1 /* 2 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. Neither the name of the project nor the names of its contributors 14 * may be used to endorse or promote products derived from this software 15 * without specific prior written permission. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 * SUCH DAMAGE. 28 * 29 */ 30 31 /* \summary: Internet Security Association and Key Management Protocol (ISAKMP) printer */ 32 33 #ifdef HAVE_CONFIG_H 34 #include "config.h" 35 #endif 36 37 /* The functions from print-esp.c used in this file are only defined when both 38 * OpenSSL and evp.h are detected. Employ the same preprocessor device here. 39 */ 40 #ifndef HAVE_OPENSSL_EVP_H 41 #undef HAVE_LIBCRYPTO 42 #endif 43 44 #include <netdissect-stdinc.h> 45 46 #include <string.h> 47 48 #include "netdissect.h" 49 #include "addrtoname.h" 50 #include "extract.h" 51 52 #include "ip.h" 53 #include "ip6.h" 54 #include "ipproto.h" 55 56 /* refer to RFC 2408 */ 57 58 typedef u_char cookie_t[8]; 59 typedef u_char msgid_t[4]; 60 61 #define PORT_ISAKMP 500 62 63 /* 3.1 ISAKMP Header Format (IKEv1 and IKEv2) 64 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 65 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 66 ! Initiator ! 67 ! Cookie ! 68 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 69 ! Responder ! 70 ! Cookie ! 71 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 72 ! Next Payload ! MjVer ! MnVer ! Exchange Type ! Flags ! 73 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 74 ! Message ID ! 75 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 76 ! Length ! 77 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 78 */ 79 struct isakmp { 80 cookie_t i_ck; /* Initiator Cookie */ 81 cookie_t r_ck; /* Responder Cookie */ 82 uint8_t np; /* Next Payload Type */ 83 uint8_t vers; 84 #define ISAKMP_VERS_MAJOR 0xf0 85 #define ISAKMP_VERS_MAJOR_SHIFT 4 86 #define ISAKMP_VERS_MINOR 0x0f 87 #define ISAKMP_VERS_MINOR_SHIFT 0 88 uint8_t etype; /* Exchange Type */ 89 uint8_t flags; /* Flags */ 90 msgid_t msgid; 91 uint32_t len; /* Length */ 92 }; 93 94 /* Next Payload Type */ 95 #define ISAKMP_NPTYPE_NONE 0 /* NONE*/ 96 #define ISAKMP_NPTYPE_SA 1 /* Security Association */ 97 #define ISAKMP_NPTYPE_P 2 /* Proposal */ 98 #define ISAKMP_NPTYPE_T 3 /* Transform */ 99 #define ISAKMP_NPTYPE_KE 4 /* Key Exchange */ 100 #define ISAKMP_NPTYPE_ID 5 /* Identification */ 101 #define ISAKMP_NPTYPE_CERT 6 /* Certificate */ 102 #define ISAKMP_NPTYPE_CR 7 /* Certificate Request */ 103 #define ISAKMP_NPTYPE_HASH 8 /* Hash */ 104 #define ISAKMP_NPTYPE_SIG 9 /* Signature */ 105 #define ISAKMP_NPTYPE_NONCE 10 /* Nonce */ 106 #define ISAKMP_NPTYPE_N 11 /* Notification */ 107 #define ISAKMP_NPTYPE_D 12 /* Delete */ 108 #define ISAKMP_NPTYPE_VID 13 /* Vendor ID */ 109 #define ISAKMP_NPTYPE_v2E 46 /* v2 Encrypted payload */ 110 111 #define IKEv1_MAJOR_VERSION 1 112 #define IKEv1_MINOR_VERSION 0 113 114 #define IKEv2_MAJOR_VERSION 2 115 #define IKEv2_MINOR_VERSION 0 116 117 /* Flags */ 118 #define ISAKMP_FLAG_E 0x01 /* Encryption Bit */ 119 #define ISAKMP_FLAG_C 0x02 /* Commit Bit */ 120 #define ISAKMP_FLAG_extra 0x04 121 122 /* IKEv2 */ 123 #define ISAKMP_FLAG_I (1 << 3) /* (I)nitiator */ 124 #define ISAKMP_FLAG_V (1 << 4) /* (V)ersion */ 125 #define ISAKMP_FLAG_R (1 << 5) /* (R)esponse */ 126 127 128 /* 3.2 Payload Generic Header 129 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 130 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 131 ! Next Payload ! RESERVED ! Payload Length ! 132 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 133 */ 134 struct isakmp_gen { 135 uint8_t np; /* Next Payload */ 136 uint8_t critical; /* bit 7 - critical, rest is RESERVED */ 137 uint16_t len; /* Payload Length */ 138 }; 139 140 /* 3.3 Data Attributes 141 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 142 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 143 !A! Attribute Type ! AF=0 Attribute Length ! 144 !F! ! AF=1 Attribute Value ! 145 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 146 . AF=0 Attribute Value . 147 . AF=1 Not Transmitted . 148 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 149 */ 150 struct isakmp_data { 151 uint16_t type; /* defined by DOI-spec, and Attribute Format */ 152 uint16_t lorv; /* if f equal 1, Attribute Length */ 153 /* if f equal 0, Attribute Value */ 154 /* if f equal 1, Attribute Value */ 155 }; 156 157 /* 3.4 Security Association Payload */ 158 /* MAY NOT be used, because of being defined in ipsec-doi. */ 159 /* 160 If the current payload is the last in the message, 161 then the value of the next payload field will be 0. 162 This field MUST NOT contain the 163 values for the Proposal or Transform payloads as they are considered 164 part of the security association negotiation. For example, this 165 field would contain the value "10" (Nonce payload) in the first 166 message of a Base Exchange (see Section 4.4) and the value "0" in the 167 first message of an Identity Protect Exchange (see Section 4.5). 168 */ 169 struct ikev1_pl_sa { 170 struct isakmp_gen h; 171 uint32_t doi; /* Domain of Interpretation */ 172 uint32_t sit; /* Situation */ 173 }; 174 175 /* 3.5 Proposal Payload */ 176 /* 177 The value of the next payload field MUST only contain the value "2" 178 or "0". If there are additional Proposal payloads in the message, 179 then this field will be 2. If the current Proposal payload is the 180 last within the security association proposal, then this field will 181 be 0. 182 */ 183 struct ikev1_pl_p { 184 struct isakmp_gen h; 185 uint8_t p_no; /* Proposal # */ 186 uint8_t prot_id; /* Protocol */ 187 uint8_t spi_size; /* SPI Size */ 188 uint8_t num_t; /* Number of Transforms */ 189 /* SPI */ 190 }; 191 192 /* 3.6 Transform Payload */ 193 /* 194 The value of the next payload field MUST only contain the value "3" 195 or "0". If there are additional Transform payloads in the proposal, 196 then this field will be 3. If the current Transform payload is the 197 last within the proposal, then this field will be 0. 198 */ 199 struct ikev1_pl_t { 200 struct isakmp_gen h; 201 uint8_t t_no; /* Transform # */ 202 uint8_t t_id; /* Transform-Id */ 203 uint16_t reserved; /* RESERVED2 */ 204 /* SA Attributes */ 205 }; 206 207 /* 3.7 Key Exchange Payload */ 208 struct ikev1_pl_ke { 209 struct isakmp_gen h; 210 /* Key Exchange Data */ 211 }; 212 213 /* 3.8 Identification Payload */ 214 /* MUST NOT to be used, because of being defined in ipsec-doi. */ 215 struct ikev1_pl_id { 216 struct isakmp_gen h; 217 union { 218 uint8_t id_type; /* ID Type */ 219 uint32_t doi_data; /* DOI Specific ID Data */ 220 } d; 221 /* Identification Data */ 222 }; 223 224 /* 3.9 Certificate Payload */ 225 struct ikev1_pl_cert { 226 struct isakmp_gen h; 227 uint8_t encode; /* Cert Encoding */ 228 char cert; /* Certificate Data */ 229 /* 230 This field indicates the type of 231 certificate or certificate-related information contained in the 232 Certificate Data field. 233 */ 234 }; 235 236 /* 3.10 Certificate Request Payload */ 237 struct ikev1_pl_cr { 238 struct isakmp_gen h; 239 uint8_t num_cert; /* # Cert. Types */ 240 /* 241 Certificate Types (variable length) 242 -- Contains a list of the types of certificates requested, 243 sorted in order of preference. Each individual certificate 244 type is 1 octet. This field is NOT requiredo 245 */ 246 /* # Certificate Authorities (1 octet) */ 247 /* Certificate Authorities (variable length) */ 248 }; 249 250 /* 3.11 Hash Payload */ 251 /* may not be used, because of having only data. */ 252 struct ikev1_pl_hash { 253 struct isakmp_gen h; 254 /* Hash Data */ 255 }; 256 257 /* 3.12 Signature Payload */ 258 /* may not be used, because of having only data. */ 259 struct ikev1_pl_sig { 260 struct isakmp_gen h; 261 /* Signature Data */ 262 }; 263 264 /* 3.13 Nonce Payload */ 265 /* may not be used, because of having only data. */ 266 struct ikev1_pl_nonce { 267 struct isakmp_gen h; 268 /* Nonce Data */ 269 }; 270 271 /* 3.14 Notification Payload */ 272 struct ikev1_pl_n { 273 struct isakmp_gen h; 274 uint32_t doi; /* Domain of Interpretation */ 275 uint8_t prot_id; /* Protocol-ID */ 276 uint8_t spi_size; /* SPI Size */ 277 uint16_t type; /* Notify Message Type */ 278 /* SPI */ 279 /* Notification Data */ 280 }; 281 282 /* 3.14.1 Notify Message Types */ 283 /* NOTIFY MESSAGES - ERROR TYPES */ 284 #define ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE 1 285 #define ISAKMP_NTYPE_DOI_NOT_SUPPORTED 2 286 #define ISAKMP_NTYPE_SITUATION_NOT_SUPPORTED 3 287 #define ISAKMP_NTYPE_INVALID_COOKIE 4 288 #define ISAKMP_NTYPE_INVALID_MAJOR_VERSION 5 289 #define ISAKMP_NTYPE_INVALID_MINOR_VERSION 6 290 #define ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE 7 291 #define ISAKMP_NTYPE_INVALID_FLAGS 8 292 #define ISAKMP_NTYPE_INVALID_MESSAGE_ID 9 293 #define ISAKMP_NTYPE_INVALID_PROTOCOL_ID 10 294 #define ISAKMP_NTYPE_INVALID_SPI 11 295 #define ISAKMP_NTYPE_INVALID_TRANSFORM_ID 12 296 #define ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED 13 297 #define ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN 14 298 #define ISAKMP_NTYPE_BAD_PROPOSAL_SYNTAX 15 299 #define ISAKMP_NTYPE_PAYLOAD_MALFORMED 16 300 #define ISAKMP_NTYPE_INVALID_KEY_INFORMATION 17 301 #define ISAKMP_NTYPE_INVALID_ID_INFORMATION 18 302 #define ISAKMP_NTYPE_INVALID_CERT_ENCODING 19 303 #define ISAKMP_NTYPE_INVALID_CERTIFICATE 20 304 #define ISAKMP_NTYPE_BAD_CERT_REQUEST_SYNTAX 21 305 #define ISAKMP_NTYPE_INVALID_CERT_AUTHORITY 22 306 #define ISAKMP_NTYPE_INVALID_HASH_INFORMATION 23 307 #define ISAKMP_NTYPE_AUTHENTICATION_FAILED 24 308 #define ISAKMP_NTYPE_INVALID_SIGNATURE 25 309 #define ISAKMP_NTYPE_ADDRESS_NOTIFICATION 26 310 311 /* 3.15 Delete Payload */ 312 struct ikev1_pl_d { 313 struct isakmp_gen h; 314 uint32_t doi; /* Domain of Interpretation */ 315 uint8_t prot_id; /* Protocol-Id */ 316 uint8_t spi_size; /* SPI Size */ 317 uint16_t num_spi; /* # of SPIs */ 318 /* SPI(es) */ 319 }; 320 321 struct ikev1_ph1tab { 322 struct ikev1_ph1 *head; 323 struct ikev1_ph1 *tail; 324 int len; 325 }; 326 327 struct isakmp_ph2tab { 328 struct ikev1_ph2 *head; 329 struct ikev1_ph2 *tail; 330 int len; 331 }; 332 333 /* IKEv2 (RFC4306) */ 334 335 /* 3.3 Security Association Payload -- generic header */ 336 /* 3.3.1. Proposal Substructure */ 337 struct ikev2_p { 338 struct isakmp_gen h; 339 uint8_t p_no; /* Proposal # */ 340 uint8_t prot_id; /* Protocol */ 341 uint8_t spi_size; /* SPI Size */ 342 uint8_t num_t; /* Number of Transforms */ 343 }; 344 345 /* 3.3.2. Transform Substructure */ 346 struct ikev2_t { 347 struct isakmp_gen h; 348 uint8_t t_type; /* Transform Type (ENCR,PRF,INTEG,etc.