contrib/tcpdump/print-isakmp.c

   1 /*
   2  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  * 3. Neither the name of the project nor the names of its contributors
  14  *    may be used to endorse or promote products derived from this software
  15  *    without specific prior written permission.
  16  *
  17  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  27  * SUCH DAMAGE.
  28  *
  29  */
  30
  31 /* \summary: Internet Security Association and Key Management Protocol (ISAKMP) printer */
  32
  33 #ifdef HAVE_CONFIG_H
  34 #include "config.h"
  35 #endif
  36
  37 /* The functions from print-esp.c used in this file are only defined when both
  38  * OpenSSL and evp.h are detected. Employ the same preprocessor device here.
  39  */
  40 #ifndef HAVE_OPENSSL_EVP_H
  41 #undef HAVE_LIBCRYPTO
  42 #endif
  43
  44 #include <netdissect-stdinc.h>
  45
  46 #include <string.h>
  47
  48 #include "netdissect.h"
  49 #include "addrtoname.h"
  50 #include "extract.h"
  51
  52 #include "ip.h"
  53 #include "ip6.h"
  54
  55 /* refer to RFC 2408 */
  56
  57 typedef u_char cookie_t[8];
  58 typedef u_char msgid_t[4];
  59
  60 #define PORT_ISAKMP 500
  61
  62 /* 3.1 ISAKMP Header Format (IKEv1 and IKEv2)
  63          0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
  64         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  65         !                          Initiator                            !
  66         !                            Cookie                             !
  67         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  68         !                          Responder                            !
  69         !                            Cookie                             !
  70         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  71         !  Next Payload ! MjVer ! MnVer ! Exchange Type !     Flags     !
  72         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  73         !                          Message ID                           !
  74         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  75         !                            Length                             !
  76         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  77 */
  78 struct isakmp {
  79         cookie_t i_ck;          /* Initiator Cookie */
  80         cookie_t r_ck;          /* Responder Cookie */
  81         uint8_t np;             /* Next Payload Type */
  82         uint8_t vers;
  83 #define ISAKMP_VERS_MAJOR       0xf0
  84 #define ISAKMP_VERS_MAJOR_SHIFT 4
  85 #define ISAKMP_VERS_MINOR       0x0f
  86 #define ISAKMP_VERS_MINOR_SHIFT 0
  87         uint8_t etype;          /* Exchange Type */
  88         uint8_t flags;          /* Flags */
  89         msgid_t msgid;
  90         uint32_t len;           /* Length */
  91 };
  92
  93 /* Next Payload Type */
  94 #define ISAKMP_NPTYPE_NONE   0 /* NONE*/
  95 #define ISAKMP_NPTYPE_SA     1 /* Security Association */
  96 #define ISAKMP_NPTYPE_P      2 /* Proposal */
  97 #define ISAKMP_NPTYPE_T      3 /* Transform */
  98 #define ISAKMP_NPTYPE_KE     4 /* Key Exchange */
  99 #define ISAKMP_NPTYPE_ID     5 /* Identification */
 100 #define ISAKMP_NPTYPE_CERT   6 /* Certificate */
 101 #define ISAKMP_NPTYPE_CR     7 /* Certificate Request */
 102 #define ISAKMP_NPTYPE_HASH   8 /* Hash */
 103 #define ISAKMP_NPTYPE_SIG    9 /* Signature */
 104 #define ISAKMP_NPTYPE_NONCE 10 /* Nonce */
 105 #define ISAKMP_NPTYPE_N     11 /* Notification */
 106 #define ISAKMP_NPTYPE_D     12 /* Delete */
 107 #define ISAKMP_NPTYPE_VID   13 /* Vendor ID */
 108 #define ISAKMP_NPTYPE_v2E   46 /* v2 Encrypted payload */
 109
 110 #define IKEv1_MAJOR_VERSION  1
 111 #define IKEv1_MINOR_VERSION  0
 112
 113 #define IKEv2_MAJOR_VERSION  2
 114 #define IKEv2_MINOR_VERSION  0
 115
 116 /* Flags */
 117 #define ISAKMP_FLAG_E 0x01 /* Encryption Bit */
 118 #define ISAKMP_FLAG_C 0x02 /* Commit Bit */
 119 #define ISAKMP_FLAG_extra 0x04
 120
 121 /* IKEv2 */
 122 #define ISAKMP_FLAG_I (1 << 3)  /* (I)nitiator */
 123 #define ISAKMP_FLAG_V (1 << 4)  /* (V)ersion   */
 124 #define ISAKMP_FLAG_R (1 << 5)  /* (R)esponse  */
 125
 126
 127 /* 3.2 Payload Generic Header
 128          0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 129         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 130         ! Next Payload  !   RESERVED    !         Payload Length        !
 131         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 132 */
 133 struct isakmp_gen {
 134         uint8_t  np;       /* Next Payload */
 135         uint8_t  critical; /* bit 7 - critical, rest is RESERVED */
 136         uint16_t len;      /* Payload Length */
 137 };
 138
 139 /* 3.3 Data Attributes
 140          0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 141         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 142         !A!       Attribute Type        !    AF=0  Attribute Length     !
 143         !F!                             !    AF=1  Attribute Value      !
 144         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 145         .                   AF=0  Attribute Value                       .
 146         .                   AF=1  Not Transmitted                       .
 147         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 148 */
 149 struct isakmp_data {
 150         uint16_t type;     /* defined by DOI-spec, and Attribute Format */
 151         uint16_t lorv;     /* if f equal 1, Attribute Length */
 152                           /* if f equal 0, Attribute Value */
 153         /* if f equal 1, Attribute Value */
 154 };
 155
 156 /* 3.4 Security Association Payload */
 157         /* MAY NOT be used, because of being defined in ipsec-doi. */
 158         /*
 159         If the current payload is the last in the message,
 160         then the value of the next payload field will be 0.
 161         This field MUST NOT contain the
 162         values for the Proposal or Transform payloads as they are considered
 163         part of the security association negotiation.  For example, this
 164         field would contain the value "10" (Nonce payload) in the first
 165         message of a Base Exchange (see Section 4.4) and the value "0" in the
 166         first message of an Identity Protect Exchange (see Section 4.5).
 167         */
 168 struct ikev1_pl_sa {
 169         struct isakmp_gen h;
 170         uint32_t doi; /* Domain of Interpretation */
 171         uint32_t sit; /* Situation */
 172 };
 173
 174 /* 3.5 Proposal Payload */
 175         /*
 176         The value of the next payload field MUST only contain the value "2"
 177         or "0".  If there are additional Proposal payloads in the message,
 178         then this field will be 2.  If the current Proposal payload is the
 179         last within the security association proposal, then this field will
 180         be 0.
 181         */
 182 struct ikev1_pl_p {
 183         struct isakmp_gen h;
 184         uint8_t p_no;      /* Proposal # */
 185         uint8_t prot_id;   /* Protocol */
 186         uint8_t spi_size;  /* SPI Size */
 187         uint8_t num_t;     /* Number of Transforms */
 188         /* SPI */
 189 };
 190
 191 /* 3.6 Transform Payload */
 192         /*
 193         The value of the next payload field MUST only contain the value "3"
 194         or "0".  If there are additional Transform payloads in the proposal,
 195         then this field will be 3.  If the current Transform payload is the
 196         last within the proposal, then this field will be 0.
 197         */
 198 struct ikev1_pl_t {
 199         struct isakmp_gen h;
 200         uint8_t  t_no;     /* Transform # */
 201         uint8_t  t_id;     /* Transform-Id */
 202         uint16_t reserved; /* RESERVED2 */
 203         /* SA Attributes */
 204 };
 205
 206 /* 3.7 Key Exchange Payload */
 207 struct ikev1_pl_ke {
 208         struct isakmp_gen h;
 209         /* Key Exchange Data */
 210 };
 211
 212 /* 3.8 Identification Payload */
 213         /* MUST NOT to be used, because of being defined in ipsec-doi. */
 214 struct ikev1_pl_id {
 215         struct isakmp_gen h;
 216         union {
 217                 uint8_t  id_type;   /* ID Type */
 218                 uint32_t doi_data;  /* DOI Specific ID Data */
 219         } d;
 220         /* Identification Data */
 221 };
 222
 223 /* 3.9 Certificate Payload */
 224 struct ikev1_pl_cert {
 225         struct isakmp_gen h;
 226         uint8_t encode; /* Cert Encoding */
 227         char   cert;   /* Certificate Data */
 228                 /*
 229                 This field indicates the type of
 230                 certificate or certificate-related information contained in the
 231                 Certificate Data field.
 232                 */
 233 };
 234
 235 /* 3.10 Certificate Request Payload */
 236 struct ikev1_pl_cr {
 237         struct isakmp_gen h;
 238         uint8_t num_cert; /* # Cert. Types */
 239         /*
 240         Certificate Types (variable length)
 241           -- Contains a list of the types of certificates requested,
 242           sorted in order of preference.  Each individual certificate
 243           type is 1 octet.  This field is NOT requiredo
 244         */
 245         /* # Certificate Authorities (1 octet) */
 246         /* Certificate Authorities (variable length) */
 247 };
 248
 249 /* 3.11 Hash Payload */
 250         /* may not be used, because of having only data. */
 251 struct ikev1_pl_hash {
 252         struct isakmp_gen h;
 253         /* Hash Data */
 254 };
 255
 256 /* 3.12 Signature Payload */
 257         /* may not be used, because of having only data. */
 258 struct ikev1_pl_sig {
 259         struct isakmp_gen h;
 260         /* Signature Data */
 261 };
 262
 263 /* 3.13 Nonce Payload */
 264         /* may not be used, because of having only data. */
 265 struct ikev1_pl_nonce {
 266         struct isakmp_gen h;
 267         /* Nonce Data */
 268 };
 269
 270 /* 3.14 Notification Payload */
 271 struct ikev1_pl_n {
 272         struct isakmp_gen h;
 273         uint32_t doi;      /* Domain of Interpretation */
 274         uint8_t  prot_id;  /* Protocol-ID */
 275         uint8_t  spi_size; /* SPI Size */
 276         uint16_t type;     /* Notify Message Type */
 277         /* SPI */
 278         /* Notification Data */
 279 };
 280
 281 /* 3.14.1 Notify Message Types */
 282 /* NOTIFY MESSAGES - ERROR TYPES */
 283 #define ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE           1
 284 #define ISAKMP_NTYPE_DOI_NOT_SUPPORTED              2
 285 #define ISAKMP_NTYPE_SITUATION_NOT_SUPPORTED        3
 286 #define ISAKMP_NTYPE_INVALID_COOKIE                 4
 287 #define ISAKMP_NTYPE_INVALID_MAJOR_VERSION          5
 288 #define ISAKMP_NTYPE_INVALID_MINOR_VERSION          6
 289 #define ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE          7
 290 #define ISAKMP_NTYPE_INVALID_FLAGS                  8
 291 #define ISAKMP_NTYPE_INVALID_MESSAGE_ID             9
 292 #define ISAKMP_NTYPE_INVALID_PROTOCOL_ID            10
 293 #define ISAKMP_NTYPE_INVALID_SPI                    11
 294 #define ISAKMP_NTYPE_INVALID_TRANSFORM_ID           12
 295 #define ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED       13
 296 #define ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN             14
 297 #define ISAKMP_NTYPE_BAD_PROPOSAL_SYNTAX            15
 298 #define ISAKMP_NTYPE_PAYLOAD_MALFORMED              16
 299 #define ISAKMP_NTYPE_INVALID_KEY_INFORMATION        17
 300 #define ISAKMP_NTYPE_INVALID_ID_INFORMATION         18
 301 #define ISAKMP_NTYPE_INVALID_CERT_ENCODING          19
 302 #define ISAKMP_NTYPE_INVALID_CERTIFICATE            20
 303 #define ISAKMP_NTYPE_BAD_CERT_REQUEST_SYNTAX        21
 304 #define ISAKMP_NTYPE_INVALID_CERT_AUTHORITY         22
 305 #define ISAKMP_NTYPE_INVALID_HASH_INFORMATION       23
 306 #define ISAKMP_NTYPE_AUTHENTICATION_FAILED          24
 307 #define ISAKMP_NTYPE_INVALID_SIGNATURE              25
 308 #define ISAKMP_NTYPE_ADDRESS_NOTIFICATION           26
 309
 310 /* 3.15 Delete Payload */
 311 struct ikev1_pl_d {
 312         struct isakmp_gen h;
 313         uint32_t doi;      /* Domain of Interpretation */
 314         uint8_t  prot_id;  /* Protocol-Id */
 315         uint8_t  spi_size; /* SPI Size */
 316         uint16_t num_spi;  /* # of SPIs */
 317         /* SPI(es) */
 318 };
 319
 320 struct ikev1_ph1tab {
 321         struct ikev1_ph1 *head;
 322         struct ikev1_ph1 *tail;
 323         int len;
 324 };
 325
 326 struct isakmp_ph2tab {
 327         struct ikev1_ph2 *head;
 328         struct ikev1_ph2 *tail;
 329         int len;
 330 };
 331
 332 /* IKEv2 (RFC4306) */
 333
 334 /* 3.3  Security Association Payload -- generic header */
 335 /* 3.3.1.  Proposal Substructure */
 336 struct ikev2_p {
 337         struct isakmp_gen h;
 338         uint8_t p_no;      /* Proposal # */
 339         uint8_t prot_id;   /* Protocol */
 340         uint8_t spi_size;  /* SPI Size */
 341         uint8_t num_t;     /* Number of Transforms */
 342 };
 343
 344 /* 3.3.2.  Transform Substructure */
 345 struct ikev2_t {
 346         struct isakmp_gen h;
 347         uint8_t t_type;    /* Transform Type (ENCR,PRF,INTEG,etc.*/
 348         uint8_t res2;      /* reserved byte */
 349         uint16_t t_id;     /* Transform ID */
 350 };
 351
 352 enum ikev2_t_type {
 353         IV2_T_ENCR = 1,
 354         IV2_T_PRF  = 2,
 355         IV2_T_INTEG= 3,
 356         IV2_T_DH   = 4,
 357         IV2_T_ESN  = 5
 358 };
 359
 360 /* 3.4.  Key Exchange Payload */
 361 struct ikev2_ke {
 362         struct isakmp_gen h;
 363         uint16_t  ke_group;
 364         uint16_t  ke_res1;
 365         /* KE data */
 366 };
 367
 368
 369 /* 3.5.  Identification Payloads */
 370 enum ikev2_id_type {
 371         ID_IPV4_ADDR=1,
 372         ID_FQDN=2,
 373         ID_RFC822_ADDR=3,
 374         ID_IPV6_ADDR=5,
 375         ID_DER_ASN1_DN=9,
 376         ID_DER_ASN1_GN=10,
 377         ID_KEY_ID=11
 378 };
 379 struct ikev2_id {
 380         struct isakmp_gen h;
 381         uint8_t  type;        /* ID type */
 382         uint8_t  res1;
 383         uint16_t res2;
 384         /* SPI */
 385         /* Notification Data */
 386 };
 387
 388 /* 3.10 Notification Payload */
 389 struct ikev2_n {
 390         struct isakmp_gen h;
 391         uint8_t  prot_id;  /* Protocol-ID */
 392         uint8_t  spi_size; /* SPI Size */
 393         uint16_t type;     /* Notify Message Type */
 394 };
 395
 396 enum ikev2_n_type {
 397         IV2_NOTIFY_UNSUPPORTED_CRITICAL_PAYLOAD            = 1,
 398         IV2_NOTIFY_INVALID_IKE_SPI                         = 4,
 399         IV2_NOTIFY_INVALID_MAJOR_VERSION                   = 5,
 400         IV2_NOTIFY_INVALID_SYNTAX                          = 7,
 401         IV2_NOTIFY_INVALID_MESSAGE_ID                      = 9,
 402         IV2_NOTIFY_INVALID_SPI                             =11,
