1 /* 2 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. Neither the name of the project nor the names of its contributors 14 * may be used to endorse or promote products derived from this software 15 * without specific prior written permission. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 * SUCH DAMAGE. 28 * 29 */ 30 31 /* \summary: Internet Security Association and Key Management Protocol (ISAKMP) printer */ 32 33 #ifdef HAVE_CONFIG_H 34 #include "config.h" 35 #endif 36 37 /* The functions from print-esp.c used in this file are only defined when both 38 * OpenSSL and evp.h are detected. Employ the same preprocessor device here. 39 */ 40 #ifndef HAVE_OPENSSL_EVP_H 41 #undef HAVE_LIBCRYPTO 42 #endif 43 44 #include <netdissect-stdinc.h> 45 46 #include <string.h> 47 48 #include "netdissect.h" 49 #include "addrtoname.h" 50 #include "extract.h" 51 52 #include "ip.h" 53 #include "ip6.h" 54 55 /* refer to RFC 2408 */ 56 57 typedef u_char cookie_t[8]; 58 typedef u_char msgid_t[4]; 59 60 #define PORT_ISAKMP 500 61 62 /* 3.1 ISAKMP Header Format (IKEv1 and IKEv2) 63 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 64 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 65 ! Initiator ! 66 ! Cookie ! 67 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 68 ! Responder ! 69 ! Cookie ! 70 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 71 ! Next Payload ! MjVer ! MnVer ! Exchange Type ! Flags ! 72 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 73 ! Message ID ! 74 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 75 ! Length ! 76 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 77 */ 78 struct isakmp { 79 cookie_t i_ck; /* Initiator Cookie */ 80 cookie_t r_ck; /* Responder Cookie */ 81 uint8_t np; /* Next Payload Type */ 82 uint8_t vers; 83 #define ISAKMP_VERS_MAJOR 0xf0 84 #define ISAKMP_VERS_MAJOR_SHIFT 4 85 #define ISAKMP_VERS_MINOR 0x0f 86 #define ISAKMP_VERS_MINOR_SHIFT 0 87 uint8_t etype; /* Exchange Type */ 88 uint8_t flags; /* Flags */ 89 msgid_t msgid; 90 uint32_t len; /* Length */ 91 }; 92 93 /* Next Payload Type */ 94 #define ISAKMP_NPTYPE_NONE 0 /* NONE*/ 95 #define ISAKMP_NPTYPE_SA 1 /* Security Association */ 96 #define ISAKMP_NPTYPE_P 2 /* Proposal */ 97 #define ISAKMP_NPTYPE_T 3 /* Transform */ 98 #define ISAKMP_NPTYPE_KE 4 /* Key Exchange */ 99 #define ISAKMP_NPTYPE_ID 5 /* Identification */ 100 #define ISAKMP_NPTYPE_CERT 6 /* Certificate */ 101 #define ISAKMP_NPTYPE_CR 7 /* Certificate Request */ 102 #define ISAKMP_NPTYPE_HASH 8 /* Hash */ 103 #define ISAKMP_NPTYPE_SIG 9 /* Signature */ 104 #define ISAKMP_NPTYPE_NONCE 10 /* Nonce */ 105 #define ISAKMP_NPTYPE_N 11 /* Notification */ 106 #define ISAKMP_NPTYPE_D 12 /* Delete */ 107 #define ISAKMP_NPTYPE_VID 13 /* Vendor ID */ 108 #define ISAKMP_NPTYPE_v2E 46 /* v2 Encrypted payload */ 109 110 #define IKEv1_MAJOR_VERSION 1 111 #define IKEv1_MINOR_VERSION 0 112 113 #define IKEv2_MAJOR_VERSION 2 114 #define IKEv2_MINOR_VERSION 0 115 116 /* Flags */ 117 #define ISAKMP_FLAG_E 0x01 /* Encryption Bit */ 118 #define ISAKMP_FLAG_C 0x02 /* Commit Bit */ 119 #define ISAKMP_FLAG_extra 0x04 120 121 /* IKEv2 */ 122 #define ISAKMP_FLAG_I (1 << 3) /* (I)nitiator */ 123 #define ISAKMP_FLAG_V (1 << 4) /* (V)ersion */ 124 #define ISAKMP_FLAG_R (1 << 5) /* (R)esponse */ 125 126 127 /* 3.2 Payload Generic Header 128 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 129 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 130 ! Next Payload ! RESERVED ! Payload Length ! 131 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 132 */ 133 struct isakmp_gen { 134 uint8_t np; /* Next Payload */ 135 uint8_t critical; /* bit 7 - critical, rest is RESERVED */ 136 uint16_t len; /* Payload Length */ 137 }; 138 139 /* 3.3 Data Attributes 140 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 141 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 142 !A! Attribute Type ! AF=0 Attribute Length ! 143 !F! ! AF=1 Attribute Value ! 144 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 145 . AF=0 Attribute Value . 146 . AF=1 Not Transmitted . 147 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 148 */ 149 struct isakmp_data { 150 uint16_t type; /* defined by DOI-spec, and Attribute Format */ 151 uint16_t lorv; /* if f equal 1, Attribute Length */ 152 /* if f equal 0, Attribute Value */ 153 /* if f equal 1, Attribute Value */ 154 }; 155 156 /* 3.4 Security Association Payload */ 157 /* MAY NOT be used, because of being defined in ipsec-doi. */ 158 /* 159 If the current payload is the last in the message, 160 then the value of the next payload field will be 0. 161 This field MUST NOT contain the 162 values for the Proposal or Transform payloads as they are considered 163 part of the security association negotiation. For example, this 164 field would contain the value "10" (Nonce payload) in the first 165 message of a Base Exchange (see Section 4.4) and the value "0" in the 166 first message of an Identity Protect Exchange (see Section 4.5). 167 */ 168 struct ikev1_pl_sa { 169 struct isakmp_gen h; 170 uint32_t doi; /* Domain of Interpretation */ 171 uint32_t sit; /* Situation */ 172 }; 173 174 /* 3.5 Proposal Payload */ 175 /* 176 The value of the next payload field MUST only contain the value "2" 177 or "0". If there are additional Proposal payloads in the message, 178 then this field will be 2. If the current Proposal payload is the 179 last within the security association proposal, then this field will 180 be 0. 181 */ 182 struct ikev1_pl_p { 183 struct isakmp_gen h; 184 uint8_t p_no; /* Proposal # */ 185 uint8_t prot_id; /* Protocol */ 186 uint8_t spi_size; /* SPI Size */ 187 uint8_t num_t; /* Number of Transforms */ 188 /* SPI */ 189 }; 190 191 /* 3.6 Transform Payload */ 192 /* 193 The value of the next payload field MUST only contain the value "3" 194 or "0". If there are additional Transform payloads in the proposal, 195 then this field will be 3. If the current Transform payload is the 196 last within the proposal, then this field will be 0. 197 */ 198 struct ikev1_pl_t { 199 struct isakmp_gen h; 200 uint8_t t_no; /* Transform # */ 201 uint8_t t_id; /* Transform-Id */ 202 uint16_t reserved; /* RESERVED2 */ 203 /* SA Attributes */ 204 }; 205 206 /* 3.7 Key Exchange Payload */ 207 struct ikev1_pl_ke { 208 struct isakmp_gen h; 209 /* Key Exchange Data */ 210 }; 211 212 /* 3.8 Identification Payload */ 213 /* MUST NOT to be used, because of being defined in ipsec-doi. */ 214 struct ikev1_pl_id { 215 struct isakmp_gen h; 216 union { 217 uint8_t id_type; /* ID Type */ 218 uint32_t doi_data; /* DOI Specific ID Data */ 219 } d; 220 /* Identification Data */ 221 }; 222 223 /* 3.9 Certificate Payload */ 224 struct ikev1_pl_cert { 225 struct isakmp_gen h; 226 uint8_t encode; /* Cert Encoding */ 227 char cert; /* Certificate Data */ 228 /* 229 This field indicates the type of 230 certificate or certificate-related information contained in the 231 Certificate Data field. 232 */ 233 }; 234 235 /* 3.10 Certificate Request Payload */ 236 struct ikev1_pl_cr { 237 struct isakmp_gen h; 238 uint8_t num_cert; /* # Cert. Types */ 239 /* 240 Certificate Types (variable length) 241 -- Contains a list of the types of certificates requested, 242 sorted in order of preference. Each individual certificate 243 type is 1 octet. This field is NOT requiredo 244 */ 245 /* # Certificate Authorities (1 octet) */ 246 /* Certificate Authorities (variable length) */ 247 }; 248 249 /* 3.11 Hash Payload */ 250 /* may not be used, because of having only data. */ 251 struct ikev1_pl_hash { 252 struct isakmp_gen h; 253 /* Hash Data */ 254 }; 255 256 /* 3.12 Signature Payload */ 257 /* may not be used, because of having only data. */ 258 struct ikev1_pl_sig { 259 struct isakmp_gen h; 260 /* Signature Data */ 261 }; 262 263 /* 3.13 Nonce Payload */ 264 /* may not be used, because of having only data. */ 265 struct ikev1_pl_nonce { 266 struct isakmp_gen h; 267 /* Nonce Data */ 268 }; 269 270 /* 3.14 Notification Payload */ 271 struct ikev1_pl_n { 272 struct isakmp_gen h; 273 uint32_t doi; /* Domain of Interpretation */ 274 uint8_t prot_id; /* Protocol-ID */ 275 uint8_t spi_size; /* SPI Size */ 276 uint16_t type; /* Notify Message Type */ 277 /* SPI */ 278 /* Notification Data */ 279 }; 280 281 /* 3.14.1 Notify Message Types */ 282 /* NOTIFY MESSAGES - ERROR TYPES */ 283 #define ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE 1 284 #define ISAKMP_NTYPE_DOI_NOT_SUPPORTED 2 285 #define ISAKMP_NTYPE_SITUATION_NOT_SUPPORTED 3 286 #define ISAKMP_NTYPE_INVALID_COOKIE 4 287 #define ISAKMP_NTYPE_INVALID_MAJOR_VERSION 5 288 #define ISAKMP_NTYPE_INVALID_MINOR_VERSION 6 289 #define ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE 7 290 #define ISAKMP_NTYPE_INVALID_FLAGS 8 291 #define ISAKMP_NTYPE_INVALID_MESSAGE_ID 9 292 #define ISAKMP_NTYPE_INVALID_PROTOCOL_ID 10 293 #define ISAKMP_NTYPE_INVALID_SPI 11 294 #define ISAKMP_NTYPE_INVALID_TRANSFORM_ID 12 295 #define ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED 13 296 #define ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN 14 297 #define ISAKMP_NTYPE_BAD_PROPOSAL_SYNTAX 15 298 #define ISAKMP_NTYPE_PAYLOAD_MALFORMED 16 299 #define ISAKMP_NTYPE_INVALID_KEY_INFORMATION 17 300 #define ISAKMP_NTYPE_INVALID_ID_INFORMATION 18 301 #define ISAKMP_NTYPE_INVALID_CERT_ENCODING 19 302 #define ISAKMP_NTYPE_INVALID_CERTIFICATE 20 303 #define ISAKMP_NTYPE_BAD_CERT_REQUEST_SYNTAX 21 304 #define ISAKMP_NTYPE_INVALID_CERT_AUTHORITY 22 305 #define ISAKMP_NTYPE_INVALID_HASH_INFORMATION 23 306 #define ISAKMP_NTYPE_AUTHENTICATION_FAILED 24 307 #define ISAKMP_NTYPE_INVALID_SIGNATURE 25 308 #define ISAKMP_NTYPE_ADDRESS_NOTIFICATION 26 309 310 /* 3.15 Delete Payload */ 311 struct ikev1_pl_d { 312 struct isakmp_gen h; 313 uint32_t doi; /* Domain of Interpretation */ 314 uint8_t prot_id; /* Protocol-Id */ 315 uint8_t spi_size; /* SPI Size */ 316 uint16_t num_spi; /* # of SPIs */ 317 /* SPI(es) */ 318 }; 319 320 struct ikev1_ph1tab { 321 struct ikev1_ph1 *head; 322 struct ikev1_ph1 *tail; 323 int len; 324 }; 325 326 struct isakmp_ph2tab { 327 struct ikev1_ph2 *head; 328 struct ikev1_ph2 *tail; 329 int len; 330 }; 331 332 /* IKEv2 (RFC4306) */ 333 334 /* 3.3 Security Association Payload -- generic header */ 335 /* 3.3.1. Proposal Substructure */ 336 struct ikev2_p { 337 struct isakmp_gen h; 338 uint8_t p_no; /* Proposal # */ 339 uint8_t prot_id; /* Protocol */ 340 uint8_t spi_size; /* SPI Size */ 341 uint8_t num_t; /* Number of Transforms */ 342 }; 343 344 /* 3.3.2. Transform Substructure */ 345 struct ikev2_t { 346 struct isakmp_gen h; 347 uint8_t t_type; /* Transform Type (ENCR,PRF,INTEG,etc.