*/ 349 uint8_t res2; /* reserved byte */ 350 uint16_t t_id; /* Transform ID */ 351 }; 352 353 enum ikev2_t_type { 354 IV2_T_ENCR = 1, 355 IV2_T_PRF = 2, 356 IV2_T_INTEG= 3, 357 IV2_T_DH = 4, 358 IV2_T_ESN = 5 359 }; 360 361 /* 3.4. Key Exchange Payload */ 362 struct ikev2_ke { 363 struct isakmp_gen h; 364 uint16_t ke_group; 365 uint16_t ke_res1; 366 /* KE data */ 367 }; 368 369 370 /* 3.5. Identification Payloads */ 371 enum ikev2_id_type { 372 ID_IPV4_ADDR=1, 373 ID_FQDN=2, 374 ID_RFC822_ADDR=3, 375 ID_IPV6_ADDR=5, 376 ID_DER_ASN1_DN=9, 377 ID_DER_ASN1_GN=10, 378 ID_KEY_ID=11 379 }; 380 struct ikev2_id { 381 struct isakmp_gen h; 382 uint8_t type; /* ID type */ 383 uint8_t res1; 384 uint16_t res2; 385 /* SPI */ 386 /* Notification Data */ 387 }; 388 389 /* 3.10 Notification Payload */ 390 struct ikev2_n { 391 struct isakmp_gen h; 392 uint8_t prot_id; /* Protocol-ID */ 393 uint8_t spi_size; /* SPI Size */ 394 uint16_t type; /* Notify Message Type */ 395 }; 396 397 enum ikev2_n_type { 398 IV2_NOTIFY_UNSUPPORTED_CRITICAL_PAYLOAD = 1, 399 IV2_NOTIFY_INVALID_IKE_SPI = 4, 400 IV2_NOTIFY_INVALID_MAJOR_VERSION = 5, 401 IV2_NOTIFY_INVALID_SYNTAX = 7, 402 IV2_NOTIFY_INVALID_MESSAGE_ID = 9, 403 IV2_NOTIFY_INVALID_SPI =11, 404 IV2_NOTIFY_NO_PROPOSAL_CHOSEN =14, 405 IV2_NOTIFY_INVALID_KE_PAYLOAD =17, 406 IV2_NOTIFY_AUTHENTICATION_FAILED =24, 407 IV2_NOTIFY_SINGLE_PAIR_REQUIRED =34, 408 IV2_NOTIFY_NO_ADDITIONAL_SAS =35, 409 IV2_NOTIFY_INTERNAL_ADDRESS_FAILURE =36, 410 IV2_NOTIFY_FAILED_CP_REQUIRED =37, 411 IV2_NOTIFY_INVALID_SELECTORS =39, 412 IV2_NOTIFY_INITIAL_CONTACT =16384, 413 IV2_NOTIFY_SET_WINDOW_SIZE =16385, 414 IV2_NOTIFY_ADDITIONAL_TS_POSSIBLE =16386, 415 IV2_NOTIFY_IPCOMP_SUPPORTED =16387, 416 IV2_NOTIFY_NAT_DETECTION_SOURCE_IP =16388, 417 IV2_NOTIFY_NAT_DETECTION_DESTINATION_IP =16389, 418 IV2_NOTIFY_COOKIE =16390, 419 IV2_NOTIFY_USE_TRANSPORT_MODE =16391, 420 IV2_NOTIFY_HTTP_CERT_LOOKUP_SUPPORTED =16392, 421 IV2_NOTIFY_REKEY_SA =16393, 422 IV2_NOTIFY_ESP_TFC_PADDING_NOT_SUPPORTED =16394, 423 IV2_NOTIFY_NON_FIRST_FRAGMENTS_ALSO =16395 424 }; 425 426 struct notify_messages { 427 uint16_t type; 428 char *msg; 429 }; 430 431 /* 3.8 Authentication Payload */ 432 struct ikev2_auth { 433 struct isakmp_gen h; 434 uint8_t auth_method; /* Protocol-ID */ 435 uint8_t reserved[3]; 436 /* authentication data */ 437 }; 438 439 enum ikev2_auth_type { 440 IV2_RSA_SIG = 1, 441 IV2_SHARED = 2, 442 IV2_DSS_SIG = 3 443 }; 444 445 /* refer to RFC 2409 */ 446 447 #if 0 448 /* isakmp sa structure */ 449 struct oakley_sa { 450 uint8_t proto_id; /* OAKLEY */ 451 vchar_t *spi; /* spi */ 452 uint8_t dhgrp; /* DH; group */ 453 uint8_t auth_t; /* method of authentication */ 454 uint8_t prf_t; /* type of prf */ 455 uint8_t hash_t; /* type of hash */ 456 uint8_t enc_t; /* type of cipher */ 457 uint8_t life_t; /* type of duration of lifetime */ 458 uint32_t ldur; /* life duration */ 459 }; 460 #endif 461 462 /* refer to RFC 2407 */ 463 464 #define IPSEC_DOI 1 465 466 /* 4.2 IPSEC Situation Definition */ 467 #define IPSECDOI_SIT_IDENTITY_ONLY 0x00000001 468 #define IPSECDOI_SIT_SECRECY 0x00000002 469 #define IPSECDOI_SIT_INTEGRITY 0x00000004 470 471 /* 4.4.1 IPSEC Security Protocol Identifiers */ 472 /* 4.4.2 IPSEC ISAKMP Transform Values */ 473 #define IPSECDOI_PROTO_ISAKMP 1 474 #define IPSECDOI_KEY_IKE 1 475 476 /* 4.4.1 IPSEC Security Protocol Identifiers */ 477 #define IPSECDOI_PROTO_IPSEC_AH 2 478 /* 4.4.3 IPSEC AH Transform Values */ 479 #define IPSECDOI_AH_MD5 2 480 #define IPSECDOI_AH_SHA 3 481 #define IPSECDOI_AH_DES 4 482 #define IPSECDOI_AH_SHA2_256 5 483 #define IPSECDOI_AH_SHA2_384 6 484 #define IPSECDOI_AH_SHA2_512 7 485 486 /* 4.4.1 IPSEC Security Protocol Identifiers */ 487 #define IPSECDOI_PROTO_IPSEC_ESP 3 488 /* 4.4.4 IPSEC ESP Transform Identifiers */ 489 #define IPSECDOI_ESP_DES_IV64 1 490 #define IPSECDOI_ESP_DES 2 491 #define IPSECDOI_ESP_3DES 3 492 #define IPSECDOI_ESP_RC5 4 493 #define IPSECDOI_ESP_IDEA 5 494 #define IPSECDOI_ESP_CAST 6 495 #define IPSECDOI_ESP_BLOWFISH 7 496 #define IPSECDOI_ESP_3IDEA 8 497 #define IPSECDOI_ESP_DES_IV32 9 498 #define IPSECDOI_ESP_RC4 10 499 #define IPSECDOI_ESP_NULL 11 500 #define IPSECDOI_ESP_RIJNDAEL 12 501 #define IPSECDOI_ESP_AES 12 502 503 /* 4.4.1 IPSEC Security Protocol Identifiers */ 504 #define IPSECDOI_PROTO_IPCOMP 4 505 /* 4.4.5 IPSEC IPCOMP Transform Identifiers */ 506 #define IPSECDOI_IPCOMP_OUI 1 507 #define IPSECDOI_IPCOMP_DEFLATE 2 508 #define IPSECDOI_IPCOMP_LZS 3 509 510 /* 4.5 IPSEC Security Association Attributes */ 511 #define IPSECDOI_ATTR_SA_LTYPE 1 /* B */ 512 #define IPSECDOI_ATTR_SA_LTYPE_DEFAULT 1 513 #define IPSECDOI_ATTR_SA_LTYPE_SEC 1 514 #define IPSECDOI_ATTR_SA_LTYPE_KB 2 515 #define IPSECDOI_ATTR_SA_LDUR 2 /* V */ 516 #define IPSECDOI_ATTR_SA_LDUR_DEFAULT 28800 /* 8 hours */ 517 #define IPSECDOI_ATTR_GRP_DESC 3 /* B */ 518 #define IPSECDOI_ATTR_ENC_MODE 4 /* B */ 519 /* default value: host dependent */ 520 #define IPSECDOI_ATTR_ENC_MODE_TUNNEL 1 521 #define IPSECDOI_ATTR_ENC_MODE_TRNS 2 522 #define IPSECDOI_ATTR_AUTH 5 /* B */ 523 /* 0 means not to use authentication. */ 524 #define IPSECDOI_ATTR_AUTH_HMAC_MD5 1 525 #define IPSECDOI_ATTR_AUTH_HMAC_SHA1 2 526 #define IPSECDOI_ATTR_AUTH_DES_MAC 3 527 #define IPSECDOI_ATTR_AUTH_KPDK 4 /*RFC-1826(Key/Pad/Data/Key)*/ 528 /* 529 * When negotiating ESP without authentication, the Auth 530 * Algorithm attribute MUST NOT be included in the proposal. 531 * When negotiating ESP without confidentiality, the Auth 532 * Algorithm attribute MUST be included in the proposal and 533 * the ESP transform ID must be ESP_NULL. 534 */ 535 #define IPSECDOI_ATTR_KEY_LENGTH 6 /* B */ 536 #define IPSECDOI_ATTR_KEY_ROUNDS 7 /* B */ 537 #define IPSECDOI_ATTR_COMP_DICT_SIZE 8 /* B */ 538 #define IPSECDOI_ATTR_COMP_PRIVALG 9 /* V */ 539 540 /* 4.6.1 Security Association Payload */ 541 struct ipsecdoi_sa { 542 struct isakmp_gen h; 543 uint32_t doi; /* Domain of Interpretation */ 544 uint32_t sit; /* Situation */ 545 }; 546 547 struct ipsecdoi_secrecy_h { 548 uint16_t len; 549 uint16_t reserved; 550 }; 551 552 /* 4.6.2.1 Identification Type Values */ 553 struct ipsecdoi_id { 554 struct isakmp_gen h; 555 uint8_t type; /* ID Type */ 556 uint8_t proto_id; /* Protocol ID */ 557 uint16_t port; /* Port */ 558 /* Identification Data */ 559 }; 560 561 #define IPSECDOI_ID_IPV4_ADDR 1 562 #define IPSECDOI_ID_FQDN 2 563 #define IPSECDOI_ID_USER_FQDN 3 564 #define IPSECDOI_ID_IPV4_ADDR_SUBNET 4 565 #define IPSECDOI_ID_IPV6_ADDR 5 566 #define IPSECDOI_ID_IPV6_ADDR_SUBNET 6 567 #define IPSECDOI_ID_IPV4_ADDR_RANGE 7 568 #define IPSECDOI_ID_IPV6_ADDR_RANGE 8 569 #define IPSECDOI_ID_DER_ASN1_DN 9 570 #define IPSECDOI_ID_DER_ASN1_GN 10 571 #define IPSECDOI_ID_KEY_ID 11 572 573 /* 4.6.3 IPSEC DOI Notify Message Types */ 574 /* Notify Messages - Status Types */ 575 #define IPSECDOI_NTYPE_RESPONDER_LIFETIME 24576 576 #define IPSECDOI_NTYPE_REPLAY_STATUS 24577 577 #define IPSECDOI_NTYPE_INITIAL_CONTACT 24578 578 579 #define DECLARE_PRINTER(func) static const u_char *ike##func##_print( \ 580 netdissect_options *ndo, u_char tpay, \ 581 const struct isakmp_gen *ext, \ 582 u_int item_len, \ 583 const u_char *end_pointer, \ 584 uint32_t phase,\ 585 uint32_t doi0, \ 586 uint32_t proto0, int depth) 587 588 DECLARE_PRINTER(v1_sa); 589 DECLARE_PRINTER(v1_p); 590 DECLARE_PRINTER(v1_t); 591 DECLARE_PRINTER(v1_ke); 592 DECLARE_PRINTER(v1_id); 593 DECLARE_PRINTER(v1_cert); 594 DECLARE_PRINTER(v1_cr); 595 DECLARE_PRINTER(v1_sig); 596 DECLARE_PRINTER(v1_hash); 597 DECLARE_PRINTER(v1_nonce); 598 DECLARE_PRINTER(v1_n); 599 DECLARE_PRINTER(v1_d); 600 DECLARE_PRINTER(v1_vid); 601 602 DECLARE_PRINTER(v2_sa); 603 DECLARE_PRINTER(v2_ke); 604 DECLARE_PRINTER(v2_ID); 605 DECLARE_PRINTER(v2_cert); 606 DECLARE_PRINTER(v2_cr); 607 DECLARE_PRINTER(v2_auth); 608 DECLARE_PRINTER(v2_nonce); 609 DECLARE_PRINTER(v2_n); 610 DECLARE_PRINTER(v2_d); 611 DECLARE_PRINTER(v2_vid); 612 DECLARE_PRINTER(v2_TS); 613 DECLARE_PRINTER(v2_cp); 614 DECLARE_PRINTER(v2_eap); 615 616 static const u_char *ikev2_e_print(netdissect_options *ndo, 617 struct isakmp *base, 618 u_char tpay, 619 const struct isakmp_gen *ext, 620 u_int item_len, 621 const u_char *end_pointer, 622 uint32_t phase, 623 uint32_t doi0, 624 uint32_t proto0, int depth); 625 626 627 static const u_char *ike_sub0_print(netdissect_options *ndo,u_char, const struct isakmp_gen *, 628 const u_char *, uint32_t, uint32_t, uint32_t, int); 629 static const u_char *ikev1_sub_print(netdissect_options *ndo,u_char, const struct isakmp_gen *, 630 const u_char *, uint32_t, uint32_t, uint32_t, int); 631 632 static const u_char *ikev2_sub_print(netdissect_options *ndo, 633 struct isakmp *base, 634 u_char np, const struct isakmp_gen *ext, 635 const u_char *ep, uint32_t phase, 636 uint32_t doi, uint32_t proto, 637 int depth); 638 639 640 static char *numstr(int); 641 642 static void 643 ikev1_print(netdissect_options *ndo, 644 const u_char *bp, u_int length, 645 const u_char *bp2, struct isakmp *base); 646 647 #define MAXINITIATORS 20 648 static int ninitiator = 0; 649 union inaddr_u { 650 struct in_addr in4; 651 struct in6_addr in6; 652 }; 653 static struct { 654 cookie_t initiator; 655 u_int version; 656 union inaddr_u iaddr; 657 union inaddr_u raddr; 658 } cookiecache[MAXINITIATORS]; 659 660 /* protocol id */ 661 static const char *protoidstr[] = { 662 NULL, "isakmp", "ipsec-ah", "ipsec-esp", "ipcomp", 663 }; 664 665 /* isakmp->np */ 666 static const char *npstr[] = { 667 "none", "sa", "p", "t", "ke", "id", "cert", "cr", "hash", /* 0 - 8 */ 668 "sig", "nonce", "n", "d", "vid", /* 9 - 13 */ 669 "pay14", "pay15", "pay16", "pay17", "pay18", /* 14- 18 */ 670 "pay19", "pay20", "pay21", "pay22", "pay23", /* 19- 23 */ 671 "pay24", "pay25", "pay26", "pay27", "pay28", /* 24- 28 */ 672 "pay29", "pay30", "pay31", "pay32", /* 29- 32 */ 673 "v2sa", "v2ke", "v2IDi", "v2IDr", "v2cert",/* 33- 37 */ 674 "v2cr", "v2auth","v2nonce", "v2n", "v2d", /* 38- 42 */ 675 "v2vid", "v2TSi", "v2TSr", "v2e", "v2cp", /* 43- 47 */ 676 "v2eap", /* 48 */ 677 678 }; 679 680 /* isakmp->np */ 681 static const u_char *(*npfunc[])(netdissect_options *ndo, u_char tpay, 682 const struct isakmp_gen *ext, 683 u_int item_len, 684 const u_char *end_pointer, 685 uint32_t phase, 686 uint32_t doi0, 687 uint32_t proto0, int depth) = { 688 NULL, 689 ikev1_sa_print, 690 ikev1_p_print, 691 ikev1_t_print, 692 ikev1_ke_print, 693 ikev1_id_print, 694 ikev1_cert_print, 695 ikev1_cr_print, 696 ikev1_hash_print, 697 ikev1_sig_print, 698 ikev1_nonce_print, 699 ikev1_n_print, 700 ikev1_d_print, 701 ikev1_vid_print, /* 13 */ 702 NULL, NULL, NULL, NULL, NULL, /* 14- 18 */ 703 NULL, NULL, NULL, NULL, NULL, /* 19- 23 */ 704 NULL, NULL, NULL, NULL, NULL, /* 24- 28 */ 705 NULL, NULL, NULL, NULL, /* 29- 32 */ 706 ikev2_sa_print, /* 33 */ 707 ikev2_ke_print, /* 34 */ 708 ikev2_ID_print, /* 35 */ 709 ikev2_ID_print, /* 36 */ 710 ikev2_cert_print, /* 37 */ 711 ikev2_cr_print, /* 38 */ 712 ikev2_auth_print, /* 39 */ 713 ikev2_nonce_print, /* 40 */ 714 ikev2_n_print, /* 41 */ 715 ikev2_d_print, /* 42 */ 716 ikev2_vid_print, /* 43 */ 717 ikev2_TS_print, /* 44 */ 718 ikev2_TS_print, /* 45 */ 719 NULL, /* ikev2_e_print,*/ /* 46 - special */ 720 ikev2_cp_print, /* 47 */ 721 ikev2_eap_print, /* 48 */ 722 }; 723 724 /* isakmp->etype */ 725 static const char *etypestr[] = { 726 /* IKEv1 exchange types */ 727 "none", "base", "ident", "auth", "agg", "inf", NULL, NULL, /* 0-7 */ 728 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, /* 8-15 */ 