1 /* 2 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. Neither the name of the project nor the names of its contributors 14 * may be used to endorse or promote products derived from this software 15 * without specific prior written permission. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 * SUCH DAMAGE. 28 * 29 */ 30 31 /* \summary: Internet Security Association and Key Management Protocol (ISAKMP) printer */ 32 33 /* specification: RFC 2407, RFC 2408, RFC 5996 */ 34 35 #ifdef HAVE_CONFIG_H 36 #include <config.h> 37 #endif 38 39 /* The functions from print-esp.c used in this file are only defined when both 40 * OpenSSL and evp.h are detected. Employ the same preprocessor device here. 41 */ 42 #ifndef HAVE_OPENSSL_EVP_H 43 #undef HAVE_LIBCRYPTO 44 #endif 45 46 #include "netdissect-stdinc.h" 47 48 #include <string.h> 49 50 #include "netdissect-ctype.h" 51 52 #include "netdissect.h" 53 #include "addrtoname.h" 54 #include "extract.h" 55 56 #include "ip.h" 57 #include "ip6.h" 58 #include "ipproto.h" 59 60 typedef nd_byte cookie_t[8]; 61 typedef nd_byte msgid_t[4]; 62 63 #define PORT_ISAKMP 500 64 65 /* 3.1 ISAKMP Header Format (IKEv1 and IKEv2) 66 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 67 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 68 ! Initiator ! 69 ! Cookie ! 70 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 71 ! Responder ! 72 ! Cookie ! 73 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 74 ! Next Payload ! MjVer ! MnVer ! Exchange Type ! Flags ! 75 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 76 ! Message ID ! 77 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 78 ! Length ! 79 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 80 */ 81 struct isakmp { 82 cookie_t i_ck; /* Initiator Cookie */ 83 cookie_t r_ck; /* Responder Cookie */ 84 nd_uint8_t np; /* Next Payload Type */ 85 nd_uint8_t vers; 86 #define ISAKMP_VERS_MAJOR 0xf0 87 #define ISAKMP_VERS_MAJOR_SHIFT 4 88 #define ISAKMP_VERS_MINOR 0x0f 89 #define ISAKMP_VERS_MINOR_SHIFT 0 90 nd_uint8_t etype; /* Exchange Type */ 91 nd_uint8_t flags; /* Flags */ 92 msgid_t msgid; 93 nd_uint32_t len; /* Length */ 94 }; 95 96 /* Next Payload Type */ 97 #define ISAKMP_NPTYPE_NONE 0 /* NONE*/ 98 #define ISAKMP_NPTYPE_SA 1 /* Security Association */ 99 #define ISAKMP_NPTYPE_P 2 /* Proposal */ 100 #define ISAKMP_NPTYPE_T 3 /* Transform */ 101 #define ISAKMP_NPTYPE_KE 4 /* Key Exchange */ 102 #define ISAKMP_NPTYPE_ID 5 /* Identification */ 103 #define ISAKMP_NPTYPE_CERT 6 /* Certificate */ 104 #define ISAKMP_NPTYPE_CR 7 /* Certificate Request */ 105 #define ISAKMP_NPTYPE_HASH 8 /* Hash */ 106 #define ISAKMP_NPTYPE_SIG 9 /* Signature */ 107 #define ISAKMP_NPTYPE_NONCE 10 /* Nonce */ 108 #define ISAKMP_NPTYPE_N 11 /* Notification */ 109 #define ISAKMP_NPTYPE_D 12 /* Delete */ 110 #define ISAKMP_NPTYPE_VID 13 /* Vendor ID */ 111 #define ISAKMP_NPTYPE_v2E 46 /* v2 Encrypted payload */ 112 113 #define IKEv1_MAJOR_VERSION 1 114 #define IKEv1_MINOR_VERSION 0 115 116 #define