*/ 348 uint8_t res2; /* reserved byte */ 349 uint16_t t_id; /* Transform ID */ 350 }; 351 352 enum ikev2_t_type { 353 IV2_T_ENCR = 1, 354 IV2_T_PRF = 2, 355 IV2_T_INTEG= 3, 356 IV2_T_DH = 4, 357 IV2_T_ESN = 5 358 }; 359 360 /* 3.4. Key Exchange Payload */ 361 struct ikev2_ke { 362 struct isakmp_gen h; 363 uint16_t ke_group; 364 uint16_t ke_res1; 365 /* KE data */ 366 }; 367 368 369 /* 3.5. Identification Payloads */ 370 enum ikev2_id_type { 371 ID_IPV4_ADDR=1, 372 ID_FQDN=2, 373 ID_RFC822_ADDR=3, 374 ID_IPV6_ADDR=5, 375 ID_DER_ASN1_DN=9, 376 ID_DER_ASN1_GN=10, 377 ID_KEY_ID=11 378 }; 379 struct ikev2_id { 380 struct isakmp_gen h; 381 uint8_t type; /* ID type */ 382 uint8_t res1; 383 uint16_t res2; 384 /* SPI */ 385 /* Notification Data */ 386 }; 387 388 /* 3.10 Notification Payload */ 389 struct ikev2_n { 390 struct isakmp_gen h; 391 uint8_t prot_id; /* Protocol-ID */ 392 uint8_t spi_size; /* SPI Size */ 393 uint16_t type; /* Notify Message Type */ 394 }; 395 396 enum ikev2_n_type { 397 IV2_NOTIFY_UNSUPPORTED_CRITICAL_PAYLOAD = 1, 398 IV2_NOTIFY_INVALID_IKE_SPI = 4, 399 IV2_NOTIFY_INVALID_MAJOR_VERSION = 5, 400 IV2_NOTIFY_INVALID_SYNTAX = 7, 401 IV2_NOTIFY_INVALID_MESSAGE_ID = 9, 402 IV2_NOTIFY_INVALID_SPI =11, 403 IV2_NOTIFY_NO_PROPOSAL_CHOSEN =14, 404 IV2_NOTIFY_INVALID_KE_PAYLOAD =17, 405 IV2_NOTIFY_AUTHENTICATION_FAILED =24, 406 IV2_NOTIFY_SINGLE_PAIR_REQUIRED =34, 407 IV2_NOTIFY_NO_ADDITIONAL_SAS =35, 408 IV2_NOTIFY_INTERNAL_ADDRESS_FAILURE =36, 409 IV2_NOTIFY_FAILED_CP_REQUIRED =37, 410 IV2_NOTIFY_INVALID_SELECTORS =39, 411 IV2_NOTIFY_INITIAL_CONTACT =16384, 412 IV2_NOTIFY_SET_WINDOW_SIZE =16385, 413 IV2_NOTIFY_ADDITIONAL_TS_POSSIBLE =16386, 414 IV2_NOTIFY_IPCOMP_SUPPORTED =16387, 415 IV2_NOTIFY_NAT_DETECTION_SOURCE_IP =16388, 416 IV2_NOTIFY_NAT_DETECTION_DESTINATION_IP =16389, 417 IV2_NOTIFY_COOKIE =16390, 418 IV2_NOTIFY_USE_TRANSPORT_MODE =16391, 419 IV2_NOTIFY_HTTP_CERT_LOOKUP_SUPPORTED =16392, 420 IV2_NOTIFY_REKEY_SA =16393, 421 IV2_NOTIFY_ESP_TFC_PADDING_NOT_SUPPORTED =16394, 422 IV2_NOTIFY_NON_FIRST_FRAGMENTS_ALSO =16395 423 }; 424 425 struct notify_messages { 426 uint16_t type; 427 char *msg; 428 }; 429 430 /* 3.8 Notification Payload */ 431 struct ikev2_auth { 432 struct isakmp_gen h; 433 uint8_t auth_method; /* Protocol-ID */ 434 uint8_t reserved[3]; 435 /* authentication data */ 436 }; 437 438 enum ikev2_auth_type { 439 IV2_RSA_SIG = 1, 440 IV2_SHARED = 2, 441 IV2_DSS_SIG = 3 442 }; 443 444 /* refer to RFC 2409 */ 445 446 #if 0 447 /* isakmp sa structure */ 448 struct oakley_sa { 449 uint8_t proto_id; /* OAKLEY */ 450 vchar_t *spi; /* spi */ 451 uint8_t dhgrp; /* DH; group */ 452 uint8_t auth_t; /* method of authentication */ 453 uint8_t prf_t; /* type of prf */ 454 uint8_t hash_t; /* type of hash */ 455 uint8_t enc_t; /* type of cipher */ 456 uint8_t life_t; /* type of duration of lifetime */ 457 uint32_t ldur; /* life duration */ 458 }; 459 #endif 460 461 /* refer to RFC 2407 */ 462 463 #define IPSEC_DOI 1 464 465 /* 4.2 IPSEC Situation Definition */ 466 #define IPSECDOI_SIT_IDENTITY_ONLY 0x00000001 467 #define IPSECDOI_SIT_SECRECY 0x00000002 468 #define IPSECDOI_SIT_INTEGRITY 0x00000004 469 470 /* 4.4.1 IPSEC Security Protocol Identifiers */ 471 /* 4.4.2 IPSEC ISAKMP Transform Values */ 472 #define IPSECDOI_PROTO_ISAKMP 1 473 #define IPSECDOI_KEY_IKE 1 474 475 /* 4.4.1 IPSEC Security Protocol Identifiers */ 476 #define IPSECDOI_PROTO_IPSEC_AH 2 477 /* 4.4.3 IPSEC AH Transform Values */ 478 #define IPSECDOI_AH_MD5 2 479 #define IPSECDOI_AH_SHA 3 480 #define IPSECDOI_AH_DES 4 481 #define IPSECDOI_AH_SHA2_256 5 482 #define IPSECDOI_AH_SHA2_384 6 483 #define IPSECDOI_AH_SHA2_512 7 484 485 /* 4.4.1 IPSEC Security Protocol Identifiers */ 486 #define IPSECDOI_PROTO_IPSEC_ESP 3 487 /* 4.4.4 IPSEC ESP Transform Identifiers */ 488 #define IPSECDOI_ESP_DES_IV64 1 489 #define IPSECDOI_ESP_DES 2 490 #define IPSECDOI_ESP_3DES 3 491 #define IPSECDOI_ESP_RC5 4 492 #define IPSECDOI_ESP_IDEA 5 493 #define IPSECDOI_ESP_CAST 6 494 #define IPSECDOI_ESP_BLOWFISH 7 495 #define IPSECDOI_ESP_3IDEA 8 496 #define IPSECDOI_ESP_DES_IV32 9 497 #define IPSECDOI_ESP_RC4 10 498 #define IPSECDOI_ESP_NULL 11 499 #define IPSECDOI_ESP_RIJNDAEL 12 500 #define IPSECDOI_ESP_AES 12 501 502 /* 4.4.1 IPSEC Security Protocol Identifiers */ 503 #define IPSECDOI_PROTO_IPCOMP 4 504 /* 4.4.5 IPSEC IPCOMP Transform Identifiers */ 505 #define IPSECDOI_IPCOMP_OUI 1 506 #define IPSECDOI_IPCOMP_DEFLATE 2 507 #define IPSECDOI_IPCOMP_LZS 3 508 509 /* 4.5 IPSEC Security Association Attributes */ 510 #define IPSECDOI_ATTR_SA_LTYPE 1 /* B */ 511 #define IPSECDOI_ATTR_SA_LTYPE_DEFAULT 1 512 #define IPSECDOI_ATTR_SA_LTYPE_SEC 1 513 #define IPSECDOI_ATTR_SA_LTYPE_KB 2 514 #define IPSECDOI_ATTR_SA_LDUR 2 /* V */ 515 #define IPSECDOI_ATTR_SA_LDUR_DEFAULT 28800 /* 8 hours */ 516 #define IPSECDOI_ATTR_GRP_DESC 3 /* B */ 517 #define IPSECDOI_ATTR_ENC_MODE 4 /* B */ 518 /* default value: host dependent */ 519 #define IPSECDOI_ATTR_ENC_MODE_TUNNEL 1 520 #define IPSECDOI_ATTR_ENC_MODE_TRNS 2 521 #define IPSECDOI_ATTR_AUTH 5 /* B */ 522 /* 0 means not to use authentication. */ 523 #define IPSECDOI_ATTR_AUTH_HMAC_MD5 1 524 #define IPSECDOI_ATTR_AUTH_HMAC_SHA1 2 525 #define IPSECDOI_ATTR_AUTH_DES_MAC 3 526 #define IPSECDOI_ATTR_AUTH_KPDK 4 /*RFC-1826(Key/Pad/Data/Key)*/ 527 /* 528 * When negotiating ESP without authentication, the Auth 529 * Algorithm attribute MUST NOT be included in the proposal. 530 * When negotiating ESP without confidentiality, the Auth 531 * Algorithm attribute MUST be included in the proposal and 532 * the ESP transform ID must be ESP_NULL. 533 */ 534 #define IPSECDOI_ATTR_KEY_LENGTH 6 /* B */ 535 #define IPSECDOI_ATTR_KEY_ROUNDS 7 /* B */ 536 #define IPSECDOI_ATTR_COMP_DICT_SIZE 8 /* B */ 537 #define IPSECDOI_ATTR_COMP_PRIVALG 9 /* V */ 538 539 /* 4.6.1 Security Association Payload */ 540 struct ipsecdoi_sa { 541 struct isakmp_gen h; 542 uint32_t doi; /* Domain of Interpretation */ 543 uint32_t sit; /* Situation */ 544 }; 545 546 struct ipsecdoi_secrecy_h { 547 uint16_t len; 548 uint16_t reserved; 549 }; 550 551 /* 4.6.2.1 Identification Type Values */ 552 struct ipsecdoi_id { 553 struct isakmp_gen h; 554 uint8_t type; /* ID Type */ 555 uint8_t proto_id; /* Protocol ID */ 556 uint16_t port; /* Port */ 557 /* Identification Data */ 558 }; 559 560 #define IPSECDOI_ID_IPV4_ADDR 1 561 #define IPSECDOI_ID_FQDN 2 562 #define IPSECDOI_ID_USER_FQDN 3 563 #define IPSECDOI_ID_IPV4_ADDR_SUBNET 4 564 #define IPSECDOI_ID_IPV6_ADDR 5 565 #define IPSECDOI_ID_IPV6_ADDR_SUBNET 6 566 #define IPSECDOI_ID_IPV4_ADDR_RANGE 7 567 #define IPSECDOI_ID_IPV6_ADDR_RANGE 8 568 #define IPSECDOI_ID_DER_ASN1_DN 9 569 #define IPSECDOI_ID_DER_ASN1_GN 10 570 #define IPSECDOI_ID_KEY_ID 11 571 572 /* 4.6.3 IPSEC DOI Notify Message Types */ 573 /* Notify Messages - Status Types */ 574 #define IPSECDOI_NTYPE_RESPONDER_LIFETIME 24576 575 #define IPSECDOI_NTYPE_REPLAY_STATUS 24577 576 #define IPSECDOI_NTYPE_INITIAL_CONTACT 24578 577 578 #define DECLARE_PRINTER(func) static const u_char *ike##func##_print( \ 579 netdissect_options *ndo, u_char tpay, \ 580 const struct isakmp_gen *ext, \ 581 u_int item_len, \ 582 const u_char *end_pointer, \ 583 uint32_t phase,\ 584 uint32_t doi0, \ 585 uint32_t proto0, int depth) 586 587 DECLARE_PRINTER(v1_sa); 588 DECLARE_PRINTER(v1_p); 589 DECLARE_PRINTER(v1_t); 590 DECLARE_PRINTER(v1_ke); 591 DECLARE_PRINTER(v1_id); 592 DECLARE_PRINTER(v1_cert); 593 DECLARE_PRINTER(v1_cr); 594 DECLARE_PRINTER(v1_sig); 595 DECLARE_PRINTER(v1_hash); 596 DECLARE_PRINTER(v1_nonce); 597 DECLARE_PRINTER(v1_n); 598 DECLARE_PRINTER(v1_d); 599 DECLARE_PRINTER(v1_vid); 600 601 DECLARE_PRINTER(v2_sa); 602 DECLARE_PRINTER(v2_ke); 603 DECLARE_PRINTER(v2_ID); 604 DECLARE_PRINTER(v2_cert); 605 DECLARE_PRINTER(v2_cr); 606 DECLARE_PRINTER(v2_auth); 607 DECLARE_PRINTER(v2_nonce); 608 DECLARE_PRINTER(v2_n); 609 DECLARE_PRINTER(v2_d); 610 DECLARE_PRINTER(v2_vid); 611 DECLARE_PRINTER(v2_TS); 612 DECLARE_PRINTER(v2_cp); 613 DECLARE_PRINTER(v2_eap); 614 615 static const u_char *ikev2_e_print(netdissect_options *ndo, 616 struct isakmp *base, 617 u_char tpay, 618 const struct isakmp_gen *ext, 619 u_int item_len, 620 const u_char *end_pointer, 621 uint32_t phase, 622 uint32_t doi0, 623 uint32_t proto0, int depth); 624 625 626 static const u_char *ike_sub0_print(netdissect_options *ndo,u_char, const struct isakmp_gen *, 627 const u_char *, uint32_t, uint32_t, uint32_t, int); 628 static const u_char *ikev1_sub_print(netdissect_options *ndo,u_char, const struct isakmp_gen *, 629 const u_char *, uint32_t, uint32_t, uint32_t, int); 630 631 static const u_char *ikev2_sub_print(netdissect_options *ndo, 632 struct isakmp *base, 633 u_char np, const struct isakmp_gen *ext, 634 const u_char *ep, uint32_t phase, 635 uint32_t doi, uint32_t proto, 636 int depth); 637 638 639 static char *numstr(int); 640 641 static void 642 ikev1_print(netdissect_options *ndo, 643 const u_char *bp, u_int length, 644 const u_char *bp2, struct isakmp *base); 645 646 #define MAXINITIATORS 20 647 static int ninitiator = 0; 648 union inaddr_u { 649 struct in_addr in4; 650 struct in6_addr in6; 651 }; 652 static struct { 653 cookie_t initiator; 654 u_int version; 655 union inaddr_u iaddr; 656 union inaddr_u raddr; 657 } cookiecache[MAXINITIATORS]; 658 659 /* protocol id */ 660 static const char *protoidstr[] = { 661 NULL, "isakmp", "ipsec-ah", "ipsec-esp", "ipcomp", 662 }; 663 664 /* isakmp->np */ 665 static const char *npstr[] = { 666 "none", "sa", "p", "t", "ke", "id", "cert", "cr", "hash", /* 0 - 8 */ 667 "sig", "nonce", "n", "d", "vid", /* 9 - 13 */ 668 "pay14", "pay15", "pay16", "pay17", "pay18", /* 14- 18 */ 669 "pay19", "pay20", "pay21", "pay22", "pay23", /* 19- 23 */ 670 "pay24", "pay25", "pay26", "pay27", "pay28", /* 24- 28 */ 671 "pay29", "pay30", "pay31", "pay32", /* 29- 32 */ 672 "v2sa", "v2ke", "v2IDi", "v2IDr", "v2cert",/* 33- 37 */ 673 "v2cr", "v2auth","v2nonce", "v2n", "v2d", /* 38- 42 */ 674 "v2vid", "v2TSi", "v2TSr", "v2e", "v2cp", /* 43- 47 */ 675 "v2eap", /* 48 */ 676 677 }; 678 679 /* isakmp->np */ 680 static const u_char *(*npfunc[])(netdissect_options *ndo, u_char tpay, 681 const struct isakmp_gen *ext, 682 u_int item_len, 683 const u_char *end_pointer, 684 uint32_t phase, 685 uint32_t doi0, 686 uint32_t proto0, int depth) = { 687 NULL, 688 ikev1_sa_print, 689 ikev1_p_print, 690 ikev1_t_print, 691 ikev1_ke_print, 692 ikev1_id_print, 693 ikev1_cert_print, 694 ikev1_cr_print, 695 ikev1_hash_print, 696 ikev1_sig_print, 697 ikev1_nonce_print, 698 ikev1_n_print, 699 ikev1_d_print, 700 ikev1_vid_print, /* 13 */ 701 NULL, NULL, NULL, NULL, NULL, /* 14- 18 */ 702 NULL, NULL, NULL, NULL, NULL, /* 19- 23 */ 703 NULL, NULL, NULL, NULL, NULL, /* 24- 28 */ 704 NULL, NULL, NULL, NULL, /* 29- 32 */ 705 ikev2_sa_print, /* 33 */ 706 ikev2_ke_print, /* 34 */ 707 ikev2_ID_print, /* 35 */ 708 ikev2_ID_print, /* 36 */ 709 ikev2_cert_print, /* 37 */ 710 ikev2_cr_print, /* 38 */ 711 ikev2_auth_print, /* 39 */ 712 ikev2_nonce_print, /* 40 */ 713 ikev2_n_print, /* 41 */ 714 ikev2_d_print, /* 42 */ 715 ikev2_vid_print, /* 43 */ 716 ikev2_TS_print, /* 44 */ 717 ikev2_TS_print, /* 45 */ 718 NULL, /* ikev2_e_print,*/ /* 46 - special */ 719 ikev2_cp_print, /* 47 */ 720 