729 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, /* 16-23 */ 730 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, /* 24-31 */ 731 "oakley-quick", "oakley-newgroup", /* 32-33 */ 732 /* IKEv2 exchange types */ 733 "ikev2_init", "ikev2_auth", "child_sa", "inf2" /* 34-37 */ 734 }; 735 736 #define STR_OR_ID(x, tab) \ 737 (((x) < sizeof(tab)/sizeof(tab[0]) && tab[(x)]) ? tab[(x)] : numstr(x)) 738 #define PROTOIDSTR(x) STR_OR_ID(x, protoidstr) 739 #define NPSTR(x) STR_OR_ID(x, npstr) 740 #define ETYPESTR(x) STR_OR_ID(x, etypestr) 741 742 #define CHECKLEN(p, np) \ 743 if (ep < (const u_char *)(p)) { \ 744 ND_PRINT((ndo," [|%s]", NPSTR(np))); \ 745 goto done; \ 746 } 747 748 749 #define NPFUNC(x) \ 750 (((x) < sizeof(npfunc)/sizeof(npfunc[0]) && npfunc[(x)]) \ 751 ? npfunc[(x)] : NULL) 752 753 static int 754 iszero(const u_char *p, size_t l) 755 { 756 while (l--) { 757 if (*p++) 758 return 0; 759 } 760 return 1; 761 } 762 763 /* find cookie from initiator cache */ 764 static int 765 cookie_find(cookie_t *in) 766 { 767 int i; 768 769 for (i = 0; i < MAXINITIATORS; i++) { 770 if (memcmp(in, &cookiecache[i].initiator, sizeof(*in)) == 0) 771 return i; 772 } 773 774 return -1; 775 } 776 777 /* record initiator */ 778 static void 779 cookie_record(cookie_t *in, const u_char *bp2) 780 { 781 int i; 782 const struct ip *ip; 783 const struct ip6_hdr *ip6; 784 785 i = cookie_find(in); 786 if (0 <= i) { 787 ninitiator = (i + 1) % MAXINITIATORS; 788 return; 789 } 790 791 ip = (const struct ip *)bp2; 792 switch (IP_V(ip)) { 793 case 4: 794 cookiecache[ninitiator].version = 4; 795 UNALIGNED_MEMCPY(&cookiecache[ninitiator].iaddr.in4, &ip->ip_src, sizeof(struct in_addr)); 796 UNALIGNED_MEMCPY(&cookiecache[ninitiator].raddr.in4, &ip->ip_dst, sizeof(struct in_addr)); 797 break; 798 case 6: 799 ip6 = (const struct ip6_hdr *)bp2; 800 cookiecache[ninitiator].version = 6; 801 UNALIGNED_MEMCPY(&cookiecache[ninitiator].iaddr.in6, &ip6->ip6_src, sizeof(struct in6_addr)); 802 UNALIGNED_MEMCPY(&cookiecache[ninitiator].raddr.in6, &ip6->ip6_dst, sizeof(struct in6_addr)); 803 break; 804 default: 805 return; 806 } 807 UNALIGNED_MEMCPY(&cookiecache[ninitiator].initiator, in, sizeof(*in)); 808 ninitiator = (ninitiator + 1) % MAXINITIATORS; 809 } 810 811 #define cookie_isinitiator(x, y) cookie_sidecheck((x), (y), 1) 812 #define cookie_isresponder(x, y) cookie_sidecheck((x), (y), 0) 813 static int 814 cookie_sidecheck(int i, const u_char *bp2, int initiator) 815 { 816 const struct ip *ip; 817 const struct ip6_hdr *ip6; 818 819 ip = (const struct ip *)bp2; 820 switch (IP_V(ip)) { 821 case 4: 822 if (cookiecache[i].version != 4) 823 return 0; 824 if (initiator) { 825 if (UNALIGNED_MEMCMP(&ip->ip_src, &cookiecache[i].iaddr.in4, sizeof(struct in_addr)) == 0) 826 return 1; 827 } else { 828 if (UNALIGNED_MEMCMP(&ip->ip_src, &cookiecache[i].raddr.in4, sizeof(struct in_addr)) == 0) 829 return 1; 830 } 831 break; 832 case 6: 833 if (cookiecache[i].version != 6) 834 return 0; 835 ip6 = (const struct ip6_hdr *)bp2; 836 if (initiator) { 837 if (UNALIGNED_MEMCMP(&ip6->ip6_src, &cookiecache[i].iaddr.in6, sizeof(struct in6_addr)) == 0) 838 return 1; 839 } else { 840 if (UNALIGNED_MEMCMP(&ip6->ip6_src, &cookiecache[i].raddr.in6, sizeof(struct in6_addr)) == 0) 841 return 1; 842 } 843 break; 844 default: 845 break; 846 } 847 848 return 0; 849 } 850 851 static void 852 hexprint(netdissect_options *ndo, const uint8_t *loc, size_t len) 853 { 854 const uint8_t *p; 855 size_t i; 856 857 p = loc; 858 for (i = 0; i < len; i++) 859 ND_PRINT((ndo,"%02x", p[i] & 0xff)); 860 } 861 862 static int 863 rawprint(netdissect_options *ndo, const uint8_t *loc, size_t len) 864 { 865 ND_TCHECK2(*loc, len); 866 867 hexprint(ndo, loc, len); 868 return 1; 869 trunc: 870 return 0; 871 } 872 873 874 /* 875 * returns false if we run out of data buffer 876 */ 877 static int ike_show_somedata(netdissect_options *ndo, 878 const u_char *cp, const u_char *ep) 879 { 880 /* there is too much data, just show some of it */ 881 const u_char *end = ep - 20; 882 int elen = 20; 883 int len = ep - cp; 884 if(len > 10) { 885 len = 10; 886 } 887 888 /* really shouldn't happen because of above */ 889 if(end < cp + len) { 890 end = cp+len; 891 elen = ep - end; 892 } 893 894 ND_PRINT((ndo," data=(")); 895 if(!rawprint(ndo, (const uint8_t *)(cp), len)) goto trunc; 896 ND_PRINT((ndo, "...")); 897 if(elen) { 898 if(!rawprint(ndo, (const uint8_t *)(end), elen)) goto trunc; 899 } 900 ND_PRINT((ndo,")")); 901 return 1; 902 903 trunc: 904 return 0; 905 } 906 907 struct attrmap { 908 const char *type; 909 u_int nvalue; 910 const char *value[30]; /*XXX*/ 911 }; 912 913 static const u_char * 914 ikev1_attrmap_print(netdissect_options *ndo, 915 const u_char *p, const u_char *ep2, 916 const struct attrmap *map, size_t nmap) 917 { 918 int totlen; 919 uint32_t t, v; 920 921 ND_TCHECK(p[0]); 922 if (p[0] & 0x80) 923 totlen = 4; 924 else { 925 ND_TCHECK_16BITS(&p[2]); 926 totlen = 4 + EXTRACT_16BITS(&p[2]); 927 } 928 if (ep2 < p + totlen) { 929 ND_PRINT((ndo,"[|attr]")); 930 return ep2 + 1; 931 } 932 933 ND_TCHECK_16BITS(&p[0]); 934 ND_PRINT((ndo,"(")); 935 t = EXTRACT_16BITS(&p[0]) & 0x7fff; 936 if (map && t < nmap && map[t].type) 937 ND_PRINT((ndo,"type=%s ", map[t].type)); 938 else 939 ND_PRINT((ndo,"type=#%d ", t)); 940 if (p[0] & 0x80) { 941 ND_PRINT((ndo,"value=")); 942 ND_TCHECK_16BITS(&p[2]); 943 v = EXTRACT_16BITS(&p[2]); 944 if (map && t < nmap && v < map[t].nvalue && map[t].value[v]) 945 ND_PRINT((ndo,"%s", map[t].value[v])); 946 else { 947 if (!rawprint(ndo, (const uint8_t *)&p[2], 2)) { 948 ND_PRINT((ndo,")")); 949 goto trunc; 950 } 951 } 952 } else { 953 ND_PRINT((ndo,"len=%d value=", totlen - 4)); 954 if (!rawprint(ndo, (const uint8_t *)&p[4], totlen - 4)) { 955 ND_PRINT((ndo,")")); 956 goto trunc; 957 } 958 } 959 ND_PRINT((ndo,")")); 960 return p + totlen; 961 962 trunc: 963 return NULL; 964 } 965 966 static const u_char * 967 ikev1_attr_print(netdissect_options *ndo, const u_char *p, const u_char *ep2) 968 { 969 int totlen; 970 uint32_t t; 971 972 ND_TCHECK(p[0]); 973 if (p[0] & 0x80) 974 totlen = 4; 975 else { 976 ND_TCHECK_16BITS(&p[2]); 977 totlen = 4 + EXTRACT_16BITS(&p[2]); 978 } 979 if (ep2 < p + totlen) { 980 ND_PRINT((ndo,"[|attr]")); 981 return ep2 + 1; 982 } 983 984 ND_TCHECK_16BITS(&p[0]); 985 ND_PRINT((ndo,"(")); 986 t = EXTRACT_16BITS(&p[0]) & 0x7fff; 987 ND_PRINT((ndo,"type=#%d ", t)); 988 if (p[0] & 0x80) { 989 ND_PRINT((ndo,"value=")); 990 t = p[2]; 991 if (!rawprint(ndo, (const uint8_t *)&p[2], 2)) { 992 ND_PRINT((ndo,")")); 993 goto trunc; 994 } 995 } else { 996 ND_PRINT((ndo,"len=%d value=", totlen - 4)); 997 if (!rawprint(ndo, (const uint8_t *)&p[4], totlen - 4)) { 998 ND_PRINT((ndo,")")); 999 goto trunc; 1000 } 1001 } 1002 ND_PRINT((ndo,")")); 1003 return p + totlen; 1004 1005 trunc: 1006 return NULL; 1007 } 1008 1009 static const u_char * 1010 ikev1_sa_print(netdissect_options *ndo, u_char tpay _U_, 1011 const struct isakmp_gen *ext, 1012 u_int item_len _U_, 1013 const u_char *ep, uint32_t phase, uint32_t doi0 _U_, 1014 uint32_t proto0, int depth) 1015 { 1016 const struct ikev1_pl_sa *p; 1017 struct ikev1_pl_sa sa; 1018 uint32_t doi, sit, ident; 1019 const u_char *cp, *np; 1020 int t; 1021 1022 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_SA))); 1023 1024 p = (const struct ikev1_pl_sa *)ext; 1025 ND_TCHECK(*p); 1026 UNALIGNED_MEMCPY(&sa, ext, sizeof(sa)); 1027 doi = ntohl(sa.doi); 1028 sit = ntohl(sa.sit); 1029 if (doi != 1) { 1030 ND_PRINT((ndo," doi=%d", doi)); 1031 ND_PRINT((ndo," situation=%u", (uint32_t)ntohl(sa.sit))); 1032 return (const u_char *)(p + 1); 1033 } 1034 1035 ND_PRINT((ndo," doi=ipsec")); 1036 ND_PRINT((ndo," situation=")); 1037 t = 0; 1038 if (sit & 0x01) { 1039 ND_PRINT((ndo,"identity")); 1040 t++; 1041 } 1042 if (sit & 0x02) { 1043 ND_PRINT((ndo,"%ssecrecy", t ? "+" : "")); 1044 t++; 1045 } 1046 if (sit & 0x04) 1047 ND_PRINT((ndo,"%sintegrity", t ? "+" : "")); 1048 1049 np = (const u_char *)ext + sizeof(sa); 1050 if (sit != 0x01) { 1051 ND_TCHECK2(*(ext + 1), sizeof(ident)); 1052 UNALIGNED_MEMCPY(&ident, ext + 1, sizeof(ident)); 1053 ND_PRINT((ndo," ident=%u", (uint32_t)ntohl(ident))); 1054 np += sizeof(ident); 1055 } 1056 1057 ext = (const struct isakmp_gen *)np; 1058 ND_TCHECK(*ext); 1059 1060 cp = ikev1_sub_print(ndo, ISAKMP_NPTYPE_P, ext, ep, phase, doi, proto0, 1061 depth); 1062 1063 return cp; 1064 trunc: 1065 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_SA))); 1066 return NULL; 1067 } 1068 1069 static const u_char * 1070 ikev1_p_print(netdissect_options *ndo, u_char tpay _U_, 1071 const struct isakmp_gen *ext, u_int item_len _U_, 1072 const u_char *ep, uint32_t phase, uint32_t doi0, 1073 uint32_t proto0 _U_, int depth) 1074 { 1075 const struct ikev1_pl_p *p; 1076 struct ikev1_pl_p prop; 1077 const u_char *cp; 1078 1079 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_P))); 1080 1081 p = (const struct ikev1_pl_p *)ext; 1082 ND_TCHECK(*p); 1083 UNALIGNED_MEMCPY(&prop, ext, sizeof(prop)); 1084 ND_PRINT((ndo," #%d protoid=%s transform=%d", 1085 prop.p_no, PROTOIDSTR(prop.prot_id), prop.num_t)); 1086 if (prop.spi_size) { 1087 ND_PRINT((ndo," spi=")); 1088 if (!rawprint(ndo, (const uint8_t *)(p + 1), prop.spi_size)) 1089 goto trunc; 1090 } 1091 1092 ext = (const struct isakmp_gen *)((const u_char *)(p + 1) + prop.spi_size); 1093 ND_TCHECK(*ext); 1094 1095 cp = ikev1_sub_print(ndo, ISAKMP_NPTYPE_T, ext, ep, phase, doi0, 1096 prop.prot_id, depth); 1097 1098 return cp; 1099 trunc: 1100 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_P))); 1101 return NULL; 1102 } 1103 1104 static const char *ikev1_p_map[] = { 1105 NULL, "ike", 1106 }; 1107 1108 static const char *ikev2_t_type_map[]={ 1109 NULL, "encr", "prf", "integ", "dh", "esn" 1110 }; 1111 1112 static const char *ah_p_map[] = { 1113 NULL, "(reserved)", "md5", "sha", "1des", 1114 "sha2-256", "sha2-384", "sha2-512", 1115 }; 1116 1117 static const char *prf_p_map[] = { 1118 NULL, "hmac-md5", "hmac-sha", "hmac-tiger", 1119 "aes128_xcbc" 1120 }; 1121 1122 static const char *integ_p_map[] = { 1123 NULL, "hmac-md5", "hmac-sha", "dec-mac", 1124 "kpdk-md5", "aes-xcbc" 1125 }; 1126 1127 static const char *esn_p_map[] = { 1128 "no-esn", "esn" 1129 }; 1130 1131 static const char *dh_p_map[] = { 1132 NULL, "modp768", 1133 "modp1024", /* group 2 */ 1134 "EC2N 2^155", /* group 3 */ 1135 "EC2N 2^185", /* group 4 */ 1136 "modp1536", /* group 5 */ 1137 "iana-grp06", "iana-grp07", /* reserved */ 1138 "iana-grp08", "iana-grp09", 1139 "iana-grp10", "iana-grp11", 1140 "iana-grp12", "iana-grp13", 1141 "modp2048", /* group 14 */ 1142 "modp3072", /* group 15 */ 1143 "modp4096", /* group 16 */ 1144 "modp6144", /* group 17 */ 1145 "modp8192", /* group 18 */ 1146 }; 1147 1148 static const char *esp_p_map[] = { 1149 NULL, "1des-iv64", "1des", "3des", "rc5", "idea", "cast", 1150 "blowfish", "3idea", "1des-iv32", "rc4", "null", "aes" 1151 }; 1152 1153 static const char *ipcomp_p_map[] = { 1154 NULL, "oui", "deflate", "lzs", 1155 }; 1156 1157 static const struct attrmap ipsec_t_map[] = { 1158 { NULL, 0, { NULL } }, 1159 { "lifetype", 3, { NULL, "sec", "kb", }, }, 1160 { "life", 0, { NULL } }, 1161 { "group desc", 18, { NULL, "modp768", 1162 "modp1024", /* group 2 */ 1163 "EC2N 2^155", /* group 3 */ 1164 "EC2N 2^185", /* group 4 */ 1165 "modp1536", /* group 5 */ 1166 "iana-grp06", "iana-grp07", /* reserved */ 1167 "iana-grp08", "iana-grp09", 1168 "iana-grp10", "iana-grp11", 1169 "iana-grp12", "iana-grp13", 1170 "modp2048", /* group 14 */ 1171 "modp3072", /* group 15 */ 1172 "modp4096", /* group 16 */ 1173 "modp6144", /* group 17 */ 1174 "modp8192", /* group 18 */ 1175 }, }, 1176 { "enc mode", 3, { NULL, "tunnel", "transport", }, }, 1177 { "auth", 5, { NULL, "hmac-md5", "hmac-sha1", "1des-mac", "keyed", }, }, 1178 { "keylen", 0, { NULL } }, 1179 { "rounds", 0, { NULL } }, 1180 { "dictsize", 0, { NULL } }, 1181 { "privalg", 0, { NULL } }, 1182 }; 1183 1184 static const struct attrmap encr_t_map[] = { 1185 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 0, 1 */ 1186 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 2, 3 */ 1187 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 4, 5 */ 1188 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 6, 7 */ 1189 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 8, 9 */ 1190 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 10,11*/ 1191 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 12,13*/ 1192 { "keylen", 14, { NULL }}, 1193 }; 1194 1195 static const struct attrmap oakley_t_map[] = { 1196 { NULL, 0, { NULL } }, 1197 { "enc", 8, { NULL, "1des", "idea", "blowfish", "rc5", 1198 "3des", "cast", "aes", }, }, 1199 { "hash", 7, { NULL, "md5", "sha1", "tiger", 1200 "sha2-256", "sha2-384", "sha2-512", }, }, 1201 { "auth", 6, { NULL, "preshared", "dss", "rsa sig", "rsa enc", 1202 "rsa enc revised", }, }, 1203 { "group desc", 18, { NULL, "modp768", 1204 "modp1024", /* group 2 */ 1205 "EC2N 2^155", /* group 3 */ 1206 "EC2N 2^185", /* group 4 */ 1207 "modp1536", /* group 5 */ 1208 "iana-grp06", "iana-grp07", /* reserved */ 1209 "iana-grp08", "iana-grp09", 1210 "iana-grp10", "iana-grp11", 1211 "iana-grp12", "iana-grp13", 1212 "modp2048", /* group 14 */ 1213 "modp3072", /* group 15 */ 1214 "modp4096", /* group 16 */ 1215 "modp6144", /* group 17 */ 1216 "modp8192", /* group 18 */ 1217 }, }, 1218 { "group type", 4, { NULL, "MODP", "ECP", "EC2N", }, }, 1219 { "group prime", 0, { NULL } }, 1220 { "group gen1", 0, { NULL } }, 1221 { "group gen2", 0, { NULL } }, 1222 { "group curve A", 0, { NULL } }, 1223 { "group curve B", 0, { NULL } }, 1224 { "lifetype", 3, { NULL, "sec", "kb", }, }, 1225 { "lifeduration", 0, { NULL } }, 1226 { "prf", 0, { NULL } }, 1227 { "keylen", 0, { NULL } }, 1228 { "field", 0, { NULL } }, 1229 { "order", 0, { NULL } }, 1230 }; 1231 1232 static const u_char * 1233 ikev1_t_print(netdissect_options *ndo, u_char tpay _U_, 1234 const struct isakmp_gen *ext, u_int item_len, 1235 const u_char *ep, uint32_t phase _U_, uint32_t doi _U_, 1236 uint32_t proto, int depth _U_) 1237 { 1238 const struct ikev1_pl_t *p; 1239 struct ikev1_pl_t t; 1240 const u_char *cp; 1241 const char *idstr; 1242 const struct attrmap *map; 1243 size_t nmap; 1244 const u_char *ep2; 1245 1246 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_T))); 1247 1248 p = (const struct ikev1_pl_t *)ext; 1249 ND_TCHECK(*p); 1250 UNALIGNED_MEMCPY(&t, ext, sizeof(t)); 1251 1252 switch (proto) { 1253 case 1: 1254 idstr = STR_OR_ID(t.t_id, ikev1_p_map); 1255 map = oakley_t_map; 1256 nmap = sizeof(oakley_t_map)/sizeof(oakley_t_map[0]); 1257 break; 1258 case 2: 1259 idstr = STR_OR_ID(t.t_id, ah_p_map); 1260 map = ipsec_t_map; 1261 nmap = sizeof(ipsec_t_map)/sizeof(ipsec_t_map[0]); 1262 break; 1263 case 3: 1264 idstr = STR_OR_ID(t.t_id, esp_p_map); 1265 map = ipsec_t_map; 1266 nmap = sizeof(ipsec_t_map)/sizeof(ipsec_t_map[0]); 1267 break; 1268 case 4: 1269 idstr = STR_OR_ID(t.t_id, ipcomp_p_map); 1270 map = ipsec_t_map; 1271 nmap = sizeof(ipsec_t_map)/sizeof(ipsec_t_map[0]); 1272 break; 1273 default: 1274 idstr = NULL; 1275 map = NULL; 1276 nmap = 0; 1277 break; 1278 } 1279 1280 if (idstr) 1281 ND_PRINT((ndo," #%d id=%s ", t.t_no, idstr)); 1282 else 1283 ND_PRINT((ndo," #%d id=%d ", t.t_no, t.t_id)); 1284 cp = (const u_char *)(p + 1); 1285 ep2 = (const u_char *)p + item_len; 1286 while (cp < ep && cp < ep2) { 1287 if (map && nmap) 1288 cp = ikev1_attrmap_print(ndo, cp, ep2, map, nmap); 1289 else 1290 cp = ikev1_attr_print(ndo, cp, ep2); 1291 if (cp == NULL) 1292 goto trunc; 1293 } 1294 if (ep < ep2) 1295 ND_PRINT((ndo,"...")); 1296 return cp; 1297 trunc: 1298 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_T))); 1299 return NULL; 1300 } 1301 1302 static const u_char * 1303 ikev1_ke_print(netdissect_options *ndo, u_char tpay _U_, 1304 const struct isakmp_gen *ext, u_int item_len _U_, 1305 const u_char *ep _U_, uint32_t phase _U_, uint32_t doi _U_, 1306 uint32_t proto _U_, int depth _U_) 1307 { 1308 struct isakmp_gen e; 1309 1310 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_KE))); 1311 1312 ND_TCHECK(*ext); 1313 UNALIGNED_MEMCPY(&e, ext, sizeof(e)); 1314 ND_PRINT((ndo," key len=%d", ntohs(e.len) - 4)); 1315 if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) { 1316 /* Print the entire payload in hex */ 1317 ND_PRINT((ndo," ")); 1318 if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4)) 1319 goto trunc; 1320 } 1321 return (const u_char *)ext + ntohs(e.len); 1322 trunc: 1323 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_KE))); 1324 return NULL; 1325 } 1326 1327 static const u_char * 1328 ikev1_id_print(netdissect_options *ndo, u_char tpay _U_, 1329 const struct isakmp_gen *ext, u_int item_len, 1330 const u_char *ep _U_, uint32_t phase, uint32_t doi _U_, 1331 uint32_t proto _U_, int depth _U_) 1332 { 1333 #define USE_IPSECDOI_IN_PHASE1 1 1334 const struct ikev1_pl_id *p; 1335 struct ikev1_pl_id id; 1336 static const char *idtypestr[] = { 1337 "IPv4", "IPv4net", "IPv6", "IPv6net", 1338 }; 1339 static const char *ipsecidtypestr[] = { 1340 NULL, "IPv4", "FQDN", "user FQDN", "IPv4net", "IPv6", 1341 "IPv6net", "IPv4range", "IPv6range", "ASN1 DN", "ASN1 GN", 1342 "keyid", 1343 }; 1344 int len; 1345 const u_char *data; 1346 1347 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_ID))); 1348 1349 p = (const struct ikev1_pl_id *)ext; 1350 ND_TCHECK(*p); 1351 UNALIGNED_MEMCPY(&id, ext, sizeof(id)); 1352 if (sizeof(*p) < item_len) { 1353 data = (const u_char *)(p + 1); 1354 len = item_len - sizeof(*p); 1355 } else { 1356 data = NULL; 1357 len = 0; 1358 } 1359 1360 #if 0 /*debug*/ 1361 ND_PRINT((ndo," [phase=%d doi=%d proto=%d]", phase, doi, proto)); 1362 #endif 1363 switch (phase) { 1364 #ifndef USE_IPSECDOI_IN_PHASE1 1365 case 1: 1366 #endif 1367 default: 1368 ND_PRINT((ndo," idtype=%s", STR_OR_ID(id.d.id_type, idtypestr))); 1369 ND_PRINT((ndo," doi_data=%u", 1370 (uint32_t)(ntohl(id.d.doi_data) & 0xffffff))); 1371 break; 1372 1373 #ifdef USE_IPSECDOI_IN_PHASE1 1374 case 1: 1375 #endif 1376 case 2: 1377 { 1378 const struct ipsecdoi_id *doi_p; 1379 struct ipsecdoi_id doi_id; 1380 const char *p_name; 1381 1382 doi_p = (const struct ipsecdoi_id *)ext; 1383 ND_TCHECK(*doi_p); 1384 UNALIGNED_MEMCPY(&doi_id, ext, sizeof(doi_id)); 1385 ND_PRINT((ndo," idtype=%s", STR_OR_ID(doi_id.type, ipsecidtypestr))); 1386 /* A protocol ID of 0 DOES NOT mean IPPROTO_IP! */ 1387 if (!ndo->ndo_nflag && doi_id.proto_id && (p_name = netdb_protoname(doi_id.proto_id)) != NULL) 1388 ND_PRINT((ndo," protoid=%s", p_name)); 1389 else 1390 ND_PRINT((ndo," protoid=%u", doi_id.proto_id)); 1391 ND_PRINT((ndo," port=%d", ntohs(doi_id.port))); 1392 if (!len) 1393 break; 1394 if (data == NULL) 1395 goto trunc; 1396 ND_TCHECK2(*data, len); 1397 switch (doi_id.type) { 1398 case IPSECDOI_ID_IPV4_ADDR: 1399 if (len < 4) 1400 ND_PRINT((ndo," len=%d [bad: < 4]", len)); 1401 else 1402 ND_PRINT((ndo," len=%d %s", len, ipaddr_string(ndo, data))); 1403 len = 0; 1404 break; 1405 case IPSECDOI_ID_FQDN: 1406 case IPSECDOI_ID_USER_FQDN: 1407 { 1408 int i; 1409 ND_PRINT((ndo," len=%d ", len)); 1410 for (i = 0; i < len; i++) 1411 safeputchar(ndo, data[i]); 1412 len = 0; 1413 break; 1414 } 1415 case IPSECDOI_ID_IPV4_ADDR_SUBNET: 1416 { 1417 const u_char *mask; 1418 if (len < 8) 1419 ND_PRINT((ndo," len=%d [bad: < 8]", len)); 1420 else { 1421 mask = data + sizeof(struct in_addr); 1422 ND_PRINT((ndo," len=%d %s/%u.%u.%u.%u", len, 1423 ipaddr_string(ndo, data), 1424 mask[0], mask[1], mask[2], mask[3])); 1425 } 1426 len = 0; 1427 break; 1428 } 1429 case IPSECDOI_ID_IPV6_ADDR: 1430 if (len < 16) 1431 ND_PRINT((ndo," len=%d [bad: < 16]", len)); 1432 else 1433 ND_PRINT((ndo," len=%d %s", len, ip6addr_string(ndo, data))); 1434 len = 0; 1435 break; 1436 case IPSECDOI_ID_IPV6_ADDR_SUBNET: 1437 { 1438 const u_char *mask; 1439 if (len < 32) 1440 ND_PRINT((ndo," len=%d [bad: < 32]", len)); 1441 else { 1442 mask = (const u_char *)(data + sizeof(struct in6_addr)); 1443 /*XXX*/ 1444 ND_PRINT((ndo," len=%d %s/0x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x", len, 1445 ip6addr_string(ndo, data), 1446 mask[0], mask[1], mask[2], mask[3], 1447 mask[4], mask[5], mask[6], mask[7], 1448 mask[8], mask[9], mask[10], mask[11], 1449 mask[12], mask[13], mask[14], mask[15])); 1450 } 1451 len = 0; 1452 break; 1453 } 1454 case IPSECDOI_ID_IPV4_ADDR_RANGE: 1455 if (len < 8) 1456 ND_PRINT((ndo," len=%d [bad: < 8]", len)); 1457 else { 1458 ND_PRINT((ndo," len=%d %s-%s", len, 1459 ipaddr_string(ndo, data), 1460 ipaddr_string(ndo, data + sizeof(struct in_addr)))); 1461 } 1462 len = 0; 1463 break; 1464 case IPSECDOI_ID_IPV6_ADDR_RANGE: 1465 if (len < 32) 1466 ND_PRINT((ndo," len=%d [bad: < 32]", len)); 1467 else { 1468 ND_PRINT((ndo," len=%d %s-%s", len, 1469 ip6addr_string(ndo, data), 1470 ip6addr_string(ndo, data + sizeof(struct in6_addr)))); 1471 } 1472 len = 0; 1473 break; 1474 case IPSECDOI_ID_DER_ASN1_DN: 1475 case IPSECDOI_ID_DER_ASN1_GN: 1476 case IPSECDOI_ID_KEY_ID: 1477 break; 1478 } 1479 break; 1480 } 1481 } 1482 if (data && len) { 1483 ND_PRINT((ndo," len=%d", len)); 1484 if (2 < ndo->ndo_vflag) { 1485 ND_PRINT((ndo," ")); 1486 if (!rawprint(ndo, (const uint8_t *)data, len)) 1487 goto trunc; 1488 } 1489 } 1490 return (const u_char *)ext + item_len; 1491 trunc: 1492 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_ID))); 1493 return NULL; 1494 } 1495 1496 static const u_char * 1497 ikev1_cert_print(netdissect_options *ndo, u_char tpay _U_, 1498 const struct isakmp_gen *ext, u_int item_len, 1499 const u_char *ep _U_, uint32_t phase _U_, 1500 uint32_t doi0 _U_, 1501 uint32_t proto0 _U_, int depth _U_) 1502 { 1503 const struct ikev1_pl_cert *p; 1504 struct ikev1_pl_cert cert; 1505 static const char *certstr[] = { 1506 "none", "pkcs7", "pgp", "dns", 1507 "x509sign", "x509ke", "kerberos", "crl", 1508 "arl", "spki", "x509attr", 1509 }; 1510 1511 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_CERT))); 1512 1513 p = (const struct ikev1_pl_cert *)ext; 1514 ND_TCHECK(*p); 1515 UNALIGNED_MEMCPY(&cert, ext, sizeof(cert)); 1516 ND_PRINT((ndo," len=%d", item_len - 4)); 1517 ND_PRINT((ndo," type=%s", STR_OR_ID((cert.encode), certstr))); 1518 