 403         IV2_NOTIFY_NO_PROPOSAL_CHOSEN                      =14,
 404         IV2_NOTIFY_INVALID_KE_PAYLOAD                      =17,
 405         IV2_NOTIFY_AUTHENTICATION_FAILED                   =24,
 406         IV2_NOTIFY_SINGLE_PAIR_REQUIRED                    =34,
 407         IV2_NOTIFY_NO_ADDITIONAL_SAS                       =35,
 408         IV2_NOTIFY_INTERNAL_ADDRESS_FAILURE                =36,
 409         IV2_NOTIFY_FAILED_CP_REQUIRED                      =37,
 410         IV2_NOTIFY_INVALID_SELECTORS                       =39,
 411         IV2_NOTIFY_INITIAL_CONTACT                         =16384,
 412         IV2_NOTIFY_SET_WINDOW_SIZE                         =16385,
 413         IV2_NOTIFY_ADDITIONAL_TS_POSSIBLE                  =16386,
 414         IV2_NOTIFY_IPCOMP_SUPPORTED                        =16387,
 415         IV2_NOTIFY_NAT_DETECTION_SOURCE_IP                 =16388,
 416         IV2_NOTIFY_NAT_DETECTION_DESTINATION_IP            =16389,
 417         IV2_NOTIFY_COOKIE                                  =16390,
 418         IV2_NOTIFY_USE_TRANSPORT_MODE                      =16391,
 419         IV2_NOTIFY_HTTP_CERT_LOOKUP_SUPPORTED              =16392,
 420         IV2_NOTIFY_REKEY_SA                                =16393,
 421         IV2_NOTIFY_ESP_TFC_PADDING_NOT_SUPPORTED           =16394,
 422         IV2_NOTIFY_NON_FIRST_FRAGMENTS_ALSO                =16395
 423 };
 424
 425 struct notify_messages {
 426         uint16_t type;
 427         char     *msg;
 428 };
 429
 430 /* 3.8 Notification Payload */
 431 struct ikev2_auth {
 432         struct isakmp_gen h;
 433         uint8_t  auth_method;  /* Protocol-ID */
 434         uint8_t  reserved[3];
 435         /* authentication data */
 436 };
 437
 438 enum ikev2_auth_type {
 439         IV2_RSA_SIG = 1,
 440         IV2_SHARED  = 2,
 441         IV2_DSS_SIG = 3
 442 };
 443
 444 /* refer to RFC 2409 */
 445
 446 #if 0
 447 /* isakmp sa structure */
 448 struct oakley_sa {
 449         uint8_t  proto_id;            /* OAKLEY */
 450         vchar_t   *spi;                /* spi */
 451         uint8_t  dhgrp;               /* DH; group */
 452         uint8_t  auth_t;              /* method of authentication */
 453         uint8_t  prf_t;               /* type of prf */
 454         uint8_t  hash_t;              /* type of hash */
 455         uint8_t  enc_t;               /* type of cipher */
 456         uint8_t  life_t;              /* type of duration of lifetime */
 457         uint32_t ldur;                /* life duration */
 458 };
 459 #endif
 460
 461 /* refer to RFC 2407 */
 462
 463 #define IPSEC_DOI 1
 464
 465 /* 4.2 IPSEC Situation Definition */
 466 #define IPSECDOI_SIT_IDENTITY_ONLY           0x00000001
 467 #define IPSECDOI_SIT_SECRECY                 0x00000002
 468 #define IPSECDOI_SIT_INTEGRITY               0x00000004
 469
 470 /* 4.4.1 IPSEC Security Protocol Identifiers */
 471   /* 4.4.2 IPSEC ISAKMP Transform Values */
 472 #define IPSECDOI_PROTO_ISAKMP                        1
 473 #define   IPSECDOI_KEY_IKE                             1
 474
 475 /* 4.4.1 IPSEC Security Protocol Identifiers */
 476 #define IPSECDOI_PROTO_IPSEC_AH                      2
 477   /* 4.4.3 IPSEC AH Transform Values */
 478 #define   IPSECDOI_AH_MD5                              2
 479 #define   IPSECDOI_AH_SHA                              3
 480 #define   IPSECDOI_AH_DES                              4
 481 #define   IPSECDOI_AH_SHA2_256                         5
 482 #define   IPSECDOI_AH_SHA2_384                         6
 483 #define   IPSECDOI_AH_SHA2_512                         7
 484
 485 /* 4.4.1 IPSEC Security Protocol Identifiers */
 486 #define IPSECDOI_PROTO_IPSEC_ESP                     3
 487   /* 4.4.4 IPSEC ESP Transform Identifiers */
 488 #define   IPSECDOI_ESP_DES_IV64                        1
 489 #define   IPSECDOI_ESP_DES                             2
 490 #define   IPSECDOI_ESP_3DES                            3
 491 #define   IPSECDOI_ESP_RC5                             4
 492 #define   IPSECDOI_ESP_IDEA                            5
 493 #define   IPSECDOI_ESP_CAST                            6
 494 #define   IPSECDOI_ESP_BLOWFISH                        7
 495 #define   IPSECDOI_ESP_3IDEA                           8
 496 #define   IPSECDOI_ESP_DES_IV32                        9
 497 #define   IPSECDOI_ESP_RC4                            10
 498 #define   IPSECDOI_ESP_NULL                           11
 499 #define   IPSECDOI_ESP_RIJNDAEL                         12
 500 #define   IPSECDOI_ESP_AES                              12
 501
 502 /* 4.4.1 IPSEC Security Protocol Identifiers */
 503 #define IPSECDOI_PROTO_IPCOMP                        4
 504   /* 4.4.5 IPSEC IPCOMP Transform Identifiers */
 505 #define   IPSECDOI_IPCOMP_OUI                          1
 506 #define   IPSECDOI_IPCOMP_DEFLATE                      2
 507 #define   IPSECDOI_IPCOMP_LZS                          3
 508
 509 /* 4.5 IPSEC Security Association Attributes */
 510 #define IPSECDOI_ATTR_SA_LTYPE                1 /* B */
 511 #define   IPSECDOI_ATTR_SA_LTYPE_DEFAULT        1
 512 #define   IPSECDOI_ATTR_SA_LTYPE_SEC            1
 513 #define   IPSECDOI_ATTR_SA_LTYPE_KB             2
 514 #define IPSECDOI_ATTR_SA_LDUR                 2 /* V */
 515 #define   IPSECDOI_ATTR_SA_LDUR_DEFAULT         28800 /* 8 hours */
 516 #define IPSECDOI_ATTR_GRP_DESC                3 /* B */
 517 #define IPSECDOI_ATTR_ENC_MODE                4 /* B */
 518         /* default value: host dependent */
 519 #define   IPSECDOI_ATTR_ENC_MODE_TUNNEL         1
 520 #define   IPSECDOI_ATTR_ENC_MODE_TRNS           2
 521 #define IPSECDOI_ATTR_AUTH                    5 /* B */
 522         /* 0 means not to use authentication. */
 523 #define   IPSECDOI_ATTR_AUTH_HMAC_MD5           1
 524 #define   IPSECDOI_ATTR_AUTH_HMAC_SHA1          2
 525 #define   IPSECDOI_ATTR_AUTH_DES_MAC            3
 526 #define   IPSECDOI_ATTR_AUTH_KPDK               4 /*RFC-1826(Key/Pad/Data/Key)*/
 527         /*
 528          * When negotiating ESP without authentication, the Auth
 529          * Algorithm attribute MUST NOT be included in the proposal.
 530          * When negotiating ESP without confidentiality, the Auth
 531          * Algorithm attribute MUST be included in the proposal and
 532          * the ESP transform ID must be ESP_NULL.
 533         */
 534 #define IPSECDOI_ATTR_KEY_LENGTH              6 /* B */
 535 #define IPSECDOI_ATTR_KEY_ROUNDS              7 /* B */
 536 #define IPSECDOI_ATTR_COMP_DICT_SIZE          8 /* B */
 537 #define IPSECDOI_ATTR_COMP_PRIVALG            9 /* V */
 538
 539 /* 4.6.1 Security Association Payload */
 540 struct ipsecdoi_sa {
 541         struct isakmp_gen h;
 542         uint32_t doi; /* Domain of Interpretation */
 543         uint32_t sit; /* Situation */
 544 };
 545
 546 struct ipsecdoi_secrecy_h {
 547         uint16_t len;
 548         uint16_t reserved;
 549 };
 550
 551 /* 4.6.2.1 Identification Type Values */
 552 struct ipsecdoi_id {
 553         struct isakmp_gen h;
 554         uint8_t  type;          /* ID Type */
 555         uint8_t  proto_id;      /* Protocol ID */
 556         uint16_t port;          /* Port */
 557         /* Identification Data */
 558 };
 559
 560 #define IPSECDOI_ID_IPV4_ADDR                        1
 561 #define IPSECDOI_ID_FQDN                             2
 562 #define IPSECDOI_ID_USER_FQDN                        3
 563 #define IPSECDOI_ID_IPV4_ADDR_SUBNET                 4
 564 #define IPSECDOI_ID_IPV6_ADDR                        5
 565 #define IPSECDOI_ID_IPV6_ADDR_SUBNET                 6
 566 #define IPSECDOI_ID_IPV4_ADDR_RANGE                  7
 567 #define IPSECDOI_ID_IPV6_ADDR_RANGE                  8
 568 #define IPSECDOI_ID_DER_ASN1_DN                      9
 569 #define IPSECDOI_ID_DER_ASN1_GN                      10
 570 #define IPSECDOI_ID_KEY_ID                           11
 571
 572 /* 4.6.3 IPSEC DOI Notify Message Types */
 573 /* Notify Messages - Status Types */
 574 #define IPSECDOI_NTYPE_RESPONDER_LIFETIME                  24576
 575 #define IPSECDOI_NTYPE_REPLAY_STATUS                       24577
 576 #define IPSECDOI_NTYPE_INITIAL_CONTACT                     24578
 577
 578 #define DECLARE_PRINTER(func) static const u_char *ike##func##_print( \
 579                 netdissect_options *ndo, u_char tpay,                 \
 580                 const struct isakmp_gen *ext,                         \
 581                 u_int item_len, \
 582                 const u_char *end_pointer, \
 583                 uint32_t phase,\
 584                 uint32_t doi0, \
 585                 uint32_t proto0, int depth)
 586
 587 DECLARE_PRINTER(v1_sa);
 588 DECLARE_PRINTER(v1_p);
 589 DECLARE_PRINTER(v1_t);
 590 DECLARE_PRINTER(v1_ke);
 591 DECLARE_PRINTER(v1_id);
 592 DECLARE_PRINTER(v1_cert);
 593 DECLARE_PRINTER(v1_cr);
 594 DECLARE_PRINTER(v1_sig);
 595 DECLARE_PRINTER(v1_hash);
 596 DECLARE_PRINTER(v1_nonce);
 597 DECLARE_PRINTER(v1_n);
 598 DECLARE_PRINTER(v1_d);
 599 DECLARE_PRINTER(v1_vid);
 600
 601 DECLARE_PRINTER(v2_sa);
 602 DECLARE_PRINTER(v2_ke);
 603 DECLARE_PRINTER(v2_ID);
 604 DECLARE_PRINTER(v2_cert);
 605 DECLARE_PRINTER(v2_cr);
 606 DECLARE_PRINTER(v2_auth);
 607 DECLARE_PRINTER(v2_nonce);
 608 DECLARE_PRINTER(v2_n);
 609 DECLARE_PRINTER(v2_d);
 610 DECLARE_PRINTER(v2_vid);
 611 DECLARE_PRINTER(v2_TS);
 612 DECLARE_PRINTER(v2_cp);
 613 DECLARE_PRINTER(v2_eap);
 614
 615 static const u_char *ikev2_e_print(netdissect_options *ndo,
 616                                    struct isakmp *base,
 617                                    u_char tpay,
 618                                    const struct isakmp_gen *ext,
 619                                    u_int item_len,
 620                                    const u_char *end_pointer,
 621                                    uint32_t phase,
 622                                    uint32_t doi0,
 623                                    uint32_t proto0, int depth);
 624
 625
 626 static const u_char *ike_sub0_print(netdissect_options *ndo,u_char, const struct isakmp_gen *,
 627         const u_char *, uint32_t, uint32_t, uint32_t, int);
 628 static const u_char *ikev1_sub_print(netdissect_options *ndo,u_char, const struct isakmp_gen *,
 629         const u_char *, uint32_t, uint32_t, uint32_t, int);
 630
 631 static const u_char *ikev2_sub_print(netdissect_options *ndo,
 632                                      struct isakmp *base,
 633                                      u_char np, const struct isakmp_gen *ext,
 634                                      const u_char *ep, uint32_t phase,
 635                                      uint32_t doi, uint32_t proto,
 636                                      int depth);
 637
 638
 639 static char *numstr(int);
 640
 641 static void
 642 ikev1_print(netdissect_options *ndo,
 643             const u_char *bp,  u_int length,
 644             const u_char *bp2, struct isakmp *base);
 645
 646 #define MAXINITIATORS   20
 647 static int ninitiator = 0;
 648 union inaddr_u {
 649         struct in_addr in4;
 650         struct in6_addr in6;
 651 };
 652 static struct {
 653         cookie_t initiator;
 654         u_int version;
 655         union inaddr_u iaddr;
 656         union inaddr_u raddr;
 657 } cookiecache[MAXINITIATORS];
 658
 659 /* protocol id */
 660 static const char *protoidstr[] = {
 661         NULL, "isakmp", "ipsec-ah", "ipsec-esp", "ipcomp",
 662 };
 663
 664 /* isakmp->np */
 665 static const char *npstr[] = {
 666         "none", "sa", "p", "t", "ke", "id", "cert", "cr", "hash", /* 0 - 8 */
 667         "sig", "nonce", "n", "d", "vid",      /* 9 - 13 */
 668         "pay14", "pay15", "pay16", "pay17", "pay18", /* 14- 18 */
 669         "pay19", "pay20", "pay21", "pay22", "pay23", /* 19- 23 */
 670         "pay24", "pay25", "pay26", "pay27", "pay28", /* 24- 28 */
 671         "pay29", "pay30", "pay31", "pay32",          /* 29- 32 */
 672         "v2sa",  "v2ke",  "v2IDi", "v2IDr", "v2cert",/* 33- 37 */
 673         "v2cr",  "v2auth","v2nonce", "v2n",   "v2d",   /* 38- 42 */
 674         "v2vid", "v2TSi", "v2TSr", "v2e",   "v2cp",  /* 43- 47 */
 675         "v2eap",                                     /* 48 */
 676
 677 };
 678
 679 /* isakmp->np */
 680 static const u_char *(*npfunc[])(netdissect_options *ndo, u_char tpay,
 681                                  const struct isakmp_gen *ext,
 682                                  u_int item_len,
 683                                  const u_char *end_pointer,
 684                                  uint32_t phase,
 685                                  uint32_t doi0,
 686                                  uint32_t proto0, int depth) = {
 687         NULL,
 688         ikev1_sa_print,
 689         ikev1_p_print,
 690         ikev1_t_print,
 691         ikev1_ke_print,
 692         ikev1_id_print,
 693         ikev1_cert_print,
 694         ikev1_cr_print,
 695         ikev1_hash_print,
 696         ikev1_sig_print,
 697         ikev1_nonce_print,
 698         ikev1_n_print,
 699         ikev1_d_print,
 700         ikev1_vid_print,                  /* 13 */
 701         NULL, NULL, NULL, NULL, NULL,     /* 14- 18 */
 702         NULL, NULL, NULL, NULL, NULL,     /* 19- 23 */
 703         NULL, NULL, NULL, NULL, NULL,     /* 24- 28 */
 704         NULL, NULL, NULL, NULL,           /* 29- 32 */
 705         ikev2_sa_print,                 /* 33 */
 706         ikev2_ke_print,                 /* 34 */
 707         ikev2_ID_print,                 /* 35 */
 708         ikev2_ID_print,                 /* 36 */
 709         ikev2_cert_print,               /* 37 */
 710         ikev2_cr_print,                 /* 38 */
 711         ikev2_auth_print,               /* 39 */
 712         ikev2_nonce_print,              /* 40 */
 713         ikev2_n_print,                  /* 41 */
 714         ikev2_d_print,                  /* 42 */
 715         ikev2_vid_print,                /* 43 */
 716         ikev2_TS_print,                 /* 44 */
 717         ikev2_TS_print,                 /* 45 */
 718         NULL, /* ikev2_e_print,*/       /* 46 - special */
 719         ikev2_cp_print,                 /* 47 */
 720         ikev2_eap_print,                /* 48 */
 721 };
 722
 723 /* isakmp->etype */
 724 static const char *etypestr[] = {
 725 /* IKEv1 exchange types */
 726         "none", "base", "ident", "auth", "agg", "inf", NULL, NULL,  /* 0-7 */
 727         NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,  /*  8-15 */
 728         NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,  /* 16-23 */
 729         NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,  /* 24-31 */
 730         "oakley-quick", "oakley-newgroup",               /* 32-33 */
 731 /* IKEv2 exchange types */
 732         "ikev2_init", "ikev2_auth", "child_sa", "inf2"   /* 34-37 */
 733 };
 734
 735 #define STR_OR_ID(x, tab) \
 736         (((x) < sizeof(tab)/sizeof(tab[0]) && tab[(x)]) ? tab[(x)] : numstr(x))