ikev2_eap_print, /* 48 */ 721 }; 722 723 /* isakmp->etype */ 724 static const char *etypestr[] = { 725 /* IKEv1 exchange types */ 726 "none", "base", "ident", "auth", "agg", "inf", NULL, NULL, /* 0-7 */ 727 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, /* 8-15 */ 728 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, /* 16-23 */ 729 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, /* 24-31 */ 730 "oakley-quick", "oakley-newgroup", /* 32-33 */ 731 /* IKEv2 exchange types */ 732 "ikev2_init", "ikev2_auth", "child_sa", "inf2" /* 34-37 */ 733 }; 734 735 #define STR_OR_ID(x, tab) \ 736 (((x) < sizeof(tab)/sizeof(tab[0]) && tab[(x)]) ? tab[(x)] : numstr(x)) 737 #define PROTOIDSTR(x) STR_OR_ID(x, protoidstr) 738 #define NPSTR(x) STR_OR_ID(x, npstr) 739 #define ETYPESTR(x) STR_OR_ID(x, etypestr) 740 741 #define CHECKLEN(p, np) \ 742 if (ep < (const u_char *)(p)) { \ 743 ND_PRINT((ndo," [|%s]", NPSTR(np))); \ 744 goto done; \ 745 } 746 747 748 #define NPFUNC(x) \ 749 (((x) < sizeof(npfunc)/sizeof(npfunc[0]) && npfunc[(x)]) \ 750 ? npfunc[(x)] : NULL) 751 752 static int 753 iszero(const u_char *p, size_t l) 754 { 755 while (l--) { 756 if (*p++) 757 return 0; 758 } 759 return 1; 760 } 761 762 /* find cookie from initiator cache */ 763 static int 764 cookie_find(cookie_t *in) 765 { 766 int i; 767 768 for (i = 0; i < MAXINITIATORS; i++) { 769 if (memcmp(in, &cookiecache[i].initiator, sizeof(*in)) == 0) 770 return i; 771 } 772 773 return -1; 774 } 775 776 /* record initiator */ 777 static void 778 cookie_record(cookie_t *in, const u_char *bp2) 779 { 780 int i; 781 const struct ip *ip; 782 const struct ip6_hdr *ip6; 783 784 i = cookie_find(in); 785 if (0 <= i) { 786 ninitiator = (i + 1) % MAXINITIATORS; 787 return; 788 } 789 790 ip = (const struct ip *)bp2; 791 switch (IP_V(ip)) { 792 case 4: 793 cookiecache[ninitiator].version = 4; 794 UNALIGNED_MEMCPY(&cookiecache[ninitiator].iaddr.in4, &ip->ip_src, sizeof(struct in_addr)); 795 UNALIGNED_MEMCPY(&cookiecache[ninitiator].raddr.in4, &ip->ip_dst, sizeof(struct in_addr)); 796 break; 797 case 6: 798 ip6 = (const struct ip6_hdr *)bp2; 799 cookiecache[ninitiator].version = 6; 800 UNALIGNED_MEMCPY(&cookiecache[ninitiator].iaddr.in6, &ip6->ip6_src, sizeof(struct in6_addr)); 801 UNALIGNED_MEMCPY(&cookiecache[ninitiator].raddr.in6, &ip6->ip6_dst, sizeof(struct in6_addr)); 802 break; 803 default: 804 return; 805 } 806 UNALIGNED_MEMCPY(&cookiecache[ninitiator].initiator, in, sizeof(*in)); 807 ninitiator = (ninitiator + 1) % MAXINITIATORS; 808 } 809 810 #define cookie_isinitiator(x, y) cookie_sidecheck((x), (y), 1) 811 #define cookie_isresponder(x, y) cookie_sidecheck((x), (y), 0) 812 static int 813 cookie_sidecheck(int i, const u_char *bp2, int initiator) 814 { 815 const struct ip *ip; 816 const struct ip6_hdr *ip6; 817 818 ip = (const struct ip *)bp2; 819 switch (IP_V(ip)) { 820 case 4: 821 if (cookiecache[i].version != 4) 822 return 0; 823 if (initiator) { 824 if (UNALIGNED_MEMCMP(&ip->ip_src, &cookiecache[i].iaddr.in4, sizeof(struct in_addr)) == 0) 825 return 1; 826 } else { 827 if (UNALIGNED_MEMCMP(&ip->ip_src, &cookiecache[i].raddr.in4, sizeof(struct in_addr)) == 0) 828 return 1; 829 } 830 break; 831 case 6: 832 if (cookiecache[i].version != 6) 833 return 0; 834 ip6 = (const struct ip6_hdr *)bp2; 835 if (initiator) { 836 if (UNALIGNED_MEMCMP(&ip6->ip6_src, &cookiecache[i].iaddr.in6, sizeof(struct in6_addr)) == 0) 837 return 1; 838 } else { 839 if (UNALIGNED_MEMCMP(&ip6->ip6_src, &cookiecache[i].raddr.in6, sizeof(struct in6_addr)) == 0) 840 return 1; 841 } 842 break; 843 default: 844 break; 845 } 846 847 return 0; 848 } 849 850 static void 851 hexprint(netdissect_options *ndo, const uint8_t *loc, size_t len) 852 { 853 const uint8_t *p; 854 size_t i; 855 856 p = loc; 857 for (i = 0; i < len; i++) 858 ND_PRINT((ndo,"%02x", p[i] & 0xff)); 859 } 860 861 static int 862 rawprint(netdissect_options *ndo, const uint8_t *loc, size_t len) 863 { 864 ND_TCHECK2(*loc, len); 865 866 hexprint(ndo, loc, len); 867 return 1; 868 trunc: 869 return 0; 870 } 871 872 873 /* 874 * returns false if we run out of data buffer 875 */ 876 static int ike_show_somedata(netdissect_options *ndo, 877 const u_char *cp, const u_char *ep) 878 { 879 /* there is too much data, just show some of it */ 880 const u_char *end = ep - 20; 881 int elen = 20; 882 int len = ep - cp; 883 if(len > 10) { 884 len = 10; 885 } 886 887 /* really shouldn't happen because of above */ 888 if(end < cp + len) { 889 end = cp+len; 890 elen = ep - end; 891 } 892 893 ND_PRINT((ndo," data=(")); 894 if(!rawprint(ndo, (const uint8_t *)(cp), len)) goto trunc; 895 ND_PRINT((ndo, "...")); 896 if(elen) { 897 if(!rawprint(ndo, (const uint8_t *)(end), elen)) goto trunc; 898 } 899 ND_PRINT((ndo,")")); 900 return 1; 901 902 trunc: 903 return 0; 904 } 905 906 struct attrmap { 907 const char *type; 908 u_int nvalue; 909 const char *value[30]; /*XXX*/ 910 }; 911 912 static const u_char * 913 ikev1_attrmap_print(netdissect_options *ndo, 914 const u_char *p, const u_char *ep, 915 const struct attrmap *map, size_t nmap) 916 { 917 int totlen; 918 uint32_t t, v; 919 920 if (p[0] & 0x80) 921 totlen = 4; 922 else 923 totlen = 4 + EXTRACT_16BITS(&p[2]); 924 if (ep < p + totlen) { 925 ND_PRINT((ndo,"[|attr]")); 926 return ep + 1; 927 } 928 929 ND_PRINT((ndo,"(")); 930 t = EXTRACT_16BITS(&p[0]) & 0x7fff; 931 if (map && t < nmap && map[t].type) 932 ND_PRINT((ndo,"type=%s ", map[t].type)); 933 else 934 ND_PRINT((ndo,"type=#%d ", t)); 935 if (p[0] & 0x80) { 936 ND_PRINT((ndo,"value=")); 937 v = EXTRACT_16BITS(&p[2]); 938 if (map && t < nmap && v < map[t].nvalue && map[t].value[v]) 939 ND_PRINT((ndo,"%s", map[t].value[v])); 940 else 941 rawprint(ndo, (const uint8_t *)&p[2], 2); 942 } else { 943 ND_PRINT((ndo,"len=%d value=", EXTRACT_16BITS(&p[2]))); 944 rawprint(ndo, (const uint8_t *)&p[4], EXTRACT_16BITS(&p[2])); 945 } 946 ND_PRINT((ndo,")")); 947 return p + totlen; 948 } 949 950 static const u_char * 951 ikev1_attr_print(netdissect_options *ndo, const u_char *p, const u_char *ep) 952 { 953 int totlen; 954 uint32_t t; 955 956 if (p[0] & 0x80) 957 totlen = 4; 958 else 959 totlen = 4 + EXTRACT_16BITS(&p[2]); 960 if (ep < p + totlen) { 961 ND_PRINT((ndo,"[|attr]")); 962 return ep + 1; 963 } 964 965 ND_PRINT((ndo,"(")); 966 t = EXTRACT_16BITS(&p[0]) & 0x7fff; 967 ND_PRINT((ndo,"type=#%d ", t)); 968 if (p[0] & 0x80) { 969 ND_PRINT((ndo,"value=")); 970 t = p[2]; 971 rawprint(ndo, (const uint8_t *)&p[2], 2); 972 } else { 973 ND_PRINT((ndo,"len=%d value=", EXTRACT_16BITS(&p[2]))); 974 rawprint(ndo, (const uint8_t *)&p[4], EXTRACT_16BITS(&p[2])); 975 } 976 ND_PRINT((ndo,")")); 977 return p + totlen; 978 } 979 980 static const u_char * 981 ikev1_sa_print(netdissect_options *ndo, u_char tpay _U_, 982 const struct isakmp_gen *ext, 983 u_int item_len _U_, 984 const u_char *ep, uint32_t phase, uint32_t doi0 _U_, 985 uint32_t proto0, int depth) 986 { 987 const struct ikev1_pl_sa *p; 988 struct ikev1_pl_sa sa; 989 uint32_t doi, sit, ident; 990 const u_char *cp, *np; 991 int t; 992 993 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_SA))); 994 995 p = (const struct ikev1_pl_sa *)ext; 996 ND_TCHECK(*p); 997 UNALIGNED_MEMCPY(&sa, ext, sizeof(sa)); 998 doi = ntohl(sa.doi); 999 sit = ntohl(sa.sit); 1000 if (doi != 1) { 1001 ND_PRINT((ndo," doi=%d", doi)); 1002 ND_PRINT((ndo," situation=%u", (uint32_t)ntohl(sa.sit))); 1003 return (const u_char *)(p + 1); 1004 } 1005 1006 ND_PRINT((ndo," doi=ipsec")); 1007 ND_PRINT((ndo," situation=")); 1008 t = 0; 1009 if (sit & 0x01) { 1010 ND_PRINT((ndo,"identity")); 1011 t++; 1012 } 1013 if (sit & 0x02) { 1014 ND_PRINT((ndo,"%ssecrecy", t ? "+" : "")); 1015 t++; 1016 } 1017 if (sit & 0x04) 1018 ND_PRINT((ndo,"%sintegrity", t ? "+" : "")); 1019 1020 np = (const u_char *)ext + sizeof(sa); 1021 if (sit != 0x01) { 1022 ND_TCHECK2(*(ext + 1), sizeof(ident)); 1023 UNALIGNED_MEMCPY(&ident, ext + 1, sizeof(ident)); 1024 ND_PRINT((ndo," ident=%u", (uint32_t)ntohl(ident))); 1025 np += sizeof(ident); 1026 } 1027 1028 ext = (const struct isakmp_gen *)np; 1029 ND_TCHECK(*ext); 1030 1031 cp = ikev1_sub_print(ndo, ISAKMP_NPTYPE_P, ext, ep, phase, doi, proto0, 1032 depth); 1033 1034 return cp; 1035 trunc: 1036 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_SA))); 1037 return NULL; 1038 } 1039 1040 static const u_char * 1041 ikev1_p_print(netdissect_options *ndo, u_char tpay _U_, 1042 const struct isakmp_gen *ext, u_int item_len _U_, 1043 const u_char *ep, uint32_t phase, uint32_t doi0, 1044 uint32_t proto0 _U_, int depth) 1045 { 1046 const struct ikev1_pl_p *p; 1047 struct ikev1_pl_p prop; 1048 const u_char *cp; 1049 1050 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_P))); 1051 1052 p = (const struct ikev1_pl_p *)ext; 1053 ND_TCHECK(*p); 1054 UNALIGNED_MEMCPY(&prop, ext, sizeof(prop)); 1055 ND_PRINT((ndo," #%d protoid=%s transform=%d", 1056 prop.p_no, PROTOIDSTR(prop.prot_id), prop.num_t)); 1057 if (prop.spi_size) { 1058 ND_PRINT((ndo," spi=")); 1059 if (!rawprint(ndo, (const uint8_t *)(p + 1), prop.spi_size)) 1060 goto trunc; 1061 } 1062 1063 ext = (const struct isakmp_gen *)((const u_char *)(p + 1) + prop.spi_size); 1064 ND_TCHECK(*ext); 1065 1066 cp = ikev1_sub_print(ndo, ISAKMP_NPTYPE_T, ext, ep, phase, doi0, 1067 prop.prot_id, depth); 1068 1069 return cp; 1070 trunc: 1071 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_P))); 1072 return NULL; 1073 } 1074 1075 static const char *ikev1_p_map[] = { 1076 NULL, "ike", 1077 }; 1078 1079 static const char *ikev2_t_type_map[]={ 1080 NULL, "encr", "prf", "integ", "dh", "esn" 1081 }; 1082 1083 static const char *ah_p_map[] = { 1084 NULL, "(reserved)", "md5", "sha", "1des", 1085 "sha2-256", "sha2-384", "sha2-512", 1086 }; 1087 1088 static const char *prf_p_map[] = { 1089 NULL, "hmac-md5", "hmac-sha", "hmac-tiger", 1090 "aes128_xcbc" 1091 }; 1092 1093 static const char *integ_p_map[] = { 1094 NULL, "hmac-md5", "hmac-sha", "dec-mac", 1095 "kpdk-md5", "aes-xcbc" 1096 }; 1097 1098 static const char *esn_p_map[] = { 1099 "no-esn", "esn" 1100 }; 1101 1102 static const char *dh_p_map[] = { 1103 NULL, "modp768", 1104 "modp1024", /* group 2 */ 1105 "EC2N 2^155", /* group 3 */ 1106 "EC2N 2^185", /* group 4 */ 1107 "modp1536", /* group 5 */ 1108 "iana-grp06", "iana-grp07", /* reserved */ 1109 "iana-grp08", "iana-grp09", 1110 "iana-grp10", "iana-grp11", 1111 "iana-grp12", "iana-grp13", 1112 "modp2048", /* group 14 */ 1113 "modp3072", /* group 15 */ 1114 "modp4096", /* group 16 */ 1115 "modp6144", /* group 17 */ 1116 "modp8192", /* group 18 */ 1117 }; 1118 1119 static const char *esp_p_map[] = { 1120 NULL, "1des-iv64", "1des", "3des", "rc5", "idea", "cast", 1121 "blowfish", "3idea", "1des-iv32", "rc4", "null", "aes" 1122 }; 1123 1124 static const char *ipcomp_p_map[] = { 1125 NULL, "oui", "deflate", "lzs", 1126 }; 1127 1128 static const struct attrmap ipsec_t_map[] = { 1129 { NULL, 0, { NULL } }, 1130 { "lifetype", 3, { NULL, "sec", "kb", }, }, 1131 { "life", 