _U_,
1615                   const struct isakmp_gen *ext,
1616                   u_int item_len _U_,
1617                   const u_char *ep,
1618                   uint32_t phase _U_, uint32_t doi _U_,
1619                   uint32_t proto _U_, int depth _U_)
1620 {
1621         struct isakmp_gen e;
1622
1623         ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_NONCE)));
1624
1625         ND_TCHECK(*ext);
1626         UNALIGNED_MEMCPY(&e, ext, sizeof(e));
1627         /*
1628          * Our caller has ensured that the length is >= 4.
1629          */
1630         ND_PRINT((ndo," n len=%u", ntohs(e.len) - 4));
1631         if (ntohs(e.len) > 4) {
1632                 if (ndo->ndo_vflag > 2) {
1633                         ND_PRINT((ndo, " "));
1634                         if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4))
1635                                 goto trunc;
1636                 } else if (ndo->ndo_vflag > 1) {
1637                         ND_PRINT((ndo, " "));
1638                         if (!ike_show_somedata(ndo, (const u_char *)(ext + 1), ep))
1639                                 goto trunc;
1640                 }
1641         }
1642         return (const u_char *)ext + ntohs(e.len);
1643 trunc:
1644         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_NONCE)));
1645         return NULL;
1646 }
1647
1648 static const u_char *
1649 ikev1_n_print(netdissect_options *ndo, u_char tpay _U_,
1650               const struct isakmp_gen *ext, u_int item_len,
1651               const u_char *ep, uint32_t phase _U_, uint32_t doi0 _U_,
1652               uint32_t proto0 _U_, int depth _U_)
1653 {
1654         const struct ikev1_pl_n *p;
1655         struct ikev1_pl_n n;
1656         const u_char *cp;
1657         const u_char *ep2;
1658         uint32_t doi;
1659         uint32_t proto;
1660         static const char *notify_error_str[] = {
1661                 NULL,                           "INVALID-PAYLOAD-TYPE",
1662                 "DOI-NOT-SUPPORTED",            "SITUATION-NOT-SUPPORTED",
1663                 "INVALID-COOKIE",               "INVALID-MAJOR-VERSION",
1664                 "INVALID-MINOR-VERSION",        "INVALID-EXCHANGE-TYPE",
1665                 "INVALID-FLAGS",                "INVALID-MESSAGE-ID",
1666                 "INVALID-PROTOCOL-ID",          "INVALID-SPI",
1667                 "INVALID-TRANSFORM-ID",         "ATTRIBUTES-NOT-SUPPORTED",
1668                 "NO-PROPOSAL-CHOSEN",           "BAD-PROPOSAL-SYNTAX",
1669                 "PAYLOAD-MALFORMED",            "INVALID-KEY-INFORMATION",
1670                 "INVALID-ID-INFORMATION",       "INVALID-CERT-ENCODING",
1671                 "INVALID-CERTIFICATE",          "CERT-TYPE-UNSUPPORTED",
1672                 "INVALID-CERT-AUTHORITY",       "INVALID-HASH-INFORMATION",
1673                 "AUTHENTICATION-FAILED",        "INVALID-SIGNATURE",
1674                 "ADDRESS-NOTIFICATION",         "NOTIFY-SA-LIFETIME",
1675                 "CERTIFICATE-UNAVAILABLE",      "UNSUPPORTED-EXCHANGE-TYPE",
1676                 "UNEQUAL-PAYLOAD-LENGTHS",
1677         };
1678         static const char *ipsec_notify_error_str[] = {
1679                 "RESERVED",
1680         };
1681         static const char *notify_status_str[] = {
1682                 "CONNECTED",
1683         };
1684         static const char *ipsec_notify_status_str[] = {
1685                 "RESPONDER-LIFETIME",           "REPLAY-STATUS",
1686                 "INITIAL-CONTACT",
1687         };
1688 /* NOTE: these macro must be called with x in proper range */
1689
1690 /* 0 - 8191 */
1691 #define NOTIFY_ERROR_STR(x) \
1692         STR_OR_ID((x), notify_error_str)
1693
1694 /* 8192 - 16383 */
1695 #define IPSEC_NOTIFY_ERROR_STR(x) \
1696         STR_OR_ID((u_int)((x) - 8192), ipsec_notify_error_str)
1697
1698 /* 16384 - 24575 */
1699 #define NOTIFY_STATUS_STR(x) \
1700         STR_OR_ID((u_int)((x) - 16384), notify_status_str)
1701
1702 /* 24576 - 32767 */
1703 #define IPSEC_NOTIFY_STATUS_STR(x) \
1704         STR_OR_ID((u_int)((x) - 24576), ipsec_notify_status_str)
1705
1706         ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_N)));
1707
1708         p = (const struct ikev1_pl_n *)ext;
1709         ND_TCHECK(*p);
1710         UNALIGNED_MEMCPY(&n, ext, sizeof(n));
1711         doi = ntohl(n.doi);
1712         proto = n.prot_id;
1713         if (doi != 1) {
1714                 ND_PRINT((ndo," doi=%d", doi));
1715                 ND_PRINT((ndo," proto=%d", proto));
1716                 if (ntohs(n.type) < 8192)
1717                         ND_PRINT((ndo," type=%s", NOTIFY_ERROR_STR(ntohs(n.type))));
1718                 else if (ntohs(n.type) < 16384)
1719                         ND_PRINT((ndo," type=%s", numstr(ntohs(n.type))));
1720                 else if (ntohs(n.type) < 24576)
1721                         ND_PRINT((ndo," type=%s", NOTIFY_STATUS_STR(ntohs(n.type))));
1722                 else
1723                         ND_PRINT((ndo," type=%s", numstr(ntohs(n.type))));
1724                 if (n.spi_size) {
1725                         ND_PRINT((ndo," spi="));
1726                         if (!rawprint(ndo, (const uint8_t *)(p + 1), n.spi_size))
1727                                 goto trunc;
1728                 }
1729                 return (const u_char *)(p + 1) + n.spi_size;
1730         }
1731
1732         ND_PRINT((ndo," doi=ipsec"));
1733         ND_PRINT((ndo," proto=%s", PROTOIDSTR(proto)));
1734         if (ntohs(n.type) < 8192)
1735                 ND_PRINT((ndo," type=%s", NOTIFY_ERROR_STR(ntohs(n.type))));
1736         else if (ntohs(n.type) < 16384)
1737                 ND_PRINT((ndo," type=%s", IPSEC_NOTIFY_ERROR_STR(ntohs(n.type))));
1738         else if (ntohs(n.type) < 24576)
1739                 ND_PRINT((ndo," type=%s", NOTIFY_STATUS_STR(ntohs(n.type))));
1740         else if (ntohs(n.type) < 32768)
1741                 ND_PRINT((ndo," type=%s", IPSEC_NOTIFY_STATUS_STR(ntohs(n.type))));
1742         else
1743                 ND_PRINT((ndo," type=%s", numstr(ntohs(n.type))));
1744         if (n.spi_size) {
1745                 ND_PRINT((ndo," spi="));
1746                 if (!rawprint(ndo, (const uint8_t *)(p + 1), n.spi_size))
1747                         goto trunc;
1748         }
1749
1750         cp = (const u_char *)(p + 1) + n.spi_size;
1751         ep2 = (const u_char *)p + item_len;
1752
1753         if (cp < ep) {
1754                 switch (ntohs(n.type)) {
1755                 case IPSECDOI_NTYPE_RESPONDER_LIFETIME:
1756                     {
1757                         const struct attrmap *map = oakley_t_map;
1758                         size_t nmap = sizeof(oakley_t_map)/sizeof(oakley_t_map[0]);
1759                         ND_PRINT((ndo," attrs=("));
1760                         while (cp < ep && cp < ep2) {
1761                                 cp = ikev1_attrmap_print(ndo, cp, ep2, map, nmap);
1762                                 if (cp == NULL) {
1763                                         ND_PRINT((ndo,")"));
1764                                         goto trunc;
1765                                 }
1766                         }
1767                         ND_PRINT((ndo,")"));
1768                         break;
1769                     }
1770                 case IPSECDOI_NTYPE_REPLAY_STATUS:
1771                         ND_PRINT((ndo," status=("));
1772                         ND_PRINT((ndo,"replay detection %sabled",
1773                                   EXTRACT_32BITS(cp) ? "en" : "dis"));
1774                         ND_PRINT((ndo,")"));
1775                         break;
1776                 default:
1777                         /*
1778                          * XXX - fill in more types here; see, for example,
1779                          * draft-ietf-ipsec-notifymsg-04.