 737 #define PROTOIDSTR(x)   STR_OR_ID(x, protoidstr)
 738 #define NPSTR(x)        STR_OR_ID(x, npstr)
 739 #define ETYPESTR(x)     STR_OR_ID(x, etypestr)
 740
 741 #define CHECKLEN(p, np)                                                 \
 742                 if (ep < (const u_char *)(p)) {                         \
 743                         ND_PRINT((ndo," [|%s]", NPSTR(np)));            \
 744                         goto done;                                      \
 745                 }
 746
 747
 748 #define NPFUNC(x) \
 749         (((x) < sizeof(npfunc)/sizeof(npfunc[0]) && npfunc[(x)]) \
 750                 ? npfunc[(x)] : NULL)
 751
 752 static int
 753 iszero(const u_char *p, size_t l)
 754 {
 755         while (l--) {
 756                 if (*p++)
 757                         return 0;
 758         }
 759         return 1;
 760 }
 761
 762 /* find cookie from initiator cache */
 763 static int
 764 cookie_find(cookie_t *in)
 765 {
 766         int i;
 767
 768         for (i = 0; i < MAXINITIATORS; i++) {
 769                 if (memcmp(in, &cookiecache[i].initiator, sizeof(*in)) == 0)
 770                         return i;
 771         }
 772
 773         return -1;
 774 }
 775
 776 /* record initiator */
 777 static void
 778 cookie_record(cookie_t *in, const u_char *bp2)
 779 {
 780         int i;
 781         const struct ip *ip;
 782         const struct ip6_hdr *ip6;
 783
 784         i = cookie_find(in);
 785         if (0 <= i) {
 786                 ninitiator = (i + 1) % MAXINITIATORS;
 787                 return;
 788         }
 789
 790         ip = (const struct ip *)bp2;
 791         switch (IP_V(ip)) {
 792         case 4:
 793                 cookiecache[ninitiator].version = 4;
 794                 UNALIGNED_MEMCPY(&cookiecache[ninitiator].iaddr.in4, &ip->ip_src, sizeof(struct in_addr));
 795                 UNALIGNED_MEMCPY(&cookiecache[ninitiator].raddr.in4, &ip->ip_dst, sizeof(struct in_addr));
 796                 break;
 797         case 6:
 798                 ip6 = (const struct ip6_hdr *)bp2;
 799                 cookiecache[ninitiator].version = 6;
 800                 UNALIGNED_MEMCPY(&cookiecache[ninitiator].iaddr.in6, &ip6->ip6_src, sizeof(struct in6_addr));
 801                 UNALIGNED_MEMCPY(&cookiecache[ninitiator].raddr.in6, &ip6->ip6_dst, sizeof(struct in6_addr));
 802                 break;
 803         default:
 804                 return;
 805         }
 806         UNALIGNED_MEMCPY(&cookiecache[ninitiator].initiator, in, sizeof(*in));
 807         ninitiator = (ninitiator + 1) % MAXINITIATORS;
 808 }
 809
 810 #define cookie_isinitiator(x, y)        cookie_sidecheck((x), (y), 1)
 811 #define cookie_isresponder(x, y)        cookie_sidecheck((x), (y), 0)
 812 static int
 813 cookie_sidecheck(int i, const u_char *bp2, int initiator)
 814 {
 815         const struct ip *ip;
 816         const struct ip6_hdr *ip6;
 817
 818         ip = (const struct ip *)bp2;
 819         switch (IP_V(ip)) {
 820         case 4:
 821                 if (cookiecache[i].version != 4)
 822                         return 0;
 823                 if (initiator) {
 824                         if (UNALIGNED_MEMCMP(&ip->ip_src, &cookiecache[i].iaddr.in4, sizeof(struct in_addr)) == 0)
 825                                 return 1;
 826                 } else {
 827                         if (UNALIGNED_MEMCMP(&ip->ip_src, &cookiecache[i].raddr.in4, sizeof(struct in_addr)) == 0)
 828                                 return 1;
 829                 }
 830                 break;
 831         case 6:
 832                 if (cookiecache[i].version != 6)
 833                         return 0;
 834                 ip6 = (const struct ip6_hdr *)bp2;
 835                 if (initiator) {
 836                         if (UNALIGNED_MEMCMP(&ip6->ip6_src, &cookiecache[i].iaddr.in6, sizeof(struct in6_addr)) == 0)
 837                                 return 1;
 838                 } else {
 839                         if (UNALIGNED_MEMCMP(&ip6->ip6_src, &cookiecache[i].raddr.in6, sizeof(struct in6_addr)) == 0)
 840                                 return 1;
 841                 }
 842                 break;
 843         default:
 844                 break;
 845         }
 846
 847         return 0;
 848 }
 849
 850 static void
 851 hexprint(netdissect_options *ndo, const uint8_t *loc, size_t len)
 852 {
 853         const uint8_t *p;
 854         size_t i;
 855
 856         p = loc;
 857         for (i = 0; i < len; i++)
 858                 ND_PRINT((ndo,"%02x", p[i] & 0xff));
 859 }
 860
 861 static int
 862 rawprint(netdissect_options *ndo, const uint8_t *loc, size_t len)
 863 {
 864         ND_TCHECK2(*loc, len);
 865
 866         hexprint(ndo, loc, len);
 867         return 1;
 868 trunc:
 869         return 0;
 870 }
 871
 872
 873 /*
 874  * returns false if we run out of data buffer
 875  */
 876 static int ike_show_somedata(netdissect_options *ndo,
 877                              const u_char *cp, const u_char *ep)
 878 {
 879         /* there is too much data, just show some of it */
 880         const u_char *end = ep - 20;
 881         int  elen = 20;
 882         int   len = ep - cp;
 883         if(len > 10) {
 884                 len = 10;
 885         }
 886
 887         /* really shouldn't happen because of above */
 888         if(end < cp + len) {
 889                 end = cp+len;
 890                 elen = ep - end;
 891         }
 892
 893         ND_PRINT((ndo," data=("));
 894         if(!rawprint(ndo, (const uint8_t *)(cp), len)) goto trunc;
 895         ND_PRINT((ndo, "..."));
 896         if(elen) {
 897                 if(!rawprint(ndo, (const uint8_t *)(end), elen)) goto trunc;
 898         }
 899         ND_PRINT((ndo,")"));
 900         return 1;
 901
 902 trunc:
 903         return 0;
 904 }
 905
 906 struct attrmap {
 907         const char *type;
 908         u_int nvalue;
 909         const char *value[30];  /*XXX*/
 910 };
 911
 912 static const u_char *
 913 ikev1_attrmap_print(netdissect_options *ndo,
 914                     const u_char *p, const u_char *ep,
 915                     const struct attrmap *map, size_t nmap)
 916 {
 917         int totlen;
 918         uint32_t t, v;
 919
 920         if (p[0] & 0x80)
 921                 totlen = 4;
 922         else
 923                 totlen = 4 + EXTRACT_16BITS(&p[2]);
 924         if (ep < p + totlen) {
 925                 ND_PRINT((ndo,"[|attr]"));
 926                 return ep + 1;
 927         }
 928
 929         ND_PRINT((ndo,"("));
 930         t = EXTRACT_16BITS(&p[0]) & 0x7fff;
 931         if (map && t < nmap && map[t].type)
 932                 ND_PRINT((ndo,"type=%s ", map[t].type));
 933         else
 934                 ND_PRINT((ndo,"type=#%d ", t));
 935         if (p[0] & 0x80) {
 936                 ND_PRINT((ndo,"value="));
 937                 v = EXTRACT_16BITS(&p[2]);
 938                 if (map && t < nmap && v < map[t].nvalue && map[t].value[v])
 939                         ND_PRINT((ndo,"%s", map[t].value[v]));
 940                 else
 941                         rawprint(ndo, (const uint8_t *)&p[2], 2);
 942         } else {
 943                 ND_PRINT((ndo,"len=%d value=", EXTRACT_16BITS(&p[2])));
 944                 rawprint(ndo, (const uint8_t *)&p[4], EXTRACT_16BITS(&p[2]));
 945         }
 946         ND_PRINT((ndo,")"));
 947         return p + totlen;
 948 }
 949
 950 static const u_char *
 951 ikev1_attr_print(netdissect_options *ndo, const u_char *p, const u_char *ep)
 952 {
 953         int totlen;
 954         uint32_t t;
 955
 956         if (p[0] & 0x80)
 957                 totlen = 4;
 958         else
 959                 totlen = 4 + EXTRACT_16BITS(&p[2]);
 960         if (ep < p + totlen) {
 961                 ND_PRINT((ndo,"[|attr]"));
 962                 return ep + 1;
 963         }
 964
 965         ND_PRINT((ndo,"("));
 966         t = EXTRACT_16BITS(&p[0]) & 0x7fff;
 967         ND_PRINT((ndo,"type=#%d ", t));
 968         if (p[0] & 0x80) {
 969                 ND_PRINT((ndo,"value="));
 970                 t = p[2];
 971                 rawprint(ndo, (const uint8_t *)&p[2], 2);
 972         } else {
 973                 ND_PRINT((ndo,"len=%d value=", EXTRACT_16BITS(&p[2])));
 974                 rawprint(ndo, (const uint8_t *)&p[4], EXTRACT_16BITS(&p[2]));
 975         }
 976         ND_PRINT((ndo,")"));
 977         return p + totlen;
 978 }
 979
 980 static const u_char *
 981 ikev1_sa_print(netdissect_options *ndo, u_char tpay _U_,
 982                const struct isakmp_gen *ext,
 983                 u_int item_len _U_,
 984                 const u_char *ep, uint32_t phase, uint32_t doi0 _U_,
 985                 uint32_t proto0, int depth)
 986 {
 987         const struct ikev1_pl_sa *p;
 988         struct ikev1_pl_sa sa;
 989         uint32_t doi, sit, ident;
 990         const u_char *cp, *np;
 991         int t;
 992
 993         ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_SA)));
 994
 995         p = (const struct ikev1_pl_sa *)ext;
 996         ND_TCHECK(*p);
 997         UNALIGNED_MEMCPY(&sa, ext, sizeof(sa));
 998         doi = ntohl(sa.doi);
 999         sit = ntohl(sa.sit);
1000         if (doi != 1) {
1001                 ND_PRINT((ndo," doi=%d", doi));
1002                 ND_PRINT((ndo," situation=%u", (uint32_t)ntohl(sa.sit)));
1003                 return (const u_char *)(p + 1);
1004         }
1005
1006         ND_PRINT((ndo," doi=ipsec"));
1007         ND_PRINT((ndo," situation="));
1008         t = 0;
1009         if (sit & 0x01) {
1010                 ND_PRINT((ndo,"identity"));
1011                 t++;
1012         }
1013         if (sit & 0x02) {
1014                 ND_PRINT((ndo,"%ssecrecy", t ? "+" : ""));
1015                 t++;
1016         }
1017         if (sit & 0x04)
1018                 ND_PRINT((ndo,"%sintegrity", t ? "+" : ""));
1019
1020         np = (const u_char *)ext + sizeof(sa);
1021         if (sit != 0x01) {
1022                 ND_TCHECK2(*(ext + 1), sizeof(ident));
1023                 UNALIGNED_MEMCPY(&ident, ext + 1, sizeof(ident));
1024                 ND_PRINT((ndo," ident=%u", (uint32_t)ntohl(ident)));
1025                 np += sizeof(ident);
1026         }
1027
1028         ext = (const struct isakmp_gen *)np;
1029         ND_TCHECK(*ext);
1030
1031         cp = ikev1_sub_print(ndo, ISAKMP_NPTYPE_P, ext, ep, phase, doi, proto0,
1032                 depth);
1033
1034         return cp;
1035 trunc:
1036         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_SA)));
1037         return NULL;
1038 }
1039
1040 static const u_char *
1041 ikev1_p_print(netdissect_options *ndo, u_char tpay _U_,
1042               const struct isakmp_gen *ext, u_int item_len _U_,
1043                const u_char *ep, uint32_t phase, uint32_t doi0,
1044                uint32_t proto0 _U_, int depth)
1045 {
1046         const struct ikev1_pl_p *p;
1047         struct ikev1_pl_p prop;
1048         const u_char *cp;
1049
1050         ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_P)));
1051
1052         p = (const struct ikev1_pl_p *)ext;
1053         ND_TCHECK(*p);
1054         UNALIGNED_MEMCPY(&prop, ext, sizeof(prop));
1055         ND_PRINT((ndo," #%d protoid=%s transform=%d",
1056                   prop.p_no, PROTOIDSTR(prop.prot_id), prop.num_t));
1057         if (prop.spi_size) {
1058                 ND_PRINT((ndo," spi="));
1059                 if (!rawprint(ndo, (const uint8_t *)(p + 1), prop.spi_size))
1060                         goto trunc;
1061         }
1062
1063         ext = (const struct isakmp_gen *)((const u_char *)(p + 1) + prop.spi_size);
1064         ND_TCHECK(*ext);
1065
1066         cp = ikev1_sub_print(ndo, ISAKMP_NPTYPE_T, ext, ep, phase, doi0,
1067                              prop.prot_id, depth);
1068
1069         return cp;
1070 trunc:
1071         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_P)));
1072         return NULL;
1073 }
1074
1075 static const char *ikev1_p_map[] = {
1076         NULL, "ike",
1077 };
1078
1079 static const char *ikev2_t_type_map[]={
1080         NULL, "encr", "prf", "integ", "dh", "esn"
1081 };
1082
1083 static const char *ah_p_map[] = {
1084         NULL, "(reserved)", "md5", "sha", "1des",
1085         "sha2-256", "sha2-384", "sha2-512",
1086 };
1087
1088 static const char *prf_p_map[] = {
1089         NULL, "hmac-md5", "hmac-sha", "hmac-tiger",
1090         "aes128_xcbc"
1091 };
1092
1093 static const char *integ_p_map[] = {
1094         NULL, "hmac-md5", "hmac-sha", "dec-mac",
1095         "kpdk-md5", "aes-xcbc"
1096 };
1097
1098 static const char *esn_p_map[] = {
1099         "no-esn", "esn"
1100 };
1101
1102 static const char *dh_p_map[] = {
1103         NULL, "modp768",
1104         "modp1024",    /* group 2 */
1105         "EC2N 2^155",  /* group 3 */
1106         "EC2N 2^185",  /* group 4 */
1107         "modp1536",    /* group 5 */
1108         "iana-grp06", "iana-grp07", /* reserved */
1109         "iana-grp08", "iana-grp09",
1110         "iana-grp10", "iana-grp11",
1111         "iana-grp12", "iana-grp13",
1112         "modp2048",    /* group 14 */
1113         "modp3072",    /* group 15 */
1114         "modp4096",    /* group 16 */
1115         "modp6144",    /* group 17 */
1116         "modp8192",    /* group 18 */
1117 };
1118
1119 static const char *esp_p_map[] = {
1120         NULL, "1des-iv64", "1des", "3des", "rc5", "idea", "cast",
1121         "blowfish", "3idea", "1des-iv32", "rc4", "null", "aes"
1122 };
1123
1124 static const char *ipcomp_p_map[] = {
1125         NULL, "oui", "deflate", "lzs",
1126 };
1127
1128 static const struct attrmap ipsec_t_map[] = {
1129         { NULL, 0, { NULL } },
1130         { "lifetype", 3, { NULL, "sec", "kb", }, },
1131         { "life", 0, { NULL } },
1132         { "group desc", 18,     { NULL, "modp768",
1133                                   "modp1024",    /* group 2 */
1134                                   "EC2N 2^155",  /* group 3 */
1135                                   "EC2N 2^185",  /* group 4 */
1136                                   "modp1536",    /* group 5 */
1137                                   "iana-grp06", "iana-grp07", /* reserved */
1138                                   "iana-grp08", "iana-grp09",
1139                                   "iana-grp10", "iana-grp11",
1140                                   "iana-grp12", "iana-grp13",
1141                                   "modp2048",    /* group 14 */
1142                                   "modp3072",    /* group 15 */
1143                                   "modp4096",    /* group 16 */
1144                                   "modp6144",    /* group 17 */
1145                                   "modp8192",    /* group 18 */
1146                 }, },
1147         { "enc mode", 3, { NULL, "tunnel", "transport", }, },
1148         { "auth", 5, { NULL, "hmac-md5", "hmac-sha1", "1des-mac", "keyed", }, },
1149         { "keylen", 0, { NULL } },