0, { NULL } }, 1132 { "group desc", 18, { NULL, "modp768", 1133 "modp1024", /* group 2 */ 1134 "EC2N 2^155", /* group 3 */ 1135 "EC2N 2^185", /* group 4 */ 1136 "modp1536", /* group 5 */ 1137 "iana-grp06", "iana-grp07", /* reserved */ 1138 "iana-grp08", "iana-grp09", 1139 "iana-grp10", "iana-grp11", 1140 "iana-grp12", "iana-grp13", 1141 "modp2048", /* group 14 */ 1142 "modp3072", /* group 15 */ 1143 "modp4096", /* group 16 */ 1144 "modp6144", /* group 17 */ 1145 "modp8192", /* group 18 */ 1146 }, }, 1147 { "enc mode", 3, { NULL, "tunnel", "transport", }, }, 1148 { "auth", 5, { NULL, "hmac-md5", "hmac-sha1", "1des-mac", "keyed", }, }, 1149 { "keylen", 0, { NULL } }, 1150 { "rounds", 0, { NULL } }, 1151 { "dictsize", 0, { NULL } }, 1152 { "privalg", 0, { NULL } }, 1153 }; 1154 1155 static const struct attrmap encr_t_map[] = { 1156 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 0, 1 */ 1157 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 2, 3 */ 1158 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 4, 5 */ 1159 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 6, 7 */ 1160 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 8, 9 */ 1161 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 10,11*/ 1162 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 12,13*/ 1163 { "keylen", 14, { NULL }}, 1164 }; 1165 1166 static const struct attrmap oakley_t_map[] = { 1167 { NULL, 0, { NULL } }, 1168 { "enc", 8, { NULL, "1des", "idea", "blowfish", "rc5", 1169 "3des", "cast", "aes", }, }, 1170 { "hash", 7, { NULL, "md5", "sha1", "tiger", 1171 "sha2-256", "sha2-384", "sha2-512", }, }, 1172 { "auth", 6, { NULL, "preshared", "dss", "rsa sig", "rsa enc", 1173 "rsa enc revised", }, }, 1174 { "group desc", 18, { NULL, "modp768", 1175 "modp1024", /* group 2 */ 1176 "EC2N 2^155", /* group 3 */ 1177 "EC2N 2^185", /* group 4 */ 1178 "modp1536", /* group 5 */ 1179 "iana-grp06", "iana-grp07", /* reserved */ 1180 "iana-grp08", "iana-grp09", 1181 "iana-grp10", "iana-grp11", 1182 "iana-grp12", "iana-grp13", 1183 "modp2048", /* group 14 */ 1184 "modp3072", /* group 15 */ 1185 "modp4096", /* group 16 */ 1186 "modp6144", /* group 17 */ 1187 "modp8192", /* group 18 */ 1188 }, }, 1189 { "group type", 4, { NULL, "MODP", "ECP", "EC2N", }, }, 1190 { "group prime", 0, { NULL } }, 1191 { "group gen1", 0, { NULL } }, 1192 { "group gen2", 0, { NULL } }, 1193 { "group curve A", 0, { NULL } }, 1194 { "group curve B", 0, { NULL } }, 1195 { "lifetype", 3, { NULL, "sec", "kb", }, }, 1196 { "lifeduration", 0, { NULL } }, 1197 { "prf", 0, { NULL } }, 1198 { "keylen", 0, { NULL } }, 1199 { "field", 0, { NULL } }, 1200 { "order", 0, { NULL } }, 1201 }; 1202 1203 static const u_char * 1204 ikev1_t_print(netdissect_options *ndo, u_char tpay _U_, 1205 const struct isakmp_gen *ext, u_int item_len, 1206 const u_char *ep, uint32_t phase _U_, uint32_t doi _U_, 1207 uint32_t proto, int depth _U_) 1208 { 1209 const struct ikev1_pl_t *p; 1210 struct ikev1_pl_t t; 1211 const u_char *cp; 1212 const char *idstr; 1213 const struct attrmap *map; 1214 size_t nmap; 1215 const u_char *ep2; 1216 1217 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_T))); 1218 1219 p = (const struct ikev1_pl_t *)ext; 1220 ND_TCHECK(*p); 1221 UNALIGNED_MEMCPY(&t, ext, sizeof(t)); 1222 1223 switch (proto) { 1224 case 1: 1225 idstr = STR_OR_ID(t.t_id, ikev1_p_map); 1226 map = oakley_t_map; 1227 nmap = sizeof(oakley_t_map)/sizeof(oakley_t_map[0]); 1228 break; 1229 case 2: 1230 idstr = STR_OR_ID(t.t_id, ah_p_map); 1231 map = ipsec_t_map; 1232 nmap = sizeof(ipsec_t_map)/sizeof(ipsec_t_map[0]); 1233 break; 1234 case 3: 1235 idstr = STR_OR_ID(t.t_id, esp_p_map); 1236 map = ipsec_t_map; 1237 nmap = sizeof(ipsec_t_map)/sizeof(ipsec_t_map[0]); 1238 break; 1239 case 4: 1240 idstr = STR_OR_ID(t.t_id, ipcomp_p_map); 1241 map = ipsec_t_map; 1242 nmap = sizeof(ipsec_t_map)/sizeof(ipsec_t_map[0]); 1243 break; 1244 default: 1245 idstr = NULL; 1246 map = NULL; 1247 nmap = 0; 1248 break; 1249 } 1250 1251 if (idstr) 1252 ND_PRINT((ndo," #%d id=%s ", t.t_no, idstr)); 1253 else 1254 ND_PRINT((ndo," #%d id=%d ", t.t_no, t.t_id)); 1255 cp = (const u_char *)(p + 1); 1256 ep2 = (const u_char *)p + item_len; 1257 while (cp < ep && cp < ep2) { 1258 if (map && nmap) { 1259 cp = ikev1_attrmap_print(ndo, cp, (ep < ep2) ? ep : ep2, 1260 map, nmap); 1261 } else 1262 cp = ikev1_attr_print(ndo, cp, (ep < ep2) ? ep : ep2); 1263 } 1264 if (ep < ep2) 1265 ND_PRINT((ndo,"...")); 1266 return cp; 1267 trunc: 1268 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_T))); 1269 return NULL; 1270 } 1271 1272 static const u_char * 1273 ikev1_ke_print(netdissect_options *ndo, u_char tpay _U_, 1274 const struct isakmp_gen *ext, u_int item_len _U_, 1275 const u_char *ep _U_, uint32_t phase _U_, uint32_t doi _U_, 1276 uint32_t proto _U_, int depth _U_) 1277 { 1278 struct isakmp_gen e; 1279 1280 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_KE))); 1281 1282 ND_TCHECK(*ext); 1283 UNALIGNED_MEMCPY(&e, ext, sizeof(e)); 1284 ND_PRINT((ndo," key len=%d", ntohs(e.len) - 4)); 1285 if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) { 1286 ND_PRINT((ndo," ")); 1287 if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4)) 1288 goto trunc; 1289 } 1290 return (const u_char *)ext + ntohs(e.len); 1291 trunc: 1292 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_KE))); 1293 return NULL; 1294 } 1295 1296 static const u_char * 1297 ikev1_id_print(netdissect_options *ndo, u_char tpay _U_, 1298 const struct isakmp_gen *ext, u_int item_len, 1299 const u_char *ep _U_, uint32_t phase, uint32_t doi _U_, 1300 uint32_t proto _U_, int depth _U_) 1301 { 1302 #define USE_IPSECDOI_IN_PHASE1 1 1303 const struct ikev1_pl_id *p; 1304 struct ikev1_pl_id id; 1305 static const char *idtypestr[] = { 1306 "IPv4", "IPv4net", "IPv6", "IPv6net", 1307 }; 1308 static const char *ipsecidtypestr[] = { 1309 NULL, "IPv4", "FQDN", "user FQDN", "IPv4net", "IPv6", 1310 "IPv6net", "IPv4range", "IPv6range", "ASN1 DN", "ASN1 GN", 1311 "keyid", 1312 }; 1313 int len; 1314 const u_char *data; 1315 1316 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_ID))); 1317 1318 p = (const struct ikev1_pl_id *)ext; 1319 ND_TCHECK(*p); 1320 UNALIGNED_MEMCPY(&id, ext, sizeof(id)); 1321 if (sizeof(*p) < item_len) { 1322 data = (const u_char *)(p + 1); 1323 len = item_len - sizeof(*p); 1324 } else { 1325 data = NULL; 1326 len = 0; 1327 } 1328 1329 #if 0 /*debug*/ 1330 ND_PRINT((ndo," [phase=%d doi=%d proto=%d]", phase, doi, proto)); 1331 #endif 1332 switch (phase) { 1333 #ifndef USE_IPSECDOI_IN_PHASE1 1334 case 1: 1335 #endif 1336 default: 1337 ND_PRINT((ndo," idtype=%s", STR_OR_ID(id.d.id_type, idtypestr))); 1338 ND_PRINT((ndo," doi_data=%u", 1339 (uint32_t)(ntohl(id.d.doi_data) & 0xffffff))); 1340 break; 1341 1342 #ifdef USE_IPSECDOI_IN_PHASE1 1343 case 1: 1344 #endif 1345 case 2: 1346 { 1347 const struct ipsecdoi_id *doi_p; 1348 struct ipsecdoi_id doi_id; 1349 struct protoent *pe; 1350 1351 doi_p = (const struct ipsecdoi_id *)ext; 1352 ND_TCHECK(*doi_p); 1353 UNALIGNED_MEMCPY(&doi_id, ext, sizeof(doi_id)); 1354 ND_PRINT((ndo," idtype=%s", STR_OR_ID(doi_id.type, ipsecidtypestr))); 1355 /* A protocol ID of 0 DOES NOT mean IPPROTO_IP! */ 1356 pe = doi_id.proto_id ? getprotobynumber(doi_id.proto_id) : NULL; 1357 if (pe) 1358 ND_PRINT((ndo," protoid=%s", pe->p_name)); 1359 else 1360 ND_PRINT((ndo," protoid=%u", doi_id.proto_id)); 1361 ND_PRINT((ndo," port=%d", ntohs(doi_id.port))); 1362 if (!len) 1363 break; 1364 if (data == NULL) 1365 goto trunc; 1366 ND_TCHECK2(*data, len); 1367 switch (doi_id.type) { 1368 case IPSECDOI_ID_IPV4_ADDR: 1369 if (len < 4) 1370 ND_PRINT((ndo," len=%d [bad: < 4]", len)); 1371 else 1372 ND_PRINT((ndo," len=%d %s", len, ipaddr_string(ndo, data))); 1373 len = 0; 1374 break; 1375 case IPSECDOI_ID_FQDN: 1376 case IPSECDOI_ID_USER_FQDN: 1377 { 1378 int i; 1379 ND_PRINT((ndo," len=%d ", len)); 1380 for (i = 0; i < len; i++) 1381 safeputchar(ndo, data[i]); 1382 len = 0; 1383 break; 1384 } 1385 case IPSECDOI_ID_IPV4_ADDR_SUBNET: 1386 { 1387 const u_char *mask; 1388 if (len < 8) 1389 ND_PRINT((ndo," len=%d [bad: < 8]", len)); 1390 else { 1391 mask = data + sizeof(struct in_addr); 1392 ND_PRINT((ndo," len=%d %s/%u.%u.%u.%u", len, 1393 ipaddr_string(ndo, data), 1394 mask[0], mask[1], mask[2], mask[3])); 1395 } 1396 len = 0; 1397 break; 1398 } 1399 case IPSECDOI_ID_IPV6_ADDR: 1400 if (len < 16) 1401 ND_PRINT((ndo," len=%d [bad: < 16]", len)); 1402 else 1403 ND_PRINT((ndo," len=%d %s", len, ip6addr_string(ndo, data))); 1404 len = 0; 1405 break; 1406 case IPSECDOI_ID_IPV6_ADDR_SUBNET: 1407 { 1408 const u_char *mask; 1409 if (len < 20) 1410 ND_PRINT((ndo," len=%d [bad: < 20]", len)); 1411 else { 1412 mask = (const u_char *)(data + sizeof(struct in6_addr)); 1413 /*XXX*/ 1414 ND_PRINT((ndo," len=%d %s/0x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x", len, 1415 ip6addr_string(ndo, data), 1416 mask[0], mask[1], mask[2], mask[3], 1417 mask[4], mask[5], mask[6], mask[7], 1418 mask[8], mask[9], mask[10], mask[11], 1419 mask[12], mask[13], mask[14], mask[15])); 1420 } 1421 len = 0; 1422 break; 1423 } 1424 case IPSECDOI_ID_IPV4_ADDR_RANGE: 1425 if (len < 8) 1426 ND_PRINT((ndo," len=%d [bad: < 8]", len)); 1427 else { 1428 ND_PRINT((ndo," len=%d %s-%s", len, 1429 ipaddr_string(ndo, data), 1430 ipaddr_string(ndo, data + sizeof(struct in_addr)))); 1431 } 1432 len = 0; 1433 break; 1434 case IPSECDOI_ID_IPV6_ADDR_RANGE: 1435 if (len < 32) 1436 ND_PRINT((ndo," len=%d [bad: < 32]", len)); 1437 else { 1438 ND_PRINT((ndo," len=%d %s-%s", len, 1439 ip6addr_string(ndo, data), 1440 ip6addr_string(ndo, data + sizeof(struct in6_addr)))); 1441 } 1442 len = 0; 1443 break; 1444 case IPSECDOI_ID_DER_ASN1_DN: 1445 case IPSECDOI_ID_DER_ASN1_GN: 1446 case IPSECDOI_ID_KEY_ID: 1447 break; 1448 } 1449 break; 1450 } 1451 } 1452 if (data && len) { 1453 ND_PRINT((ndo," len=%d", len)); 1454 if (2 < ndo->ndo_vflag) { 1455 ND_PRINT((ndo," ")); 1456 if (!rawprint(ndo, (const uint8_t *)data, len)) 1457 goto trunc; 1458 } 1459 } 1460 return (const u_char *)ext + item_len; 1461 trunc: 1462 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_ID))); 1463 return NULL; 1464 } 1465 1466 static const u_char * 1467 ikev1_cert_print(netdissect_options *ndo, u_char tpay _U_, 1468 const struct isakmp_gen *ext, u_int item_len, 1469 const u_char *ep _U_, uint32_t phase _U_, 1470 uint32_t doi0 _U_, 1471 uint32_t proto0 _U_, int depth _U_) 1472 { 1473 const struct ikev1_pl_cert *p; 1474 struct ikev1_pl_cert cert; 1475 static const char *certstr[] = { 1476 "none", "pkcs7", "pgp", "dns", 1477 "x509sign", "x509ke", "kerberos", "crl", 1478 "arl", "spki", "x509attr", 1479 }; 1480 1481 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_CERT))); 1482 1483 p = (const struct ikev1_pl_cert *)ext; 1484 ND_TCHECK(*p); 1485 UNALIGNED_MEMCPY(&cert, ext, sizeof(cert)); 1486 ND_PRINT((ndo," len=%d", item_len - 4)); 1487 ND_PRINT((ndo," type=%s", STR_OR_ID((cert.encode), certstr))); 