if (2 < ndo->ndo_vflag && 4 < item_len) { 1519 /* Print the entire payload in hex */ 1520 ND_PRINT((ndo," ")); 1521 if (!rawprint(ndo, (const uint8_t *)(ext + 1), item_len - 4)) 1522 goto trunc; 1523 } 1524 return (const u_char *)ext + item_len; 1525 trunc: 1526 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_CERT))); 1527 return NULL; 1528 } 1529 1530 static const u_char * 1531 ikev1_cr_print(netdissect_options *ndo, u_char tpay _U_, 1532 const struct isakmp_gen *ext, u_int item_len, 1533 const u_char *ep _U_, uint32_t phase _U_, uint32_t doi0 _U_, 1534 uint32_t proto0 _U_, int depth _U_) 1535 { 1536 const struct ikev1_pl_cert *p; 1537 struct ikev1_pl_cert cert; 1538 static const char *certstr[] = { 1539 "none", "pkcs7", "pgp", "dns", 1540 "x509sign", "x509ke", "kerberos", "crl", 1541 "arl", "spki", "x509attr", 1542 }; 1543 1544 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_CR))); 1545 1546 p = (const struct ikev1_pl_cert *)ext; 1547 ND_TCHECK(*p); 1548 UNALIGNED_MEMCPY(&cert, ext, sizeof(cert)); 1549 ND_PRINT((ndo," len=%d", item_len - 4)); 1550 ND_PRINT((ndo," type=%s", STR_OR_ID((cert.encode), certstr))); 1551 if (2 < ndo->ndo_vflag && 4 < item_len) { 1552 /* Print the entire payload in hex */ 1553 ND_PRINT((ndo," ")); 1554 if (!rawprint(ndo, (const uint8_t *)(ext + 1), item_len - 4)) 1555 goto trunc; 1556 } 1557 return (const u_char *)ext + item_len; 1558 trunc: 1559 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_CR))); 1560 return NULL; 1561 } 1562 1563 static const u_char * 1564 ikev1_hash_print(netdissect_options *ndo, u_char tpay _U_, 1565 const struct isakmp_gen *ext, u_int item_len _U_, 1566 const u_char *ep _U_, uint32_t phase _U_, uint32_t doi _U_, 1567 uint32_t proto _U_, int depth _U_) 1568 { 1569 struct isakmp_gen e; 1570 1571 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_HASH))); 1572 1573 ND_TCHECK(*ext); 1574 UNALIGNED_MEMCPY(&e, ext, sizeof(e)); 1575 ND_PRINT((ndo," len=%d", ntohs(e.len) - 4)); 1576 if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) { 1577 /* Print the entire payload in hex */ 1578 ND_PRINT((ndo," ")); 1579 if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4)) 1580 goto trunc; 1581 } 1582 return (const u_char *)ext + ntohs(e.len); 1583 trunc: 1584 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_HASH))); 1585 return NULL; 1586 } 1587 1588 static const u_char * 1589 ikev1_sig_print(netdissect_options *ndo, u_char tpay _U_, 1590 const struct isakmp_gen *ext, u_int item_len _U_, 1591 const u_char *ep _U_, uint32_t phase _U_, uint32_t doi _U_, 1592 uint32_t proto _U_, int depth _U_) 1593 { 1594 struct isakmp_gen e; 1595 1596 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_SIG))); 1597 1598 ND_TCHECK(*ext); 1599 UNALIGNED_MEMCPY(&e, ext, sizeof(e)); 1600 ND_PRINT((ndo," len=%d", ntohs(e.len) - 4)); 1601 if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) { 1602 /* Print the entire payload in hex */ 1603 ND_PRINT((ndo," ")); 1604 if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4)) 1605 goto trunc; 1606 } 1607 return (const u_char *)ext + ntohs(e.len); 1608 trunc: 1609 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_SIG))); 1610 return NULL; 1611 } 1612 1613 static const u_char * 1614 ikev1_nonce_print(netdissect_options *ndo, u_char tpay _U_, 1615 const struct isakmp_gen *ext, 1616 u_int item_len _U_, 1617 const u_char *ep, 1618 uint32_t phase _U_, uint32_t doi _U_, 1619 uint32_t proto _U_, int depth _U_) 1620 { 1621 struct isakmp_gen e; 1622 1623 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_NONCE))); 1624 1625 ND_TCHECK(*ext); 1626 UNALIGNED_MEMCPY(&e, ext, sizeof(e)); 1627 /* 1628 * Our caller has ensured that the length is >= 4. 1629 */ 1630 ND_PRINT((ndo," n len=%u", ntohs(e.len) - 4)); 1631 if (ntohs(e.len) > 4) { 1632 if (ndo->ndo_vflag > 2) { 1633 ND_PRINT((ndo, " ")); 1634 if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4)) 1635 goto trunc; 1636 } else if (ndo->ndo_vflag > 1) { 1637 ND_PRINT((ndo, " ")); 1638 if (!ike_show_somedata(ndo, (const u_char *)(ext + 1), ep)) 1639 goto trunc; 1640 } 1641 } 1642 return (const u_char *)ext + ntohs(e.len); 1643 trunc: 1644 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_NONCE))); 1645 return NULL; 1646 } 1647 1648 static const u_char * 1649 ikev1_n_print(netdissect_options *ndo, u_char tpay _U_, 1650 const struct isakmp_gen *ext, u_int item_len, 1651 const u_char *ep, uint32_t phase _U_, uint32_t doi0 _U_, 1652 uint32_t proto0 _U_, int depth _U_) 1653 { 1654 const struct ikev1_pl_n *p; 1655 struct ikev1_pl_n n; 1656 const u_char *cp; 1657 const u_char *ep2; 1658 uint32_t doi; 1659 uint32_t proto; 1660 static const char *notify_error_str[] = { 1661 NULL, "INVALID-PAYLOAD-TYPE", 1662 "DOI-NOT-SUPPORTED", "SITUATION-NOT-SUPPORTED", 1663 "INVALID-COOKIE", "INVALID-MAJOR-VERSION", 1664 "INVALID-MINOR-VERSION", "INVALID-EXCHANGE-TYPE", 1665 "INVALID-FLAGS", "INVALID-MESSAGE-ID", 1666 "INVALID-PROTOCOL-ID", "INVALID-SPI", 1667 "INVALID-TRANSFORM-ID", "ATTRIBUTES-NOT-SUPPORTED", 1668 "NO-PROPOSAL-CHOSEN", "BAD-PROPOSAL-SYNTAX", 1669 "PAYLOAD-MALFORMED", "INVALID-KEY-INFORMATION", 1670 "INVALID-ID-INFORMATION", "INVALID-CERT-ENCODING", 1671 "INVALID-CERTIFICATE", "CERT-TYPE-UNSUPPORTED", 1672 "INVALID-CERT-AUTHORITY", "INVALID-HASH-INFORMATION", 1673 "AUTHENTICATION-FAILED", "INVALID-SIGNATURE", 1674 "ADDRESS-NOTIFICATION", "NOTIFY-SA-LIFETIME", 1675 "CERTIFICATE-UNAVAILABLE", "UNSUPPORTED-EXCHANGE-TYPE", 1676 "UNEQUAL-PAYLOAD-LENGTHS", 1677 }; 1678 static const char *ipsec_notify_error_str[] = { 1679 "RESERVED", 1680 }; 1681 static const char *notify_status_str[] = { 1682 "CONNECTED", 1683 }; 1684 static const char *ipsec_notify_status_str[] = { 1685 "RESPONDER-LIFETIME", "REPLAY-STATUS", 1686 "INITIAL-CONTACT", 1687 }; 1688 /* NOTE: these macro must be called with x in proper range */ 1689 1690 /* 0 - 8191 */ 1691 #define NOTIFY_ERROR_STR(x) \ 1692 STR_OR_ID((x), notify_error_str) 1693 1694 /* 8192 - 16383 */ 1695 #define IPSEC_NOTIFY_ERROR_STR(x) \ 1696 STR_OR_ID((u_int)((x) - 8192), ipsec_notify_error_str) 1697 1698 /* 16384 - 24575 */ 1699 #define NOTIFY_STATUS_STR(x) \ 1700 STR_OR_ID((u_int)((x) - 16384), notify_status_str) 1701 1702 /* 24576 - 32767 */ 1703 #define IPSEC_NOTIFY_STATUS_STR(x) \ 1704 STR_OR_ID((u_int)((x) - 24576), ipsec_notify_status_str) 1705 1706 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_N))); 1707 1708 p = (const struct ikev1_pl_n *)ext; 1709 ND_TCHECK(*p); 1710 UNALIGNED_MEMCPY(&n, ext, sizeof(n)); 1711 doi = ntohl(n.doi); 1712 proto = n.prot_id; 1713 if (doi != 1) { 1714 ND_PRINT((ndo," doi=%d", doi)); 1715 ND_PRINT((ndo," proto=%d", proto)); 1716 if (ntohs(n.type) < 8192) 1717 ND_PRINT((ndo," type=%s", NOTIFY_ERROR_STR(ntohs(n.type)))); 1718 else if (ntohs(n.type) < 16384) 1719 ND_PRINT((ndo," type=%s", numstr(ntohs(n.type)))); 1720 else if (ntohs(n.type) < 24576) 1721 ND_PRINT((ndo," type=%s", NOTIFY_STATUS_STR(ntohs(n.type)))); 1722 else 1723 ND_PRINT((ndo," type=%s", numstr(ntohs(n.type)))); 1724 if (n.spi_size) { 1725 ND_PRINT((ndo," spi=")); 1726 if (!rawprint(ndo, (const uint8_t *)(p + 1), n.spi_size)) 1727 goto trunc; 1728 } 1729 return (const u_char *)(p + 1) + n.spi_size; 1730 } 1731 1732 ND_PRINT((ndo," doi=ipsec")); 1733 ND_PRINT((ndo," proto=%s", PROTOIDSTR(proto))); 1734 if (ntohs(n.type) < 8192) 1735 ND_PRINT((ndo," type=%s", NOTIFY_ERROR_STR(ntohs(n.type)))); 1736 else if (ntohs(n.type) < 16384) 1737 ND_PRINT((ndo," type=%s", IPSEC_NOTIFY_ERROR_STR(ntohs(n.type)))); 1738 else if (ntohs(n.type) < 24576) 1739 ND_PRINT((ndo," type=%s", NOTIFY_STATUS_STR(ntohs(n.type)))); 1740 else if (ntohs(n.type) < 32768) 1741 ND_PRINT((ndo," type=%s", IPSEC_NOTIFY_STATUS_STR(ntohs(n.type)))); 1742 else 1743 ND_PRINT((ndo," type=%s", numstr(ntohs(n.type)))); 1744 if (n.spi_size) { 1745 ND_PRINT((ndo," spi=")); 1746 if (!rawprint(ndo, (const uint8_t *)(p + 1), n.spi_size)) 1747 goto trunc; 1748 } 1749 1750 cp = (const u_char *)(p + 1) + n.spi_size; 1751 ep2 = (const u_char *)p + item_len; 1752 1753 if (cp < ep) { 1754 switch (ntohs(n.type)) { 1755 case IPSECDOI_NTYPE_RESPONDER_LIFETIME: 1756 { 1757 const struct attrmap *map = oakley_t_map; 1758 size_t nmap = sizeof(oakley_t_map)/sizeof(oakley_t_map[0]); 1759 ND_PRINT((ndo," attrs=(")); 1760 while (cp < ep && cp < ep2) { 1761 cp = ikev1_attrmap_print(ndo, cp, ep2, map, nmap); 1762 if (cp == NULL) { 1763 ND_PRINT((ndo,")")); 1764 goto trunc; 1765 } 1766 } 1767 ND_PRINT((ndo,")")); 1768 break; 1769 } 1770 case IPSECDOI_NTYPE_REPLAY_STATUS: 1771 ND_PRINT((ndo," status=(")); 1772 ND_PRINT((ndo,"replay detection %sabled", 1773 EXTRACT_32BITS(cp) ? "en" : "dis")); 1774 ND_PRINT((ndo,")")); 1775 break; 1776 default: 1777 /* 1778 * XXX - fill in more types here; see, for example, 1779 * draft-ietf-ipsec-notifymsg-04. 1780 */ 1781 if (ndo->ndo_vflag > 3) { 1782 ND_PRINT((ndo," data=(")); 1783 if (!rawprint(ndo, (const uint8_t *)(cp), ep - cp)) 1784 goto trunc; 1785 ND_PRINT((ndo,")")); 1786 } else { 1787 if (!ike_show_somedata(ndo, cp, ep)) 1788 goto trunc; 1789 } 1790 break; 1791 } 1792 } 1793 return (const u_char *)ext + item_len; 1794 trunc: 1795 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_N))); 1796 return NULL; 1797 } 1798 1799 static const u_char * 1800 ikev1_d_print(netdissect_options *ndo, u_char tpay _U_, 1801 const struct isakmp_gen *ext, u_int item_len _U_, 1802 const u_char *ep _U_, uint32_t phase _U_, uint32_t doi0 _U_, 1803 uint32_t proto0 _U_, int depth _U_) 1804 { 1805 const struct ikev1_pl_d *p; 1806 struct ikev1_pl_d d; 1807 const uint8_t *q; 1808 uint32_t doi; 1809 uint32_t proto; 1810 int i; 1811 1812 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_D))); 1813 1814 p = (const struct ikev1_pl_d *)ext; 1815 ND_TCHECK(*p); 1816 UNALIGNED_MEMCPY(&d, ext, sizeof(d)); 1817 doi = ntohl(d.doi); 1818 proto = d.prot_id; 1819 if (doi != 1) { 1820 ND_PRINT((ndo," doi=%u", doi)); 1821 ND_PRINT((ndo," proto=%u", proto)); 1822 } else { 1823 ND_PRINT((ndo," doi=ipsec")); 1824 ND_PRINT((ndo," proto=%s", PROTOIDSTR(proto))); 1825 } 1826 ND_PRINT((ndo," spilen=%u", d.spi_size)); 1827 ND_PRINT((ndo," nspi=%u", ntohs(d.num_spi))); 1828 ND_PRINT((ndo," spi=")); 1829 q = (const uint8_t *)(p + 1); 1830 for (i = 0; i < ntohs(d.num_spi); i++) { 1831 if (i != 0) 1832 ND_PRINT((ndo,",")); 1833 if (!rawprint(ndo, (const uint8_t *)q, d.spi_size)) 1834 goto trunc; 1835 q += d.spi_size; 1836 } 1837 return q; 1838 trunc: 1839 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_D))); 1840 return NULL; 1841 } 1842 1843 static const u_char * 1844 ikev1_vid_print(netdissect_options *ndo, u_char tpay _U_, 1845 const struct isakmp_gen *ext, 1846 u_int item_len _U_, const u_char *ep _U_, 1847 uint32_t phase _U_, uint32_t doi _U_, 1848 uint32_t proto _U_, int depth _U_) 1849 { 1850 struct isakmp_gen e; 1851 1852 ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_VID))); 1853 1854 ND_TCHECK(*ext); 1855 UNALIGNED_MEMCPY(&e, ext, sizeof(e)); 1856 ND_PRINT((ndo," len=%d", ntohs(e.len) - 4)); 1857 if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) { 1858 /* Print the