1780                          */
1781                         if (ndo->ndo_vflag > 3) {
1782                                 ND_PRINT((ndo," data=("));
1783                                 if (!rawprint(ndo, (const uint8_t *)(cp), ep - cp))
1784                                         goto trunc;
1785                                 ND_PRINT((ndo,")"));
1786                         } else {
1787                                 if (!ike_show_somedata(ndo, cp, ep))
1788                                         goto trunc;
1789                         }
1790                         break;
1791                 }
1792         }
1793         return (const u_char *)ext + item_len;
1794 trunc:
1795         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_N)));
1796         return NULL;
1797 }
1798
1799 static const u_char *
1800 ikev1_d_print(netdissect_options *ndo, u_char tpay _U_,
1801               const struct isakmp_gen *ext, u_int item_len _U_,
1802               const u_char *ep _U_, uint32_t phase _U_, uint32_t doi0 _U_,
1803               uint32_t proto0 _U_, int depth _U_)
1804 {
1805         const struct ikev1_pl_d *p;
1806         struct ikev1_pl_d d;
1807         const uint8_t *q;
1808         uint32_t doi;
1809         uint32_t proto;
1810         int i;
1811
1812         ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_D)));
1813
1814         p = (const struct ikev1_pl_d *)ext;
1815         ND_TCHECK(*p);
1816         UNALIGNED_MEMCPY(&d, ext, sizeof(d));
1817         doi = ntohl(d.doi);
1818         proto = d.prot_id;
1819         if (doi != 1) {
1820                 ND_PRINT((ndo," doi=%u", doi));
1821                 ND_PRINT((ndo," proto=%u", proto));
1822         } else {
1823                 ND_PRINT((ndo," doi=ipsec"));
1824                 ND_PRINT((ndo," proto=%s", PROTOIDSTR(proto)));
1825         }
1826         ND_PRINT((ndo," spilen=%u", d.spi_size));
1827         ND_PRINT((ndo," nspi=%u", ntohs(d.num_spi)));
1828         ND_PRINT((ndo," spi="));
1829         q = (const uint8_t *)(p + 1);
1830         for (i = 0; i < ntohs(d.num_spi); i++) {
1831                 if (i != 0)
1832                         ND_PRINT((ndo,","));
1833                 if (!rawprint(ndo, (const uint8_t *)q, d.spi_size))
1834                         goto trunc;
1835                 q += d.spi_size;
1836         }
1837         return q;
1838 trunc:
1839         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_D)));
1840         return NULL;
1841 }
1842
1843 static const u_char *
1844 ikev1_vid_print(netdissect_options *ndo, u_char tpay _U_,
1845                 const struct isakmp_gen *ext,
1846                 u_int item_len _U_, const u_char *ep _U_,
1847                 uint32_t phase _U_, uint32_t doi _U_,
1848                 uint32_t proto _U_, int depth _U_)
1849 {
1850         struct isakmp_gen e;
1851
1852         ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_VID)));
1853
1854         ND_TCHECK(*ext);
1855         UNALIGNED_MEMCPY(&e, ext, sizeof(e));
1856         ND_PRINT((ndo," len=%d", ntohs(e.len) - 4));
1857         if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1858                 /* Print the entire payload in hex */
1859                 ND_PRINT((ndo," "));
1860                 if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4))
1861                         goto trunc;
1862         }
1863         return (const u_char *)ext + ntohs(e.len);
1864 trunc:
1865         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_VID)));
1866         return NULL;
1867 }
1868
1869 /************************************************************/
1870 /*                                                          */
1871 /*              IKE v2 - rfc4306 - dissector                */
1872 /*                                                          */
1873 /************************************************************/
1874
1875 static void
1876 ikev2_pay_print(netdissect_options *ndo, const char *payname, int critical)
1877 {
1878         ND_PRINT((ndo,"%s%s:", payname, critical&0x80 ? "[C]" : ""));
1879 }
1880
1881 static const u_char *
1882 ikev2_gen_print(netdissect_options *ndo, u_char tpay,
1883                 const struct isakmp_gen *ext)
1884 {
1885         struct isakmp_gen e;
1886
1887         ND_TCHECK(*ext);
1888         UNALIGNED_MEMCPY(&e, ext, sizeof(e));
1889         ikev2_pay_print(ndo, NPSTR(tpay), e.critical);
1890
1891         ND_PRINT((ndo," len=%d", ntohs(e.len) - 4));
1892         if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1893                 /* Print the entire payload in hex */
1894                 ND_PRINT((ndo," "));
1895                 if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4))
1896                         goto trunc;
1897         }
1898         return (const u_char *)ext + ntohs(e.len);
1899 trunc:
1900         ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
1901         return NULL;
1902 }
1903
1904 static const u_char *
1905 ikev2_t_print(netdissect_options *ndo, int tcount,
1906               const struct isakmp_gen *ext, u_int item_len,
1907               const u_char *ep)
1908 {
1909         const struct ikev2_t *p;
1910         struct ikev2_t t;
1911         uint16_t  t_id;
1912         const u_char *cp;
1913         const char *idstr;
1914         const struct attrmap *map;
1915         size_t nmap;
1916         const u_char *ep2;
1917
1918         p = (const struct ikev2_t *)ext;
1919         ND_TCHECK(*p);
1920         UNALIGNED_MEMCPY(&t, ext, sizeof(t));
1921         ikev2_pay_print(ndo, NPSTR(ISAKMP_NPTYPE_T), t.h.critical);
1922
1923         t_id = ntohs(t.t_id);
1924
1925         map = NULL;
1926         nmap = 0;
1927
1928         switch (t.t_type) {
1929         case IV2_T_ENCR:
1930                 idstr = STR_OR_ID(t_id, esp_p_map);
1931                 map = encr_t_map;
1932                 nmap = sizeof(encr_t_map)/sizeof(encr_t_map[0]);
1933                 break;
1934
1935         case IV2_T_PRF:
1936                 idstr = STR_OR_ID(t_id, prf_p_map);
1937                 break;
1938
1939         case IV2_T_INTEG:
1940                 idstr = STR_OR_ID(t_id, integ_p_map);
1941                 break;
1942
1943         case IV2_T_DH:
1944                 idstr = STR_OR_ID(t_id, dh_p_map);
1945                 break;
1946
1947         case IV2_T_ESN:
1948                 idstr = STR_OR_ID(t_id, esn_p_map);
1949                 break;
1950
1951         default:
1952                 idstr = NULL;
1953                 break;
1954         }
1955
1956         if (idstr)
1957                 ND_PRINT((ndo," #%u type=%s id=%s ", tcount,
1958                           STR_OR_ID(t.t_type, ikev2_t_type_map),
1959                           idstr));
1960         else
1961                 ND_PRINT((ndo," #%u type=%s id=%u ", tcount,
1962                           STR_OR_ID(t.t_type, ikev2_t_type_map),
1963                           t.t_id));
1964         cp = (const u_char *)(p + 1);
1965         ep2 = (const u_char *)p + item_len;
1966         while (cp < ep && cp < ep2) {
1967                 if (map && nmap) {
1968                         cp = ikev1_attrmap_print(ndo, cp, ep2, map, nmap);
1969                 } else
1970                         cp = ikev1_attr_print(ndo, cp, ep2);
1971                 if (cp == NULL)
1972                         goto trunc;
1973         }
1974         if (ep < ep2)
1975                 ND_PRINT((ndo,"..."));
1976         return cp;
1977 trunc:
1978         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_T)));
1979         return NULL;
1980 }
1981
1982 static const u_char *
1983 ikev2_p_print(netdissect_options *ndo, u_char tpay _U_, int pcount _U_,
1984               const struct isakmp_gen *ext, u_int oprop_length,
1985               const u_char *ep, int depth)
1986 {
1987         const struct ikev2_p *p;
1988         struct ikev2_p prop;
1989         u_int prop_length;
1990         const u_char *cp;
1991         int i;
1992         int tcount;
1993         u_char np;
1994         struct isakmp_gen e;
1995         u_int item_len;
1996
1997         p = (const struct ikev2_p *)ext;
1998         ND_TCHECK(*p);
1999         UNALIGNED_MEMCPY(&prop, ext, sizeof(prop));
2000
2001         ikev2_pay_print(ndo, NPSTR(ISAKMP_NPTYPE_P), prop.h.critical);
2002
2003         /*
2004          * ikev2_sa_print() guarantees that this is >= 4.