1488 if (2 < ndo->ndo_vflag && 4 < item_len) { 1489 ND_PRINT((ndo," ")); 1490 if (!rawprint(ndo, (const uint8_t *)(ext + 1), item_len - 4)) 1491 goto trunc; 1492 } 1493 return (const u_char *)ext + item_len; 1494 trunc: 1495 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_CERT))); 1496 return NULL; 1497 } 1498 1499 static const u_char * 1500 ikev1_cr_print(netdissect_options *ndo, u_char tpay _U_, 1501 const struct isakmp_gen *ext, u_int item_len, 1502 const u_char *ep _U_, uint32_t phase _U_, uint32_t doi0 _U_, 1503 uint32_t proto0 _U_, int depth _U_) 1504 { 1505 const struct ikev1_pl_cert *p; 1506 struct ikev1_pl_cert cert; 1507 static const char *certstr[] = { 1508 "none", "pkcs7", "pgp", "dns", 1509 "x509sign", "x509ke", "kerberos", "crl", 1510 "arl", "spki", "x509attr", 1511 }; 1512 1513 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_CR))); 1514 1515 p = (const struct ikev1_pl_cert *)ext; 1516 ND_TCHECK(*p); 1517 UNALIGNED_MEMCPY(&cert, ext, sizeof(cert)); 1518 ND_PRINT((ndo," len=%d", item_len - 4)); 1519 ND_PRINT((ndo," type=%s", STR_OR_ID((cert.encode), certstr))); 1520 if (2 < ndo->ndo_vflag && 4 < item_len) { 1521 ND_PRINT((ndo," ")); 1522 if (!rawprint(ndo, (const uint8_t *)(ext + 1), item_len - 4)) 1523 goto trunc; 1524 } 1525 return (const u_char *)ext + item_len; 1526 trunc: 1527 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_CR))); 1528 return NULL; 1529 } 1530 1531 static const u_char * 1532 ikev1_hash_print(netdissect_options *ndo, u_char tpay _U_, 1533 const struct isakmp_gen *ext, u_int item_len _U_, 1534 const u_char *ep _U_, uint32_t phase _U_, uint32_t doi _U_, 1535 uint32_t proto _U_, int depth _U_) 1536 { 1537 struct isakmp_gen e; 1538 1539 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_HASH))); 1540 1541 ND_TCHECK(*ext); 1542 UNALIGNED_MEMCPY(&e, ext, sizeof(e)); 1543 ND_PRINT((ndo," len=%d", ntohs(e.len) - 4)); 1544 if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) { 1545 ND_PRINT((ndo," ")); 1546 if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4)) 1547 goto trunc; 1548 } 1549 return (const u_char *)ext + ntohs(e.len); 1550 trunc: 1551 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_HASH))); 1552 return NULL; 1553 } 1554 1555 static const u_char * 1556 ikev1_sig_print(netdissect_options *ndo, u_char tpay _U_, 1557 const struct isakmp_gen *ext, u_int item_len _U_, 1558 const u_char *ep _U_, uint32_t phase _U_, uint32_t doi _U_, 1559 uint32_t proto _U_, int depth _U_) 1560 { 1561 struct isakmp_gen e; 1562 1563 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_SIG))); 1564 1565 ND_TCHECK(*ext); 1566 UNALIGNED_MEMCPY(&e, ext, sizeof(e)); 1567 ND_PRINT((ndo," len=%d", ntohs(e.len) - 4)); 1568 if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) { 1569 ND_PRINT((ndo," ")); 1570 if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4)) 1571 goto trunc; 1572 } 1573 return (const u_char *)ext + ntohs(e.len); 1574 trunc: 1575 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_SIG))); 1576 return NULL; 1577 } 1578 1579 static const u_char * 1580 ikev1_nonce_print(netdissect_options *ndo, u_char tpay _U_, 1581 const struct isakmp_gen *ext, 1582 u_int item_len _U_, 1583 const u_char *ep, 1584 uint32_t phase _U_, uint32_t doi _U_, 1585 uint32_t proto _U_, int depth _U_) 1586 { 1587 struct isakmp_gen e; 1588 1589 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_NONCE))); 1590 1591 ND_TCHECK(*ext); 1592 UNALIGNED_MEMCPY(&e, ext, sizeof(e)); 1593 ND_PRINT((ndo," n len=%d", ntohs(e.len) - 4)); 1594 if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) { 1595 ND_PRINT((ndo," ")); 1596 if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4)) 1597 goto trunc; 1598 } else if (1 < ndo->ndo_vflag && 4 < ntohs(e.len)) { 1599 ND_PRINT((ndo," ")); 1600 if (!ike_show_somedata(ndo, (const u_char *)(const uint8_t *)(ext + 1), ep)) 1601 goto trunc; 1602 } 1603 return (const u_char *)ext + ntohs(e.len); 1604 trunc: 1605 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_NONCE))); 1606 return NULL; 1607 } 1608 1609 static const u_char * 1610 ikev1_n_print(netdissect_options *ndo, u_char tpay _U_, 1611 const struct isakmp_gen *ext, u_int item_len, 1612 const u_char *ep, uint32_t phase, uint32_t doi0 _U_, 1613 uint32_t proto0 _U_, int depth) 1614 { 1615 const struct ikev1_pl_n *p; 1616 struct ikev1_pl_n n; 1617 const u_char *cp; 1618 const u_char *ep2; 1619 uint32_t doi; 1620 uint32_t proto; 1621 static const char *notify_error_str[] = { 1622 NULL, "INVALID-PAYLOAD-TYPE", 1623 "DOI-NOT-SUPPORTED", "SITUATION-NOT-SUPPORTED", 1624 "INVALID-COOKIE", "INVALID-MAJOR-VERSION", 1625 "INVALID-MINOR-VERSION", "INVALID-EXCHANGE-TYPE", 1626 "INVALID-FLAGS", "INVALID-MESSAGE-ID", 1627 "INVALID-PROTOCOL-ID", "INVALID-SPI", 1628 "INVALID-TRANSFORM-ID", "ATTRIBUTES-NOT-SUPPORTED", 1629 "NO-PROPOSAL-CHOSEN", "BAD-PROPOSAL-SYNTAX", 1630 "PAYLOAD-MALFORMED", "INVALID-KEY-INFORMATION", 1631 "INVALID-ID-INFORMATION", "INVALID-CERT-ENCODING", 1632 "INVALID-CERTIFICATE", "CERT-TYPE-UNSUPPORTED", 1633 "INVALID-CERT-AUTHORITY", "INVALID-HASH-INFORMATION", 1634 "AUTHENTICATION-FAILED", "INVALID-SIGNATURE", 1635 "ADDRESS-NOTIFICATION", "NOTIFY-SA-LIFETIME", 1636 "CERTIFICATE-UNAVAILABLE", "UNSUPPORTED-EXCHANGE-TYPE", 1637 "UNEQUAL-PAYLOAD-LENGTHS", 1638 }; 1639 static const char *ipsec_notify_error_str[] = { 1640 "RESERVED", 1641 }; 1642 static const char *notify_status_str[] = { 1643 "CONNECTED", 1644 }; 1645 static const char *ipsec_notify_status_str[] = { 1646 "RESPONDER-LIFETIME", "REPLAY-STATUS", 1647 "INITIAL-CONTACT", 1648 }; 1649 /* NOTE: these macro must be called with x in proper range */ 1650 1651 /* 0 - 8191 */ 1652 #define NOTIFY_ERROR_STR(x) \ 1653 STR_OR_ID((x), notify_error_str) 1654 1655 /* 8192 - 16383 */ 1656 #define IPSEC_NOTIFY_ERROR_STR(x) \ 1657 STR_OR_ID((u_int)((x) - 8192), ipsec_notify_error_str) 1658 1659 /* 16384 - 24575 */ 1660 #define NOTIFY_STATUS_STR(x) \ 1661 STR_OR_ID((u_int)((x) - 16384), notify_status_str) 1662 1663 /* 24576 - 32767 */ 1664 #define IPSEC_NOTIFY_STATUS_STR(x) \ 1665 STR_OR_ID((u_int)((x) - 24576), ipsec_notify_status_str) 1666 1667 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_N))); 1668 1669 p = (const struct ikev1_pl_n *)ext; 1670 ND_TCHECK(*p); 1671 UNALIGNED_MEMCPY(&n, ext, sizeof(n)); 1672 doi = ntohl(n.doi); 1673 proto = n.prot_id; 1674 if (doi != 1) { 1675 ND_PRINT((ndo," doi=%d", doi)); 1676 ND_PRINT((ndo," proto=%d", proto)); 1677 if (ntohs(n.type) < 8192) 1678 ND_PRINT((ndo," type=%s", NOTIFY_ERROR_STR(ntohs(n.type)))); 1679 else if (ntohs(n.type) < 16384) 1680 ND_PRINT((ndo," type=%s", numstr(ntohs(n.type)))); 1681 else if (ntohs(n.type) < 24576) 1682 ND_PRINT((ndo," type=%s", NOTIFY_STATUS_STR(ntohs(n.type)))); 1683 else 1684 ND_PRINT((ndo," type=%s", numstr(ntohs(n.type)))); 1685 if (n.spi_size) { 1686 ND_PRINT((ndo," spi=")); 1687 if (!rawprint(ndo, (const uint8_t *)(p + 1), n.spi_size)) 1688 goto trunc; 1689 } 1690 return (const u_char *)(p + 1) + n.spi_size; 1691 } 1692 1693 ND_PRINT((ndo," doi=ipsec")); 1694 ND_PRINT((ndo," proto=%s", PROTOIDSTR(proto))); 1695 if (ntohs(n.type) < 8192) 1696 ND_PRINT((ndo," type=%s", NOTIFY_ERROR_STR(ntohs(n.type)))); 1697 else if (ntohs(n.type) < 16384) 1698 ND_PRINT((ndo," type=%s", IPSEC_NOTIFY_ERROR_STR(ntohs(n.type)))); 1699 else if (ntohs(n.type) < 24576) 1700 ND_PRINT((ndo," type=%s", NOTIFY_STATUS_STR(ntohs(n.type)))); 1701 else if (ntohs(n.type) < 32768) 1702 ND_PRINT((ndo," type=%s", IPSEC_NOTIFY_STATUS_STR(ntohs(n.type)))); 1703 else 1704 ND_PRINT((ndo," type=%s", numstr(ntohs(n.type)))); 1705 if (n.spi_size) { 1706 ND_PRINT((ndo," spi=")); 1707 if (!rawprint(ndo, (const uint8_t *)(p + 1), n.spi_size)) 1708 goto trunc; 1709 } 1710 1711 cp = (const u_char *)(p + 1) + n.spi_size; 1712 ep2 = (const u_char *)p + item_len; 1713 1714 if (cp < ep) { 1715 ND_PRINT((ndo," orig=(")); 1716 switch (ntohs(n.type)) { 1717 case IPSECDOI_NTYPE_RESPONDER_LIFETIME: 1718 { 1719 const struct attrmap *map = oakley_t_map; 1720 size_t nmap = sizeof(oakley_t_map)/sizeof(oakley_t_map[0]); 1721 while (cp < ep && cp < ep2) { 1722 cp = ikev1_attrmap_print(ndo, cp, 1723 (ep < ep2) ? ep : ep2, map, nmap); 1724 } 1725 break; 1726 } 1727 case IPSECDOI_NTYPE_REPLAY_STATUS: 1728 ND_PRINT((ndo,"replay detection %sabled", 1729 EXTRACT_32BITS(cp) ? "en" : "dis")); 1730 break; 1731 case ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN: 1732 if (ikev1_sub_print(ndo, ISAKMP_NPTYPE_SA, 1733 (const struct isakmp_gen *)cp, ep, phase, doi, proto, 1734 depth) == NULL) 1735 return NULL; 1736 break; 1737 default: 1738 /* NULL is dummy */ 1739 isakmp_print(ndo, cp, 1740 item_len - sizeof(*p) - n.spi_size, 1741 NULL); 1742 } 1743 ND_PRINT((ndo,")")); 1744 } 1745 return (const u_char *)ext + item_len; 1746 trunc: 1747 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_N))); 1748 return NULL; 1749 } 1750 1751 static const u_char * 1752 ikev1_d_print(netdissect_options *ndo, u_char tpay _U_, 1753 const struct isakmp_gen *ext, u_int item_len _U_, 1754 const u_char *ep _U_, uint32_t phase _U_, uint32_t doi0 _U_, 1755 uint32_t proto0 _U_, int depth _U_) 1756 { 1757 const struct ikev1_pl_d *p; 1758 struct ikev1_pl_d d; 1759 const uint8_t *q; 1760 uint32_t doi; 1761 uint32_t proto; 1762 int i; 1763 1764 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_D))); 1765 1766 p = (const struct ikev1_pl_d *)ext; 1767 ND_TCHECK(*p); 1768 UNALIGNED_MEMCPY(&d, ext, sizeof(d)); 1769 doi = ntohl(d.doi); 1770 proto = d.prot_id; 1771 if (doi != 1) { 1772 ND_PRINT((ndo," doi=%u", doi)); 1773 ND_PRINT((ndo," proto=%u", proto)); 1774 } else { 1775 ND_PRINT((ndo," doi=ipsec")); 1776 ND_PRINT((ndo," proto=%s", PROTOIDSTR(proto))); 1777 } 1778 ND_PRINT((ndo," spilen=%u", d.spi_size)); 1779 ND_PRINT((ndo," nspi=%u", ntohs(d.num_spi))); 1780 ND_PRINT((ndo," spi=")); 1781 q = (const uint8_t *)(p + 1); 1782 for (i = 0; i < ntohs(d.num_spi); i++) { 1783 if (i != 0) 1784 ND_PRINT((ndo,",")); 1785 if (!rawprint(ndo, (const uint8_t *)q, d.spi_size)) 1786 goto trunc; 1787 q += d.spi_size; 1788 } 1789 return q; 1790 trunc: 1791 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_D))); 1792 return NULL; 1793 } 1794 1795 static const u_char * 1796 ikev1_vid_print(netdissect_options *ndo, u_char tpay _U_, 1797 const struct isakmp_gen *ext, 1798 u_int item_len _U_, const u_char *ep _U_, 1799 uint32_t phase _U_, uint32_t doi _U_, 1800 uint32_t proto _U_, int depth _U_) 1801 { 1802 struct isakmp_gen e; 1803 1804 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_VID))); 1805 1806 ND_TCHECK(*ext); 1807 UNALIGNED_MEMCPY(&e, ext, sizeof(e)); 1808 ND_PRINT((ndo," len=%d", ntohs(e.len) - 4)); 1809 if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) { 1810 ND_PRINT((ndo," ")); 1811 if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4)) 1812 goto trunc; 1813 } 1814 return (const u_char *)ext + ntohs(e.len); 1815 trunc: 1816 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_VID))); 