entire payload in hex */ 1859 ND_PRINT((ndo," ")); 1860 if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4)) 1861 goto trunc; 1862 } 1863 return (const u_char *)ext + ntohs(e.len); 1864 trunc: 1865 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_VID))); 1866 return NULL; 1867 } 1868 1869 /************************************************************/ 1870 /* */ 1871 /* IKE v2 - rfc4306 - dissector */ 1872 /* */ 1873 /************************************************************/ 1874 1875 static void 1876 ikev2_pay_print(netdissect_options *ndo, const char *payname, int critical) 1877 { 1878 ND_PRINT((ndo,"%s%s:", payname, critical&0x80 ? "[C]" : "")); 1879 } 1880 1881 static const u_char * 1882 ikev2_gen_print(netdissect_options *ndo, u_char tpay, 1883 const struct isakmp_gen *ext) 1884 { 1885 struct isakmp_gen e; 1886 1887 ND_TCHECK(*ext); 1888 UNALIGNED_MEMCPY(&e, ext, sizeof(e)); 1889 ikev2_pay_print(ndo, NPSTR(tpay), e.critical); 1890 1891 ND_PRINT((ndo," len=%d", ntohs(e.len) - 4)); 1892 if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) { 1893 /* Print the entire payload in hex */ 1894 ND_PRINT((ndo," ")); 1895 if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4)) 1896 goto trunc; 1897 } 1898 return (const u_char *)ext + ntohs(e.len); 1899 trunc: 1900 ND_PRINT((ndo," [|%s]", NPSTR(tpay))); 1901 return NULL; 1902 } 1903 1904 static const u_char * 1905 ikev2_t_print(netdissect_options *ndo, int tcount, 1906 const struct isakmp_gen *ext, u_int item_len, 1907 const u_char *ep) 1908 { 1909 const struct ikev2_t *p; 1910 struct ikev2_t t; 1911 uint16_t t_id; 1912 const u_char *cp; 1913 const char *idstr; 1914 const struct attrmap *map; 1915 size_t nmap; 1916 const u_char *ep2; 1917 1918 p = (const struct ikev2_t *)ext; 1919 ND_TCHECK(*p); 1920 UNALIGNED_MEMCPY(&t, ext, sizeof(t)); 1921 ikev2_pay_print(ndo, NPSTR(ISAKMP_NPTYPE_T), t.h.critical); 1922 1923 t_id = ntohs(t.t_id); 1924 1925 map = NULL; 1926 nmap = 0; 1927 1928 switch (t.t_type) { 1929 case IV2_T_ENCR: 1930 idstr = STR_OR_ID(t_id, esp_p_map); 1931 map = encr_t_map; 1932 nmap = sizeof(encr_t_map)/sizeof(encr_t_map[0]); 1933 break; 1934 1935 case IV2_T_PRF: 1936 idstr = STR_OR_ID(t_id, prf_p_map); 1937 break; 1938 1939 case IV2_T_INTEG: 1940 idstr = STR_OR_ID(t_id, integ_p_map); 1941 break; 1942 1943 case IV2_T_DH: 1944 idstr = STR_OR_ID(t_id, dh_p_map); 1945 break; 1946 1947 case IV2_T_ESN: 1948 idstr = STR_OR_ID(t_id, esn_p_map); 1949 break; 1950 1951 default: 1952 idstr = NULL; 1953 break; 1954 } 1955 1956 if (idstr) 1957 ND_PRINT((ndo," #%u type=%s id=%s ", tcount, 1958 STR_OR_ID(t.t_type, ikev2_t_type_map), 1959 idstr)); 1960 else 1961 ND_PRINT((ndo," #%u type=%s id=%u ", tcount, 1962 STR_OR_ID(t.t_type, ikev2_t_type_map), 1963 t.t_id)); 1964 cp = (const u_char *)(p + 1); 1965 ep2 = (const u_char *)p + item_len; 1966 while (cp < ep && cp < ep2) { 1967 if (map && nmap) { 1968 cp = ikev1_attrmap_print(ndo, cp, ep2, map, nmap); 1969 } else 1970 cp = ikev1_attr_print(ndo, cp, ep2); 1971 if (cp == NULL) 1972 goto trunc; 1973 } 1974 if (ep < ep2) 1975 ND_PRINT((ndo,"...")); 1976 return cp; 1977 trunc: 1978 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_T))); 1979 return NULL; 1980 } 1981 1982 static const u_char * 1983 ikev2_p_print(netdissect_options *ndo, u_char tpay _U_, int pcount _U_, 1984 const struct isakmp_gen *ext, u_int oprop_length, 1985 const u_char *ep, int depth) 1986 { 1987 const struct ikev2_p *p; 1988 struct ikev2_p prop; 1989 u_int prop_length; 1990 const u_char *cp; 1991 int i; 1992 int tcount; 1993 u_char np; 1994 struct isakmp_gen e; 1995 u_int item_len; 1996 1997 p = (const struct ikev2_p *)ext; 1998 ND_TCHECK(*p); 1999 UNALIGNED_MEMCPY(&prop, ext, sizeof(prop)); 2000 2001 ikev2_pay_print(ndo, NPSTR(ISAKMP_NPTYPE_P), prop.h.critical); 2002 2003 /* 2004 * ikev2_sa_print() guarantees that this is >= 4. 2005 */ 2006 prop_length = oprop_length - 4; 2007 ND_PRINT((ndo," #%u protoid=%s transform=%d len=%u", 2008 prop.p_no, PROTOIDSTR(prop.prot_id), 2009 prop.num_t, oprop_length)); 2010 cp = (const u_char *)(p + 1); 2011 2012 if (prop.spi_size) { 2013 if (prop_length < prop.spi_size) 2014 goto toolong; 2015 ND_PRINT((ndo," spi=")); 2016 if (!rawprint(ndo, (const uint8_t *)cp, prop.spi_size)) 2017 goto trunc; 2018 cp += prop.spi_size; 2019 prop_length -= prop.spi_size; 2020 } 2021 2022 /* 2023 * Print the transforms. 2024 */ 2025 tcount = 0; 2026 for (np = ISAKMP_NPTYPE_T; np != 0; np = e.np) { 2027 tcount++; 2028 ext = (const struct isakmp_gen *)cp; 2029 if (prop_length < sizeof(*ext)) 2030 goto toolong; 2031 ND_TCHECK(*ext); 2032 UNALIGNED_MEMCPY(&e, ext, sizeof(e)); 2033 2034 /* 2035 * Since we can't have a payload length of less than 4 bytes, 2036 * we need to bail out here if the generic header is nonsensical 2037 * or truncated, otherwise we could loop forever processing 2038 * zero-length items or otherwise misdissect the packet. 2039 */ 2040 item_len = ntohs(e.len); 2041 if (item_len <= 4) 2042 goto trunc; 2043 2044 if (prop_length < item_len) 2045 goto toolong; 2046 ND_TCHECK2(*cp, item_len); 2047 2048 depth++; 2049 ND_PRINT((ndo,"\n")); 2050 for (i = 0; i < depth; i++) 2051 ND_PRINT((ndo," ")); 2052 ND_PRINT((ndo,"(")); 2053 if (np == ISAKMP_NPTYPE_T) { 2054 cp = ikev2_t_print(ndo, tcount, ext, item_len, ep); 2055 if (cp == NULL) { 2056 /* error, already reported */ 2057 return NULL; 2058 } 2059 } else { 2060 ND_PRINT((ndo, "%s", NPSTR(np))); 2061 cp += item_len; 2062 } 2063 ND_PRINT((ndo,")")); 2064 depth--; 2065 prop_length -= item_len; 2066 } 2067 return cp; 2068 toolong: 2069 /* 2070 * Skip the rest of the proposal. 2071 */ 2072 cp += prop_length; 2073 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_P))); 2074 return cp; 2075 trunc: 2076 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_P))); 2077 return NULL; 2078 } 2079 2080 static const u_char * 2081 ikev2_sa_print(netdissect_options *ndo, u_char tpay, 2082 const struct isakmp_gen *ext1, 2083 u_int osa_length, const u_char *ep, 2084 uint32_t phase _U_, uint32_t doi _U_, 2085 uint32_t proto _U_, int depth) 2086 { 2087 const struct isakmp_gen *ext; 2088 struct isakmp_gen e; 2089 u_int sa_length; 2090 const u_char *cp; 2091 int i; 2092 int pcount; 2093 u_char np; 2094 u_int item_len; 2095 2096 ND_TCHECK(*ext1); 2097 UNALIGNED_MEMCPY(&e, ext1, sizeof(e)); 2098 ikev2_pay_print(ndo, "sa", e.critical); 2099 2100 /* 2101 * ikev2_sub0_print() guarantees that this is >= 4. 2102 */ 2103 osa_length= ntohs(e.len); 2104 sa_length = osa_length - 4; 2105 ND_PRINT((ndo," len=%d", sa_length)); 2106 2107 /* 2108 * Print the payloads. 2109 */ 2110 cp = (const u_char *)(ext1 + 1); 2111 pcount = 0; 2112 for (np = ISAKMP_NPTYPE_P; np != 0; np = e.np) { 2113 pcount++; 2114 ext = (const struct isakmp_gen *)cp; 2115 if (sa_length < sizeof(*ext)) 2116 goto toolong; 2117 ND_TCHECK(*ext); 2118 UNALIGNED_MEMCPY(&e, ext, sizeof(e)); 2119 2120 /* 2121 * Since we can't have a payload length of less than 4 bytes, 2122 * we need to bail out here if the generic header is nonsensical 2123 * or truncated, otherwise we could loop forever processing 2124 * zero-length items or otherwise misdissect the packet. 2125 */ 2126 item_len = ntohs(e.len); 2127 if (item_len <= 4) 2128 goto trunc; 2129 2130 if (sa_length < item_len) 2131 goto toolong; 2132 ND_TCHECK2(*cp, item_len); 2133 2134 depth++; 2135 ND_PRINT((ndo,"\n")); 2136 for (i = 0; i < depth; i++) 2137 ND_PRINT((ndo," ")); 2138 ND_PRINT((ndo,"(")); 2139 if (np == ISAKMP_NPTYPE_P) { 2140 cp = ikev2_p_print(ndo, np, pcount, ext, item_len, 2141 ep, depth); 2142 if (cp == NULL) { 2143 /* error, already reported */ 2144 return NULL; 2145 } 2146 } else { 2147 ND_PRINT((ndo, "%s", NPSTR(np))); 2148 cp += item_len; 2149 } 2150 ND_PRINT((ndo,")")); 2151 depth--; 2152 sa_length -= item_len; 2153 } 2154 return cp; 2155 toolong: 2156 /* 2157 * Skip the rest of the SA. 2158 */ 2159 cp += sa_length; 2160 ND_PRINT((ndo," [|%s]", NPSTR(tpay))); 2161 return cp; 2162 trunc: 2163 ND_PRINT((ndo," [|%s]", NPSTR(tpay))); 2164 return NULL; 2165 } 2166 2167 static const u_char * 2168 ikev2_ke_print(netdissect_options *ndo, u_char tpay, 2169 const struct isakmp_gen *ext, 2170 u_int item_len _U_, const u_char *ep _U_, 2171 uint32_t phase _U_, uint32_t doi _U_, 2172 uint32_t proto _U_, int depth _U_) 2173 { 2174 struct ikev2_ke ke; 2175 const struct ikev2_ke *k; 2176 2177 k = (const struct ikev2_ke *)ext; 2178 ND_TCHECK(*k); 2179 UNALIGNED_MEMCPY(&ke, ext, sizeof(ke)); 2180 ikev2_pay_print(ndo, NPSTR(tpay), ke.h.critical); 2181 2182 ND_PRINT((ndo," len=%u group=%s", ntohs(ke.h.len) - 8, 2183 STR_OR_ID(ntohs(ke.ke_group), dh_p_map))); 2184 2185 if (2 < ndo->ndo_vflag && 8 < ntohs(ke.h.len)) { 2186 ND_PRINT((ndo," ")); 2187 if (!rawprint(ndo, (const uint8_t *)(k + 1), ntohs(ke.h.len) - 8)) 2188 goto trunc; 2189 } 2190 return (const u_char *)ext + ntohs(ke.h.len); 2191 trunc: 2192 ND_PRINT((ndo," [|%s]", NPSTR(tpay))); 2193 return NULL; 2194 } 2195 2196 static const u_char * 2197 ikev2_ID_print(netdissect_options *ndo, u_char tpay, 2198 const struct isakmp_gen *ext, 2199 u_int item_len _U_, const u_char *ep _U_, 2200 uint32_t phase _U_, uint32_t doi _U_, 2201 uint32_t proto _U_, int depth _U_) 2202 { 2203 const struct ikev2_id *idp; 2204 struct ikev2_id id; 2205 int id_len, idtype_len, i; 2206 unsigned int dumpascii, dumphex; 2207 const unsigned char *typedata; 2208 2209 idp = (const struct ikev2_id *)ext; 2210 ND_TCHECK(*idp); 2211 UNALIGNED_MEMCPY(&id, ext, sizeof(id)); 2212 ikev2_pay_print(ndo, NPSTR(tpay), id.h.critical); 2213 2214 id_len = ntohs(id.h.len); 2215 2216 ND_PRINT((ndo," len=%d", id_len - 4)); 2217 if (2 < ndo->ndo_vflag && 4 < id_len) { 2218 /* Print the entire payload in hex */ 2219 ND_PRINT((ndo," ")); 2220 if (!rawprint(ndo, (const uint8_t *)(ext + 1), id_len - 4)) 2221 goto trunc; 2222 } 2223 2224 idtype_len =id_len - sizeof(struct ikev2_id); 2225 dumpascii = 0; 2226 dumphex = 0; 2227 typedata = (const unsigned char *)(ext)+sizeof(struct ikev2_id); 2228 2229 switch(id.type) { 2230 case ID_IPV4_ADDR: 2231 ND_PRINT((ndo, " ipv4:")); 2232 dumphex=1; 2233 break; 2234 case ID_FQDN: 2235 ND_PRINT((ndo, " fqdn:")); 2236 dumpascii=1; 2237 break; 2238 case ID_RFC822_ADDR: 2239 ND_PRINT((ndo, " rfc822:")); 2240 dumpascii=1; 2241 break; 2242 case ID_IPV6_ADDR: 2243 ND_PRINT((ndo, " ipv6:")); 2244 dumphex=1; 2245 break; 2246 case ID_DER_ASN1_DN: 2247 ND_PRINT((ndo, " dn:")); 2248 dumphex=1; 2249 break; 2250 case ID_DER_ASN1_GN: 2251 ND_PRINT((ndo, " gn:")); 2252 dumphex=1; 2253 break; 2254 case ID_KEY_ID: 2255 ND_PRINT((ndo, " keyid:")); 2256 dumphex=1; 2257 break; 2258 } 2259 2260 if(dumpascii) { 2261 ND_TCHECK2(*typedata, idtype_len); 2262 for(i=0; i<idtype_len; i++) { 2263 if(ND_ISPRINT(typedata[i])) { 2264 ND_PRINT((ndo, "%c", typedata[i])); 2265 } else { 2266 ND_PRINT((ndo, ".")); 2267 } 2268 } 2269 } 2270 if(dumphex) { 2271 if (!rawprint(ndo, (const uint8_t *)typedata, idtype_len)) 2272 goto trunc; 2273 } 2274 2275 return (const u_char *)ext + id_len; 2276 trunc: 2277 ND_PRINT((ndo," [|%s]", NPSTR(tpay))); 2278 return NULL; 2279 } 2280 2281 static const u_char * 2282 ikev2_cert_print(netdissect_options *ndo, u_char tpay, 2283 const struct isakmp_gen *ext, 2284 u_int item_len _U_, const u_char *ep _U_, 2285 uint32_t phase _U_, uint32_t doi _U_, 2286 uint32_t proto _U_, int depth _U_) 2287 { 2288 return ikev2_gen_print(ndo, tpay, ext); 2289 } 2290 2291 static const u_char * 2292 ikev2_cr_print(netdissect_options *ndo, u_char tpay, 2293 const struct isakmp_gen *ext, 2294 u_int item_len _U_, const u_char *ep _U_, 2295 uint32_t phase _U_, uint32_t doi _U_, 2296 uint32_t proto _U_, int depth _U_) 2297 { 2298 return ikev2_gen_print(ndo, tpay, ext); 2299 } 2300 2301 static const u_char * 2302 ikev2_auth_print(netdissect_options *ndo, u_char tpay, 2303 const struct isakmp_gen *ext, 2304 u_int item_len _U_, const u_char *ep, 2305 uint32_t phase _U_, uint32_t doi _U_, 2306 uint32_t proto _U_, int depth _U_) 2307 { 2308 struct ikev2_auth a; 2309 const char *v2_auth[]={ "invalid", "rsasig", 2310 "shared-secret", "dsssig" }; 2311 const u_char *authdata = (const u_char*)ext + sizeof(a); 2312 unsigned int len; 2313 2314 ND_TCHECK2(*ext, sizeof(a)); 2315 UNALIGNED_MEMCPY(&a, ext, sizeof(a)); 2316 ikev2_pay_print(ndo, NPSTR(tpay), a.h.critical); 2317 len = ntohs(a.h.len); 2318 2319 /* 2320 * Our caller has ensured that the length is >= 4. 