1150         { "rounds", 0, { NULL } },
1151         { "dictsize", 0, { NULL } },
1152         { "privalg", 0, { NULL } },
1153 };
1154
1155 static const struct attrmap encr_t_map[] = {
1156         { NULL, 0, { NULL } },  { NULL, 0, { NULL } },  /* 0, 1 */
1157         { NULL, 0, { NULL } },  { NULL, 0, { NULL } },  /* 2, 3 */
1158         { NULL, 0, { NULL } },  { NULL, 0, { NULL } },  /* 4, 5 */
1159         { NULL, 0, { NULL } },  { NULL, 0, { NULL } },  /* 6, 7 */
1160         { NULL, 0, { NULL } },  { NULL, 0, { NULL } },  /* 8, 9 */
1161         { NULL, 0, { NULL } },  { NULL, 0, { NULL } },  /* 10,11*/
1162         { NULL, 0, { NULL } },  { NULL, 0, { NULL } },  /* 12,13*/
1163         { "keylen", 14, { NULL }},
1164 };
1165
1166 static const struct attrmap oakley_t_map[] = {
1167         { NULL, 0, { NULL } },
1168         { "enc", 8,     { NULL, "1des", "idea", "blowfish", "rc5",
1169                           "3des", "cast", "aes", }, },
1170         { "hash", 7,    { NULL, "md5", "sha1", "tiger",
1171                           "sha2-256", "sha2-384", "sha2-512", }, },
1172         { "auth", 6,    { NULL, "preshared", "dss", "rsa sig", "rsa enc",
1173                           "rsa enc revised", }, },
1174         { "group desc", 18,     { NULL, "modp768",
1175                                   "modp1024",    /* group 2 */
1176                                   "EC2N 2^155",  /* group 3 */
1177                                   "EC2N 2^185",  /* group 4 */
1178                                   "modp1536",    /* group 5 */
1179                                   "iana-grp06", "iana-grp07", /* reserved */
1180                                   "iana-grp08", "iana-grp09",
1181                                   "iana-grp10", "iana-grp11",
1182                                   "iana-grp12", "iana-grp13",
1183                                   "modp2048",    /* group 14 */
1184                                   "modp3072",    /* group 15 */
1185                                   "modp4096",    /* group 16 */
1186                                   "modp6144",    /* group 17 */
1187                                   "modp8192",    /* group 18 */
1188                 }, },
1189         { "group type", 4,      { NULL, "MODP", "ECP", "EC2N", }, },
1190         { "group prime", 0, { NULL } },
1191         { "group gen1", 0, { NULL } },
1192         { "group gen2", 0, { NULL } },
1193         { "group curve A", 0, { NULL } },
1194         { "group curve B", 0, { NULL } },
1195         { "lifetype", 3,        { NULL, "sec", "kb", }, },
1196         { "lifeduration", 0, { NULL } },
1197         { "prf", 0, { NULL } },
1198         { "keylen", 0, { NULL } },
1199         { "field", 0, { NULL } },
1200         { "order", 0, { NULL } },
1201 };
1202
1203 static const u_char *
1204 ikev1_t_print(netdissect_options *ndo, u_char tpay _U_,
1205               const struct isakmp_gen *ext, u_int item_len,
1206               const u_char *ep, uint32_t phase _U_, uint32_t doi _U_,
1207               uint32_t proto, int depth _U_)
1208 {
1209         const struct ikev1_pl_t *p;
1210         struct ikev1_pl_t t;
1211         const u_char *cp;
1212         const char *idstr;
1213         const struct attrmap *map;
1214         size_t nmap;
1215         const u_char *ep2;
1216
1217         ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_T)));
1218
1219         p = (const struct ikev1_pl_t *)ext;
1220         ND_TCHECK(*p);
1221         UNALIGNED_MEMCPY(&t, ext, sizeof(t));
1222
1223         switch (proto) {
1224         case 1:
1225                 idstr = STR_OR_ID(t.t_id, ikev1_p_map);
1226                 map = oakley_t_map;
1227                 nmap = sizeof(oakley_t_map)/sizeof(oakley_t_map[0]);
1228                 break;
1229         case 2:
1230                 idstr = STR_OR_ID(t.t_id, ah_p_map);
1231                 map = ipsec_t_map;
1232                 nmap = sizeof(ipsec_t_map)/sizeof(ipsec_t_map[0]);
1233                 break;
1234         case 3:
1235                 idstr = STR_OR_ID(t.t_id, esp_p_map);
1236                 map = ipsec_t_map;
1237                 nmap = sizeof(ipsec_t_map)/sizeof(ipsec_t_map[0]);
1238                 break;
1239         case 4:
1240                 idstr = STR_OR_ID(t.t_id, ipcomp_p_map);
1241                 map = ipsec_t_map;
1242                 nmap = sizeof(ipsec_t_map)/sizeof(ipsec_t_map[0]);
1243                 break;
1244         default:
1245                 idstr = NULL;
1246                 map = NULL;
1247                 nmap = 0;
1248                 break;
1249         }
1250
1251         if (idstr)
1252                 ND_PRINT((ndo," #%d id=%s ", t.t_no, idstr));
1253         else
1254                 ND_PRINT((ndo," #%d id=%d ", t.t_no, t.t_id));
1255         cp = (const u_char *)(p + 1);
1256         ep2 = (const u_char *)p + item_len;
1257         while (cp < ep && cp < ep2) {
1258                 if (map && nmap) {
1259                         cp = ikev1_attrmap_print(ndo, cp, (ep < ep2) ? ep : ep2,
1260                                 map, nmap);
1261                 } else
1262                         cp = ikev1_attr_print(ndo, cp, (ep < ep2) ? ep : ep2);
1263         }
1264         if (ep < ep2)
1265                 ND_PRINT((ndo,"..."));
1266         return cp;
1267 trunc:
1268         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_T)));
1269         return NULL;
1270 }
1271
1272 static const u_char *
1273 ikev1_ke_print(netdissect_options *ndo, u_char tpay _U_,
1274                const struct isakmp_gen *ext, u_int item_len _U_,
1275                const u_char *ep _U_, uint32_t phase _U_, uint32_t doi _U_,
1276                uint32_t proto _U_, int depth _U_)
1277 {
1278         struct isakmp_gen e;
1279
1280         ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_KE)));
1281
1282         ND_TCHECK(*ext);
1283         UNALIGNED_MEMCPY(&e, ext, sizeof(e));
1284         ND_PRINT((ndo," key len=%d", ntohs(e.len) - 4));
1285         if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1286                 ND_PRINT((ndo," "));
1287                 if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4))
1288                         goto trunc;
1289         }
1290         return (const u_char *)ext + ntohs(e.len);
1291 trunc:
1292         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_KE)));
1293         return NULL;
1294 }
1295
1296 static const u_char *
1297 ikev1_id_print(netdissect_options *ndo, u_char tpay _U_,
1298                const struct isakmp_gen *ext, u_int item_len,
1299                const u_char *ep _U_, uint32_t phase, uint32_t doi _U_,
1300                uint32_t proto _U_, int depth _U_)
1301 {
1302 #define USE_IPSECDOI_IN_PHASE1  1
1303         const struct ikev1_pl_id *p;
1304         struct ikev1_pl_id id;
1305         static const char *idtypestr[] = {
1306                 "IPv4", "IPv4net", "IPv6", "IPv6net",
1307         };
1308         static const char *ipsecidtypestr[] = {
1309                 NULL, "IPv4", "FQDN", "user FQDN", "IPv4net", "IPv6",
1310                 "IPv6net", "IPv4range", "IPv6range", "ASN1 DN", "ASN1 GN",
1311                 "keyid",
1312         };
1313         int len;
1314         const u_char *data;
1315
1316         ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_ID)));
1317
1318         p = (const struct ikev1_pl_id *)ext;
1319         ND_TCHECK(*p);
1320         UNALIGNED_MEMCPY(&id, ext, sizeof(id));
1321         if (sizeof(*p) < item_len) {
1322                 data = (const u_char *)(p + 1);
1323                 len = item_len - sizeof(*p);
1324         } else {
1325                 data = NULL;
1326                 len = 0;
1327         }
1328
1329 #if 0 /*debug*/
1330         ND_PRINT((ndo," [phase=%d doi=%d proto=%d]", phase, doi, proto));
1331 #endif
1332         switch (phase) {
1333 #ifndef USE_IPSECDOI_IN_PHASE1
1334         case 1:
1335 #endif
1336         default:
1337                 ND_PRINT((ndo," idtype=%s", STR_OR_ID(id.d.id_type, idtypestr)));
1338                 ND_PRINT((ndo," doi_data=%u",
1339                           (uint32_t)(ntohl(id.d.doi_data) & 0xffffff)));
1340                 break;
1341
1342 #ifdef USE_IPSECDOI_IN_PHASE1
1343         case 1:
1344 #endif
1345         case 2:
1346             {
1347                 const struct ipsecdoi_id *doi_p;
1348                 struct ipsecdoi_id doi_id;
1349                 struct protoent *pe;
1350
1351                 doi_p = (const struct ipsecdoi_id *)ext;
1352                 ND_TCHECK(*doi_p);
1353                 UNALIGNED_MEMCPY(&doi_id, ext, sizeof(doi_id));
1354                 ND_PRINT((ndo," idtype=%s", STR_OR_ID(doi_id.type, ipsecidtypestr)));
1355                 /* A protocol ID of 0 DOES NOT mean IPPROTO_IP! */
1356                 pe = doi_id.proto_id ? getprotobynumber(doi_id.proto_id) : NULL;
1357                 if (pe)
1358                         ND_PRINT((ndo," protoid=%s", pe->p_name));
1359                 else
1360                         ND_PRINT((ndo," protoid=%u", doi_id.proto_id));
1361                 ND_PRINT((ndo," port=%d", ntohs(doi_id.port)));
1362                 if (!len)
1363                         break;
1364                 if (data == NULL)
1365                         goto trunc;
1366                 ND_TCHECK2(*data, len);
1367                 switch (doi_id.type) {
1368                 case IPSECDOI_ID_IPV4_ADDR:
1369                         if (len < 4)
1370                                 ND_PRINT((ndo," len=%d [bad: < 4]", len));
1371                         else
1372                                 ND_PRINT((ndo," len=%d %s", len, ipaddr_string(ndo, data)));
1373                         len = 0;
1374                         break;
1375                 case IPSECDOI_ID_FQDN:
1376                 case IPSECDOI_ID_USER_FQDN:
1377                     {
1378                         int i;
1379                         ND_PRINT((ndo," len=%d ", len));
1380                         for (i = 0; i < len; i++)
1381                                 safeputchar(ndo, data[i]);
1382                         len = 0;
1383                         break;
1384                     }
1385                 case IPSECDOI_ID_IPV4_ADDR_SUBNET:
1386                     {
1387                         const u_char *mask;
1388                         if (len < 8)
1389                                 ND_PRINT((ndo," len=%d [bad: < 8]", len));
1390                         else {
1391                                 mask = data + sizeof(struct in_addr);
1392                                 ND_PRINT((ndo," len=%d %s/%u.%u.%u.%u", len,
1393                                           ipaddr_string(ndo, data),
1394                                           mask[0], mask[1], mask[2], mask[3]));
1395                         }
1396                         len = 0;
1397                         break;
1398                     }
1399                 case IPSECDOI_ID_IPV6_ADDR:
1400                         if (len < 16)
1401                                 ND_PRINT((ndo," len=%d [bad: < 16]", len));
1402                         else
1403                                 ND_PRINT((ndo," len=%d %s", len, ip6addr_string(ndo, data)));
1404                         len = 0;
1405                         break;
1406                 case IPSECDOI_ID_IPV6_ADDR_SUBNET:
1407                     {
1408                         const u_char *mask;
1409                         if (len < 20)
1410                                 ND_PRINT((ndo," len=%d [bad: < 20]", len));
1411                         else {
1412                                 mask = (const u_char *)(data + sizeof(struct in6_addr));
1413                                 /*XXX*/
1414                                 ND_PRINT((ndo," len=%d %s/0x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x", len,
1415                                           ip6addr_string(ndo, data),
1416                                           mask[0], mask[1], mask[2], mask[3],
1417                                           mask[4], mask[5], mask[6], mask[7],
1418                                           mask[8], mask[9], mask[10], mask[11],
1419                                           mask[12], mask[13], mask[14], mask[15]));
1420                         }
1421                         len = 0;
1422                         break;
1423                     }
1424                 case IPSECDOI_ID_IPV4_ADDR_RANGE:
1425                         if (len < 8)
1426                                 ND_PRINT((ndo," len=%d [bad: < 8]", len));
1427                         else {
1428                                 ND_PRINT((ndo," len=%d %s-%s", len,
1429                                           ipaddr_string(ndo, data),
1430                                           ipaddr_string(ndo, data + sizeof(struct in_addr))));
1431                         }
1432                         len = 0;
1433                         break;
1434                 case IPSECDOI_ID_IPV6_ADDR_RANGE:
1435                         if (len < 32)
1436                                 ND_PRINT((ndo," len=%d [bad: < 32]", len));
1437                         else {
1438                                 ND_PRINT((ndo," len=%d %s-%s", len,
1439                                           ip6addr_string(ndo, data),
1440                                           ip6addr_string(ndo, data + sizeof(struct in6_addr))));
1441                         }
1442                         len = 0;
1443                         break;
1444                 case IPSECDOI_ID_DER_ASN1_DN:
1445                 case IPSECDOI_ID_DER_ASN1_GN:
1446                 case IPSECDOI_ID_KEY_ID:
1447                         break;
1448                 }
1449                 break;
1450             }
1451         }
1452         if (data && len) {
1453                 ND_PRINT((ndo," len=%d", len));
1454                 if (2 < ndo->ndo_vflag) {
1455                         ND_PRINT((ndo," "));
1456                         if (!rawprint(ndo, (const uint8_t *)data, len))
1457                                 goto trunc;
1458                 }
1459         }
1460         return (const u_char *)ext + item_len;
1461 trunc:
1462         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_ID)));
1463         return NULL;
1464 }
1465
1466 static const u_char *
1467 ikev1_cert_print(netdissect_options *ndo, u_char tpay _U_,
1468                  const struct isakmp_gen *ext, u_int item_len,
1469                  const u_char *ep _U_, uint32_t phase _U_,
1470                  uint32_t doi0 _U_,
1471                  uint32_t proto0 _U_, int depth _U_)
1472 {
1473         const struct ikev1_pl_cert *p;
1474         struct ikev1_pl_cert cert;
1475         static const char *certstr[] = {
1476                 "none", "pkcs7", "pgp", "dns",
1477                 "x509sign", "x509ke", "kerberos", "crl",
1478                 "arl", "spki", "x509attr",
1479         };
1480