1817 return NULL; 1818 } 1819 1820 /************************************************************/ 1821 /* */ 1822 /* IKE v2 - rfc4306 - dissector */ 1823 /* */ 1824 /************************************************************/ 1825 1826 static void 1827 ikev2_pay_print(netdissect_options *ndo, const char *payname, int critical) 1828 { 1829 ND_PRINT((ndo,"%s%s:", payname, critical&0x80 ? "[C]" : "")); 1830 } 1831 1832 static const u_char * 1833 ikev2_gen_print(netdissect_options *ndo, u_char tpay, 1834 const struct isakmp_gen *ext) 1835 { 1836 struct isakmp_gen e; 1837 1838 ND_TCHECK(*ext); 1839 UNALIGNED_MEMCPY(&e, ext, sizeof(e)); 1840 ikev2_pay_print(ndo, NPSTR(tpay), e.critical); 1841 1842 ND_PRINT((ndo," len=%d", ntohs(e.len) - 4)); 1843 if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) { 1844 ND_PRINT((ndo," ")); 1845 if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4)) 1846 goto trunc; 1847 } 1848 return (const u_char *)ext + ntohs(e.len); 1849 trunc: 1850 ND_PRINT((ndo," [|%s]", NPSTR(tpay))); 1851 return NULL; 1852 } 1853 1854 static const u_char * 1855 ikev2_t_print(netdissect_options *ndo, int tcount, 1856 const struct isakmp_gen *ext, u_int item_len, 1857 const u_char *ep) 1858 { 1859 const struct ikev2_t *p; 1860 struct ikev2_t t; 1861 uint16_t t_id; 1862 const u_char *cp; 1863 const char *idstr; 1864 const struct attrmap *map; 1865 size_t nmap; 1866 const u_char *ep2; 1867 1868 p = (const struct ikev2_t *)ext; 1869 ND_TCHECK(*p); 1870 UNALIGNED_MEMCPY(&t, ext, sizeof(t)); 1871 ikev2_pay_print(ndo, NPSTR(ISAKMP_NPTYPE_T), t.h.critical); 1872 1873 t_id = ntohs(t.t_id); 1874 1875 map = NULL; 1876 nmap = 0; 1877 1878 switch (t.t_type) { 1879 case IV2_T_ENCR: 1880 idstr = STR_OR_ID(t_id, esp_p_map); 1881 map = encr_t_map; 1882 nmap = sizeof(encr_t_map)/sizeof(encr_t_map[0]); 1883 break; 1884 1885 case IV2_T_PRF: 1886 idstr = STR_OR_ID(t_id, prf_p_map); 1887 break; 1888 1889 case IV2_T_INTEG: 1890 idstr = STR_OR_ID(t_id, integ_p_map); 1891 break; 1892 1893 case IV2_T_DH: 1894 idstr = STR_OR_ID(t_id, dh_p_map); 1895 break; 1896 1897 case IV2_T_ESN: 1898 idstr = STR_OR_ID(t_id, esn_p_map); 1899 break; 1900 1901 default: 1902 idstr = NULL; 1903 break; 1904 } 1905 1906 if (idstr) 1907 ND_PRINT((ndo," #%u type=%s id=%s ", tcount, 1908 STR_OR_ID(t.t_type, ikev2_t_type_map), 1909 idstr)); 1910 else 1911 ND_PRINT((ndo," #%u type=%s id=%u ", tcount, 1912 STR_OR_ID(t.t_type, ikev2_t_type_map), 1913 t.t_id)); 1914 cp = (const u_char *)(p + 1); 1915 ep2 = (const u_char *)p + item_len; 1916 while (cp < ep && cp < ep2) { 1917 if (map && nmap) { 1918 cp = ikev1_attrmap_print(ndo, cp, (ep < ep2) ? ep : ep2, 1919 map, nmap); 1920 } else 1921 cp = ikev1_attr_print(ndo, cp, (ep < ep2) ? ep : ep2); 1922 } 1923 if (ep < ep2) 1924 ND_PRINT((ndo,"...")); 1925 return cp; 1926 trunc: 1927 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_T))); 1928 return NULL; 1929 } 1930 1931 static const u_char * 1932 ikev2_p_print(netdissect_options *ndo, u_char tpay _U_, int pcount _U_, 1933 const struct isakmp_gen *ext, u_int oprop_length, 1934 const u_char *ep, int depth) 1935 { 1936 const struct ikev2_p *p; 1937 struct ikev2_p prop; 1938 u_int prop_length; 1939 const u_char *cp; 1940 int i; 1941 int tcount; 1942 u_char np; 1943 struct isakmp_gen e; 1944 u_int item_len; 1945 1946 p = (const struct ikev2_p *)ext; 1947 ND_TCHECK(*p); 1948 UNALIGNED_MEMCPY(&prop, ext, sizeof(prop)); 1949 1950 ikev2_pay_print(ndo, NPSTR(ISAKMP_NPTYPE_P), prop.h.critical); 1951 1952 /* 1953 * ikev2_sa_print() guarantees that this is >= 4. 1954 */ 1955 prop_length = oprop_length - 4; 1956 ND_PRINT((ndo," #%u protoid=%s transform=%d len=%u", 1957 prop.p_no, PROTOIDSTR(prop.prot_id), 1958 prop.num_t, oprop_length)); 1959 cp = (const u_char *)(p + 1); 1960 1961 if (prop.spi_size) { 1962 if (prop_length < prop.spi_size) 1963 goto toolong; 1964 ND_PRINT((ndo," spi=")); 1965 if (!rawprint(ndo, (const uint8_t *)cp, prop.spi_size)) 1966 goto trunc; 1967 cp += prop.spi_size; 1968 prop_length -= prop.spi_size; 1969 } 1970 1971 /* 1972 * Print the transforms. 1973 */ 1974 tcount = 0; 1975 for (np = ISAKMP_NPTYPE_T; np != 0; np = e.np) { 1976 tcount++; 1977 ext = (const struct isakmp_gen *)cp; 1978 if (prop_length < sizeof(*ext)) 1979 goto toolong; 1980 ND_TCHECK(*ext); 1981 1982 UNALIGNED_MEMCPY(&e, ext, sizeof(e)); 1983 1984 /* 1985 * Since we can't have a payload length of less than 4 bytes, 1986 * we need to bail out here if the generic header is nonsensical 1987 * or truncated, otherwise we could loop forever processing 1988 * zero-length items or otherwise misdissect the packet. 1989 */ 1990 item_len = ntohs(e.len); 1991 if (item_len <= 4) 1992 goto trunc; 1993 1994 if (prop_length < item_len) 1995 goto toolong; 1996 ND_TCHECK2(*cp, item_len); 1997 1998 depth++; 1999 ND_PRINT((ndo,"\n")); 2000 for (i = 0; i < depth; i++) 2001 ND_PRINT((ndo," ")); 2002 ND_PRINT((ndo,"(")); 2003 if (np == ISAKMP_NPTYPE_T) { 2004 cp = ikev2_t_print(ndo, tcount, ext, item_len, ep); 2005 if (cp == NULL) { 2006 /* error, already reported */ 2007 return NULL; 2008 } 2009 } else { 2010 ND_PRINT((ndo, "%s", NPSTR(np))); 2011 cp += item_len; 2012 } 2013 ND_PRINT((ndo,")")); 2014 depth--; 2015 prop_length -= item_len; 2016 } 2017 return cp; 2018 toolong: 2019 /* 2020 * Skip the rest of the proposal. 2021 */ 2022 cp += prop_length; 2023 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_P))); 2024 return cp; 2025 trunc: 2026 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_P))); 2027 return NULL; 2028 } 2029 2030 static const u_char * 2031 ikev2_sa_print(netdissect_options *ndo, u_char tpay, 2032 const struct isakmp_gen *ext1, 2033 u_int osa_length, const u_char *ep, 2034 uint32_t phase _U_, uint32_t doi _U_, 2035 uint32_t proto _U_, int depth) 2036 { 2037 const struct isakmp_gen *ext; 2038 struct isakmp_gen e; 2039 u_int sa_length; 2040 const u_char *cp; 2041 int i; 2042 int pcount; 2043 u_char np; 2044 u_int item_len; 2045 2046 ND_TCHECK(*ext1); 2047 UNALIGNED_MEMCPY(&e, ext1, sizeof(e)); 2048 ikev2_pay_print(ndo, "sa", e.critical); 2049 2050 /* 2051 * ikev2_sub0_print() guarantees that this is >= 4. 2052 */ 2053 osa_length= ntohs(e.len); 2054 sa_length = osa_length - 4; 2055 ND_PRINT((ndo," len=%d", sa_length)); 2056 2057 /* 2058 * Print the payloads. 2059 */ 2060 cp = (const u_char *)(ext1 + 1); 2061 pcount = 0; 2062 for (np = ISAKMP_NPTYPE_P; np != 0; np = e.np) { 2063 pcount++; 2064 ext = (const struct isakmp_gen *)cp; 2065 if (sa_length < sizeof(*ext)) 2066 goto toolong; 2067 ND_TCHECK(*ext); 2068 2069 UNALIGNED_MEMCPY(&e, ext, sizeof(e)); 2070 2071 /* 2072 * Since we can't have a payload length of less than 4 bytes, 2073 * we need to bail out here if the generic header is nonsensical 2074 * or truncated, otherwise we could loop forever processing 2075 * zero-length items or otherwise misdissect the packet. 2076 */ 2077 item_len = ntohs(e.len); 2078 if (item_len <= 4) 2079 goto trunc; 2080 2081 if (sa_length < item_len) 2082 goto toolong; 2083 ND_TCHECK2(*cp, item_len); 2084 2085 depth++; 2086 ND_PRINT((ndo,"\n")); 2087 for (i = 0; i < depth; i++) 2088 ND_PRINT((ndo," ")); 2089 ND_PRINT((ndo,"(")); 2090 if (np == ISAKMP_NPTYPE_P) { 2091 cp = ikev2_p_print(ndo, np, pcount, ext, item_len, 2092 ep, depth); 2093 if (cp == NULL) { 2094 /* error, already reported */ 2095 return NULL; 2096 } 2097 } else { 2098 ND_PRINT((ndo, "%s", NPSTR(np))); 2099 cp += item_len; 2100 } 2101 ND_PRINT((ndo,")")); 2102 depth--; 2103 sa_length -= item_len; 2104 } 2105 return cp; 2106 toolong: 2107 /* 2108 * Skip the rest of the SA. 2109 */ 2110 cp += sa_length; 2111 ND_PRINT((ndo," [|%s]", NPSTR(tpay))); 2112 return cp; 2113 trunc: 2114 ND_PRINT((ndo," [|%s]", NPSTR(tpay))); 2115 return NULL; 2116 } 2117 2118 static const u_char * 2119 ikev2_ke_print(netdissect_options *ndo, u_char tpay, 2120 const struct isakmp_gen *ext, 2121 u_int item_len _U_, const u_char *ep _U_, 2122 uint32_t phase _U_, uint32_t doi _U_, 2123 uint32_t proto _U_, int depth _U_) 2124 { 2125 struct ikev2_ke ke; 2126 const struct ikev2_ke *k; 2127 2128 k = (const struct ikev2_ke *)ext; 2129 ND_TCHECK(*ext); 2130 UNALIGNED_MEMCPY(&ke, ext, sizeof(ke)); 2131 ikev2_pay_print(ndo, NPSTR(tpay), ke.h.critical); 2132 2133 ND_PRINT((ndo," len=%u group=%s", ntohs(ke.h.len) - 8, 2134 STR_OR_ID(ntohs(ke.ke_group), dh_p_map))); 2135 2136 if (2 < ndo->ndo_vflag && 8 < ntohs(ke.h.len)) { 2137 ND_PRINT((ndo," ")); 2138 if (!rawprint(ndo, (const uint8_t *)(k + 1), ntohs(ke.h.len) - 8)) 2139 goto trunc; 2140 } 2141 return (const u_char *)ext + ntohs(ke.h.len); 2142 trunc: 2143 ND_PRINT((ndo," [|%s]", NPSTR(tpay))); 2144 return NULL; 2145 } 2146 2147 static const u_char * 2148 ikev2_ID_print(netdissect_options *ndo, u_char tpay, 2149 const struct isakmp_gen *ext, 2150 u_int item_len _U_, const u_char *ep _U_, 2151 uint32_t phase _U_, uint32_t doi _U_, 2152 uint32_t proto _U_, int depth _U_) 2153 { 2154 struct ikev2_id id; 2155 int id_len, idtype_len, i; 2156 unsigned int dumpascii, dumphex; 2157 const unsigned char *typedata; 2158 2159 ND_TCHECK(*ext); 2160 UNALIGNED_MEMCPY(&id, ext, sizeof(id)); 2161 ikev2_pay_print(ndo, NPSTR(tpay), id.h.critical); 2162 2163 id_len = ntohs(id.h.len); 2164 2165 ND_PRINT((ndo," len=%d", id_len - 4)); 2166 if (2 < ndo->ndo_vflag && 4 < id_len) { 2167 ND_PRINT((ndo," ")); 2168 if (!rawprint(ndo, (const uint8_t *)(ext + 1), id_len - 4)) 2169 goto trunc; 2170 } 2171 2172 idtype_len =id_len - sizeof(struct ikev2_id); 2173 dumpascii = 0; 2174 dumphex = 0; 2175 typedata = (const unsigned char *)(ext)+sizeof(struct ikev2_id); 2176 2177 switch(id.type) { 2178 case ID_IPV4_ADDR: 2179 ND_PRINT((ndo, " ipv4:")); 2180 dumphex=1; 2181 break; 2182 case ID_FQDN: 2183 ND_PRINT((ndo, " fqdn:")); 2184 dumpascii=1; 2185 break; 2186 case ID_RFC822_ADDR: 2187 ND_PRINT((ndo, " rfc822:")); 2188 dumpascii=1; 2189 break; 2190 case ID_IPV6_ADDR: 2191 ND_PRINT((ndo, " ipv6:")); 2192 dumphex=1; 2193 break; 2194 case ID_DER_ASN1_DN: 2195 ND_PRINT((ndo, " dn:")); 2196 dumphex=1; 2197 break; 2198 case ID_DER_ASN1_GN: 2199 ND_PRINT((ndo, " gn:")); 2200 dumphex=1; 2201 break; 2202 case ID_KEY_ID: 2203 ND_PRINT((ndo, " keyid:")); 2204 dumphex=1; 2205 break; 2206 } 2207 2208 if(dumpascii) { 2209 ND_TCHECK2(*typedata, idtype_len); 2210 for(i=0; i<idtype_len; i++) { 2211 if(ND_ISPRINT(typedata[i])) { 2212 ND_PRINT((ndo, "%c", typedata[i])); 2213 } else { 2214 ND_PRINT((ndo, ".")); 2215 } 2216 } 2217 } 2218 if(dumphex) { 2219 if (!rawprint(ndo, (const uint8_t *)typedata, idtype_len)) 2220 goto trunc; 2221 } 2222 2223 return (const u_char *)ext + id_len; 2224 trunc: 2225 ND_PRINT((ndo," [|%s]", NPSTR(tpay))); 2226 return NULL; 2227 } 2228 2229 static const u_char * 2230 ikev2_cert_print(netdissect_options *ndo, u_char tpay, 2231 const struct isakmp_gen *ext, 2232 u_int item_len _U_, const u_char *ep _U_, 2233 uint32_t phase _U_, uint32_t doi _U_, 2234 uint32_t proto _U_, int