2005          */
2006         prop_length = oprop_length - 4;
2007         ND_PRINT((ndo," #%u protoid=%s transform=%d len=%u",
2008                   prop.p_no,  PROTOIDSTR(prop.prot_id),
2009                   prop.num_t, oprop_length));
2010         cp = (const u_char *)(p + 1);
2011
2012         if (prop.spi_size) {
2013                 if (prop_length < prop.spi_size)
2014                         goto toolong;
2015                 ND_PRINT((ndo," spi="));
2016                 if (!rawprint(ndo, (const uint8_t *)cp, prop.spi_size))
2017                         goto trunc;
2018                 cp += prop.spi_size;
2019                 prop_length -= prop.spi_size;
2020         }
2021
2022         /*
2023          * Print the transforms.
2024          */
2025         tcount = 0;
2026         for (np = ISAKMP_NPTYPE_T; np != 0; np = e.np) {
2027                 tcount++;
2028                 ext = (const struct isakmp_gen *)cp;
2029                 if (prop_length < sizeof(*ext))
2030                         goto toolong;
2031                 ND_TCHECK(*ext);
2032                 UNALIGNED_MEMCPY(&e, ext, sizeof(e));
2033
2034                 /*
2035                  * Since we can't have a payload length of less than 4 bytes,
2036                  * we need to bail out here if the generic header is nonsensical
2037                  * or truncated, otherwise we could loop forever processing
2038                  * zero-length items or otherwise misdissect the packet.
2039                  */
2040                 item_len = ntohs(e.len);
2041                 if (item_len <= 4)
2042                         goto trunc;
2043
2044                 if (prop_length < item_len)
2045                         goto toolong;
2046                 ND_TCHECK2(*cp, item_len);
2047
2048                 depth++;
2049                 ND_PRINT((ndo,"\n"));
2050                 for (i = 0; i < depth; i++)
2051                         ND_PRINT((ndo,"    "));
2052                 ND_PRINT((ndo,"("));
2053                 if (np == ISAKMP_NPTYPE_T) {
2054                         cp = ikev2_t_print(ndo, tcount, ext, item_len, ep);
2055                         if (cp == NULL) {
2056                                 /* error, already reported */
2057                                 return NULL;
2058                         }
2059                 } else {
2060                         ND_PRINT((ndo, "%s", NPSTR(np)));
2061                         cp += item_len;
2062                 }
2063                 ND_PRINT((ndo,")"));
2064                 depth--;
2065                 prop_length -= item_len;
2066         }
2067         return cp;
2068 toolong:
2069         /*
2070          * Skip the rest of the proposal.
2071          */
2072         cp += prop_length;
2073         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_P)));
2074         return cp;
2075 trunc:
2076         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_P)));
2077         return NULL;
2078 }
2079
2080 static const u_char *
2081 ikev2_sa_print(netdissect_options *ndo, u_char tpay,
2082                 const struct isakmp_gen *ext1,
2083                 u_int osa_length, const u_char *ep,
2084                 uint32_t phase _U_, uint32_t doi _U_,
2085                 uint32_t proto _U_, int depth)
2086 {
2087         const struct isakmp_gen *ext;
2088         struct isakmp_gen e;
2089         u_int sa_length;
2090         const u_char *cp;
2091         int i;
2092         int pcount;
2093         u_char np;
2094         u_int item_len;
2095
2096         ND_TCHECK(*ext1);
2097         UNALIGNED_MEMCPY(&e, ext1, sizeof(e));
2098         ikev2_pay_print(ndo, "sa", e.critical);
2099
2100         /*
2101          * ikev2_sub0_print() guarantees that this is >= 4.
2102          */
2103         osa_length= ntohs(e.len);
2104         sa_length = osa_length - 4;
2105         ND_PRINT((ndo," len=%d", sa_length));
2106
2107         /*
2108          * Print the payloads.
2109          */
2110         cp = (const u_char *)(ext1 + 1);
2111         pcount = 0;
2112         for (np = ISAKMP_NPTYPE_P; np != 0; np = e.np) {
2113                 pcount++;
2114                 ext = (const struct isakmp_gen *)cp;
2115                 if (sa_length < sizeof(*ext))
2116                         goto toolong;
2117                 ND_TCHECK(*ext);
2118                 UNALIGNED_MEMCPY(&e, ext, sizeof(e));
2119
2120                 /*
2121                  * Since we can't have a payload length of less than 4 bytes,
2122                  * we need to bail out here if the generic header is nonsensical
2123                  * or truncated, otherwise we could loop forever processing
2124                  * zero-length items or otherwise misdissect the packet.
2125                  */
2126                 item_len = ntohs(e.len);
2127                 if (item_len <= 4)
2128                         goto trunc;
2129
2130                 if (sa_length < item_len)
2131                         goto toolong;
2132                 ND_TCHECK2(*cp, item_len);
2133
2134                 depth++;
2135                 ND_PRINT((ndo,"\n"));
2136                 for (i = 0; i < depth; i++)
2137                         ND_PRINT((ndo,"    "));
2138                 ND_PRINT((ndo,"("));
2139                 if (np == ISAKMP_NPTYPE_P) {
2140                         cp = ikev2_p_print(ndo, np, pcount, ext, item_len,
2141                                            ep, depth);
2142                         if (cp == NULL) {
2143                                 /* error, already reported */
2144                                 return NULL;
2145                         }
2146                 } else {
2147                         ND_PRINT((ndo, "%s", NPSTR(np)));
2148                         cp += item_len;
2149                 }
2150                 ND_PRINT((ndo,")"));
2151                 depth--;
2152                 sa_length -= item_len;
2153         }
2154         return cp;
2155 toolong:
2156         /*
2157          * Skip the rest of the SA.