1481         ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_CERT)));
1482
1483         p = (const struct ikev1_pl_cert *)ext;
1484         ND_TCHECK(*p);
1485         UNALIGNED_MEMCPY(&cert, ext, sizeof(cert));
1486         ND_PRINT((ndo," len=%d", item_len - 4));
1487         ND_PRINT((ndo," type=%s", STR_OR_ID((cert.encode), certstr)));
1488         if (2 < ndo->ndo_vflag && 4 < item_len) {
1489                 ND_PRINT((ndo," "));
1490                 if (!rawprint(ndo, (const uint8_t *)(ext + 1), item_len - 4))
1491                         goto trunc;
1492         }
1493         return (const u_char *)ext + item_len;
1494 trunc:
1495         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_CERT)));
1496         return NULL;
1497 }
1498
1499 static const u_char *
1500 ikev1_cr_print(netdissect_options *ndo, u_char tpay _U_,
1501                const struct isakmp_gen *ext, u_int item_len,
1502                const u_char *ep _U_, uint32_t phase _U_, uint32_t doi0 _U_,
1503                uint32_t proto0 _U_, int depth _U_)
1504 {
1505         const struct ikev1_pl_cert *p;
1506         struct ikev1_pl_cert cert;
1507         static const char *certstr[] = {
1508                 "none", "pkcs7", "pgp", "dns",
1509                 "x509sign", "x509ke", "kerberos", "crl",
1510                 "arl", "spki", "x509attr",
1511         };
1512
1513         ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_CR)));
1514
1515         p = (const struct ikev1_pl_cert *)ext;
1516         ND_TCHECK(*p);
1517         UNALIGNED_MEMCPY(&cert, ext, sizeof(cert));
1518         ND_PRINT((ndo," len=%d", item_len - 4));
1519         ND_PRINT((ndo," type=%s", STR_OR_ID((cert.encode), certstr)));
1520         if (2 < ndo->ndo_vflag && 4 < item_len) {
1521                 ND_PRINT((ndo," "));
1522                 if (!rawprint(ndo, (const uint8_t *)(ext + 1), item_len - 4))
1523                         goto trunc;
1524         }
1525         return (const u_char *)ext + item_len;
1526 trunc:
1527         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_CR)));
1528         return NULL;
1529 }
1530
1531 static const u_char *
1532 ikev1_hash_print(netdissect_options *ndo, u_char tpay _U_,
1533                  const struct isakmp_gen *ext, u_int item_len _U_,
1534                  const u_char *ep _U_, uint32_t phase _U_, uint32_t doi _U_,
1535                  uint32_t proto _U_, int depth _U_)
1536 {
1537         struct isakmp_gen e;
1538
1539         ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_HASH)));
1540
1541         ND_TCHECK(*ext);
1542         UNALIGNED_MEMCPY(&e, ext, sizeof(e));
1543         ND_PRINT((ndo," len=%d", ntohs(e.len) - 4));
1544         if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1545                 ND_PRINT((ndo," "));
1546                 if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4))
1547                         goto trunc;
1548         }
1549         return (const u_char *)ext + ntohs(e.len);
1550 trunc:
1551         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_HASH)));
1552         return NULL;
1553 }
1554
1555 static const u_char *
1556 ikev1_sig_print(netdissect_options *ndo, u_char tpay _U_,
1557                 const struct isakmp_gen *ext, u_int item_len _U_,
1558                 const u_char *ep _U_, uint32_t phase _U_, uint32_t doi _U_,
1559                 uint32_t proto _U_, int depth _U_)
1560 {
1561         struct isakmp_gen e;
1562
1563         ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_SIG)));
1564
1565         ND_TCHECK(*ext);
1566         UNALIGNED_MEMCPY(&e, ext, sizeof(e));
1567         ND_PRINT((ndo," len=%d", ntohs(e.len) - 4));
1568         if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1569                 ND_PRINT((ndo," "));
1570                 if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4))
1571                         goto trunc;
1572         }
1573         return (const u_char *)ext + ntohs(e.len);
1574 trunc:
1575         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_SIG)));
1576         return NULL;
1577 }
1578
1579 static const u_char *
1580 ikev1_nonce_print(netdissect_options *ndo, u_char tpay _U_,
1581                   const struct isakmp_gen *ext,
1582                   u_int item_len _U_,
1583                   const u_char *ep,
1584                   uint32_t phase _U_, uint32_t doi _U_,
1585                   uint32_t proto _U_, int depth _U_)
1586 {
1587         struct isakmp_gen e;
1588
1589         ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_NONCE)));
1590
1591         ND_TCHECK(*ext);
1592         UNALIGNED_MEMCPY(&e, ext, sizeof(e));
1593         ND_PRINT((ndo," n len=%d", ntohs(e.len) - 4));
1594         if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1595                 ND_PRINT((ndo," "));
1596                 if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4))
1597                         goto trunc;
1598         } else if (1 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1599                 ND_PRINT((ndo," "));
1600                 if (!ike_show_somedata(ndo, (const u_char *)(const uint8_t *)(ext + 1), ep))
1601                         goto trunc;
1602         }
1603         return (const u_char *)ext + ntohs(e.len);
1604 trunc:
1605         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_NONCE)));
1606         return NULL;
1607 }
1608
1609 static const u_char *
1610 ikev1_n_print(netdissect_options *ndo, u_char tpay _U_,
1611               const struct isakmp_gen *ext, u_int item_len,
1612               const u_char *ep, uint32_t phase, uint32_t doi0 _U_,
1613               uint32_t proto0 _U_, int depth)
1614 {
1615         const struct ikev1_pl_n *p;
1616         struct ikev1_pl_n n;
1617         const u_char *cp;
1618         const u_char *ep2;
1619         uint32_t doi;
1620         uint32_t proto;
1621         static const char *notify_error_str[] = {
1622                 NULL,                           "INVALID-PAYLOAD-TYPE",
1623                 "DOI-NOT-SUPPORTED",            "SITUATION-NOT-SUPPORTED",
1624                 "INVALID-COOKIE",               "INVALID-MAJOR-VERSION",
1625                 "INVALID-MINOR-VERSION",        "INVALID-EXCHANGE-TYPE",
1626                 "INVALID-FLAGS",                "INVALID-MESSAGE-ID",
1627                 "INVALID-PROTOCOL-ID",          "INVALID-SPI",
1628                 "INVALID-TRANSFORM-ID",         "ATTRIBUTES-NOT-SUPPORTED",
1629                 "NO-PROPOSAL-CHOSEN",           "BAD-PROPOSAL-SYNTAX",
1630                 "PAYLOAD-MALFORMED",            "INVALID-KEY-INFORMATION",
1631                 "INVALID-ID-INFORMATION",       "INVALID-CERT-ENCODING",
1632                 "INVALID-CERTIFICATE",          "CERT-TYPE-UNSUPPORTED",
1633                 "INVALID-CERT-AUTHORITY",       "INVALID-HASH-INFORMATION",
1634                 "AUTHENTICATION-FAILED",        "INVALID-SIGNATURE",
1635                 "ADDRESS-NOTIFICATION",         "NOTIFY-SA-LIFETIME",
1636                 "CERTIFICATE-UNAVAILABLE",      "UNSUPPORTED-EXCHANGE-TYPE",
1637                 "UNEQUAL-PAYLOAD-LENGTHS",
1638         };
1639         static const char *ipsec_notify_error_str[] = {
1640                 "RESERVED",
1641         };
1642         static const char *notify_status_str[] = {
1643                 "CONNECTED",
1644         };
1645         static const char *ipsec_notify_status_str[] = {
1646                 "RESPONDER-LIFETIME",           "REPLAY-STATUS",
1647                 "INITIAL-CONTACT",
1648         };
1649 /* NOTE: these macro must be called with x in proper range */
1650
1651 /* 0 - 8191 */
1652 #define NOTIFY_ERROR_STR(x) \
1653         STR_OR_ID((x), notify_error_str)
1654
1655 /* 8192 - 16383 */
1656 #define IPSEC_NOTIFY_ERROR_STR(x) \
1657         STR_OR_ID((u_int)((x) - 8192), ipsec_notify_error_str)
1658
1659 /* 16384 - 24575 */
1660 #define NOTIFY_STATUS_STR(x) \
1661         STR_OR_ID((u_int)((x) - 16384), notify_status_str)
1662
1663 /* 24576 - 32767 */
1664 #define IPSEC_NOTIFY_STATUS_STR(x) \
1665         STR_OR_ID((u_int)((x) - 24576), ipsec_notify_status_str)
1666
1667         ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_N)));
1668
1669         p = (const struct ikev1_pl_n *)ext;
1670         ND_TCHECK(*p);
1671         UNALIGNED_MEMCPY(&n, ext, sizeof(n));
1672         doi = ntohl(n.doi);
1673         proto = n.prot_id;
1674         if (doi != 1) {
1675                 ND_PRINT((ndo," doi=%d", doi));
1676                 ND_PRINT((ndo," proto=%d", proto));
1677                 if (ntohs(n.type) < 8192)
1678                         ND_PRINT((ndo," type=%s", NOTIFY_ERROR_STR(ntohs(n.type))));
1679                 else if (ntohs(n.type) < 16384)
1680                         ND_PRINT((ndo," type=%s", numstr(ntohs(n.type))));
1681                 else if (ntohs(n.type) < 24576)
1682                         ND_PRINT((ndo," type=%s", NOTIFY_STATUS_STR(ntohs(n.type))));
1683                 else
1684                         ND_PRINT((ndo," type=%s", numstr(ntohs(n.type))));
1685                 if (n.spi_size) {
1686                         ND_PRINT((ndo," spi="));
1687                         if (!rawprint(ndo, (const uint8_t *)(p + 1), n.spi_size))
1688                                 goto trunc;
1689                 }
1690                 return (const u_char *)(p + 1) + n.spi_size;
1691         }
1692
1693         ND_PRINT((ndo," doi=ipsec"));
1694         ND_PRINT((ndo," proto=%s", PROTOIDSTR(proto)));
1695         if (ntohs(n.type) < 8192)
1696                 ND_PRINT((ndo," type=%s", NOTIFY_ERROR_STR(ntohs(n.type))));
1697         else if (ntohs(n.type) < 16384)
1698                 ND_PRINT((ndo," type=%s", IPSEC_NOTIFY_ERROR_STR(ntohs(n.type))));
1699         else if (ntohs(n.type) < 24576)
1700                 ND_PRINT((ndo," type=%s", NOTIFY_STATUS_STR(ntohs(n.type))));
1701         else if (ntohs(n.type) < 32768)
1702                 ND_PRINT((ndo," type=%s", IPSEC_NOTIFY_STATUS_STR(ntohs(n.type))));
1703         else
1704                 ND_PRINT((ndo," type=%s", numstr(ntohs(n.type))));
1705         if (n.spi_size) {
1706                 ND_PRINT((ndo," spi="));
1707                 if (!rawprint(ndo, (const uint8_t *)(p + 1), n.spi_size))
1708                         goto trunc;
1709         }
1710
1711         cp = (const u_char *)(p + 1) + n.spi_size;
1712         ep2 = (const u_char *)p + item_len;
1713
1714         if (cp < ep) {
1715                 ND_PRINT((ndo," orig=("));
1716                 switch (ntohs(n.type)) {
1717                 case IPSECDOI_NTYPE_RESPONDER_LIFETIME:
1718                     {
1719                         const struct attrmap *map = oakley_t_map;
1720                         size_t nmap = sizeof(oakley_t_map)/sizeof(oakley_t_map[0]);
1721                         while (cp < ep && cp < ep2) {
1722                                 cp = ikev1_attrmap_print(ndo, cp,
1723                                         (ep < ep2) ? ep : ep2, map, nmap);
1724                         }
1725                         break;
1726                     }
1727                 case IPSECDOI_NTYPE_REPLAY_STATUS:
1728                         ND_PRINT((ndo,"replay detection %sabled",
1729                                   EXTRACT_32BITS(cp) ? "en" : "dis"));
1730                         break;
1731                 case ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN:
1732                         if (ikev1_sub_print(ndo, ISAKMP_NPTYPE_SA,
1733                                             (const struct isakmp_gen *)cp, ep, phase, doi, proto,
1734                                             depth) == NULL)
1735                                 return NULL;
1736                         break;
1737                 default:
1738                         /* NULL is dummy */
1739                         isakmp_print(ndo, cp,
1740                                      item_len - sizeof(*p) - n.spi_size,
1741                                      NULL);
1742                 }
1743                 ND_PRINT((ndo,")"));
1744         }
1745         return (const u_char *)ext + item_len;
1746 trunc:
1747         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_N)));
1748         return NULL;
1749 }
1750
1751 static const u_char *
1752 ikev1_d_print(netdissect_options *ndo, u_char tpay _U_,
1753               const struct isakmp_gen *ext, u_int item_len _U_,
1754               const u_char *ep _U_, uint32_t phase _U_, uint32_t doi0 _U_,
1755               uint32_t proto0 _U_, int depth _U_)
1756 {
1757         const struct ikev1_pl_d *p;
1758         struct ikev1_pl_d d;
1759         const uint8_t *q;
1760         uint32_t doi;
1761         uint32_t proto;
1762         int i;
1763
1764         ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_D)));
1765
1766         p = (const struct ikev1_pl_d *)ext;
1767         ND_TCHECK(*p);
1768         UNALIGNED_MEMCPY(&d, ext, sizeof(d));
1769         doi = ntohl(d.doi);
1770         proto = d.prot_id;
1771         if (doi != 1) {
1772                 ND_PRINT((ndo," doi=%u", doi));
1773                 ND_PRINT((ndo," proto=%u", proto));
1774         } else {
1775                 ND_PRINT((ndo," doi=ipsec"));
1776                 ND_PRINT((ndo," proto=%s", PROTOIDSTR(proto)));
1777         }
1778         ND_PRINT((ndo," spilen=%u", d.spi_size));
1779         ND_PRINT((ndo," nspi=%u", ntohs(d.num_spi)));
1780         ND_PRINT((ndo," spi="));
1781         q = (const uint8_t *)(p + 1);
1782         for (i = 0; i < ntohs(d.num_spi); i++) {
1783                 if (i != 0)
1784                         ND_PRINT((ndo,","));
1785                 if (!rawprint(ndo, (const uint8_t *)q, d.spi_size))
1786                         goto trunc;
1787                 q += d.spi_size;
1788         }
1789         return q;
1790 trunc:
1791         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_D)));
1792         return NULL;
1793 }
1794
1795 static const u_char *
1796 ikev1_vid_print(netdissect_options *ndo, u_char tpay _U_,
1797                 const struct isakmp_gen *ext,
1798                 u_int item_len _U_, const u_char *ep _U_,
1799                 uint32_t phase _U_, uint32_t doi _U_,
1800                 uint32_t proto _U_, int depth _U_)
1801 {
1802         struct isakmp_gen e;
1803
1804         ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_VID)));
1805
1806         ND_TCHECK(*ext);
1807         UNALIGNED_MEMCPY(&e, ext, sizeof(e));
1808         ND_PRINT((ndo," len=%d", ntohs(e.len) - 4));
1809         if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1810                 ND_PRINT((ndo," "));
1811                 if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4))
1812                         goto trunc;
1813         }
1814         return (const u_char *)ext + ntohs(e.len);
1815 trunc:
1816         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_VID)));
1817         return NULL;
1818 }
1819
1820 /************************************************************/