depth _U_) 2235 { 2236 return ikev2_gen_print(ndo, tpay, ext); 2237 } 2238 2239 static const u_char * 2240 ikev2_cr_print(netdissect_options *ndo, u_char tpay, 2241 const struct isakmp_gen *ext, 2242 u_int item_len _U_, const u_char *ep _U_, 2243 uint32_t phase _U_, uint32_t doi _U_, 2244 uint32_t proto _U_, int depth _U_) 2245 { 2246 return ikev2_gen_print(ndo, tpay, ext); 2247 } 2248 2249 static const u_char * 2250 ikev2_auth_print(netdissect_options *ndo, u_char tpay, 2251 const struct isakmp_gen *ext, 2252 u_int item_len _U_, const u_char *ep, 2253 uint32_t phase _U_, uint32_t doi _U_, 2254 uint32_t proto _U_, int depth _U_) 2255 { 2256 struct ikev2_auth a; 2257 const char *v2_auth[]={ "invalid", "rsasig", 2258 "shared-secret", "dsssig" }; 2259 const u_char *authdata = (const u_char*)ext + sizeof(a); 2260 unsigned int len; 2261 2262 ND_TCHECK(*ext); 2263 UNALIGNED_MEMCPY(&a, ext, sizeof(a)); 2264 ikev2_pay_print(ndo, NPSTR(tpay), a.h.critical); 2265 len = ntohs(a.h.len); 2266 2267 ND_PRINT((ndo," len=%d method=%s", len-4, 2268 STR_OR_ID(a.auth_method, v2_auth))); 2269 2270 if (1 < ndo->ndo_vflag && 4 < len) { 2271 ND_PRINT((ndo," authdata=(")); 2272 if (!rawprint(ndo, (const uint8_t *)authdata, len - sizeof(a))) 2273 goto trunc; 2274 ND_PRINT((ndo,") ")); 2275 } else if(ndo->ndo_vflag && 4 < len) { 2276 if(!ike_show_somedata(ndo, authdata, ep)) goto trunc; 2277 } 2278 2279 return (const u_char *)ext + len; 2280 trunc: 2281 ND_PRINT((ndo," [|%s]", NPSTR(tpay))); 2282 return NULL; 2283 } 2284 2285 static const u_char * 2286 ikev2_nonce_print(netdissect_options *ndo, u_char tpay, 2287 const struct isakmp_gen *ext, 2288 u_int item_len _U_, const u_char *ep, 2289 uint32_t phase _U_, uint32_t doi _U_, 2290 uint32_t proto _U_, int depth _U_) 2291 { 2292 struct isakmp_gen e; 2293 2294 ND_TCHECK(*ext); 2295 UNALIGNED_MEMCPY(&e, ext, sizeof(e)); 2296 ikev2_pay_print(ndo, "nonce", e.critical); 2297 2298 ND_PRINT((ndo," len=%d", ntohs(e.len) - 4)); 2299 if (1 < ndo->ndo_vflag && 4 < ntohs(e.len)) { 2300 ND_PRINT((ndo," nonce=(")); 2301 if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4)) 2302 goto trunc; 2303 ND_PRINT((ndo,") ")); 2304 } else if(ndo->ndo_vflag && 4 < ntohs(e.len)) { 2305 if(!ike_show_somedata(ndo, (const u_char *)(ext+1), ep)) goto trunc; 2306 } 2307 2308 return (const u_char *)ext + ntohs(e.len); 2309 trunc: 2310 ND_PRINT((ndo," [|%s]", NPSTR(tpay))); 2311 return NULL; 2312 } 2313 2314 /* notify payloads */ 2315 static const u_char * 2316 ikev2_n_print(netdissect_options *ndo, u_char tpay _U_, 2317 const struct isakmp_gen *ext, 2318 u_int item_len, const u_char *ep, 2319 uint32_t phase _U_, uint32_t doi _U_, 2320 uint32_t proto _U_, int depth _U_) 2321 { 2322 const struct ikev2_n *p; 2323 struct ikev2_n n; 2324 const u_char *cp; 2325 u_char showspi, showdata, showsomedata; 2326 const char *notify_name; 2327 uint32_t type; 2328 2329 p = (const struct ikev2_n *)ext; 2330 ND_TCHECK(*p); 2331 UNALIGNED_MEMCPY(&n, ext, sizeof(n)); 2332 ikev2_pay_print(ndo, NPSTR(ISAKMP_NPTYPE_N), n.h.critical); 2333 2334 showspi = 1; 2335 showdata = 0; 2336 showsomedata=0; 2337 notify_name=NULL; 2338 2339 ND_PRINT((ndo," prot_id=%s", PROTOIDSTR(n.prot_id))); 2340 2341 type = ntohs(n.type); 2342 2343 /* notify space is annoying sparse */ 2344 switch(type) { 2345 case IV2_NOTIFY_UNSUPPORTED_CRITICAL_PAYLOAD: 2346 notify_name = "unsupported_critical_payload"; 2347 showspi = 0; 2348 break; 2349 2350 case IV2_NOTIFY_INVALID_IKE_SPI: 2351 notify_name = "invalid_ike_spi"; 2352 showspi = 1; 2353 break; 2354 2355 case IV2_NOTIFY_INVALID_MAJOR_VERSION: 2356 notify_name = "invalid_major_version"; 2357 showspi = 0; 2358 break; 2359 2360 case IV2_NOTIFY_INVALID_SYNTAX: 2361 notify_name = "invalid_syntax"; 2362 showspi = 1; 2363 break; 2364 2365 case IV2_NOTIFY_INVALID_MESSAGE_ID: 2366 notify_name = "invalid_message_id"; 2367 showspi = 1; 2368 break; 2369 2370 case IV2_NOTIFY_INVALID_SPI: 2371 notify_name = "invalid_spi"; 2372 showspi = 1; 2373 break; 2374 2375 case IV2_NOTIFY_NO_PROPOSAL_CHOSEN: 2376 notify_name = "no_protocol_chosen"; 2377 showspi = 1; 2378 break; 2379 2380 case IV2_NOTIFY_INVALID_KE_PAYLOAD: 2381 notify_name = "invalid_ke_payload"; 2382 showspi = 1; 2383 break; 2384 2385 case IV2_NOTIFY_AUTHENTICATION_FAILED: 2386 notify_name = "authentication_failed"; 2387 showspi = 1; 2388 break; 2389 2390 case IV2_NOTIFY_SINGLE_PAIR_REQUIRED: 2391 notify_name = "single_pair_required"; 2392 showspi = 1; 2393 break; 2394 2395 case IV2_NOTIFY_NO_ADDITIONAL_SAS: 2396 notify_name = "no_additional_sas"; 2397 showspi = 0; 2398 break; 2399 2400 case IV2_NOTIFY_INTERNAL_ADDRESS_FAILURE: 2401 notify_name = "internal_address_failure"; 2402 showspi = 0; 2403 break; 2404 2405 case IV2_NOTIFY_FAILED_CP_REQUIRED: 2406 notify_name = "failed:cp_required"; 2407 showspi = 0; 2408 break; 2409 2410 case IV2_NOTIFY_INVALID_SELECTORS: 2411 notify_name = "invalid_selectors"; 2412 showspi = 0; 2413 break; 2414 2415 case IV2_NOTIFY_INITIAL_CONTACT: 2416 notify_name = "initial_contact"; 2417 showspi = 0; 2418 break; 2419 2420 case IV2_NOTIFY_SET_WINDOW_SIZE: 2421 notify_name = "set_window_size"; 2422 showspi = 0; 2423 break; 2424 2425 case IV2_NOTIFY_ADDITIONAL_TS_POSSIBLE: 2426 notify_name = "additional_ts_possible"; 2427 showspi = 0; 2428 break; 2429 2430 case IV2_NOTIFY_IPCOMP_SUPPORTED: 2431 notify_name = "ipcomp_supported"; 2432 showspi = 0; 2433 break; 2434 2435 case IV2_NOTIFY_NAT_DETECTION_SOURCE_IP: 2436 notify_name = "nat_detection_source_ip"; 2437 showspi = 1; 2438 break; 2439 2440 case IV2_NOTIFY_NAT_DETECTION_DESTINATION_IP: 2441 notify_name = "nat_detection_destination_ip"; 2442 showspi = 1; 2443 break; 2444 2445 case IV2_NOTIFY_COOKIE: 2446 notify_name = "cookie"; 2447 showspi = 1; 2448 showsomedata= 1; 2449 showdata= 0; 2450 break; 2451 2452 case IV2_NOTIFY_USE_TRANSPORT_MODE: 2453 notify_name = "use_transport_mode"; 2454 showspi = 0; 2455 break; 2456 2457 case IV2_NOTIFY_HTTP_CERT_LOOKUP_SUPPORTED: 2458 notify_name = "http_cert_lookup_supported"; 2459 showspi = 0; 2460 break; 2461 2462 case IV2_NOTIFY_REKEY_SA: 2463 notify_name = "rekey_sa"; 2464 showspi = 1; 2465 break; 2466 2467 case IV2_NOTIFY_ESP_TFC_PADDING_NOT_SUPPORTED: 2468 notify_name = "tfc_padding_not_supported"; 2469 showspi = 0; 2470 break; 2471 2472 case IV2_NOTIFY_NON_FIRST_FRAGMENTS_ALSO: 2473 notify_name = "non_first_fragment_also"; 2474 showspi = 0; 2475 break; 2476 2477 default: 2478 if (type < 8192) { 2479 notify_name="error"; 2480 } else if(type < 16384) { 2481 notify_name="private-error"; 2482 } else if(type < 40960) { 2483 notify_name="status"; 2484 } else { 2485 notify_name="private-status"; 2486 } 2487 } 2488 2489 if(notify_name) { 2490 ND_PRINT((ndo," type=%u(%s)", type, notify_name)); 2491 } 2492 2493 2494 if (showspi && n.spi_size) { 2495 ND_PRINT((ndo," spi=")); 2496 if (!rawprint(ndo, (const uint8_t *)(p + 1), n.spi_size)) 2497 goto trunc; 2498 } 2499 2500 cp = (const u_char *)(p + 1) + n.spi_size; 2501 2502 if(3 < ndo->ndo_vflag) { 2503 showdata = 1; 2504 } 2505 2506 if ((showdata || (showsomedata && ep-cp < 30)) && cp < ep) { 2507 ND_PRINT((ndo," data=(")); 2508 if (!rawprint(ndo, (const uint8_t *)(cp), ep - cp)) 2509 goto trunc; 2510 2511 ND_PRINT((ndo,")")); 2512 2513 } else if(showsomedata && cp < ep) { 2514 if(!ike_show_somedata(ndo, cp, ep)) goto trunc; 2515 } 2516 2517 return (const u_char *)ext + item_len; 2518 trunc: 2519 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_N))); 2520 return NULL; 2521 } 2522 2523 static const u_char * 2524 ikev2_d_print(netdissect_options *ndo, u_char tpay, 2525 const struct isakmp_gen *ext, 2526 u_int item_len _U_, const u_char *ep _U_, 2527 uint32_t phase _U_, uint32_t doi _U_, 2528 uint32_t proto _U_, int depth _U_) 2529 { 2530 return ikev2_gen_print(ndo, tpay, ext); 2531 } 2532 2533 static const u_char * 2534 ikev2_vid_print(netdissect_options *ndo, u_char tpay, 2535 const struct isakmp_gen *ext, 2536 u_int item_len _U_, const u_char *ep _U_, 2537 uint32_t phase _U_, uint32_t doi _U_, 2538 uint32_t proto _U_, int depth _U_) 2539 { 2540 struct isakmp_gen e; 2541 const u_char *vid; 2542 int i, len; 2543 2544 ND_TCHECK(*ext); 2545 UNALIGNED_MEMCPY(&e, ext, sizeof(e)); 2546 ikev2_pay_print(ndo, NPSTR(tpay), e.critical); 2547 ND_PRINT((ndo," len=%d vid=", ntohs(e.len) - 4)); 2548 2549 vid = (const u_char *)(ext+1); 2550 len = ntohs(e.len) - 4; 2551 ND_TCHECK2(*vid, len); 2552 for(i=0; i<len; i++) { 2553 if(ND_ISPRINT(vid[i])) ND_PRINT((ndo, "%c", vid[i])); 2554 else ND_PRINT((ndo, ".")); 2555 } 2556 if (2 < ndo->ndo_vflag && 4 < len) { 2557 ND_PRINT((ndo," ")); 2558 if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4)) 2559 goto trunc; 2560 } 2561 return (const u_char *)ext + ntohs(e.len); 2562 trunc: 2563 ND_PRINT((ndo," [|%s]", NPSTR(tpay))); 2564 return NULL; 2565 } 2566 2567 static const u_char * 2568 ikev2_TS_print(netdissect_options *ndo, u_char tpay, 2569 const struct isakmp_gen *ext, 2570 u_int item_len _U_, const u_char *ep _U_, 2571 uint32_t phase _U_, uint32_t doi _U_, 2572 uint32_t proto _U_, int depth _U_) 2573 { 2574 return ikev2_gen_print(ndo, tpay, ext); 2575 } 2576 2577 static const u_char * 2578 ikev2_e_print(netdissect_options *ndo, 2579 #ifndef HAVE_LIBCRYPTO 2580 _U_ 2581 #endif 2582 struct isakmp *base, 2583 u_char tpay, 2584 const struct isakmp_gen *ext, 2585 u_int item_len _U_, const u_char *ep _U_, 2586 #ifndef HAVE_LIBCRYPTO 2587 _U_ 2588 #endif 2589 uint32_t phase, 2590 #ifndef HAVE_LIBCRYPTO 2591 _U_ 2592 #endif 2593 uint32_t doi, 2594 #ifndef HAVE_LIBCRYPTO 2595 _U_ 2596 #endif 2597 uint32_t proto, 2598 #ifndef HAVE_LIBCRYPTO 2599 _U_ 2600 #endif 2601 int depth) 2602 { 2603 struct isakmp_gen e; 2604 const u_char *dat; 2605 volatile int dlen; 2606 2607 ND_TCHECK(*ext); 2608 UNALIGNED_MEMCPY(&e, ext, sizeof(e)); 2609 ikev2_pay_print(ndo, NPSTR(tpay), e.critical); 2610 2611 dlen = ntohs(e.len)-4; 2612 2613 ND_PRINT((ndo," len=%d", dlen)); 2614 if (2 < ndo->ndo_vflag && 4 < dlen) { 2615 ND_PRINT((ndo," ")); 2616 if (!rawprint(ndo, (const uint8_t *)(ext + 1), dlen)) 2617 goto trunc; 2618 } 2619 2620 dat = (const u_char *)(ext+1); 2621 ND_TCHECK2(*dat, dlen); 2622 2623 #ifdef HAVE_LIBCRYPTO 2624 /* try to decypt it! */ 2625 if(esp_print_decrypt_buffer_by_ikev2(ndo, 2626 base->flags & ISAKMP_FLAG_I, 2627 base->i_ck, base->r_ck, 2628 dat, dat+dlen)) { 2629 2630 ext = (const struct isakmp_gen *)ndo->ndo_packetp; 2631 2632 /* got it decrypted, print stuff inside. */ 2633 ikev2_sub_print(ndo, base, e.np, ext, ndo->ndo_snapend, 2634 phase, doi, proto, depth+1); 2635 } 2636 #endif 2637 2638 2639 /* always return NULL, because E must be at end, and NP refers 2640 * to what was inside. 