2158          */
2159         cp += sa_length;
2160         ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
2161         return cp;
2162 trunc:
2163         ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
2164         return NULL;
2165 }
2166
2167 static const u_char *
2168 ikev2_ke_print(netdissect_options *ndo, u_char tpay,
2169                 const struct isakmp_gen *ext,
2170                 u_int item_len _U_, const u_char *ep _U_,
2171                 uint32_t phase _U_, uint32_t doi _U_,
2172                 uint32_t proto _U_, int depth _U_)
2173 {
2174         struct ikev2_ke ke;
2175         const struct ikev2_ke *k;
2176
2177         k = (const struct ikev2_ke *)ext;
2178         ND_TCHECK(*k);
2179         UNALIGNED_MEMCPY(&ke, ext, sizeof(ke));
2180         ikev2_pay_print(ndo, NPSTR(tpay), ke.h.critical);
2181
2182         ND_PRINT((ndo," len=%u group=%s", ntohs(ke.h.len) - 8,
2183                   STR_OR_ID(ntohs(ke.ke_group), dh_p_map)));
2184
2185         if (2 < ndo->ndo_vflag && 8 < ntohs(ke.h.len)) {
2186                 ND_PRINT((ndo," "));
2187                 if (!rawprint(ndo, (const uint8_t *)(k + 1), ntohs(ke.h.len) - 8))
2188                         goto trunc;
2189         }
2190         return (const u_char *)ext + ntohs(ke.h.len);
2191 trunc:
2192         ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
2193         return NULL;
2194 }
2195
2196 static const u_char *
2197 ikev2_ID_print(netdissect_options *ndo, u_char tpay,
2198                 const struct isakmp_gen *ext,
2199                 u_int item_len _U_, const u_char *ep _U_,
2200                 uint32_t phase _U_, uint32_t doi _U_,
2201                 uint32_t proto _U_, int depth _U_)
2202 {
2203         const struct ikev2_id *idp;
2204         struct ikev2_id id;
2205         int id_len, idtype_len, i;
2206         unsigned int dumpascii, dumphex;
2207         const unsigned char *typedata;
2208
2209         idp = (const struct ikev2_id *)ext;
2210         ND_TCHECK(*idp);
2211         UNALIGNED_MEMCPY(&id, ext, sizeof(id));
2212         ikev2_pay_print(ndo, NPSTR(tpay), id.h.critical);
2213
2214         id_len = ntohs(id.h.len);
2215
2216         ND_PRINT((ndo," len=%d", id_len - 4));
2217         if (2 < ndo->ndo_vflag && 4 < id_len) {
2218                 /* Print the entire payload in hex */
2219                 ND_PRINT((ndo," "));
2220                 if (!rawprint(ndo, (const uint8_t *)(ext + 1), id_len - 4))
2221                         goto trunc;
2222         }
2223
2224         idtype_len =id_len - sizeof(struct ikev2_id);
2225         dumpascii = 0;
2226         dumphex   = 0;
2227         typedata  = (const unsigned char *)(ext)+sizeof(struct ikev2_id);
2228
2229         switch(id.type) {
2230         case ID_IPV4_ADDR:
2231                 ND_PRINT((ndo, " ipv4:"));
2232                 dumphex=1;
2233                 break;
2234         case ID_FQDN:
2235                 ND_PRINT((ndo, " fqdn:"));
2236                 dumpascii=1;
2237                 break;
2238         case ID_RFC822_ADDR:
2239                 ND_PRINT((ndo, " rfc822:"));
2240                 dumpascii=1;
2241                 break;
2242         case ID_IPV6_ADDR:
2243                 ND_PRINT((ndo, " ipv6:"));
2244                 dumphex=1;
2245                 break;
2246         case ID_DER_ASN1_DN:
2247                 ND_PRINT((ndo, " dn:"));
2248                 dumphex=1;
2249                 break;
2250         case ID_DER_ASN1_GN:
2251                 ND_PRINT((ndo, " gn:"));
2252                 dumphex=1;
2253                 break;
2254         case ID_KEY_ID:
2255                 ND_PRINT((ndo, " keyid:"));
2256                 dumphex=1;
2257                 break;
2258         }
2259
2260         if(dumpascii) {
2261                 ND_TCHECK2(*typedata, idtype_len);
2262                 for(i=0; i<idtype_len; i++) {
2263                         if(ND_ISPRINT(typedata[i])) {
2264                                 ND_PRINT((ndo, "%c", typedata[i]));
2265                         } else {
2266                                 ND_PRINT((ndo, "."));
2267                         }
2268                 }
2269         }
2270         if(dumphex) {
2271                 if (!rawprint(ndo, (const uint8_t *)typedata, idtype_len))
2272                         goto trunc;
2273         }
2274
2275         return (const u_char *)ext + id_len;
2276 trunc:
2277         ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
2278         return NULL;
2279 }
2280
2281 static const u_char *
2282 ikev2_cert_print(netdissect_options *ndo, u_char tpay,
2283                 const struct isakmp_gen *ext,
2284                 u_int item_len _U_, const u_char *ep _U_,
2285                 uint32_t phase _U_, uint32_t doi _U_,
2286                 uint32_t proto _U_, int depth _U_)
2287 {
2288         return ikev2_gen_print(ndo, tpay, ext);
2289 }
2290
2291 static const u_char *
2292 ikev2_cr_print(netdissect_options *ndo, u_char tpay,
2293                 const struct isakmp_gen *ext,
2294                 u_int item_len _U_, const u_char *ep _U_,
2295                 uint32_t phase _U_, uint32_t doi _U_,
2296                 uint32_t proto _U_, int depth _U_)
2297 {
2298         return ikev2_gen_print(ndo, tpay, ext);
2299 }
2300
2301 static const u_char *
2302 ikev2_auth_print(netdissect_options *ndo, u_char tpay,
2303                 const struct isakmp_gen *ext,
2304                 u_int item_len _U_, const u_char *ep,
2305                 uint32_t phase _U_, uint32_t doi _U_,
2306                 uint32_t proto _U_, int depth _U_)
2307 {
2308         struct ikev2_auth a;
2309         const char *v2_auth[]={ "invalid", "rsasig",
2310                                 "shared-secret", "dsssig" };
2311         const u_char *authdata = (const u_char*)ext + sizeof(a);
2312         unsigned int len;
2313
2314         ND_TCHECK2(*ext, sizeof(a));
2315         UNALIGNED_MEMCPY(&a, ext, sizeof(a));
2316         ikev2_pay_print(ndo, NPSTR(tpay), a.h.critical);
2317         len = ntohs(a.h.len);
2318
2319         /*
2320          * Our caller has ensured that the length is >= 4.