1821 /*                                                          */
1822 /*              IKE v2 - rfc4306 - dissector                */
1823 /*                                                          */
1824 /************************************************************/
1825
1826 static void
1827 ikev2_pay_print(netdissect_options *ndo, const char *payname, int critical)
1828 {
1829         ND_PRINT((ndo,"%s%s:", payname, critical&0x80 ? "[C]" : ""));
1830 }
1831
1832 static const u_char *
1833 ikev2_gen_print(netdissect_options *ndo, u_char tpay,
1834                 const struct isakmp_gen *ext)
1835 {
1836         struct isakmp_gen e;
1837
1838         ND_TCHECK(*ext);
1839         UNALIGNED_MEMCPY(&e, ext, sizeof(e));
1840         ikev2_pay_print(ndo, NPSTR(tpay), e.critical);
1841
1842         ND_PRINT((ndo," len=%d", ntohs(e.len) - 4));
1843         if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1844                 ND_PRINT((ndo," "));
1845                 if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4))
1846                         goto trunc;
1847         }
1848         return (const u_char *)ext + ntohs(e.len);
1849 trunc:
1850         ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
1851         return NULL;
1852 }
1853
1854 static const u_char *
1855 ikev2_t_print(netdissect_options *ndo, int tcount,
1856               const struct isakmp_gen *ext, u_int item_len,
1857               const u_char *ep)
1858 {
1859         const struct ikev2_t *p;
1860         struct ikev2_t t;
1861         uint16_t  t_id;
1862         const u_char *cp;
1863         const char *idstr;
1864         const struct attrmap *map;
1865         size_t nmap;
1866         const u_char *ep2;
1867
1868         p = (const struct ikev2_t *)ext;
1869         ND_TCHECK(*p);
1870         UNALIGNED_MEMCPY(&t, ext, sizeof(t));
1871         ikev2_pay_print(ndo, NPSTR(ISAKMP_NPTYPE_T), t.h.critical);
1872
1873         t_id = ntohs(t.t_id);
1874
1875         map = NULL;
1876         nmap = 0;
1877
1878         switch (t.t_type) {
1879         case IV2_T_ENCR:
1880                 idstr = STR_OR_ID(t_id, esp_p_map);
1881                 map = encr_t_map;
1882                 nmap = sizeof(encr_t_map)/sizeof(encr_t_map[0]);
1883                 break;
1884
1885         case IV2_T_PRF:
1886                 idstr = STR_OR_ID(t_id, prf_p_map);
1887                 break;
1888
1889         case IV2_T_INTEG:
1890                 idstr = STR_OR_ID(t_id, integ_p_map);
1891                 break;
1892
1893         case IV2_T_DH:
1894                 idstr = STR_OR_ID(t_id, dh_p_map);
1895                 break;
1896
1897         case IV2_T_ESN:
1898                 idstr = STR_OR_ID(t_id, esn_p_map);
1899                 break;
1900
1901         default:
1902                 idstr = NULL;
1903                 break;
1904         }
1905
1906         if (idstr)
1907                 ND_PRINT((ndo," #%u type=%s id=%s ", tcount,
1908                           STR_OR_ID(t.t_type, ikev2_t_type_map),
1909                           idstr));
1910         else
1911                 ND_PRINT((ndo," #%u type=%s id=%u ", tcount,
1912                           STR_OR_ID(t.t_type, ikev2_t_type_map),
1913                           t.t_id));
1914         cp = (const u_char *)(p + 1);
1915         ep2 = (const u_char *)p + item_len;
1916         while (cp < ep && cp < ep2) {
1917                 if (map && nmap) {
1918                         cp = ikev1_attrmap_print(ndo, cp, (ep < ep2) ? ep : ep2,
1919                                 map, nmap);
1920                 } else
1921                         cp = ikev1_attr_print(ndo, cp, (ep < ep2) ? ep : ep2);
1922         }
1923         if (ep < ep2)
1924                 ND_PRINT((ndo,"..."));
1925         return cp;
1926 trunc:
1927         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_T)));
1928         return NULL;
1929 }
1930
1931 static const u_char *
1932 ikev2_p_print(netdissect_options *ndo, u_char tpay _U_, int pcount _U_,
1933               const struct isakmp_gen *ext, u_int oprop_length,
1934               const u_char *ep, int depth)
1935 {
1936         const struct ikev2_p *p;
1937         struct ikev2_p prop;
1938         u_int prop_length;
1939         const u_char *cp;
1940         int i;
1941         int tcount;
1942         u_char np;
1943         struct isakmp_gen e;
1944         u_int item_len;
1945
1946         p = (const struct ikev2_p *)ext;
1947         ND_TCHECK(*p);
1948         UNALIGNED_MEMCPY(&prop, ext, sizeof(prop));
1949
1950         ikev2_pay_print(ndo, NPSTR(ISAKMP_NPTYPE_P), prop.h.critical);
1951
1952         /*
1953          * ikev2_sa_print() guarantees that this is >= 4.
1954          */
1955         prop_length = oprop_length - 4;
1956         ND_PRINT((ndo," #%u protoid=%s transform=%d len=%u",
1957                   prop.p_no,  PROTOIDSTR(prop.prot_id),
1958                   prop.num_t, oprop_length));
1959         cp = (const u_char *)(p + 1);
1960
1961         if (prop.spi_size) {
1962                 if (prop_length < prop.spi_size)
1963                         goto toolong;
1964                 ND_PRINT((ndo," spi="));
1965                 if (!rawprint(ndo, (const uint8_t *)cp, prop.spi_size))
1966                         goto trunc;
1967                 cp += prop.spi_size;
1968                 prop_length -= prop.spi_size;
1969         }
1970
1971         /*
1972          * Print the transforms.
1973          */
1974         tcount = 0;
1975         for (np = ISAKMP_NPTYPE_T; np != 0; np = e.np) {
1976                 tcount++;
1977                 ext = (const struct isakmp_gen *)cp;
1978                 if (prop_length < sizeof(*ext))
1979                         goto toolong;
1980                 ND_TCHECK(*ext);
1981
1982                 UNALIGNED_MEMCPY(&e, ext, sizeof(e));
1983
1984                 /*
1985                  * Since we can't have a payload length of less than 4 bytes,
1986                  * we need to bail out here if the generic header is nonsensical
1987                  * or truncated, otherwise we could loop forever processing
1988                  * zero-length items or otherwise misdissect the packet.
1989                  */
1990                 item_len = ntohs(e.len);
1991                 if (item_len <= 4)
1992                         goto trunc;
1993
1994                 if (prop_length < item_len)
1995                         goto toolong;
1996                 ND_TCHECK2(*cp, item_len);
1997
1998                 depth++;
1999                 ND_PRINT((ndo,"\n"));
2000                 for (i = 0; i < depth; i++)
2001                         ND_PRINT((ndo,"    "));
2002                 ND_PRINT((ndo,"("));
2003                 if (np == ISAKMP_NPTYPE_T) {
2004                         cp = ikev2_t_print(ndo, tcount, ext, item_len, ep);
2005                         if (cp == NULL) {
2006                                 /* error, already reported */
2007                                 return NULL;
2008                         }
2009                 } else {
2010                         ND_PRINT((ndo, "%s", NPSTR(np)));
2011                         cp += item_len;
2012                 }
2013                 ND_PRINT((ndo,")"));
2014                 depth--;
2015                 prop_length -= item_len;
2016         }
2017         return cp;
2018 toolong:
2019         /*
2020          * Skip the rest of the proposal.
2021          */
2022         cp += prop_length;
2023         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_P)));
2024         return cp;
2025 trunc:
2026         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_P)));
2027         return NULL;
2028 }
2029
2030 static const u_char *
2031 ikev2_sa_print(netdissect_options *ndo, u_char tpay,
2032                 const struct isakmp_gen *ext1,
2033                 u_int osa_length, const u_char *ep,
2034                 uint32_t phase _U_, uint32_t doi _U_,
2035                 uint32_t proto _U_, int depth)
2036 {
2037         const struct isakmp_gen *ext;
2038         struct isakmp_gen e;
2039         u_int sa_length;
2040         const u_char *cp;
2041         int i;
2042         int pcount;
2043         u_char np;
2044         u_int item_len;
2045
2046         ND_TCHECK(*ext1);
2047         UNALIGNED_MEMCPY(&e, ext1, sizeof(e));
2048         ikev2_pay_print(ndo, "sa", e.critical);
2049
2050         /*
2051          * ikev2_sub0_print() guarantees that this is >= 4.
2052          */
2053         osa_length= ntohs(e.len);
2054         sa_length = osa_length - 4;
2055         ND_PRINT((ndo," len=%d", sa_length));
2056
2057         /*
2058          * Print the payloads.
2059          */
2060         cp = (const u_char *)(ext1 + 1);
2061         pcount = 0;
2062         for (np = ISAKMP_NPTYPE_P; np != 0; np = e.np) {
2063                 pcount++;
2064                 ext = (const struct isakmp_gen *)cp;
2065                 if (sa_length < sizeof(*ext))
2066                         goto toolong;
2067                 ND_TCHECK(*ext);
2068
2069                 UNALIGNED_MEMCPY(&e, ext, sizeof(e));
2070
2071                 /*
2072                  * Since we can't have a payload length of less than 4 bytes,
2073                  * we need to bail out here if the generic header is nonsensical
2074                  * or truncated, otherwise we could loop forever processing
2075                  * zero-length items or otherwise misdissect the packet.
2076                  */
2077                 item_len = ntohs(e.len);
2078                 if (item_len <= 4)
2079                         goto trunc;
2080
2081                 if (sa_length < item_len)
2082                         goto toolong;
2083                 ND_TCHECK2(*cp, item_len);
2084
2085                 depth++;
2086                 ND_PRINT((ndo,"\n"));
2087                 for (i = 0; i < depth; i++)
2088                         ND_PRINT((ndo,"    "));
2089                 ND_PRINT((ndo,"("));
2090                 if (np == ISAKMP_NPTYPE_P) {
2091                         cp = ikev2_p_print(ndo, np, pcount, ext, item_len,
2092                                            ep, depth);
2093                         if (cp == NULL) {
2094                                 /* error, already reported */
2095                                 return NULL;
2096                         }
2097                 } else {
2098                         ND_PRINT((ndo, "%s", NPSTR(np)));
2099                         cp += item_len;
2100                 }
2101                 ND_PRINT((ndo,")"));
2102                 depth--;
2103                 sa_length -= item_len;
2104         }
2105         return cp;
2106 toolong:
2107         /*
2108          * Skip the rest of the SA.
2109          */
2110         cp += sa_length;
2111         ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
2112         return cp;
2113 trunc:
2114         ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
2115         return NULL;
2116 }
2117
2118 static const u_char *
2119 ikev2_ke_print(netdissect_options *ndo, u_char tpay,
2120                 const struct isakmp_gen *ext,
2121                 u_int item_len _U_, const u_char *ep _U_,
2122                 uint32_t phase _U_, uint32_t doi _U_,
2123                 uint32_t proto _U_, int depth _U_)
2124 {
2125         struct ikev2_ke ke;
2126         const struct ikev2_ke *k;
2127
2128         k = (const struct ikev2_ke *)ext;
2129         ND_TCHECK(*ext);
2130         UNALIGNED_MEMCPY(&ke, ext, sizeof(ke));
2131         ikev2_pay_print(ndo, NPSTR(tpay), ke.h.critical);
2132
2133         ND_PRINT((ndo," len=%u group=%s", ntohs(ke.h.len) - 8,
2134                   STR_OR_ID(ntohs(ke.ke_group), dh_p_map)));
2135
2136         if (2 < ndo->ndo_vflag && 8 < ntohs(ke.h.len)) {
2137                 ND_PRINT((ndo," "));
2138                 if (!rawprint(ndo, (const uint8_t *)(k + 1), ntohs(ke.h.len) - 8))
2139                         goto trunc;
2140         }
2141         return (const u_char *)ext + ntohs(ke.h.len);
2142 trunc:
2143         ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
2144         return NULL;
2145 }
2146
2147 static const u_char *
2148 ikev2_ID_print(netdissect_options *ndo, u_char tpay,
2149                 const struct isakmp_gen *ext,
2150                 u_int item_len _U_, const u_char *ep _U_,
2151                 uint32_t phase _U_, uint32_t doi _U_,
2152                 uint32_t proto _U_, int depth _U_)
2153 {
2154         struct ikev2_id id;
2155         int id_len, idtype_len, i;
2156         unsigned int dumpascii, dumphex;
2157         const unsigned char *typedata;
2158
2159         ND_TCHECK(*ext);
2160         UNALIGNED_MEMCPY(&id, ext, sizeof(id));
2161         ikev2_pay_print(ndo, NPSTR(tpay), id.h.critical);
2162
2163         id_len = ntohs(id.h.len);
2164
2165         ND_PRINT((ndo," len=%d", id_len - 4));
2166         if (2 < ndo->ndo_vflag && 4 < id_len) {
2167                 ND_PRINT((ndo," "));
2168                 if (!rawprint(ndo, (const uint8_t *)(ext + 1), id_len - 4))
2169                         goto trunc;
2170         }
2171
2172         idtype_len =id_len - sizeof(struct ikev2_id);
2173         dumpascii = 0;
2174         dumphex   = 0;
2175         typedata  = (const unsigned char *)(ext)+sizeof(struct ikev2_id);
2176
2177         switch(id.type) {
2178         case ID_IPV4_ADDR:
2179                 ND_PRINT((ndo, " ipv4:"));
2180                 dumphex=1;
2181                 break;
2182         case ID_FQDN:
2183                 ND_PRINT((ndo, " fqdn:"));
2184                 dumpascii=1;
2185                 break;
2186         case ID_RFC822_ADDR:
2187                 ND_PRINT((ndo, " rfc822:"));
2188                 dumpascii=1;
2189                 break;
2190         case ID_IPV6_ADDR:
2191                 ND_PRINT((ndo, " ipv6:"));
2192                 dumphex=1;
2193                 break;
2194         case ID_DER_ASN1_DN:
2195                 ND_PRINT((ndo, " dn:"));
2196                 dumphex=1;
2197                 break;
2198         case ID_DER_ASN1_GN:
2199                 ND_PRINT((ndo, " gn:"));
2200                 dumphex=1;
2201                 break;
2202         case ID_KEY_ID:
2203                 ND_PRINT((ndo, " keyid:"));
2204                 dumphex=1;
2205                 break;
2206         }
2207
2208         if(dumpascii) {
2209                 ND_TCHECK2(*typedata, idtype_len);
2210                 for(i=0; i<idtype_len; i++) {
2211                         if(ND_ISPRINT(typedata[i])) {
2212                                 ND_PRINT((ndo, "%c", typedata[i]));
2213                         } else {
2214                                 ND_PRINT((ndo, "."));
2215                         }
2216                 }
2217         }
2218         if(dumphex) {
2219                 if (!rawprint(ndo, (const uint8_t *)typedata, idtype_len))
2220                         goto trunc;
2221         }
2222
2223         return (const u_char *)ext + id_len;