2321 */ 2322 ND_PRINT((ndo," len=%u method=%s", len-4, 2323 STR_OR_ID(a.auth_method, v2_auth))); 2324 if (len > 4) { 2325 if (ndo->ndo_vflag > 1) { 2326 ND_PRINT((ndo, " authdata=(")); 2327 if (!rawprint(ndo, (const uint8_t *)authdata, len - sizeof(a))) 2328 goto trunc; 2329 ND_PRINT((ndo, ") ")); 2330 } else if (ndo->ndo_vflag) { 2331 if (!ike_show_somedata(ndo, authdata, ep)) 2332 goto trunc; 2333 } 2334 } 2335 2336 return (const u_char *)ext + len; 2337 trunc: 2338 ND_PRINT((ndo," [|%s]", NPSTR(tpay))); 2339 return NULL; 2340 } 2341 2342 static const u_char * 2343 ikev2_nonce_print(netdissect_options *ndo, u_char tpay, 2344 const struct isakmp_gen *ext, 2345 u_int item_len _U_, const u_char *ep, 2346 uint32_t phase _U_, uint32_t doi _U_, 2347 uint32_t proto _U_, int depth _U_) 2348 { 2349 struct isakmp_gen e; 2350 2351 ND_TCHECK(*ext); 2352 UNALIGNED_MEMCPY(&e, ext, sizeof(e)); 2353 ikev2_pay_print(ndo, "nonce", e.critical); 2354 2355 ND_PRINT((ndo," len=%d", ntohs(e.len) - 4)); 2356 if (1 < ndo->ndo_vflag && 4 < ntohs(e.len)) { 2357 ND_PRINT((ndo," nonce=(")); 2358 if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4)) 2359 goto trunc; 2360 ND_PRINT((ndo,") ")); 2361 } else if(ndo->ndo_vflag && 4 < ntohs(e.len)) { 2362 if(!ike_show_somedata(ndo, (const u_char *)(ext+1), ep)) goto trunc; 2363 } 2364 2365 return (const u_char *)ext + ntohs(e.len); 2366 trunc: 2367 ND_PRINT((ndo," [|%s]", NPSTR(tpay))); 2368 return NULL; 2369 } 2370 2371 /* notify payloads */ 2372 static const u_char * 2373 ikev2_n_print(netdissect_options *ndo, u_char tpay _U_, 2374 const struct isakmp_gen *ext, 2375 u_int item_len, const u_char *ep, 2376 uint32_t phase _U_, uint32_t doi _U_, 2377 uint32_t proto _U_, int depth _U_) 2378 { 2379 const struct ikev2_n *p; 2380 struct ikev2_n n; 2381 const u_char *cp; 2382 u_char showspi, showsomedata; 2383 const char *notify_name; 2384 uint32_t type; 2385 2386 p = (const struct ikev2_n *)ext; 2387 ND_TCHECK(*p); 2388 UNALIGNED_MEMCPY(&n, ext, sizeof(n)); 2389 ikev2_pay_print(ndo, NPSTR(ISAKMP_NPTYPE_N), n.h.critical); 2390 2391 showspi = 1; 2392 showsomedata=0; 2393 notify_name=NULL; 2394 2395 ND_PRINT((ndo," prot_id=%s", PROTOIDSTR(n.prot_id))); 2396 2397 type = ntohs(n.type); 2398 2399 /* notify space is annoying sparse */ 2400 switch(type) { 2401 case IV2_NOTIFY_UNSUPPORTED_CRITICAL_PAYLOAD: 2402 notify_name = "unsupported_critical_payload"; 2403 showspi = 0; 2404 break; 2405 2406 case IV2_NOTIFY_INVALID_IKE_SPI: 2407 notify_name = "invalid_ike_spi"; 2408 showspi = 1; 2409 break; 2410 2411 case IV2_NOTIFY_INVALID_MAJOR_VERSION: 2412 notify_name = "invalid_major_version"; 2413 showspi = 0; 2414 break; 2415 2416 case IV2_NOTIFY_INVALID_SYNTAX: 2417 notify_name = "invalid_syntax"; 2418 showspi = 1; 2419 break; 2420 2421 case IV2_NOTIFY_INVALID_MESSAGE_ID: 2422 notify_name = "invalid_message_id"; 2423 showspi = 1; 2424 break; 2425 2426 case IV2_NOTIFY_INVALID_SPI: 2427 notify_name = "invalid_spi"; 2428 showspi = 1; 2429 break; 2430 2431 case IV2_NOTIFY_NO_PROPOSAL_CHOSEN: 2432 notify_name = "no_protocol_chosen"; 2433 showspi = 1; 2434 break; 2435 2436 case IV2_NOTIFY_INVALID_KE_PAYLOAD: 2437 notify_name = "invalid_ke_payload"; 2438 showspi = 1; 2439 break; 2440 2441 case IV2_NOTIFY_AUTHENTICATION_FAILED: 2442 notify_name = "authentication_failed"; 2443 showspi = 1; 2444 break; 2445 2446 case IV2_NOTIFY_SINGLE_PAIR_REQUIRED: 2447 notify_name = "single_pair_required"; 2448 showspi = 1; 2449 break; 2450 2451 case IV2_NOTIFY_NO_ADDITIONAL_SAS: 2452 notify_name = "no_additional_sas"; 2453 showspi = 0; 2454 break; 2455 2456 case IV2_NOTIFY_INTERNAL_ADDRESS_FAILURE: 2457 notify_name = "internal_address_failure"; 2458 showspi = 0; 2459 break; 2460 2461 case IV2_NOTIFY_FAILED_CP_REQUIRED: 2462 notify_name = "failed:cp_required"; 2463 showspi = 0; 2464 break; 2465 2466 case IV2_NOTIFY_INVALID_SELECTORS: 2467 notify_name = "invalid_selectors"; 2468 showspi = 0; 2469 break; 2470 2471 case IV2_NOTIFY_INITIAL_CONTACT: 2472 notify_name = "initial_contact"; 2473 showspi = 0; 2474 break; 2475 2476 case IV2_NOTIFY_SET_WINDOW_SIZE: 2477 notify_name = "set_window_size"; 2478 showspi = 0; 2479 break; 2480 2481 case IV2_NOTIFY_ADDITIONAL_TS_POSSIBLE: 2482 notify_name = "additional_ts_possible"; 2483 showspi = 0; 2484 break; 2485 2486 case IV2_NOTIFY_IPCOMP_SUPPORTED: 2487 notify_name = "ipcomp_supported"; 2488 showspi = 0; 2489 break; 2490 2491 case IV2_NOTIFY_NAT_DETECTION_SOURCE_IP: 2492 notify_name = "nat_detection_source_ip"; 2493 showspi = 1; 2494 break; 2495 2496 case IV2_NOTIFY_NAT_DETECTION_DESTINATION_IP: 2497 notify_name = "nat_detection_destination_ip"; 2498 showspi = 1; 2499 break; 2500 2501 case IV2_NOTIFY_COOKIE: 2502 notify_name = "cookie"; 2503 showspi = 1; 2504 showsomedata= 1; 2505 break; 2506 2507 case IV2_NOTIFY_USE_TRANSPORT_MODE: 2508 notify_name = "use_transport_mode"; 2509 showspi = 0; 2510 break; 2511 2512 case IV2_NOTIFY_HTTP_CERT_LOOKUP_SUPPORTED: 2513 notify_name = "http_cert_lookup_supported"; 2514 showspi = 0; 2515 break; 2516 2517 case IV2_NOTIFY_REKEY_SA: 2518 notify_name = "rekey_sa"; 2519 showspi = 1; 2520 break; 2521 2522 case IV2_NOTIFY_ESP_TFC_PADDING_NOT_SUPPORTED: 2523 notify_name = "tfc_padding_not_supported"; 2524 showspi = 0; 2525 break; 2526 2527 case IV2_NOTIFY_NON_FIRST_FRAGMENTS_ALSO: 2528 notify_name = "non_first_fragment_also"; 2529 showspi = 0; 2530 break; 2531 2532 default: 2533 if (type < 8192) { 2534 notify_name="error"; 2535 } else if(type < 16384) { 2536 notify_name="private-error"; 2537 } else if(type < 40960) { 2538 notify_name="status"; 2539 } else { 2540 notify_name="private-status"; 2541 } 2542 } 2543 2544 if(notify_name) { 2545 ND_PRINT((ndo," type=%u(%s)", type, notify_name)); 2546 } 2547 2548 2549 if (showspi && n.spi_size) { 2550 ND_PRINT((ndo," spi=")); 2551 if (!rawprint(ndo, (const uint8_t *)(p + 1), n.spi_size)) 2552 goto trunc; 2553 } 2554 2555 cp = (const u_char *)(p + 1) + n.spi_size; 2556 2557 if (cp < ep) { 2558 if (ndo->ndo_vflag > 3 || (showsomedata && ep-cp < 30)) { 2559 ND_PRINT((ndo," data=(")); 2560 if (!rawprint(ndo, (const uint8_t *)(cp), ep - cp)) 2561 goto trunc; 2562 2563 ND_PRINT((ndo,")")); 2564 } else if (showsomedata) { 2565 if (!ike_show_somedata(ndo, cp, ep)) 2566 goto trunc; 2567 } 2568 } 2569 2570 return (const u_char *)ext + item_len; 2571 trunc: 2572 ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_N))); 2573 return NULL; 2574 } 2575 2576 static const u_char * 2577 ikev2_d_print(netdissect_options *ndo, u_char tpay, 2578 const struct isakmp_gen *ext, 2579 u_int item_len _U_, const u_char *ep _U_, 2580 uint32_t phase _U_, uint32_t doi _U_, 2581 uint32_t proto _U_, int depth _U_) 2582 { 2583 return ikev2_gen_print(ndo, tpay, ext); 2584 } 2585 2586 static const u_char * 2587 ikev2_vid_print(netdissect_options *ndo, u_char tpay, 2588 const struct isakmp_gen *ext, 2589 u_int item_len _U_, const u_char *ep _U_, 2590 uint32_t phase _U_, uint32_t doi _U_, 2591 uint32_t proto _U_, int depth _U_) 2592 { 2593 struct isakmp_gen e; 2594 const u_char *vid; 2595 int i, len; 2596 2597 ND_TCHECK(*ext); 2598 UNALIGNED_MEMCPY(&e, ext, sizeof(e)); 2599 ikev2_pay_print(ndo, NPSTR(tpay), e.critical); 2600 ND_PRINT((ndo," len=%d vid=", ntohs(e.len) - 4)); 2601 2602 vid = (const u_char *)(ext+1); 2603 len = ntohs(e.len) - 4; 2604 ND_TCHECK2(*vid, len); 2605 for(i=0; i<len; i++) { 2606 if(ND_ISPRINT(vid[i])) ND_PRINT((ndo, "%c", vid[i])); 2607 else ND_PRINT((ndo, ".")); 2608 } 2609 if (2 < ndo->ndo_vflag && 4 < len) { 2610 /* Print the entire payload in hex */ 2611 ND_PRINT((ndo," ")); 2612 if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4)) 2613 goto trunc; 2614 } 2615 return (const u_char *)ext + ntohs(e.len); 2616 trunc: 2617 ND_PRINT((ndo," [|%s]", NPSTR(tpay))); 2618 return NULL; 2619 } 2620 2621 static const u_char * 2622 ikev2_TS_print(netdissect_options *ndo, u_char tpay, 2623 const struct isakmp_gen *ext, 2624 u_int item_len _U_, const u_char *ep _U_, 2625 uint32_t phase _U_, uint32_t doi _U_, 2626 uint32_t proto _U_, int depth _U_) 2627 { 2628 return ikev2_gen_print(ndo, tpay, ext); 2629 } 2630 2631 static const u_char * 2632 ikev2_e_print(netdissect_options *ndo, 2633 #ifndef HAVE_LIBCRYPTO 2634 _U_ 2635 #endif 2636 struct isakmp *base, 2637 u_char tpay, 2638 const struct isakmp_gen *ext, 2639 u_int item_len _U_, const u_char *ep _U_, 2640 #ifndef HAVE_LIBCRYPTO 2641 _U_ 2642 #endif 2643 uint32_t phase, 2644 #ifndef HAVE_LIBCRYPTO 2645 _U_ 2646 #endif 2647 uint32_t doi, 2648 #ifndef HAVE_LIBCRYPTO 2649 _U_ 2650 #endif 2651 uint32_t proto, 2652 #ifndef HAVE_LIBCRYPTO 2653 _U_ 2654 #endif 2655 int depth) 2656 { 2657 struct isakmp_gen e; 2658 const u_char *dat; 2659 volatile int dlen; 2660 2661 ND_TCHECK(*ext); 2662 UNALIGNED_MEMCPY(&e, ext, sizeof(e)); 2663 ikev2_pay_print(ndo, NPSTR(tpay), e.critical); 2664 2665 dlen = ntohs(e.len)-4; 2666 2667 ND_PRINT((ndo," len=%d", dlen)); 2668 if (2 < ndo->ndo_vflag && 4 < dlen) { 2669 ND_PRINT((ndo," ")); 2670 if (!rawprint(ndo, (const uint8_t *)(ext + 1), dlen)) 2671 goto trunc; 2672 } 2673 2674 dat = (const u_char *)(ext+1); 2675 ND_TCHECK2(*dat, dlen); 2676 2677 #ifdef HAVE_LIBCRYPTO 2678 /* try to decypt it! */ 2679 if(esp_print_decrypt_buffer_by_ikev2(ndo, 2680 base->flags & ISAKMP_FLAG_I, 2681 base->i_ck, base->r_ck, 2682 dat, dat+dlen)) { 2683 2684 ext = (const struct isakmp_gen *)ndo->ndo_packetp; 2685 2686 /* got it decrypted, print stuff inside. */ 2687 ikev2_sub_print(ndo, base, e.np, ext, ndo->ndo_snapend, 2688 phase, doi, proto, depth+1); 2689 } 2690 #endif 2691 2692 2693 /* always return NULL, because E must be at end, and NP refers 2694 * to what was inside. 