2321          */
2322         ND_PRINT((ndo," len=%u method=%s", len-4,
2323                   STR_OR_ID(a.auth_method, v2_auth)));
2324         if (len > 4) {
2325                 if (ndo->ndo_vflag > 1) {
2326                         ND_PRINT((ndo, " authdata=("));
2327                         if (!rawprint(ndo, (const uint8_t *)authdata, len - sizeof(a)))
2328                                 goto trunc;
2329                         ND_PRINT((ndo, ") "));
2330                 } else if (ndo->ndo_vflag) {
2331                         if (!ike_show_somedata(ndo, authdata, ep))
2332                                 goto trunc;
2333                 }
2334         }
2335
2336         return (const u_char *)ext + len;
2337 trunc:
2338         ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
2339         return NULL;
2340 }
2341
2342 static const u_char *
2343 ikev2_nonce_print(netdissect_options *ndo, u_char tpay,
2344                 const struct isakmp_gen *ext,
2345                 u_int item_len _U_, const u_char *ep,
2346                 uint32_t phase _U_, uint32_t doi _U_,
2347                 uint32_t proto _U_, int depth _U_)
2348 {
2349         struct isakmp_gen e;
2350
2351         ND_TCHECK(*ext);
2352         UNALIGNED_MEMCPY(&e, ext, sizeof(e));
2353         ikev2_pay_print(ndo, "nonce", e.critical);
2354
2355         ND_PRINT((ndo," len=%d", ntohs(e.len) - 4));
2356         if (1 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
2357                 ND_PRINT((ndo," nonce=("));
2358                 if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4))
2359                         goto trunc;
2360                 ND_PRINT((ndo,") "));
2361         } else if(ndo->ndo_vflag && 4 < ntohs(e.len)) {
2362                 if(!ike_show_somedata(ndo, (const u_char *)(ext+1), ep)) goto trunc;
2363         }
2364
2365         return (const u_char *)ext + ntohs(e.len);
2366 trunc:
2367         ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
2368         return NULL;
2369 }
2370
2371 /* notify payloads */
2372 static const u_char *
2373 ikev2_n_print(netdissect_options *ndo, u_char tpay _U_,
2374                 const struct isakmp_gen *ext,
2375                 u_int item_len, const u_char *ep,
2376                 uint32_t phase _U_, uint32_t doi _U_,
2377                 uint32_t proto _U_, int depth _U_)
2378 {
2379         const struct ikev2_n *p;
2380         struct ikev2_n n;
2381         const u_char *cp;
2382         u_char showspi, showsomedata;
2383         const char *notify_name;
2384         uint32_t type;
2385
2386         p = (const struct ikev2_n *)ext;
2387         ND_TCHECK(*p);
2388         UNALIGNED_MEMCPY(&n, ext, sizeof(n));
2389         ikev2_pay_print(ndo, NPSTR(ISAKMP_NPTYPE_N), n.h.critical);
2390
2391         showspi = 1;
2392         showsomedata=0;
2393         notify_name=NULL;
2394
2395         ND_PRINT((ndo," prot_id=%s", PROTOIDSTR(n.prot_id)));
2396
2397         type = ntohs(n.type);
2398
2399         /* notify space is annoying sparse */
2400         switch(type) {
2401         case IV2_NOTIFY_UNSUPPORTED_CRITICAL_PAYLOAD:
2402                 notify_name = "unsupported_critical_payload";
2403                 showspi = 0;
2404                 break;
2405
2406         case IV2_NOTIFY_INVALID_IKE_SPI:
2407                 notify_name = "invalid_ike_spi";
2408                 showspi = 1;
2409                 break;
2410
2411         case IV2_NOTIFY_INVALID_MAJOR_VERSION:
2412                 notify_name = "invalid_major_version";
2413                 showspi = 0;
2414                 break;
2415
2416         case IV2_NOTIFY_INVALID_SYNTAX:
2417                 notify_name = "invalid_syntax";
2418                 showspi = 1;
2419                 break;
2420
2421         case IV2_NOTIFY_INVALID_MESSAGE_ID:
2422                 notify_name = "invalid_message_id";
2423                 showspi = 1;
2424                 break;
2425
2426         case IV2_NOTIFY_INVALID_SPI:
2427                 notify_name = "invalid_spi";
2428                 showspi = 1;
2429                 break;
2430
2431         case IV2_NOTIFY_NO_PROPOSAL_CHOSEN:
2432                 notify_name = "no_protocol_chosen";
2433                 showspi = 1;
2434                 break;
2435
2436         case IV2_NOTIFY_INVALID_KE_PAYLOAD:
2437                 notify_name = "invalid_ke_payload";
2438                 showspi = 1;
2439                 break;
2440
2441         case IV2_NOTIFY_AUTHENTICATION_FAILED:
2442                 notify_name = "authentication_failed";
2443                 showspi = 1;
2444                 break;
2445
2446         case IV2_NOTIFY_SINGLE_PAIR_REQUIRED:
2447                 notify_name = "single_pair_required";
2448                 showspi = 1;
2449                 break;
2450
2451         case IV2_NOTIFY_NO_ADDITIONAL_SAS:
2452                 notify_name = "no_additional_sas";
2453                 showspi = 0;
2454                 break;
2455
2456         case IV2_NOTIFY_INTERNAL_ADDRESS_FAILURE:
2457                 notify_name = "internal_address_failure";
2458                 showspi = 0;
2459                 break;
2460
2461         case IV2_NOTIFY_FAILED_CP_REQUIRED:
2462                 notify_name = "failed:cp_required";
2463                 showspi = 0;
2464                 break;
2465
2466         case IV2_NOTIFY_INVALID_SELECTORS:
2467                 notify_name = "invalid_selectors";
2468                 showspi = 0;
2469                 break;
2470
2471         case IV2_NOTIFY_INITIAL_CONTACT:
2472                 notify_name = "initial_contact";
2473                 showspi = 0;
2474                 break;
2475
2476         case IV2_NOTIFY_SET_WINDOW_SIZE:
2477                 notify_name = "set_window_size";
2478                 showspi = 0;
2479                 break;
2480
2481         case IV2_NOTIFY_ADDITIONAL_TS_POSSIBLE:
2482                 notify_name = "additional_ts_possible";
2483                 showspi = 0;
2484                 break;
2485
2486         case IV2_NOTIFY_IPCOMP_SUPPORTED:
2487                 notify_name = "ipcomp_supported";
2488                 showspi = 0;
2489                 break;
2490
2491         case IV2_NOTIFY_NAT_DETECTION_SOURCE_IP:
2492                 notify_name = "nat_detection_source_ip";
2493                 showspi = 1;
2494                 break;
2495
2496         case IV2_NOTIFY_NAT_DETECTION_DESTINATION_IP:
2497                 notify_name = "nat_detection_destination_ip";
2498                 showspi = 1;
2499                 break;
2500
2501         case IV2_NOTIFY_COOKIE:
2502                 notify_name = "cookie";
2503                 showspi = 1;
2504                 showsomedata= 1;
2505                 break;
2506
2507         case IV2_NOTIFY_USE_TRANSPORT_MODE:
2508                 notify_name = "use_transport_mode";
2509                 showspi = 0;
2510                 break;
2511
2512         case IV2_NOTIFY_HTTP_CERT_LOOKUP_SUPPORTED:
2513                 notify_name = "http_cert_lookup_supported";
2514                 showspi = 0;
2515                 break;
2516
2517         case IV2_NOTIFY_REKEY_SA:
2518                 notify_name = "rekey_sa";
2519                 showspi = 1;
2520                 break;
2521
2522         case IV2_NOTIFY_ESP_TFC_PADDING_NOT_SUPPORTED:
2523                 notify_name = "tfc_padding_not_supported";
2524                 showspi = 0;
2525                 break;
2526
2527         case IV2_NOTIFY_NON_FIRST_FRAGMENTS_ALSO:
2528                 notify_name = "non_first_fragment_also";
2529                 showspi = 0;