IKEv2_MAJOR_VERSION 2 117 #define IKEv2_MINOR_VERSION 0 118 119 /* Flags */ 120 #define ISAKMP_FLAG_E 0x01 /* Encryption Bit */ 121 #define ISAKMP_FLAG_C 0x02 /* Commit Bit */ 122 #define ISAKMP_FLAG_extra 0x04 123 124 /* IKEv2 */ 125 #define ISAKMP_FLAG_I (1 << 3) /* (I)nitiator */ 126 #define ISAKMP_FLAG_V (1 << 4) /* (V)ersion */ 127 #define ISAKMP_FLAG_R (1 << 5) /* (R)esponse */ 128 129 130 /* 3.2 Payload Generic Header 131 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 132 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 133 ! Next Payload ! RESERVED ! Payload Length ! 134 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 135 */ 136 struct isakmp_gen { 137 nd_uint8_t np; /* Next Payload */ 138 nd_uint8_t critical; /* bit 7 - critical, rest is RESERVED */ 139 nd_uint16_t len; /* Payload Length */ 140 }; 141 142 /* 3.3 Data Attributes 143 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 144 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 145 !A! Attribute Type ! AF=0 Attribute Length ! 146 !F! ! AF=1 Attribute Value ! 147 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 148 . AF=0 Attribute Value . 149 . AF=1 Not Transmitted . 150 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 151 */ 152 struct isakmp_data { 153 nd_uint16_t type; /* defined by DOI-spec, and Attribute Format */ 154 nd_uint16_t lorv; /* if f equal 1, Attribute Length */ 155 /* if f equal 0, Attribute Value */ 156 /* if f equal 1, Attribute Value */ 157 }; 158 159 /* 3.4 Security Association Payload */ 160 /* MAY NOT be used, because of being defined in ipsec-doi. */ 161 /* 162 If the current payload is the last in the message, 163 then the value of the next payload field will be 0. 164 This field MUST NOT contain the 165 values for the Proposal or Transform payloads as they are considered 166 part of the security association negotiation. For example, this 167 field would contain the value "10" (Nonce payload) in the first 168 message of a Base Exchange (see Section 4.4) and the value "0" in the 169 first message of an Identity Protect Exchange (see Section 4.5). 170 */ 171 struct ikev1_pl_sa { 172 struct isakmp_gen h; 173 nd_uint32_t doi; /* Domain of Interpretation */ 174 nd_uint32_t sit; /* Situation */ 175 }; 176 177 /* 3.5 Proposal Payload */ 178 /* 179 The value of the next payload field MUST only contain the value "2" 180 or "0". If there are additional Proposal payloads in the message, 181 then this field will be 2. If the current Proposal payload is the 182 last within the security association proposal, then this field will 183 be 0. 184 */ 185 struct ikev1_pl_p { 186 struct isakmp_gen h; 187 nd_uint8_t p_no; /* Proposal # */ 188 nd_uint8_t prot_id; /* Protocol */ 189 nd_uint8_t spi_size; /* SPI Size */ 190 nd_uint8_t num_t; /* Number of Transforms */ 191 /* SPI */ 192 }; 193 194 /* 3.6 Transform Payload */ 195 /* 196 The value of the next payload field MUST only contain the value "3" 197 or "0". If there are additional Transform payloads in the proposal, 198 then this field will be 3. If the current Transform payload is the 199 last within the proposal, then this field will be 0. 