2695 */ 2696 return NULL; 2697 trunc: 2698 ND_PRINT((ndo," [|%s]", NPSTR(tpay))); 2699 return NULL; 2700 } 2701 2702 static const u_char * 2703 ikev2_cp_print(netdissect_options *ndo, u_char tpay, 2704 const struct isakmp_gen *ext, 2705 u_int item_len _U_, const u_char *ep _U_, 2706 uint32_t phase _U_, uint32_t doi _U_, 2707 uint32_t proto _U_, int depth _U_) 2708 { 2709 return ikev2_gen_print(ndo, tpay, ext); 2710 } 2711 2712 static const u_char * 2713 ikev2_eap_print(netdissect_options *ndo, u_char tpay, 2714 const struct isakmp_gen *ext, 2715 u_int item_len _U_, const u_char *ep _U_, 2716 uint32_t phase _U_, uint32_t doi _U_, 2717 uint32_t proto _U_, int depth _U_) 2718 { 2719 return ikev2_gen_print(ndo, tpay, ext); 2720 } 2721 2722 static const u_char * 2723 ike_sub0_print(netdissect_options *ndo, 2724 u_char np, const struct isakmp_gen *ext, const u_char *ep, 2725 2726 uint32_t phase, uint32_t doi, uint32_t proto, int depth) 2727 { 2728 const u_char *cp; 2729 struct isakmp_gen e; 2730 u_int item_len; 2731 2732 cp = (const u_char *)ext; 2733 ND_TCHECK(*ext); 2734 UNALIGNED_MEMCPY(&e, ext, sizeof(e)); 2735 2736 /* 2737 * Since we can't have a payload length of less than 4 bytes, 2738 * we need to bail out here if the generic header is nonsensical 2739 * or truncated, otherwise we could loop forever processing 2740 * zero-length items or otherwise misdissect the packet. 2741 */ 2742 item_len = ntohs(e.len); 2743 if (item_len <= 4) 2744 return NULL; 2745 2746 if (NPFUNC(np)) { 2747 /* 2748 * XXX - what if item_len is too short, or too long, 2749 * for this payload type? 2750 */ 2751 cp = (*npfunc[np])(ndo, np, ext, item_len, ep, phase, doi, proto, depth); 2752 } else { 2753 ND_PRINT((ndo,"%s", NPSTR(np))); 2754 cp += item_len; 2755 } 2756 2757 return cp; 2758 trunc: 2759 ND_PRINT((ndo," [|isakmp]")); 2760 return NULL; 2761 } 2762 2763 static const u_char * 2764 ikev1_sub_print(netdissect_options *ndo, 2765 u_char np, const struct isakmp_gen *ext, const u_char *ep, 2766 uint32_t phase, uint32_t doi, uint32_t proto, int depth) 2767 { 2768 const u_char *cp; 2769 int i; 2770 struct isakmp_gen e; 2771 2772 cp = (const u_char *)ext; 2773 2774 while (np) { 2775 ND_TCHECK(*ext); 2776 UNALIGNED_MEMCPY(&e, ext, sizeof(e)); 2777 2778 ND_TCHECK2(*ext, ntohs(e.len)); 2779 2780 depth++; 2781 ND_PRINT((ndo,"\n")); 2782 for (i = 0; i < depth; i++) 2783 ND_PRINT((ndo," ")); 2784 ND_PRINT((ndo,"(")); 2785 cp = ike_sub0_print(ndo, np, ext, ep, phase, doi, proto, depth); 2786 ND_PRINT((ndo,")")); 2787 depth--; 2788 2789 if (cp == NULL) { 2790 /* Zero-length subitem */ 2791 return NULL; 2792 } 2793 2794 np = e.np; 2795 ext = (const struct isakmp_gen *)cp; 2796 } 2797 return cp; 2798 trunc: 2799 ND_PRINT((ndo," [|%s]", NPSTR(np))); 2800 return NULL; 2801 } 2802 2803 static char * 2804 numstr(int x) 2805 { 2806 static char buf[20]; 2807 snprintf(buf, sizeof(buf), "#%d", x); 2808 return buf; 2809 } 2810 2811 static void 2812 ikev1_print(netdissect_options *ndo, 2813 const u_char *bp, u_int length, 2814 const u_char *bp2, struct isakmp *base) 2815 { 2816 const struct isakmp *p; 2817 const u_char *ep; 2818 u_char np; 2819 int i; 2820 int phase; 2821 2822 p = (const struct isakmp *)bp; 2823 ep = ndo->ndo_snapend; 2824 2825 phase = (EXTRACT_32BITS(base->msgid) == 0) ? 1 : 2; 2826 if (phase == 1) 2827 ND_PRINT((ndo," phase %d", phase)); 2828 else 2829 ND_PRINT((ndo," phase %d/others", phase)); 2830 2831 i = cookie_find(&base->i_ck); 2832 if (i < 0) { 2833 if (iszero((const u_char *)&base->r_ck, sizeof(base->r_ck))) { 2834 /* the first packet */ 2835 ND_PRINT((ndo," I")); 2836 if (bp2) 2837 cookie_record(&base->i_ck, bp2); 2838 } else 2839 ND_PRINT((ndo," ?")); 2840 } else { 2841 if (bp2 && cookie_isinitiator(i, bp2)) 2842 ND_PRINT((ndo," I")); 2843 else if (bp2 && cookie_isresponder(i, bp2)) 2844 ND_PRINT((ndo," R")); 2845 else 2846 ND_PRINT((ndo," ?")); 2847 } 2848 2849 ND_PRINT((ndo," %s", ETYPESTR(base->etype))); 2850 if (base->flags) { 2851 ND_PRINT((ndo,"[%s%s]", base->flags & ISAKMP_FLAG_E ? "E" : "", 2852 base->flags & ISAKMP_FLAG_C ? "C" : "")); 2853 } 2854 2855 if (ndo->ndo_vflag) { 2856 const struct isakmp_gen *ext; 2857 2858 ND_PRINT((ndo,":")); 2859 2860 /* regardless of phase... */ 2861 if (base->flags & ISAKMP_FLAG_E) { 2862 /* 2863 * encrypted, nothing we can do right now. 2864 * we hope to decrypt the packet in the future... 2865 */ 2866 ND_PRINT((ndo," [encrypted %s]", NPSTR(base->np))); 2867 goto done; 2868 } 2869 2870 CHECKLEN(p + 1, base->np); 2871 np = base->np; 2872 ext = (const struct isakmp_gen *)(p + 1); 2873 ikev1_sub_print(ndo, np, ext, ep, phase, 0, 0, 0); 2874 } 2875 2876 done: 2877 if (ndo->ndo_vflag) { 2878 if (ntohl(base->len) != length) { 2879 ND_PRINT((ndo," (len mismatch: isakmp %u/ip %u)", 2880 (uint32_t)ntohl(base->len), length)); 2881 } 2882 } 2883 } 2884 2885 static const u_char * 2886 ikev2_sub0_print(netdissect_options *ndo, struct isakmp *base, 2887 u_char np, 2888 const struct isakmp_gen *ext, const u_char *ep, 2889 uint32_t phase, uint32_t doi, uint32_t proto, int depth) 2890 { 2891 const u_char *cp; 2892 struct isakmp_gen e; 2893 u_int item_len; 2894 2895 cp = (const u_char *)ext; 2896 ND_TCHECK(*ext); 2897 UNALIGNED_MEMCPY(&e, ext, sizeof(e)); 2898 2899 /* 2900 * Since we can't have a payload length of less than 4 bytes, 2901 * we need to bail out here if the generic header is nonsensical 2902 * or truncated, otherwise we could loop forever processing 2903 * zero-length items or otherwise misdissect the packet. 2904 */ 2905 item_len = ntohs(e.len); 2906 if (item_len <= 4) 2907 return NULL; 2908 2909 if (np == ISAKMP_NPTYPE_v2E) { 2910 cp = ikev2_e_print(ndo, base, np, ext, item_len, 2911 ep, phase, doi, proto, depth); 2912 } else if (NPFUNC(np)) { 2913 /* 2914 * XXX - what if item_len is too short, or too long, 2915 * for this payload type? 2916 */ 2917 cp = (*npfunc[np])(ndo, np, ext, item_len, 2918 ep, phase, doi, proto, depth); 2919 } else { 2920 ND_PRINT((ndo,"%s", NPSTR(np))); 2921 cp += item_len; 2922 } 2923 2924 return cp; 2925 trunc: 2926 ND_PRINT((ndo," [|isakmp]")); 2927 return NULL; 2928 } 2929 2930 static const u_char * 2931 ikev2_sub_print(netdissect_options *ndo, 2932 struct isakmp *base, 2933 u_char np, const struct isakmp_gen *ext, const u_char *ep, 2934 uint32_t phase, uint32_t doi, uint32_t proto, int depth) 2935 { 2936 const u_char *cp; 2937 int i; 2938 struct isakmp_gen e; 2939 2940 cp = (const u_char *)ext; 2941 while (np) { 2942 ND_TCHECK(*ext); 2943 UNALIGNED_MEMCPY(&e, ext, sizeof(e)); 2944 2945 ND_TCHECK2(*ext, ntohs(e.len)); 2946 2947 depth++; 2948 ND_PRINT((ndo,"\n")); 2949 for (i = 0; i < depth; i++) 2950 ND_PRINT((ndo," ")); 2951 ND_PRINT((ndo,"(")); 2952 cp = ikev2_sub0_print(ndo, base, np, 2953 ext, ep, phase, doi, proto, depth); 2954 ND_PRINT((ndo,")")); 2955 depth--; 2956 2957 if (cp == NULL) { 2958 /* Zero-length subitem */ 2959 return NULL; 2960 } 2961 2962 np = e.np; 2963 ext = (const struct isakmp_gen *)cp; 2964 } 2965 return cp; 2966 trunc: 2967 ND_PRINT((ndo," [|%s]", NPSTR(np))); 2968 return NULL; 2969 } 2970 2971 static void 2972 ikev2_print(netdissect_options *ndo, 2973 const u_char *bp, u_int length, 2974 const u_char *bp2 _U_, struct isakmp *base) 2975 { 2976 const struct isakmp *p; 2977 const u_char *ep; 2978 u_char np; 2979 int phase; 2980 2981 p = (const struct isakmp *)bp; 2982 ep = ndo->ndo_snapend; 2983 2984 phase = (EXTRACT_32BITS(base->msgid) == 0) ? 1 : 2; 2985 if (phase == 1) 2986 ND_PRINT((ndo, " parent_sa")); 2987 else 2988 ND_PRINT((ndo, " child_sa ")); 2989 2990 ND_PRINT((ndo, " %s", ETYPESTR(base->etype))); 2991 if (base->flags) { 2992 ND_PRINT((ndo, "[%s%s%s]", 2993 base->flags & ISAKMP_FLAG_I ? "I" : "", 2994 base->flags & ISAKMP_FLAG_V ? "V" : "", 2995 base->flags & ISAKMP_FLAG_R ? "R" : "")); 2996 } 2997 2998 if (ndo->ndo_vflag) { 2999 const struct isakmp_gen *ext; 3000 3001 ND_PRINT((ndo, ":")); 3002 3003 /* regardless of phase... */ 3004 if (base->flags & ISAKMP_FLAG_E) { 3005 /* 3006 * encrypted, nothing we can do right now. 3007 * we hope to decrypt the packet in the future... 3008 */ 3009 ND_PRINT((ndo, " [encrypted %s]", NPSTR(base->np))); 3010 goto done; 3011 } 3012 3013 CHECKLEN(p + 1, base->np) 3014 3015 np = base->np; 3016 ext = (const struct isakmp_gen *)(p + 1); 3017 ikev2_sub_print(ndo, base, np, ext, ep, phase, 0, 0, 0); 3018 } 3019 3020 done: 3021 if (ndo->ndo_vflag) { 3022 if (ntohl(base->len) != length) { 3023 ND_PRINT((ndo, " (len mismatch: isakmp %u/ip %u)", 3024 (uint32_t)ntohl(base->len), length)); 3025 } 3026 } 3027 } 3028 3029 void 3030 isakmp_print(netdissect_options *ndo, 3031 const u_char *bp, u_int length, 3032 const u_char *bp2) 3033 { 3034 const struct isakmp *p; 3035 struct isakmp base; 3036 const u_char *ep; 3037 int major, minor; 3038 3039 #ifdef HAVE_LIBCRYPTO 3040 /* initialize SAs */ 3041 if (ndo->ndo_sa_list_head == NULL) { 3042 if (ndo->ndo_espsecret) 3043 esp_print_decodesecret(ndo); 3044 } 3045 #endif 3046 3047 p = (const struct isakmp *)bp; 3048 ep = ndo->ndo_snapend; 3049 3050 if ((const struct isakmp *)ep < p + 1) { 3051 ND_PRINT((ndo,"[|isakmp]")); 3052 return; 3053 } 3054 3055 UNALIGNED_MEMCPY(&base, p, sizeof(base)); 3056 3057 ND_PRINT((ndo,"isakmp")); 3058 major = (base.vers & ISAKMP_VERS_MAJOR) 3059 >> ISAKMP_VERS_MAJOR_SHIFT; 3060 minor = (base.vers & ISAKMP_VERS_MINOR) 3061 >> ISAKMP_VERS_MINOR_SHIFT; 3062 3063 if (ndo->ndo_vflag) { 3064 ND_PRINT((ndo," %d.%d", major, minor)); 3065 } 3066 3067 if (ndo->ndo_vflag) { 3068 ND_PRINT((ndo," msgid ")); 3069 hexprint(ndo, (const uint8_t *)&base.msgid, sizeof(base.msgid)); 3070 } 3071 3072 if (1 < ndo->ndo_vflag) { 3073 ND_PRINT((ndo," cookie ")); 3074 hexprint(ndo, (const uint8_t *)&base.i_ck, sizeof(base.i_ck)); 3075 ND_PRINT((ndo,"->")); 3076 hexprint(ndo, (const uint8_t *)&base.r_ck, sizeof(base.r_ck)); 3077 } 3078 ND_PRINT((ndo,":")); 3079 3080 switch(major) { 3081 case IKEv1_MAJOR_VERSION: 3082 ikev1_print(ndo, bp, length, bp2, &base); 3083 break; 3084 3085 case IKEv2_MAJOR_VERSION: 3086 ikev2_print(ndo, bp, length, bp2, &base); 3087 break; 3088 } 3089 } 3090 3091 void 3092 isakmp_rfc3948_print(netdissect_options *ndo, 3093 const u_char *bp, u_int length, 3094 const u_char *bp2) 3095 { 3096 ND_TCHECK(bp[0]); 3097 if(length == 1 && bp[0]==0xff) { 3098 ND_PRINT((ndo, "isakmp-nat-keep-alive")); 3099 return; 3100 } 3101 3102 if(length < 4) { 3103 goto trunc; 3104 } 3105 ND_TCHECK(bp[3]); 3106 3107 /* 3108 * see if this is an IKE packet 3109 */ 3110 if(bp[0]==0 && bp[1]==0 && bp[2]==0 && bp[3]==0) { 3111 ND_PRINT((ndo, "NONESP-encap: ")); 3112 isakmp_print(ndo, bp+4, length-4, bp2); 3113 return; 3114 } 3115 3116 /* must be an ESP packet */ 3117 { 3118 int nh, enh, padlen; 3119 int advance; 3120 3121 ND_PRINT((ndo, "UDP-encap: ")); 3122 3123 advance = esp_print(ndo, bp, length, bp2, &enh, &padlen); 3124 if(advance <= 0) 3125 return; 3126 3127 bp += advance; 3128 length -= advance + padlen; 3129 nh = enh & 0xff; 3130 3131 ip_print_inner(ndo, bp, length, nh, bp2); 3132 return; 3133 } 3134 3135 trunc: 3136 ND_PRINT((ndo,"[|isakmp]")); 3137 return; 3138 } 3139 3140 /* 3141 * Local Variables: 3142 * c-style: whitesmith 3143 * c-basic-offset: 8 3144 * End: 3145 */ 3146