2530                 break;
2531
2532         default:
2533                 if (type < 8192) {
2534                         notify_name="error";
2535                 } else if(type < 16384) {
2536                         notify_name="private-error";
2537                 } else if(type < 40960) {
2538                         notify_name="status";
2539                 } else {
2540                         notify_name="private-status";
2541                 }
2542         }
2543
2544         if(notify_name) {
2545                 ND_PRINT((ndo," type=%u(%s)", type, notify_name));
2546         }
2547
2548
2549         if (showspi && n.spi_size) {
2550                 ND_PRINT((ndo," spi="));
2551                 if (!rawprint(ndo, (const uint8_t *)(p + 1), n.spi_size))
2552                         goto trunc;
2553         }
2554
2555         cp = (const u_char *)(p + 1) + n.spi_size;
2556
2557         if (cp < ep) {
2558                 if (ndo->ndo_vflag > 3 || (showsomedata && ep-cp < 30)) {
2559                         ND_PRINT((ndo," data=("));
2560                         if (!rawprint(ndo, (const uint8_t *)(cp), ep - cp))
2561                                 goto trunc;
2562
2563                         ND_PRINT((ndo,")"));
2564                 } else if (showsomedata) {
2565                         if (!ike_show_somedata(ndo, cp, ep))
2566                                 goto trunc;
2567                 }
2568         }
2569
2570         return (const u_char *)ext + item_len;
2571 trunc:
2572         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_N)));
2573         return NULL;
2574 }
2575
2576 static const u_char *
2577 ikev2_d_print(netdissect_options *ndo, u_char tpay,
2578                 const struct isakmp_gen *ext,
2579                 u_int item_len _U_, const u_char *ep _U_,
2580                 uint32_t phase _U_, uint32_t doi _U_,
2581                 uint32_t proto _U_, int depth _U_)
2582 {
2583         return ikev2_gen_print(ndo, tpay, ext);
2584 }
2585
2586 static const u_char *
2587 ikev2_vid_print(netdissect_options *ndo, u_char tpay,
2588                 const struct isakmp_gen *ext,
2589                 u_int item_len _U_, const u_char *ep _U_,
2590                 uint32_t phase _U_, uint32_t doi _U_,
2591                 uint32_t proto _U_, int depth _U_)
2592 {
2593         struct isakmp_gen e;
2594         const u_char *vid;
2595         int i, len;
2596
2597         ND_TCHECK(*ext);
2598         UNALIGNED_MEMCPY(&e, ext, sizeof(e));
2599         ikev2_pay_print(ndo, NPSTR(tpay), e.critical);
2600         ND_PRINT((ndo," len=%d vid=", ntohs(e.len) - 4));
2601
2602         vid = (const u_char *)(ext+1);
2603         len = ntohs(e.len) - 4;
2604         ND_TCHECK2(*vid, len);
2605         for(i=0; i<len; i++) {
2606                 if(ND_ISPRINT(vid[i])) ND_PRINT((ndo, "%c", vid[i]));
2607                 else ND_PRINT((ndo, "."));
2608         }
2609         if (2 < ndo->ndo_vflag && 4 < len) {
2610                 /* Print the entire payload in hex */
2611                 ND_PRINT((ndo," "));
2612                 if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4))
2613                         goto trunc;
2614         }
2615         return (const u_char *)ext + ntohs(e.len);
2616 trunc:
2617         ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
2618         return NULL;
2619 }
2620
2621 static const u_char *
2622 ikev2_TS_print(netdissect_options *ndo, u_char tpay,
2623                 const struct isakmp_gen *ext,
2624                 u_int item_len _U_, const u_char *ep _U_,
2625                 uint32_t phase _U_, uint32_t doi _U_,
2626                 uint32_t proto _U_, int depth _U_)
2627 {
2628         return ikev2_gen_print(ndo, tpay, ext);
2629 }
2630
2631 static const u_char *
2632 ikev2_e_print(netdissect_options *ndo,
2633 #ifndef HAVE_LIBCRYPTO
2634               _U_
2635 #endif
2636               struct isakmp *base,
2637               u_char tpay,
2638               const struct isakmp_gen *ext,
2639               u_int item_len _U_, const u_char *ep _U_,
2640 #ifndef HAVE_LIBCRYPTO
2641               _U_
2642 #endif
2643               uint32_t phase,
2644 #ifndef HAVE_LIBCRYPTO
2645               _U_
2646 #endif
2647               uint32_t doi,
2648 #ifndef HAVE_LIBCRYPTO
2649               _U_
2650 #endif
2651               uint32_t proto,
2652 #ifndef HAVE_LIBCRYPTO
2653               _U_
2654 #endif
2655               int depth)
2656 {
2657         struct isakmp_gen e;
2658         const u_char *dat;
2659         volatile int dlen;
2660
2661         ND_TCHECK(*ext);
2662         UNALIGNED_MEMCPY(&e, ext, sizeof(e));
2663         ikev2_pay_print(ndo, NPSTR(tpay), e.critical);
2664
2665         dlen = ntohs(e.len)-4;
2666
2667         ND_PRINT((ndo," len=%d", dlen));
2668         if (2 < ndo->ndo_vflag && 4 < dlen) {
2669                 ND_PRINT((ndo," "));
2670                 if (!rawprint(ndo, (const uint8_t *)(ext + 1), dlen))
2671                         goto trunc;
2672         }
2673
2674         dat = (const u_char *)(ext+1);
2675         ND_TCHECK2(*dat, dlen);
2676
2677 #ifdef HAVE_LIBCRYPTO
2678         /* try to decypt it! */
2679         if(esp_print_decrypt_buffer_by_ikev2(ndo,
2680                                              base->flags & ISAKMP_FLAG_I,
2681                                              base->i_ck, base->r_ck,
2682                                              dat, dat+dlen)) {
2683
2684                 ext = (const struct isakmp_gen *)ndo->ndo_packetp;
2685
2686                 /* got it decrypted, print stuff inside. */
2687                 ikev2_sub_print(ndo, base, e.np, ext, ndo->ndo_snapend,
2688                                 phase, doi, proto, depth+1);
2689         }
2690 #endif
2691
2692
2693         /* always return NULL, because E must be at end, and NP refers
2694          * to what was inside.
2695          */
2696         return NULL;
2697 trunc:
2698         ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
2699         return NULL;
2700 }
2701
2702 static const u_char *
2703 ikev2_cp_print(netdissect_options *ndo, u_char tpay,
2704                 const struct isakmp_gen *ext,
2705                 u_int item_len _U_, const u_char *ep _U_,
2706                 uint32_t phase _U_, uint32_t doi _U_,
2707                 uint32_t proto _U_, int depth _U_)
2708 {
2709         return ikev2_gen_print(ndo, tpay, ext);
2710 }
2711
2712 static const u_char *
2713 ikev2_eap_print(netdissect_options *ndo, u_char tpay,
2714                 const struct isakmp_gen *ext,
2715                 u_int item_len _U_, const u_char *ep _U_,
2716                 uint32_t phase _U_, uint32_t doi _U_,
2717                 uint32_t proto _U_, int depth _U_)
2718 {
2719         return ikev2_gen_print(ndo, tpay, ext);
2720 }
2721
2722 static const u_char *
2723 ike_sub0_print(netdissect_options *ndo,
2724                  u_char np, const struct isakmp_gen *ext, const u_char *ep,
2725
2726                uint32_t phase, uint32_t doi, uint32_t proto, int depth)
2727 {
2728         const u_char *cp;
2729         struct isakmp_gen e;
2730         u_int item_len;
2731
2732         cp = (const u_char *)ext;
2733         ND_TCHECK(*ext);
2734         UNALIGNED_MEMCPY(&e, ext, sizeof(e));
2735
2736         /*
2737          * Since we can't have a payload length of less than 4 bytes,
2738          * we need to bail out here if the generic header is nonsensical
2739          * or truncated, otherwise we could loop forever processing
2740          * zero-length items or otherwise misdissect the packet.