200 */ 201 struct ikev1_pl_t { 202 struct isakmp_gen h; 203 nd_uint8_t t_no; /* Transform # */ 204 nd_uint8_t t_id; /* Transform-Id */ 205 nd_byte reserved[2]; /* RESERVED2 */ 206 /* SA Attributes */ 207 }; 208 209 /* 3.7 Key Exchange Payload */ 210 struct ikev1_pl_ke { 211 struct isakmp_gen h; 212 /* Key Exchange Data */ 213 }; 214 215 /* 3.8 Identification Payload */ 216 /* MUST NOT to be used, because of being defined in ipsec-doi. */ 217 struct ikev1_pl_id { 218 struct isakmp_gen h; 219 union { 220 nd_uint8_t id_type; /* ID Type */ 221 nd_uint32_t doi_data; /* DOI Specific ID Data */ 222 } d; 223 /* Identification Data */ 224 }; 225 226 /* 3.9 Certificate Payload */ 227 struct ikev1_pl_cert { 228 struct isakmp_gen h; 229 nd_uint8_t encode; /* Cert Encoding */ 230 nd_uint8_t cert; /* Certificate Data */ 231 /* 232 This field indicates the type of 233 certificate or certificate-related information contained in the 234 Certificate Data field. 235 */ 236 }; 237 238 /* 3.10 Certificate Request Payload */ 239 struct ikev1_pl_cr { 240 struct isakmp_gen h; 241 nd_uint8_t num_cert; /* # Cert. Types */ 242 /* 243 Certificate Types (variable length) 244 -- Contains a list of the types of certificates requested, 245 sorted in order of preference. Each individual certificate 246 type is 1 octet. This field is NOT requiredo 247 */ 248 /* # Certificate Authorities (1 octet) */ 249 /* Certificate Authorities (variable length) */ 250 }; 251 252 /* 3.11 Hash Payload */ 253 /* may not be used, because of having only data. */ 254 struct ikev1_pl_hash { 255 struct isakmp_gen h; 256 /* Hash Data */ 257 }; 258 259 /* 3.12 Signature Payload */ 260 /* may not be used, because of having only data. */ 261 struct ikev1_pl_sig { 262 struct isakmp_gen h; 263 /* Signature Data */ 264 }; 265 266 /* 3.13 Nonce Payload */ 267 /* may not be used, because of having only data. */ 268 struct ikev1_pl_nonce { 269 struct isakmp_gen h; 270 /* Nonce Data */ 271 }; 272 273 /* 3.14 Notification Payload */ 274 struct ikev1_pl_n { 275 struct isakmp_gen h; 276 nd_uint32_t doi; /* Domain of Interpretation */ 277 nd_uint8_t prot_id; /* Protocol-ID */ 278 nd_uint8_t spi_size; /* SPI Size */ 279 nd_uint16_t type; /* Notify Message Type */ 280 /* SPI */ 281 /* Notification Data */ 282 }; 283 284 /* 3.14.1 Notify Message Types */ 285 /* NOTIFY MESSAGES - ERROR TYPES */ 286 #define ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE 1 287 #define ISAKMP_NTYPE_DOI_NOT_SUPPORTED 2 288 #define ISAKMP_NTYPE_SITUATION_NOT_SUPPORTED 3 289 #define ISAKMP_NTYPE_INVALID_COOKIE 4 290 #define ISAKMP_NTYPE_INVALID_MAJOR_VERSION 5 291 #define ISAKMP_NTYPE_INVALID_MINOR_VERSION 6 292 #define ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE 7 293 #define ISAKMP_NTYPE_INVALID_FLAGS 8 294 #define ISAKMP_NTYPE_INVALID_MESSAGE_ID 9 295 #define ISAKMP_NTYPE_INVALID_PROTOCOL_ID 10 296 #define ISAKMP_NTYPE_INVALID_SPI 11 297 #define ISAKMP_NTYPE_INVALID_TRANSFORM_ID 12 298 #define ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED 13 299 #define ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN 14 300 #define ISAKMP_NTYPE_BAD_PROPOSAL_SYNTAX 15 301 #define ISAKMP_NTYPE_PAYLOAD_MALFORMED 16 302 #define ISAKMP_NTYPE_INVALID_KEY_INFORMATION 17 303 #define ISAKMP_NTYPE_INVALID_ID_INFORMATION 18 304 #define ISAKMP_NTYPE_INVALID_CERT_ENCODING 19 305 #define ISAKMP_NTYPE_INVALID_CERTIFICATE 20 306 #define ISAKMP_NTYPE_BAD_CERT_REQUEST_SYNTAX 21 307 #define ISAKMP_NTYPE_INVALID_CERT_AUTHORITY 22 308 #define ISAKMP_NTYPE_INVALID_HASH_INFORMATION 23 309 #define ISAKMP_NTYPE_AUTHENTICATION_FAILED 24 310 #define ISAKMP_NTYPE_INVALID_SIGNATURE 25 311 #define ISAKMP_NTYPE_ADDRESS_NOTIFICATION 26 312 313 /* 3.15 Delete Payload */ 314 struct ikev1_pl_d { 315 struct isakmp_gen h; 316 nd_uint32_t doi; /* Domain of Interpretation */ 317 nd_uint8_t prot_id; /* Protocol-Id */ 318 nd_uint8_t spi_size; /* SPI Size */ 319 nd_uint16_t num_spi; /* # of SPIs */ 320 /* SPI(es) */ 321 }; 322 323 /* IKEv2 (RFC4306) */ 324 325 /* 3.3 Security Association Payload -- generic header */ 326 /* 3.3.1. Proposal Substructure */ 327 struct ikev2_p { 328 struct isakmp_gen h; 329 nd_uint8_t p_no; /* Proposal # */ 330 nd_uint8_t prot_id; /* Protocol */ 331 nd_uint8_t spi_size; /* SPI Size */ 332 nd_uint8_t num_t; /* Number of Transforms */ 333 }; 334 335 /* 3.3.2. Transform Substructure */ 336 struct ikev2_t { 337 struct isakmp_gen h; 338 nd_uint8_t t_type; /* Transform Type (ENCR,PRF,INTEG,etc.*/ 339 nd_byte res2; /* reserved byte */ 340 nd_uint16_t t_id; /* Transform ID */ 341 }; 342 343 enum ikev2_t_type { 344 IV2_T_ENCR = 1, 345 IV2_T_PRF = 2, 346 IV2_T_INTEG= 3, 347 IV2_T_DH = 4, 348 IV2_T_ESN = 5 349 }; 350 351 /* 3.4. Key Exchange Payload */ 352 struct ikev2_ke { 353 struct isakmp_gen h; 354 nd_uint16_t ke_group; 355 nd_uint16_t ke_res1; 356 /* KE data */ 357 }; 358 359 360 /* 3.5. Identification Payloads */ 361 enum ikev2_id_type { 362 ID_IPV4_ADDR=1, 363 ID_FQDN=2, 364 ID_RFC822_ADDR=3, 365 ID_IPV6_ADDR=5, 366 ID_DER_ASN1_DN=9, 367 ID_DER_ASN1_GN=10, 368 ID_KEY_ID=11 369 }; 370 struct ikev2_id { 371 struct isakmp_gen h; 372 nd_uint8_t type; /* ID type */ 373 nd_byte res1; 374 nd_byte res2[2]; 375 /* SPI */ 376 /* Notification Data */ 377 }; 378 379 /* 3.10 Notification Payload */ 380 struct ikev2_n { 381 struct isakmp_gen h; 382 nd_uint8_t prot_id; /* Protocol-ID */ 383 nd_uint8_t spi_size; /* SPI Size */ 384 nd_uint16_t type; /* Notify Message Type */ 385 }; 386 387 enum ikev2_n_type { 388 IV2_NOTIFY_UNSUPPORTED_CRITICAL_PAYLOAD = 1, 389 IV2_NOTIFY_INVALID_IKE_SPI = 4, 390 IV2_NOTIFY_INVALID_MAJOR_VERSION = 5, 391 IV2_NOTIFY_INVALID_SYNTAX = 7, 392 IV2_NOTIFY_INVALID_MESSAGE_ID = 9, 393 IV2_NOTIFY_INVALID_SPI =11, 394 IV2_NOTIFY_NO_PROPOSAL_CHOSEN =14, 395 IV2_NOTIFY_INVALID_KE_PAYLOAD =17, 396 IV2_NOTIFY_AUTHENTICATION_FAILED =24, 397 IV2_NOTIFY_SINGLE_PAIR_REQUIRED =34, 398 IV2_NOTIFY_NO_ADDITIONAL_SAS =35, 399 