2641 */ 2642 return NULL; 2643 trunc: 2644 ND_PRINT((ndo," [|%s]", NPSTR(tpay))); 2645 return NULL; 2646 } 2647 2648 static const u_char * 2649 ikev2_cp_print(netdissect_options *ndo, u_char tpay, 2650 const struct isakmp_gen *ext, 2651 u_int item_len _U_, const u_char *ep _U_, 2652 uint32_t phase _U_, uint32_t doi _U_, 2653 uint32_t proto _U_, int depth _U_) 2654 { 2655 return ikev2_gen_print(ndo, tpay, ext); 2656 } 2657 2658 static const u_char * 2659 ikev2_eap_print(netdissect_options *ndo, u_char tpay, 2660 const struct isakmp_gen *ext, 2661 u_int item_len _U_, const u_char *ep _U_, 2662 uint32_t phase _U_, uint32_t doi _U_, 2663 uint32_t proto _U_, int depth _U_) 2664 { 2665 return ikev2_gen_print(ndo, tpay, ext); 2666 } 2667 2668 static const u_char * 2669 ike_sub0_print(netdissect_options *ndo, 2670 u_char np, const struct isakmp_gen *ext, const u_char *ep, 2671 2672 uint32_t phase, uint32_t doi, uint32_t proto, int depth) 2673 { 2674 const u_char *cp; 2675 struct isakmp_gen e; 2676 u_int item_len; 2677 2678 cp = (const u_char *)ext; 2679 ND_TCHECK(*ext); 2680 UNALIGNED_MEMCPY(&e, ext, sizeof(e)); 2681 2682 /* 2683 * Since we can't have a payload length of less than 4 bytes, 2684 * we need to bail out here if the generic header is nonsensical 2685 * or truncated, otherwise we could loop forever processing 2686 * zero-length items or otherwise misdissect the packet. 2687 */ 2688 item_len = ntohs(e.len); 2689 if (item_len <= 4) 2690 return NULL; 2691 2692 if (NPFUNC(np)) { 2693 /* 2694 * XXX - what if item_len is too short, or too long, 2695 * for this payload type? 2696 */ 2697 cp = (*npfunc[np])(ndo, np, ext, item_len, ep, phase, doi, proto, depth); 2698 } else { 2699 ND_PRINT((ndo,"%s", NPSTR(np))); 2700 cp += item_len; 2701 } 2702 2703 return cp; 2704 trunc: 2705 ND_PRINT((ndo," [|isakmp]")); 2706 return NULL; 2707 } 2708 2709 static const u_char * 2710 ikev1_sub_print(netdissect_options *ndo, 2711 u_char np, const struct isakmp_gen *ext, const u_char *ep, 2712 uint32_t phase, uint32_t doi, uint32_t proto, int depth) 2713 { 2714 const u_char *cp; 2715 int i; 2716 struct isakmp_gen e; 2717 2718 cp = (const u_char *)ext; 2719 2720 while (np) { 2721 ND_TCHECK(*ext); 2722 2723 UNALIGNED_MEMCPY(&e, ext, sizeof(e)); 2724 2725 ND_TCHECK2(*ext, ntohs(e.len)); 2726 2727 depth++; 2728 ND_PRINT((ndo,"\n")); 2729 for (i = 0; i < depth; i++) 2730 ND_PRINT((ndo," ")); 2731 ND_PRINT((ndo,"(")); 2732 cp = ike_sub0_print(ndo, np, ext, ep, phase, doi, proto, depth); 2733 ND_PRINT((ndo,")")); 2734 depth--; 2735 2736 if (cp == NULL) { 2737 /* Zero-length subitem */ 2738 return NULL; 2739 } 2740 2741 np = e.np; 2742 ext = (const struct isakmp_gen *)cp; 2743 } 2744 return cp; 2745 trunc: 2746 ND_PRINT((ndo," [|%s]", NPSTR(np))); 2747 return NULL; 2748 } 2749 2750 static char * 2751 numstr(int x) 2752 { 2753 static char buf[20]; 2754 snprintf(buf, sizeof(buf), "#%d", x); 2755 return buf; 2756 } 2757 2758 static void 2759 ikev1_print(netdissect_options *ndo, 2760 const u_char *bp, u_int length, 2761 const u_char *bp2, struct isakmp *base) 2762 { 2763 const struct isakmp *p; 2764 const u_char *ep; 2765 u_char np; 2766 int i; 2767 int phase; 2768 2769 p = (const struct isakmp *)bp; 2770 ep = ndo->ndo_snapend; 2771 2772 phase = (EXTRACT_32BITS(base->msgid) == 0) ? 1 : 2; 2773 if (phase == 1) 2774 ND_PRINT((ndo," phase %d", phase)); 2775 else 2776 ND_PRINT((ndo," phase %d/others", phase)); 2777 2778 i = cookie_find(&base->i_ck); 2779 if (i < 0) { 2780 if (iszero((const u_char *)&base->r_ck, sizeof(base->r_ck))) { 2781 /* the first packet */ 2782 ND_PRINT((ndo," I")); 2783 if (bp2) 2784 cookie_record(&base->i_ck, bp2); 2785 } else 2786 ND_PRINT((ndo," ?")); 2787 } else { 2788 if (bp2 && cookie_isinitiator(i, bp2)) 2789 ND_PRINT((ndo," I")); 2790 else if (bp2 && cookie_isresponder(i, bp2)) 2791 ND_PRINT((ndo," R")); 2792 else 2793 ND_PRINT((ndo," ?")); 2794 } 2795 2796 ND_PRINT((ndo," %s", ETYPESTR(base->etype))); 2797 if (base->flags) { 2798 ND_PRINT((ndo,"[%s%s]", base->flags & ISAKMP_FLAG_E ? "E" : "", 2799 base->flags & ISAKMP_FLAG_C ? "C" : "")); 2800 } 2801 2802 if (ndo->ndo_vflag) { 2803 const struct isakmp_gen *ext; 2804 2805 ND_PRINT((ndo,":")); 2806 2807 /* regardless of phase... */ 2808 if (base->flags & ISAKMP_FLAG_E) { 2809 /* 2810 * encrypted, nothing we can do right now. 2811 * we hope to decrypt the packet in the future... 2812 */ 2813 ND_PRINT((ndo," [encrypted %s]", NPSTR(base->np))); 2814 goto done; 2815 } 2816 2817 CHECKLEN(p + 1, base->np); 2818 np = base->np; 2819 ext = (const struct isakmp_gen *)(p + 1); 2820 ikev1_sub_print(ndo, np, ext, ep, phase, 0, 0, 0); 2821 } 2822 2823 done: 2824 if (ndo->ndo_vflag) { 2825 if (ntohl(base->len) != length) { 2826 ND_PRINT((ndo," (len mismatch: isakmp %u/ip %u)", 2827 (uint32_t)ntohl(base->len), length)); 2828 } 2829 } 2830 } 2831 2832 static const u_char * 2833 ikev2_sub0_print(netdissect_options *ndo, struct isakmp *base, 2834 u_char np, 2835 const struct isakmp_gen *ext, const u_char *ep, 2836 uint32_t phase, uint32_t doi, uint32_t proto, int depth) 2837 { 2838 const u_char *cp; 2839 struct isakmp_gen e; 2840 u_int item_len; 2841 2842 cp = (const u_char *)ext; 2843 ND_TCHECK(*ext); 2844 UNALIGNED_MEMCPY(&e, ext, sizeof(e)); 2845 2846 /* 2847 * Since we can't have a payload length of less than 4 bytes, 2848 * we need to bail out here if the generic header is nonsensical 2849 * or truncated, otherwise we could loop forever processing 2850 * zero-length items or otherwise misdissect the packet. 2851 */ 2852 item_len = ntohs(e.len); 2853 if (item_len <= 4) 2854 return NULL; 2855 2856 if (np == ISAKMP_NPTYPE_v2E) { 2857 cp = ikev2_e_print(ndo, base, np, ext, item_len, 2858 ep, phase, doi, proto, depth); 2859 } else if (NPFUNC(np)) { 2860 /* 2861 * XXX - what if item_len is too short, or too long, 2862 * for this payload type? 2863 */ 2864 cp = (*npfunc[np])(ndo, np, ext, item_len, 2865 ep, phase, doi, proto, depth); 2866 } else { 2867 ND_PRINT((ndo,"%s", NPSTR(np))); 2868 cp += item_len; 2869 } 2870 2871 return cp; 2872 trunc: 2873 ND_PRINT((ndo," [|isakmp]")); 2874 return NULL; 2875 } 2876 2877 static const u_char * 2878 ikev2_sub_print(netdissect_options *ndo, 2879 struct isakmp *base, 2880 u_char np, const struct isakmp_gen *ext, const u_char *ep, 2881 uint32_t phase, uint32_t doi, uint32_t proto, int depth) 2882 { 2883 const u_char *cp; 2884 int i; 2885 struct isakmp_gen e; 2886 2887 cp = (const u_char *)ext; 2888 while (np) { 2889 ND_TCHECK(*ext); 2890 2891 UNALIGNED_MEMCPY(&e, ext, sizeof(e)); 2892 2893 ND_TCHECK2(*ext, ntohs(e.len)); 2894 2895 depth++; 2896 ND_PRINT((ndo,"\n")); 2897 for (i = 0; i < depth; i++) 2898 ND_PRINT((ndo," ")); 2899 ND_PRINT((ndo,"(")); 2900 cp = ikev2_sub0_print(ndo, base, np, 2901 ext, ep, phase, doi, proto, depth); 2902 ND_PRINT((ndo,")")); 2903 depth--; 2904 2905 if (cp == NULL) { 2906 /* Zero-length subitem */ 2907 return NULL; 2908 } 2909 2910 np = e.np; 2911 ext = (const struct isakmp_gen *)cp; 2912 } 2913 return cp; 2914 trunc: 2915 ND_PRINT((ndo," [|%s]", NPSTR(np))); 2916 return NULL; 2917 } 2918 2919 static void 2920 ikev2_print(netdissect_options *ndo, 2921 const u_char *bp, u_int length, 2922 const u_char *bp2 _U_, struct isakmp *base) 2923 { 2924 const struct isakmp *p; 2925 const u_char *ep; 2926 u_char np; 2927 int phase; 2928 2929 p = (const struct isakmp *)bp; 2930 ep = ndo->ndo_snapend; 2931 2932 phase = (EXTRACT_32BITS(base->msgid) == 0) ? 1 : 2; 2933 if (phase == 1) 2934 ND_PRINT((ndo, " parent_sa")); 2935 else 2936 ND_PRINT((ndo, " child_sa ")); 2937 2938 ND_PRINT((ndo, " %s", ETYPESTR(base->etype))); 2939 if (base->flags) { 2940 ND_PRINT((ndo, "[%s%s%s]", 2941 base->flags & ISAKMP_FLAG_I ? "I" : "", 2942 base->flags & ISAKMP_FLAG_V ? "V" : "", 2943 base->flags & ISAKMP_FLAG_R ? "R" : "")); 2944 } 2945 2946 if (ndo->ndo_vflag) { 2947 const struct isakmp_gen *ext; 2948 2949 ND_PRINT((ndo, ":")); 2950 2951 /* regardless of phase... */ 2952 if (base->flags & ISAKMP_FLAG_E) { 2953 /* 2954 * encrypted, nothing we can do right now. 2955 * we hope to decrypt the packet in the future... 2956 */ 2957 ND_PRINT((ndo, " [encrypted %s]", NPSTR(base->np))); 2958 goto done; 2959 } 2960 2961 CHECKLEN(p + 1, base->np) 2962 2963 np = base->np; 2964 ext = (const struct isakmp_gen *)(p + 1); 2965 ikev2_sub_print(ndo, base, np, ext, ep, phase, 0, 0, 0); 2966 } 2967 2968 done: 2969 if (ndo->ndo_vflag) { 2970 if (ntohl(base->len) != length) { 2971 ND_PRINT((ndo, " (len mismatch: isakmp %u/ip %u)", 2972 (uint32_t)ntohl(base->len), length)); 2973 } 2974 } 2975 } 2976 2977 void 2978 isakmp_print(netdissect_options *ndo, 2979 const u_char *bp, u_int length, 2980 const u_char *bp2) 2981 { 2982 const struct isakmp *p; 2983 struct isakmp base; 2984 const u_char *ep; 2985 int major, minor; 2986 2987 #ifdef HAVE_LIBCRYPTO 2988 /* initialize SAs */ 2989 if (ndo->ndo_sa_list_head == NULL) { 2990 if (ndo->ndo_espsecret) 2991 esp_print_decodesecret(ndo); 2992 } 2993 #endif 2994 2995 p = (const struct isakmp *)bp; 2996 ep = ndo->ndo_snapend; 2997 2998 if ((const struct isakmp *)ep < p + 1) { 2999 ND_PRINT((ndo,"[|isakmp]")); 3000 return; 3001 } 3002 3003 UNALIGNED_MEMCPY(&base, p, sizeof(base)); 3004 3005 ND_PRINT((ndo,"isakmp")); 3006 major = (base.vers & ISAKMP_VERS_MAJOR) 3007 >> ISAKMP_VERS_MAJOR_SHIFT; 3008 minor = (base.vers & ISAKMP_VERS_MINOR) 3009 >> ISAKMP_VERS_MINOR_SHIFT; 3010 3011 if (ndo->ndo_vflag) { 3012 ND_PRINT((ndo," %d.%d", major, minor)); 3013 } 3014 3015 if (ndo->ndo_vflag) { 3016 ND_PRINT((ndo," msgid ")); 3017 hexprint(ndo, (const uint8_t *)&base.msgid, sizeof(base.msgid)); 3018 } 3019 3020 if (1 < ndo->ndo_vflag) { 3021 ND_PRINT((ndo," cookie ")); 3022 hexprint(ndo, (const uint8_t *)&base.i_ck, sizeof(base.i_ck)); 3023 ND_PRINT((ndo,"->")); 3024 hexprint(ndo, (const uint8_t *)&base.r_ck, sizeof(base.r_ck)); 3025 } 3026 ND_PRINT((ndo,":")); 3027 3028 switch(major) { 3029 case IKEv1_MAJOR_VERSION: 3030 ikev1_print(ndo, bp, length, bp2, &base); 3031 break; 3032 3033 case IKEv2_MAJOR_VERSION: 3034 ikev2_print(ndo, bp, length, bp2, &base); 3035 break; 3036 } 3037 } 3038 3039 void 3040 isakmp_rfc3948_print(netdissect_options *ndo, 3041 const u_char *bp, u_int length, 3042 const u_char *bp2) 3043 { 3044 3045 if(length == 1 && bp[0]==0xff) { 3046 ND_PRINT((ndo, "isakmp-nat-keep-alive")); 3047 return; 3048 } 3049 3050 if(length < 4) { 3051 goto trunc; 3052 } 3053 3054 /* 3055 * see if this is an IKE packet 3056 */ 3057 if(bp[0]==0 && bp[1]==0 && bp[2]==0 && bp[3]==0) { 3058 ND_PRINT((ndo, "NONESP-encap: ")); 3059 isakmp_print(ndo, bp+4, length-4, bp2); 3060 return; 3061 } 3062 3063 /* must be an ESP packet */ 3064 { 3065 int nh, enh, padlen; 3066 int advance; 3067 3068 ND_PRINT((ndo, "UDP-encap: ")); 3069 3070 advance = esp_print(ndo, bp, length, bp2, &enh, &padlen); 3071 if(advance <= 0) 3072 return; 3073 3074 bp += advance; 3075 length -= advance + padlen; 3076 nh = enh & 0xff; 3077 3078 ip_print_inner(ndo, bp, length, nh, bp2); 3079 return; 3080 } 3081 3082 trunc: 3083 ND_PRINT((ndo,"[|isakmp]")); 3084 return; 3085 } 3086 3087 /* 3088 * Local Variables: 3089 * c-style: whitesmith 3090 * c-basic-offset: 8 3091 * End: 3092 */ 3093 3094 3095 3096 3097