2741          */
2742         item_len = ntohs(e.len);
2743         if (item_len <= 4)
2744                 return NULL;
2745
2746         if (NPFUNC(np)) {
2747                 /*
2748                  * XXX - what if item_len is too short, or too long,
2749                  * for this payload type?
2750                  */
2751                 cp = (*npfunc[np])(ndo, np, ext, item_len, ep, phase, doi, proto, depth);
2752         } else {
2753                 ND_PRINT((ndo,"%s", NPSTR(np)));
2754                 cp += item_len;
2755         }
2756
2757         return cp;
2758 trunc:
2759         ND_PRINT((ndo," [|isakmp]"));
2760         return NULL;
2761 }
2762
2763 static const u_char *
2764 ikev1_sub_print(netdissect_options *ndo,
2765                 u_char np, const struct isakmp_gen *ext, const u_char *ep,
2766                 uint32_t phase, uint32_t doi, uint32_t proto, int depth)
2767 {
2768         const u_char *cp;
2769         int i;
2770         struct isakmp_gen e;
2771
2772         cp = (const u_char *)ext;
2773
2774         while (np) {
2775                 ND_TCHECK(*ext);
2776                 UNALIGNED_MEMCPY(&e, ext, sizeof(e));
2777
2778                 ND_TCHECK2(*ext, ntohs(e.len));
2779
2780                 depth++;
2781                 ND_PRINT((ndo,"\n"));
2782                 for (i = 0; i < depth; i++)
2783                         ND_PRINT((ndo,"    "));
2784                 ND_PRINT((ndo,"("));
2785                 cp = ike_sub0_print(ndo, np, ext, ep, phase, doi, proto, depth);
2786                 ND_PRINT((ndo,")"));
2787                 depth--;
2788
2789                 if (cp == NULL) {
2790                         /* Zero-length subitem */
2791                         return NULL;
2792                 }
2793
2794                 np = e.np;
2795                 ext = (const struct isakmp_gen *)cp;
2796         }
2797         return cp;
2798 trunc:
2799         ND_PRINT((ndo," [|%s]", NPSTR(np)));
2800         return NULL;
2801 }
2802
2803 static char *
2804 numstr(int x)
2805 {
2806         static char buf[20];
2807         snprintf(buf, sizeof(buf), "#%d", x);
2808         return buf;
2809 }
2810
2811 static void
2812 ikev1_print(netdissect_options *ndo,
2813             const u_char *bp,  u_int length,
2814             const u_char *bp2, struct isakmp *base)
2815 {
2816         const struct isakmp *p;
2817         const u_char *ep;
2818         u_char np;
2819         int i;
2820         int phase;
2821
2822         p = (const struct isakmp *)bp;
2823         ep = ndo->ndo_snapend;
2824
2825         phase = (EXTRACT_32BITS(base->msgid) == 0) ? 1 : 2;
2826         if (phase == 1)
2827                 ND_PRINT((ndo," phase %d", phase));
2828         else
2829                 ND_PRINT((ndo," phase %d/others", phase));
2830
2831         i = cookie_find(&base->i_ck);
2832         if (i < 0) {
2833                 if (iszero((const u_char *)&base->r_ck, sizeof(base->r_ck))) {
2834                         /* the first packet */
2835                         ND_PRINT((ndo," I"));
2836                         if (bp2)
2837                                 cookie_record(&base->i_ck, bp2);
2838                 } else
2839                         ND_PRINT((ndo," ?"));
2840         } else {
2841                 if (bp2 && cookie_isinitiator(i, bp2))
2842                         ND_PRINT((ndo," I"));
2843                 else if (bp2 && cookie_isresponder(i, bp2))
2844                         ND_PRINT((ndo," R"));
2845                 else
2846                         ND_PRINT((ndo," ?"));
2847         }
2848
2849         ND_PRINT((ndo," %s", ETYPESTR(base->etype)));
2850         if (base->flags) {
2851                 ND_PRINT((ndo,"[%s%s]", base->flags & ISAKMP_FLAG_E ? "E" : "",
2852                           base->flags & ISAKMP_FLAG_C ? "C" : ""));
2853         }
2854
2855         if (ndo->ndo_vflag) {
2856                 const struct isakmp_gen *ext;
2857
2858                 ND_PRINT((ndo,":"));
2859
2860                 /* regardless of phase... */
2861                 if (base->flags & ISAKMP_FLAG_E) {
2862                         /*
2863                          * encrypted, nothing we can do right now.
2864                          * we hope to decrypt the packet in the future...
2865                          */
2866                         ND_PRINT((ndo," [encrypted %s]", NPSTR(base->np)));
2867                         goto done;
2868                 }
2869
2870                 CHECKLEN(p + 1, base->np);
2871                 np = base->np;
2872                 ext = (const struct isakmp_gen *)(p + 1);
2873                 ikev1_sub_print(ndo, np, ext, ep, phase, 0, 0, 0);
2874         }
2875
2876 done:
2877         if (ndo->ndo_vflag) {
2878                 if (ntohl(base->len) != length) {
2879                         ND_PRINT((ndo," (len mismatch: isakmp %u/ip %u)",
2880                                   (uint32_t)ntohl(base->len), length));
2881                 }
2882         }
2883 }
2884
2885 static const u_char *
2886 ikev2_sub0_print(netdissect_options *ndo, struct isakmp *base,
2887                  u_char np,
2888                  const struct isakmp_gen *ext, const u_char *ep,
2889                  uint32_t phase, uint32_t doi, uint32_t proto, int depth)
2890 {
2891         const u_char *cp;
2892         struct isakmp_gen e;
2893         u_int item_len;
2894
2895         cp = (const u_char *)ext;
2896         ND_TCHECK(*ext);
2897         UNALIGNED_MEMCPY(&e, ext, sizeof(e));
2898
2899         /*
2900          * Since we can't have a payload length of less than 4 bytes,
2901          * we need to bail out here if the generic header is nonsensical
2902          * or truncated, otherwise we could loop forever processing
2903          * zero-length items or otherwise misdissect the packet.
2904          */
2905         item_len = ntohs(e.len);
2906         if (item_len <= 4)
2907                 return NULL;
2908
2909         if (np == ISAKMP_NPTYPE_v2E) {
2910                 cp = ikev2_e_print(ndo, base, np, ext, item_len,
2911                                    ep, phase, doi, proto, depth);
2912         } else if (NPFUNC(np)) {
2913                 /*
2914                  * XXX - what if item_len is too short, or too long,
2915                  * for this payload type?