2224 trunc:
2225         ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
2226         return NULL;
2227 }
2228
2229 static const u_char *
2230 ikev2_cert_print(netdissect_options *ndo, u_char tpay,
2231                 const struct isakmp_gen *ext,
2232                 u_int item_len _U_, const u_char *ep _U_,
2233                 uint32_t phase _U_, uint32_t doi _U_,
2234                 uint32_t proto _U_, int depth _U_)
2235 {
2236         return ikev2_gen_print(ndo, tpay, ext);
2237 }
2238
2239 static const u_char *
2240 ikev2_cr_print(netdissect_options *ndo, u_char tpay,
2241                 const struct isakmp_gen *ext,
2242                 u_int item_len _U_, const u_char *ep _U_,
2243                 uint32_t phase _U_, uint32_t doi _U_,
2244                 uint32_t proto _U_, int depth _U_)
2245 {
2246         return ikev2_gen_print(ndo, tpay, ext);
2247 }
2248
2249 static const u_char *
2250 ikev2_auth_print(netdissect_options *ndo, u_char tpay,
2251                 const struct isakmp_gen *ext,
2252                 u_int item_len _U_, const u_char *ep,
2253                 uint32_t phase _U_, uint32_t doi _U_,
2254                 uint32_t proto _U_, int depth _U_)
2255 {
2256         struct ikev2_auth a;
2257         const char *v2_auth[]={ "invalid", "rsasig",
2258                                 "shared-secret", "dsssig" };
2259         const u_char *authdata = (const u_char*)ext + sizeof(a);
2260         unsigned int len;
2261
2262         ND_TCHECK(*ext);
2263         UNALIGNED_MEMCPY(&a, ext, sizeof(a));
2264         ikev2_pay_print(ndo, NPSTR(tpay), a.h.critical);
2265         len = ntohs(a.h.len);
2266
2267         ND_PRINT((ndo," len=%d method=%s", len-4,
2268                   STR_OR_ID(a.auth_method, v2_auth)));
2269
2270         if (1 < ndo->ndo_vflag && 4 < len) {
2271                 ND_PRINT((ndo," authdata=("));
2272                 if (!rawprint(ndo, (const uint8_t *)authdata, len - sizeof(a)))
2273                         goto trunc;
2274                 ND_PRINT((ndo,") "));
2275         } else if(ndo->ndo_vflag && 4 < len) {
2276                 if(!ike_show_somedata(ndo, authdata, ep)) goto trunc;
2277         }
2278
2279         return (const u_char *)ext + len;
2280 trunc:
2281         ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
2282         return NULL;
2283 }
2284
2285 static const u_char *
2286 ikev2_nonce_print(netdissect_options *ndo, u_char tpay,
2287                 const struct isakmp_gen *ext,
2288                 u_int item_len _U_, const u_char *ep,
2289                 uint32_t phase _U_, uint32_t doi _U_,
2290                 uint32_t proto _U_, int depth _U_)
2291 {
2292         struct isakmp_gen e;
2293
2294         ND_TCHECK(*ext);
2295         UNALIGNED_MEMCPY(&e, ext, sizeof(e));
2296         ikev2_pay_print(ndo, "nonce", e.critical);
2297
2298         ND_PRINT((ndo," len=%d", ntohs(e.len) - 4));
2299         if (1 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
2300                 ND_PRINT((ndo," nonce=("));
2301                 if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4))
2302                         goto trunc;
2303                 ND_PRINT((ndo,") "));
2304         } else if(ndo->ndo_vflag && 4 < ntohs(e.len)) {
2305                 if(!ike_show_somedata(ndo, (const u_char *)(ext+1), ep)) goto trunc;
2306         }
2307
2308         return (const u_char *)ext + ntohs(e.len);
2309 trunc:
2310         ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
2311         return NULL;
2312 }
2313
2314 /* notify payloads */
2315 static const u_char *
2316 ikev2_n_print(netdissect_options *ndo, u_char tpay _U_,
2317                 const struct isakmp_gen *ext,
2318                 u_int item_len, const u_char *ep,
2319                 uint32_t phase _U_, uint32_t doi _U_,
2320                 uint32_t proto _U_, int depth _U_)
2321 {
2322         const struct ikev2_n *p;
2323         struct ikev2_n n;
2324         const u_char *cp;
2325         u_char showspi, showdata, showsomedata;
2326         const char *notify_name;
2327         uint32_t type;
2328
2329         p = (const struct ikev2_n *)ext;
2330         ND_TCHECK(*p);
2331         UNALIGNED_MEMCPY(&n, ext, sizeof(n));
2332         ikev2_pay_print(ndo, NPSTR(ISAKMP_NPTYPE_N), n.h.critical);
2333
2334         showspi = 1;
2335         showdata = 0;
2336         showsomedata=0;
2337         notify_name=NULL;
2338
2339         ND_PRINT((ndo," prot_id=%s", PROTOIDSTR(n.prot_id)));
2340
2341         type = ntohs(n.type);
2342
2343         /* notify space is annoying sparse */
2344         switch(type) {
2345         case IV2_NOTIFY_UNSUPPORTED_CRITICAL_PAYLOAD:
2346                 notify_name = "unsupported_critical_payload";
2347                 showspi = 0;
2348                 break;
2349
2350         case IV2_NOTIFY_INVALID_IKE_SPI:
2351                 notify_name = "invalid_ike_spi";
2352                 showspi = 1;
2353                 break;
2354
2355         case IV2_NOTIFY_INVALID_MAJOR_VERSION:
2356                 notify_name = "invalid_major_version";
2357                 showspi = 0;
2358                 break;
2359
2360         case IV2_NOTIFY_INVALID_SYNTAX:
2361                 notify_name = "invalid_syntax";
2362                 showspi = 1;
2363                 break;
2364
2365         case IV2_NOTIFY_INVALID_MESSAGE_ID:
2366                 notify_name = "invalid_message_id";
2367                 showspi = 1;
2368                 break;
2369
2370         case IV2_NOTIFY_INVALID_SPI:
2371                 notify_name = "invalid_spi";
2372                 showspi = 1;
2373                 break;
2374
2375         case IV2_NOTIFY_NO_PROPOSAL_CHOSEN:
2376                 notify_name = "no_protocol_chosen";
2377                 showspi = 1;
2378                 break;
2379
2380         case IV2_NOTIFY_INVALID_KE_PAYLOAD:
2381                 notify_name = "invalid_ke_payload";
2382                 showspi = 1;
2383                 break;
2384
2385         case IV2_NOTIFY_AUTHENTICATION_FAILED:
2386                 notify_name = "authentication_failed";
2387                 showspi = 1;
2388                 break;
2389
2390         case IV2_NOTIFY_SINGLE_PAIR_REQUIRED:
2391                 notify_name = "single_pair_required";
2392                 showspi = 1;
2393                 break;
2394
2395         case IV2_NOTIFY_NO_ADDITIONAL_SAS:
2396                 notify_name = "no_additional_sas";
2397                 showspi = 0;
2398                 break;
2399
2400         case IV2_NOTIFY_INTERNAL_ADDRESS_FAILURE:
2401                 notify_name = "internal_address_failure";
2402                 showspi = 0;
2403                 break;
2404
2405         case IV2_NOTIFY_FAILED_CP_REQUIRED:
2406                 notify_name = "failed:cp_required";
2407                 showspi = 0;
2408                 break;
2409
2410         case IV2_NOTIFY_INVALID_SELECTORS:
2411                 notify_name = "invalid_selectors";
2412                 showspi = 0;
2413                 break;
2414
2415         case IV2_NOTIFY_INITIAL_CONTACT:
2416                 notify_name = "initial_contact";
2417                 showspi = 0;
2418                 break;
2419
2420         case IV2_NOTIFY_SET_WINDOW_SIZE:
2421                 notify_name = "set_window_size";
2422                 showspi = 0;
2423                 break;
2424
2425         case IV2_NOTIFY_ADDITIONAL_TS_POSSIBLE:
2426                 notify_name = "additional_ts_possible";
2427                 showspi = 0;
2428                 break;
2429
2430         case IV2_NOTIFY_IPCOMP_SUPPORTED:
2431                 notify_name = "ipcomp_supported";
2432                 showspi = 0;
2433                 break;
2434
2435         case IV2_NOTIFY_NAT_DETECTION_SOURCE_IP:
2436                 notify_name = "nat_detection_source_ip";
2437                 showspi = 1;
2438                 break;
2439
2440         case IV2_NOTIFY_NAT_DETECTION_DESTINATION_IP:
2441                 notify_name = "nat_detection_destination_ip";
2442                 showspi = 1;
2443                 break;
2444
2445         case IV2_NOTIFY_COOKIE:
2446                 notify_name = "cookie";
2447                 showspi = 1;
2448                 showsomedata= 1;
2449                 showdata= 0;
2450                 break;
2451
2452         case IV2_NOTIFY_USE_TRANSPORT_MODE:
2453                 notify_name = "use_transport_mode";
2454                 showspi = 0;
2455                 break;
2456
2457         case IV2_NOTIFY_HTTP_CERT_LOOKUP_SUPPORTED:
2458                 notify_name = "http_cert_lookup_supported";
2459                 showspi = 0;
2460                 break;
2461
2462         case IV2_NOTIFY_REKEY_SA:
2463                 notify_name = "rekey_sa";
2464                 showspi = 1;
2465                 break;
2466
2467         case IV2_NOTIFY_ESP_TFC_PADDING_NOT_SUPPORTED:
2468                 notify_name = "tfc_padding_not_supported";
2469                 showspi = 0;
2470                 break;
2471
2472         case IV2_NOTIFY_NON_FIRST_FRAGMENTS_ALSO:
2473                 notify_name = "non_first_fragment_also";
2474                 showspi = 0;
2475                 break;
2476
2477         default:
2478                 if (type < 8192) {
2479                         notify_name="error";
2480                 } else if(type < 16384) {
2481                         notify_name="private-error";
2482                 } else if(type < 40960) {
2483                         notify_name="status";
2484                 } else {
2485                         notify_name="private-status";
2486                 }
2487         }
2488
2489         if(notify_name) {
2490                 ND_PRINT((ndo," type=%u(%s)", type, notify_name));
2491         }
2492
2493
2494         if (showspi && n.spi_size) {
2495                 ND_PRINT((ndo," spi="));
2496                 if (!rawprint(ndo, (const uint8_t *)(p + 1), n.spi_size))
2497                         goto trunc;
2498         }
2499
2500         cp = (const u_char *)(p + 1) + n.spi_size;
2501
2502         if(3 < ndo->ndo_vflag) {
2503                 showdata = 1;
2504         }
2505
2506         if ((showdata || (showsomedata && ep-cp < 30)) && cp < ep) {
2507                 ND_PRINT((ndo," data=("));
2508                 if (!rawprint(ndo, (const uint8_t *)(cp), ep - cp))
2509                         goto trunc;
2510
2511                 ND_PRINT((ndo,")"));
2512
2513         } else if(showsomedata && cp < ep) {
2514                 if(!ike_show_somedata(ndo, cp, ep)) goto trunc;
2515         }
2516
2517         return (const u_char *)ext + item_len;
2518 trunc:
2519         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_N)));
2520         return NULL;
2521 }
2522
2523 static const u_char *
2524 ikev2_d_print(netdissect_options *ndo, u_char tpay,
2525                 const struct isakmp_gen *ext,
2526                 u_int item_len _U_, const u_char *ep _U_,
2527                 uint32_t phase _U_, uint32_t doi _U_,
2528                 uint32_t proto _U_, int depth _U_)
2529 {
2530         return ikev2_gen_print(ndo, tpay, ext);
2531 }
2532
2533 static const u_char *
2534 ikev2_vid_print(netdissect_options *ndo, u_char tpay,
2535                 const struct isakmp_gen *ext,
2536                 u_int item_len _U_, const u_char *ep _U_,
2537                 uint32_t phase _U_, uint32_t doi _U_,
2538                 uint32_t proto _U_, int depth _U_)
2539 {
2540         struct isakmp_gen e;
2541         const u_char *vid;
2542         int i, len;
2543
2544         ND_TCHECK(*ext);
2545         UNALIGNED_MEMCPY(&e, ext, sizeof(e));
2546         ikev2_pay_print(ndo, NPSTR(tpay), e.critical);
2547         ND_PRINT((ndo," len=%d vid=", ntohs(e.len) - 4));
2548
2549         vid = (const u_char *)(ext+1);
2550         len = ntohs(e.len) - 4;
2551         ND_TCHECK2(*vid, len);
2552         for(i=0; i<len; i++) {
2553                 if(ND_ISPRINT(vid[i])) ND_PRINT((ndo, "%c", vid[i]));
2554                 else ND_PRINT((ndo, "."));
2555         }
2556         if (2 < ndo->ndo_vflag && 4 < len) {
2557                 ND_PRINT((ndo," "));
2558                 if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4))
2559                         goto trunc;
2560         }
2561         return (const u_char *)ext + ntohs(e.len);
2562 trunc:
2563         ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
2564         return NULL;
2565 }
2566
2567 static const u_char *
2568 ikev2_TS_print(netdissect_options *ndo, u_char tpay,
2569                 const struct isakmp_gen *ext,
2570                 u_int item_len _U_, const u_char *ep _U_,
2571                 uint32_t phase _U_, uint32_t doi _U_,
2572                 uint32_t proto _U_, int depth _U_)
2573 {
2574         return ikev2_gen_print(ndo, tpay, ext);
2575 }
2576
2577 static const u_char *
2578 ikev2_e_print(netdissect_options *ndo,
2579 #ifndef HAVE_LIBCRYPTO
2580               _U_
2581 #endif
2582               struct isakmp *base,
2583               u_char tpay,
2584               const struct isakmp_gen *ext,
2585               u_int item_len _U_, const u_char *ep _U_,
2586 #ifndef HAVE_LIBCRYPTO
2587               _U_
2588 #endif
2589               uint32_t phase,
2590 #ifndef HAVE_LIBCRYPTO
2591               _U_
2592 #endif
2593               uint32_t doi,
2594 #ifndef HAVE_LIBCRYPTO
2595               _U_
2596 #endif
2597               uint32_t proto,
2598 #ifndef HAVE_LIBCRYPTO
2599               _U_
2600 #endif
2601               int depth)
2602 {
2603         struct isakmp_gen e;
2604         const u_char *dat;
2605         volatile int dlen;
2606
2607         ND_TCHECK(*ext);
2608         UNALIGNED_MEMCPY(&e, ext, sizeof(e));
2609         ikev2_pay_print(ndo, NPSTR(tpay), e.critical);
2610
2611         dlen = ntohs(e.len)-4;
2612
2613         ND_PRINT((ndo," len=%d", dlen));
2614         if (2 < ndo->ndo_vflag && 4 < dlen) {
2615                 ND_PRINT((ndo," "));
2616                 if (!rawprint(ndo, (const uint8_t *)(ext + 1), dlen))
2617                         goto trunc;
2618         }
2619
2620         dat = (const u_char *)(ext+1);
2621         ND_TCHECK2(*dat, dlen);
2622
2623 #ifdef HAVE_LIBCRYPTO
2624         /* try to decypt it! */
2625         if(esp_print_decrypt_buffer_by_ikev2(ndo,
2626                                              base->flags & ISAKMP_FLAG_I,
2627                                              base->i_ck, base->r_ck,
2628                                              dat, dat+dlen)) {
2629
2630                 ext = (const struct isakmp_gen *)ndo->ndo_packetp;
2631
2632                 /* got it decrypted, print stuff inside. */
2633                 ikev2_sub_print(ndo, base, e.np, ext, ndo->ndo_snapend,
2634                                 phase, doi, proto, depth+1);
2635         }
2636 #endif
2637
2638
2639         /* always return NULL, because E must be at end, and NP refers
2640          * to what was inside.