IV2_NOTIFY_INTERNAL_ADDRESS_FAILURE =36, 400 IV2_NOTIFY_FAILED_CP_REQUIRED =37, 401 IV2_NOTIFY_INVALID_SELECTORS =39, 402 IV2_NOTIFY_INITIAL_CONTACT =16384, 403 IV2_NOTIFY_SET_WINDOW_SIZE =16385, 404 IV2_NOTIFY_ADDITIONAL_TS_POSSIBLE =16386, 405 IV2_NOTIFY_IPCOMP_SUPPORTED =16387, 406 IV2_NOTIFY_NAT_DETECTION_SOURCE_IP =16388, 407 IV2_NOTIFY_NAT_DETECTION_DESTINATION_IP =16389, 408 IV2_NOTIFY_COOKIE =16390, 409 IV2_NOTIFY_USE_TRANSPORT_MODE =16391, 410 IV2_NOTIFY_HTTP_CERT_LOOKUP_SUPPORTED =16392, 411 IV2_NOTIFY_REKEY_SA =16393, 412 IV2_NOTIFY_ESP_TFC_PADDING_NOT_SUPPORTED =16394, 413 IV2_NOTIFY_NON_FIRST_FRAGMENTS_ALSO =16395 414 }; 415 416 struct notify_messages { 417 uint16_t type; 418 char *msg; 419 }; 420 421 /* 3.8 Authentication Payload */ 422 struct ikev2_auth { 423 struct isakmp_gen h; 424 nd_uint8_t auth_method; /* Protocol-ID */ 425 nd_byte reserved[3]; 426 /* authentication data */ 427 }; 428 429 enum ikev2_auth_type { 430 IV2_RSA_SIG = 1, 431 IV2_SHARED = 2, 432 IV2_DSS_SIG = 3 433 }; 434 435 /* refer to RFC 2409 */ 436 437 #if 0 438 /* isakmp sa structure */ 439 struct oakley_sa { 440 uint8_t proto_id; /* OAKLEY */ 441 vchar_t *spi; /* spi */ 442 uint8_t dhgrp; /* DH; group */ 443 uint8_t auth_t; /* method of authentication */ 444 uint8_t prf_t; /* type of prf */ 445 uint8_t hash_t; /* type of hash */ 446 uint8_t enc_t; /* type of cipher */ 447 uint8_t life_t; /* type of duration of lifetime */ 448 uint32_t ldur; /* life duration */ 449 }; 450 #endif 451 452 /* refer to RFC 2407 */ 453 454 #define IPSEC_DOI 1 455 456 /* 4.2 IPSEC Situation Definition */ 457 #define IPSECDOI_SIT_IDENTITY_ONLY 0x00000001 458 #define IPSECDOI_SIT_SECRECY 0x00000002 459 #define IPSECDOI_SIT_INTEGRITY 0x00000004 460 461 /* 4.4.1 IPSEC Security Protocol Identifiers */ 462 /* 4.4.2 IPSEC ISAKMP Transform Values */ 463 #define IPSECDOI_PROTO_ISAKMP 1 464 #define IPSECDOI_KEY_IKE 1 465 466 /* 4.4.1 IPSEC Security Protocol Identifiers */ 467 #define IPSECDOI_PROTO_IPSEC_AH 2 468 /* 4.4.3 IPSEC AH Transform Values */ 469 #define IPSECDOI_AH_MD5 2 470 #define IPSECDOI_AH_SHA 3 471 #define IPSECDOI_AH_DES 4 472 #define IPSECDOI_AH_SHA2_256 5 473 #define IPSECDOI_AH_SHA2_384 6 474 #define IPSECDOI_AH_SHA2_512 7 475 476 /* 4.4.1 IPSEC Security Protocol Identifiers */ 477 #define IPSECDOI_PROTO_IPSEC_ESP 3 478 /* 4.4.4 IPSEC ESP Transform Identifiers */ 479 #define IPSECDOI_ESP_DES_IV64 1 480 #define IPSECDOI_ESP_DES 2 481 #define IPSECDOI_ESP_3DES 3 482 #define IPSECDOI_ESP_RC5 4 483 #define IPSECDOI_ESP_IDEA 5 484 #define IPSECDOI_ESP_CAST 6 485 #define IPSECDOI_ESP_BLOWFISH 7 486 #define IPSECDOI_ESP_3IDEA 8 487 #define IPSECDOI_ESP_DES_IV32 9 488 #define IPSECDOI_ESP_RC4 10 489 #define IPSECDOI_ESP_NULL 11 490 #define IPSECDOI_ESP_RIJNDAEL 12 491 #define IPSECDOI_ESP_AES 12 492 493 /* 4.4.1 IPSEC Security Protocol Identifiers */ 494 #define IPSECDOI_PROTO_IPCOMP 4 495 /* 4.4.5 IPSEC IPCOMP Transform Identifiers */ 496 #define IPSECDOI_IPCOMP_OUI 1 497 #define IPSECDOI_IPCOMP_DEFLATE 2 498 #define