2916                  */
2917                 cp = (*npfunc[np])(ndo, np, ext, item_len,
2918                                    ep, phase, doi, proto, depth);
2919         } else {
2920                 ND_PRINT((ndo,"%s", NPSTR(np)));
2921                 cp += item_len;
2922         }
2923
2924         return cp;
2925 trunc:
2926         ND_PRINT((ndo," [|isakmp]"));
2927         return NULL;
2928 }
2929
2930 static const u_char *
2931 ikev2_sub_print(netdissect_options *ndo,
2932                 struct isakmp *base,
2933                 u_char np, const struct isakmp_gen *ext, const u_char *ep,
2934                 uint32_t phase, uint32_t doi, uint32_t proto, int depth)
2935 {
2936         const u_char *cp;
2937         int i;
2938         struct isakmp_gen e;
2939
2940         cp = (const u_char *)ext;
2941         while (np) {
2942                 ND_TCHECK(*ext);
2943                 UNALIGNED_MEMCPY(&e, ext, sizeof(e));
2944
2945                 ND_TCHECK2(*ext, ntohs(e.len));
2946
2947                 depth++;
2948                 ND_PRINT((ndo,"\n"));
2949                 for (i = 0; i < depth; i++)
2950                         ND_PRINT((ndo,"    "));
2951                 ND_PRINT((ndo,"("));
2952                 cp = ikev2_sub0_print(ndo, base, np,
2953                                       ext, ep, phase, doi, proto, depth);
2954                 ND_PRINT((ndo,")"));
2955                 depth--;
2956
2957                 if (cp == NULL) {
2958                         /* Zero-length subitem */
2959                         return NULL;
2960                 }
2961
2962                 np = e.np;
2963                 ext = (const struct isakmp_gen *)cp;
2964         }
2965         return cp;
2966 trunc:
2967         ND_PRINT((ndo," [|%s]", NPSTR(np)));
2968         return NULL;
2969 }
2970
2971 static void
2972 ikev2_print(netdissect_options *ndo,
2973             const u_char *bp,  u_int length,
2974             const u_char *bp2 _U_, struct isakmp *base)
2975 {
2976         const struct isakmp *p;
2977         const u_char *ep;
2978         u_char np;
2979         int phase;
2980
2981         p = (const struct isakmp *)bp;
2982         ep = ndo->ndo_snapend;
2983
2984         phase = (EXTRACT_32BITS(base->msgid) == 0) ? 1 : 2;
2985         if (phase == 1)
2986                 ND_PRINT((ndo, " parent_sa"));
2987         else
2988                 ND_PRINT((ndo, " child_sa "));
2989
2990         ND_PRINT((ndo, " %s", ETYPESTR(base->etype)));
2991         if (base->flags) {
2992                 ND_PRINT((ndo, "[%s%s%s]",
2993                           base->flags & ISAKMP_FLAG_I ? "I" : "",
2994                           base->flags & ISAKMP_FLAG_V ? "V" : "",
2995                           base->flags & ISAKMP_FLAG_R ? "R" : ""));
2996         }
2997
2998         if (ndo->ndo_vflag) {
2999                 const struct isakmp_gen *ext;
3000
3001                 ND_PRINT((ndo, ":"));
3002
3003                 /* regardless of phase... */
3004                 if (base->flags & ISAKMP_FLAG_E) {
3005                         /*
3006                          * encrypted, nothing we can do right now.
3007                          * we hope to decrypt the packet in the future...
3008                          */
3009                         ND_PRINT((ndo, " [encrypted %s]", NPSTR(base->np)));
3010                         goto done;
3011                 }
3012
3013                 CHECKLEN(p + 1, base->np)
3014
3015                 np = base->np;
3016                 ext = (const struct isakmp_gen *)(p + 1);
3017                 ikev2_sub_print(ndo, base, np, ext, ep, phase, 0, 0, 0);
3018         }
3019
3020 done:
3021         if (ndo->ndo_vflag) {
3022                 if (ntohl(base->len) != length) {
3023                         ND_PRINT((ndo, " (len mismatch: isakmp %u/ip %u)",
3024                                   (uint32_t)ntohl(base->len), length));
3025                 }
3026         }
3027 }
3028
3029 void
3030 isakmp_print(netdissect_options *ndo,
3031              const u_char *bp, u_int length,
3032              const u_char *bp2)
3033 {
3034         const struct isakmp *p;
3035         struct isakmp base;
3036         const u_char *ep;
3037         int major, minor;
3038
3039 #ifdef HAVE_LIBCRYPTO
3040         /* initialize SAs */
3041         if (ndo->ndo_sa_list_head == NULL) {
3042                 if (ndo->ndo_espsecret)
3043                         esp_print_decodesecret(ndo);
3044         }
3045 #endif
3046
3047         p = (const struct isakmp *)bp;
3048         ep = ndo->ndo_snapend;
3049
3050         if ((const struct isakmp *)ep < p + 1) {
3051                 ND_PRINT((ndo,"[|isakmp]"));
3052                 return;
3053         }
3054
3055         UNALIGNED_MEMCPY(&base, p, sizeof(base));
3056
3057         ND_PRINT((ndo,"isakmp"));
3058         major = (base.vers & ISAKMP_VERS_MAJOR)
3059                 >> ISAKMP_VERS_MAJOR_SHIFT;
3060         minor = (base.vers & ISAKMP_VERS_MINOR)
3061                 >> ISAKMP_VERS_MINOR_SHIFT;
3062
3063         if (ndo->ndo_vflag) {
3064                 ND_PRINT((ndo," %d.%d", major, minor));
3065         }
3066
3067         if (ndo->ndo_vflag) {
3068                 ND_PRINT((ndo," msgid "));
3069                 hexprint(ndo, (const uint8_t *)&base.msgid, sizeof(base.msgid));
3070         }
3071
3072         if (1 < ndo->ndo_vflag) {
3073                 ND_PRINT((ndo," cookie "));
3074                 hexprint(ndo, (const uint8_t *)&base.i_ck, sizeof(base.i_ck));
3075                 ND_PRINT((ndo,"->"));
3076                 hexprint(ndo, (const uint8_t *)&base.r_ck, sizeof(base.r_ck));
3077         }
3078         ND_PRINT((ndo,":"));
3079
3080         switch(major) {
3081         case IKEv1_MAJOR_VERSION:
3082                 ikev1_print(ndo, bp, length, bp2, &base);
3083                 break;
3084
3085         case IKEv2_MAJOR_VERSION:
3086                 ikev2_print(ndo, bp, length, bp2, &base);
3087                 break;
3088         }
3089 }
3090
3091 void
3092 isakmp_rfc3948_print(netdissect_options *ndo,
3093                      const u_char *bp, u_int length,
3094                      const u_char *bp2)
3095 {
3096         ND_TCHECK(bp[0]);
3097         if(length == 1 && bp[0]==0xff) {
3098                 ND_PRINT((ndo, "isakmp-nat-keep-alive"));
3099                 return;
3100         }
3101
3102         if(length < 4) {
3103                 goto trunc;
3104         }
3105         ND_TCHECK(bp[3]);
3106
3107         /*
3108          * see if this is an IKE packet
3109          */
3110         if(bp[0]==0 && bp[1]==0 && bp[2]==0 && bp[3]==0) {
3111                 ND_PRINT((ndo, "NONESP-encap: "));
3112                 isakmp_print(ndo, bp+4, length-4, bp2);
3113                 return;
3114         }
3115
3116         /* must be an ESP packet */
3117         {
3118                 int nh, enh, padlen;
3119                 int advance;
3120
3121                 ND_PRINT((ndo, "UDP-encap: "));
3122
3123                 advance = esp_print(ndo, bp, length, bp2, &enh, &padlen);
3124                 if(advance <= 0)
3125                         return;
3126
3127                 bp += advance;
3128                 length -= advance + padlen;
3129                 nh = enh & 0xff;
3130
3131                 ip_print_inner(ndo, bp, length, nh, bp2);
3132                 return;
3133         }
3134
3135 trunc:
3136         ND_PRINT((ndo,"[|isakmp]"));
3137         return;
3138 }
3139
3140 /*
3141  * Local Variables:
3142  * c-style: whitesmith
3143  * c-basic-offset: 8
3144  * End:
3145  */