2641          */
2642         return NULL;
2643 trunc:
2644         ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
2645         return NULL;
2646 }
2647
2648 static const u_char *
2649 ikev2_cp_print(netdissect_options *ndo, u_char tpay,
2650                 const struct isakmp_gen *ext,
2651                 u_int item_len _U_, const u_char *ep _U_,
2652                 uint32_t phase _U_, uint32_t doi _U_,
2653                 uint32_t proto _U_, int depth _U_)
2654 {
2655         return ikev2_gen_print(ndo, tpay, ext);
2656 }
2657
2658 static const u_char *
2659 ikev2_eap_print(netdissect_options *ndo, u_char tpay,
2660                 const struct isakmp_gen *ext,
2661                 u_int item_len _U_, const u_char *ep _U_,
2662                 uint32_t phase _U_, uint32_t doi _U_,
2663                 uint32_t proto _U_, int depth _U_)
2664 {
2665         return ikev2_gen_print(ndo, tpay, ext);
2666 }
2667
2668 static const u_char *
2669 ike_sub0_print(netdissect_options *ndo,
2670                  u_char np, const struct isakmp_gen *ext, const u_char *ep,
2671
2672                uint32_t phase, uint32_t doi, uint32_t proto, int depth)
2673 {
2674         const u_char *cp;
2675         struct isakmp_gen e;
2676         u_int item_len;
2677
2678         cp = (const u_char *)ext;
2679         ND_TCHECK(*ext);
2680         UNALIGNED_MEMCPY(&e, ext, sizeof(e));
2681
2682         /*
2683          * Since we can't have a payload length of less than 4 bytes,
2684          * we need to bail out here if the generic header is nonsensical
2685          * or truncated, otherwise we could loop forever processing
2686          * zero-length items or otherwise misdissect the packet.
2687          */
2688         item_len = ntohs(e.len);
2689         if (item_len <= 4)
2690                 return NULL;
2691
2692         if (NPFUNC(np)) {
2693                 /*
2694                  * XXX - what if item_len is too short, or too long,
2695                  * for this payload type?
2696                  */
2697                 cp = (*npfunc[np])(ndo, np, ext, item_len, ep, phase, doi, proto, depth);
2698         } else {
2699                 ND_PRINT((ndo,"%s", NPSTR(np)));
2700                 cp += item_len;
2701         }
2702
2703         return cp;
2704 trunc:
2705         ND_PRINT((ndo," [|isakmp]"));
2706         return NULL;
2707 }
2708
2709 static const u_char *
2710 ikev1_sub_print(netdissect_options *ndo,
2711                 u_char np, const struct isakmp_gen *ext, const u_char *ep,
2712                 uint32_t phase, uint32_t doi, uint32_t proto, int depth)
2713 {
2714         const u_char *cp;
2715         int i;
2716         struct isakmp_gen e;
2717
2718         cp = (const u_char *)ext;
2719
2720         while (np) {
2721                 ND_TCHECK(*ext);
2722
2723                 UNALIGNED_MEMCPY(&e, ext, sizeof(e));
2724
2725                 ND_TCHECK2(*ext, ntohs(e.len));
2726
2727                 depth++;
2728                 ND_PRINT((ndo,"\n"));
2729                 for (i = 0; i < depth; i++)
2730                         ND_PRINT((ndo,"    "));
2731                 ND_PRINT((ndo,"("));
2732                 cp = ike_sub0_print(ndo, np, ext, ep, phase, doi, proto, depth);
2733                 ND_PRINT((ndo,")"));
2734                 depth--;
2735
2736                 if (cp == NULL) {
2737                         /* Zero-length subitem */
2738                         return NULL;
2739                 }
2740
2741                 np = e.np;
2742                 ext = (const struct isakmp_gen *)cp;
2743         }
2744         return cp;
2745 trunc:
2746         ND_PRINT((ndo," [|%s]", NPSTR(np)));
2747         return NULL;
2748 }
2749
2750 static char *
2751 numstr(int x)
2752 {
2753         static char buf[20];
2754         snprintf(buf, sizeof(buf), "#%d", x);
2755         return buf;
2756 }
2757
2758 static void
2759 ikev1_print(netdissect_options *ndo,
2760             const u_char *bp,  u_int length,
2761             const u_char *bp2, struct isakmp *base)
2762 {
2763         const struct isakmp *p;
2764         const u_char *ep;
2765         u_char np;
2766         int i;
2767         int phase;
2768
2769         p = (const struct isakmp *)bp;
2770         ep = ndo->ndo_snapend;
2771
2772         phase = (EXTRACT_32BITS(base->msgid) == 0) ? 1 : 2;
2773         if (phase == 1)
2774                 ND_PRINT((ndo," phase %d", phase));
2775         else
2776                 ND_PRINT((ndo," phase %d/others", phase));
2777
2778         i = cookie_find(&base->i_ck);
2779         if (i < 0) {
2780                 if (iszero((const u_char *)&base->r_ck, sizeof(base->r_ck))) {
2781                         /* the first packet */
2782                         ND_PRINT((ndo," I"));
2783                         if (bp2)
2784                                 cookie_record(&base->i_ck, bp2);
2785                 } else
2786                         ND_PRINT((ndo," ?"));
2787         } else {
2788                 if (bp2 && cookie_isinitiator(i, bp2))
2789                         ND_PRINT((ndo," I"));
2790                 else if (bp2 && cookie_isresponder(i, bp2))
2791                         ND_PRINT((ndo," R"));
2792                 else
2793                         ND_PRINT((ndo," ?"));
2794         }
2795
2796         ND_PRINT((ndo," %s", ETYPESTR(base->etype)));
2797         if (base->flags) {
2798                 ND_PRINT((ndo,"[%s%s]", base->flags & ISAKMP_FLAG_E ? "E" : "",
2799                           base->flags & ISAKMP_FLAG_C ? "C" : ""));
2800         }
2801
2802         if (ndo->ndo_vflag) {
2803                 const struct isakmp_gen *ext;
2804
2805                 ND_PRINT((ndo,":"));
2806
2807                 /* regardless of phase... */
2808                 if (base->flags & ISAKMP_FLAG_E) {
2809                         /*
2810                          * encrypted, nothing we can do right now.
2811                          * we hope to decrypt the packet in the future...
2812                          */
2813                         ND_PRINT((ndo," [encrypted %s]", NPSTR(base->np)));
2814                         goto done;
2815                 }
2816
2817                 CHECKLEN(p + 1, base->np);
2818                 np = base->np;
2819                 ext = (const struct isakmp_gen *)(p + 1);
2820                 ikev1_sub_print(ndo, np, ext, ep, phase, 0, 0, 0);
2821         }
2822
2823 done:
2824         if (ndo->ndo_vflag) {
2825                 if (ntohl(base->len) != length) {
2826                         ND_PRINT((ndo," (len mismatch: isakmp %u/ip %u)",
2827                                   (uint32_t)ntohl(base->len), length));
2828                 }
2829         }
2830 }
2831
2832 static const u_char *
2833 ikev2_sub0_print(netdissect_options *ndo, struct isakmp *base,
2834                  u_char np,
2835                  const struct isakmp_gen *ext, const u_char *ep,
2836                  uint32_t phase, uint32_t doi, uint32_t proto, int depth)
2837 {
2838         const u_char *cp;
2839         struct isakmp_gen e;
2840         u_int item_len;
2841
2842         cp = (const u_char *)ext;
2843         ND_TCHECK(*ext);
2844         UNALIGNED_MEMCPY(&e, ext, sizeof(e));
2845
2846         /*
2847          * Since we can't have a payload length of less than 4 bytes,
2848          * we need to bail out here if the generic header is nonsensical
2849          * or truncated, otherwise we could loop forever processing
2850          * zero-length items or otherwise misdissect the packet.
2851          */
2852         item_len = ntohs(e.len);
2853         if (item_len <= 4)
2854                 return NULL;
2855
2856         if (np == ISAKMP_NPTYPE_v2E) {
2857                 cp = ikev2_e_print(ndo, base, np, ext, item_len,
2858                                    ep, phase, doi, proto, depth);
2859         } else if (NPFUNC(np)) {
2860                 /*
2861                  * XXX - what if item_len is too short, or too long,
2862                  * for this payload type?
2863                  */
2864                 cp = (*npfunc[np])(ndo, np, ext, item_len,
2865                                    ep, phase, doi, proto, depth);
2866         } else {
2867                 ND_PRINT((ndo,"%s", NPSTR(np)));
2868                 cp += item_len;
2869         }
2870
2871         return cp;
2872 trunc:
2873         ND_PRINT((ndo," [|isakmp]"));
2874         return NULL;
2875 }
2876
2877 static const u_char *
2878 ikev2_sub_print(netdissect_options *ndo,
2879                 struct isakmp *base,
2880                 u_char np, const struct isakmp_gen *ext, const u_char *ep,
2881                 uint32_t phase, uint32_t doi, uint32_t proto, int depth)
2882 {
2883         const u_char *cp;
2884         int i;
2885         struct isakmp_gen e;
2886
2887         cp = (const u_char *)ext;
2888         while (np) {
2889                 ND_TCHECK(*ext);
2890
2891                 UNALIGNED_MEMCPY(&e, ext, sizeof(e));
2892
2893                 ND_TCHECK2(*ext, ntohs(e.len));
2894
2895                 depth++;
2896                 ND_PRINT((ndo,"\n"));
2897                 for (i = 0; i < depth; i++)
2898                         ND_PRINT((ndo,"    "));
2899                 ND_PRINT((ndo,"("));
2900                 cp = ikev2_sub0_print(ndo, base, np,
2901                                       ext, ep, phase, doi, proto, depth);
2902                 ND_PRINT((ndo,")"));
2903                 depth--;
2904
2905                 if (cp == NULL) {
2906                         /* Zero-length subitem */
2907                         return NULL;
2908                 }
2909
2910                 np = e.np;
2911                 ext = (const struct isakmp_gen *)cp;
2912         }
2913         return cp;
2914 trunc:
2915         ND_PRINT((ndo," [|%s]", NPSTR(np)));
2916         return NULL;
2917 }
2918
2919 static void
2920 ikev2_print(netdissect_options *ndo,
2921             const u_char *bp,  u_int length,
2922             const u_char *bp2 _U_, struct isakmp *base)
2923 {
2924         const struct isakmp *p;
2925         const u_char *ep;
2926         u_char np;
2927         int phase;
2928
2929         p = (const struct isakmp *)bp;
2930         ep = ndo->ndo_snapend;
2931
2932         phase = (EXTRACT_32BITS(base->msgid) == 0) ? 1 : 2;
2933         if (phase == 1)
2934                 ND_PRINT((ndo, " parent_sa"));
2935         else
2936                 ND_PRINT((ndo, " child_sa "));
2937
2938         ND_PRINT((ndo, " %s", ETYPESTR(base->etype)));
2939         if (base->flags) {
2940                 ND_PRINT((ndo, "[%s%s%s]",
2941                           base->flags & ISAKMP_FLAG_I ? "I" : "",
2942                           base->flags & ISAKMP_FLAG_V ? "V" : "",
2943                           base->flags & ISAKMP_FLAG_R ? "R" : ""));
2944         }
2945
2946         if (ndo->ndo_vflag) {
2947                 const struct isakmp_gen *ext;
2948
2949                 ND_PRINT((ndo, ":"));
2950
2951                 /* regardless of phase... */
2952                 if (base->flags & ISAKMP_FLAG_E) {
2953                         /*
2954                          * encrypted, nothing we can do right now.
2955                          * we hope to decrypt the packet in the future...
2956                          */
2957                         ND_PRINT((ndo, " [encrypted %s]", NPSTR(base->np)));
2958                         goto done;
2959                 }
2960
2961                 CHECKLEN(p + 1, base->np)
2962
2963                 np = base->np;
2964                 ext = (const struct isakmp_gen *)(p + 1);
2965                 ikev2_sub_print(ndo, base, np, ext, ep, phase, 0, 0, 0);
2966         }
2967
2968 done:
2969         if (ndo->ndo_vflag) {
2970                 if (ntohl(base->len) != length) {
2971                         ND_PRINT((ndo, " (len mismatch: isakmp %u/ip %u)",
2972                                   (uint32_t)ntohl(base->len), length));
2973                 }
2974         }
2975 }
2976
2977 void
2978 isakmp_print(netdissect_options *ndo,
2979              const u_char *bp, u_int length,
2980              const u_char *bp2)
2981 {
2982         const struct isakmp *p;
2983         struct isakmp base;
2984         const u_char *ep;
2985         int major, minor;
2986
2987 #ifdef HAVE_LIBCRYPTO
2988         /* initialize SAs */
2989         if (ndo->ndo_sa_list_head == NULL) {
2990                 if (ndo->ndo_espsecret)
2991                         esp_print_decodesecret(ndo);
2992         }
2993 #endif
2994
2995         p = (const struct isakmp *)bp;
2996         ep = ndo->ndo_snapend;
2997
2998         if ((const struct isakmp *)ep < p + 1) {
2999                 ND_PRINT((ndo,"[|isakmp]"));
3000                 return;
3001         }
3002
3003         UNALIGNED_MEMCPY(&base, p, sizeof(base));
3004
3005         ND_PRINT((ndo,"isakmp"));
3006         major = (base.vers & ISAKMP_VERS_MAJOR)
3007                 >> ISAKMP_VERS_MAJOR_SHIFT;
3008         minor = (base.vers & ISAKMP_VERS_MINOR)
3009                 >> ISAKMP_VERS_MINOR_SHIFT;
3010
3011         if (ndo->ndo_vflag) {
3012                 ND_PRINT((ndo," %d.%d", major, minor));
3013         }
3014
3015         if (ndo->ndo_vflag) {
3016                 ND_PRINT((ndo," msgid "));
3017                 hexprint(ndo, (const uint8_t *)&base.msgid, sizeof(base.msgid));
3018         }
3019
3020         if (1 < ndo->ndo_vflag) {
3021                 ND_PRINT((ndo," cookie "));
3022                 hexprint(ndo, (const uint8_t *)&base.i_ck, sizeof(base.i_ck));
3023                 ND_PRINT((ndo,"->"));
3024                 hexprint(ndo, (const uint8_t *)&base.r_ck, sizeof(base.r_ck));
3025         }
3026         ND_PRINT((ndo,":"));
3027
3028         switch(major) {
3029         case IKEv1_MAJOR_VERSION:
3030                 ikev1_print(ndo, bp, length, bp2, &base);
3031                 break;
3032
3033         case IKEv2_MAJOR_VERSION:
3034                 ikev2_print(ndo, bp, length, bp2, &base);
3035                 break;
3036         }
3037 }
3038
3039 void
3040 isakmp_rfc3948_print(netdissect_options *ndo,
3041                      const u_char *bp, u_int length,
3042                      const u_char *bp2)
3043 {
3044
3045         if(length == 1 && bp[0]==0xff) {
3046                 ND_PRINT((ndo, "isakmp-nat-keep-alive"));
3047                 return;
3048         }
3049
3050         if(length < 4) {
3051                 goto trunc;
3052         }
3053
3054         /*
3055          * see if this is an IKE packet
3056          */
3057         if(bp[0]==0 && bp[1]==0 && bp[2]==0 && bp[3]==0) {
3058                 ND_PRINT((ndo, "NONESP-encap: "));
3059                 isakmp_print(ndo, bp+4, length-4, bp2);
3060                 return;
3061         }
3062
3063         /* must be an ESP packet */
3064         {
3065                 int nh, enh, padlen;
3066                 int advance;
3067
3068                 ND_PRINT((ndo, "UDP-encap: "));
3069
3070                 advance = esp_print(ndo, bp, length, bp2, &enh, &padlen);
3071                 if(advance <= 0)
3072                         return;
3073
3074                 bp += advance;
3075                 length -= advance + padlen;
3076                 nh = enh & 0xff;
3077
3078                 ip_print_inner(ndo, bp, length, nh, bp2);
3079                 return;
3080         }
3081
3082 trunc:
3083         ND_PRINT((ndo,"[|isakmp]"));
3084         return;
3085 }
3086
3087 /*
3088  * Local Variables:
3089  * c-style: whitesmith
3090  * c-basic-offset: 8
3091  * End:
3092  */
3093
3094
3095
3096