IPSECDOI_IPCOMP_LZS 3 499 500 /* 4.5 IPSEC Security Association Attributes */ 501 #define IPSECDOI_ATTR_SA_LTYPE 1 /* B */ 502 #define IPSECDOI_ATTR_SA_LTYPE_DEFAULT 1 503 #define IPSECDOI_ATTR_SA_LTYPE_SEC 1 504 #define IPSECDOI_ATTR_SA_LTYPE_KB 2 505 #define IPSECDOI_ATTR_SA_LDUR 2 /* V */ 506 #define IPSECDOI_ATTR_SA_LDUR_DEFAULT 28800 /* 8 hours */ 507 #define IPSECDOI_ATTR_GRP_DESC 3 /* B */ 508 #define IPSECDOI_ATTR_ENC_MODE 4 /* B */ 509 /* default value: host dependent */ 510 #define IPSECDOI_ATTR_ENC_MODE_TUNNEL 1 511 #define IPSECDOI_ATTR_ENC_MODE_TRNS 2 512 #define IPSECDOI_ATTR_AUTH 5 /* B */ 513 /* 0 means not to use authentication. */ 514 #define IPSECDOI_ATTR_AUTH_HMAC_MD5 1 515 #define IPSECDOI_ATTR_AUTH_HMAC_SHA1 2 516 #define IPSECDOI_ATTR_AUTH_DES_MAC 3 517 #define IPSECDOI_ATTR_AUTH_KPDK 4 /*RFC-1826(Key/Pad/Data/Key)*/ 518 /* 519 * When negotiating ESP without authentication, the Auth 520 * Algorithm attribute MUST NOT be included in the proposal. 521 * When negotiating ESP without confidentiality, the Auth 522 * Algorithm attribute MUST be included in the proposal and 523 * the ESP transform ID must be ESP_NULL. 524 */ 525 #define IPSECDOI_ATTR_KEY_LENGTH 6 /* B */ 526 #define IPSECDOI_ATTR_KEY_ROUNDS 7 /* B */ 527 #define IPSECDOI_ATTR_COMP_DICT_SIZE 8 /* B */ 528 #define IPSECDOI_ATTR_COMP_PRIVALG 9 /* V */ 529 530 /* 4.6.1 Security Association Payload */ 531 struct ipsecdoi_sa { 532 struct isakmp_gen h; 533 nd_uint32_t doi; /* Domain of Interpretation */ 534 nd_uint32_t sit; /* Situation */ 535 }; 536 537 struct ipsecdoi_secrecy_h { 538 nd_uint16_t len; 539 nd_uint16_t reserved; 540 }; 541 542 /* 4.6.2.1 Identification Type Values */ 543 struct ipsecdoi_id { 544 struct isakmp_gen h; 545 nd_uint8_t type; /* ID Type */ 546 nd_uint8_t proto_id; /* Protocol ID */ 547 nd_uint16_t port; /* Port */ 548 /* Identification Data */ 549 }; 550 551 #define IPSECDOI_ID_IPV4_ADDR 1 552 #define IPSECDOI_ID_FQDN 2 553 #define IPSECDOI_ID_USER_FQDN 3 554 #define IPSECDOI_ID_IPV4_ADDR_SUBNET 4 555 #define IPSECDOI_ID_IPV6_ADDR 5 556 #define IPSECDOI_ID_IPV6_ADDR_SUBNET 6 557 #define IPSECDOI_ID_IPV4_ADDR_RANGE 7 558 #define IPSECDOI_ID_IPV6_ADDR_RANGE 8 559 #define IPSECDOI_ID_DER_ASN1_DN 9 560 #define IPSECDOI_ID_DER_ASN1_GN 10 561 #define IPSECDOI_ID_KEY_ID 11 562 563 /* 4.6.3 IPSEC DOI Notify Message Types */ 564 /* Notify Messages - Status Types */ 565 #define IPSECDOI_NTYPE_RESPONDER_LIFETIME 24576 566 #define IPSECDOI_NTYPE_REPLAY_STATUS 24577 567 #define IPSECDOI_NTYPE_INITIAL_CONTACT 24578 568 569 #define DECLARE_PRINTER(func) static const u_char *ike##func##_print( \ 570 netdissect_options *ndo, u_char tpay, \ 571 const struct isakmp_gen *ext, \ 572 u_int item_len, \ 573 const u_char *end_pointer, \ 574 uint32_t phase,\ 575 uint32_t doi0, \ 576 uint32_t proto0, int depth) 577 578 DECLARE_PRINTER(v1_sa); 579 DECLARE_PRINTER(v1_p); 580 DECLARE_PRINTER(v1_t); 581 DECLARE_PRINTER(v1_ke); 582 DECLARE_PRINTER(v1_id); 583 DECLARE_PRINTER(v1_cert); 584 DECLARE_PRINTER(v1_cr); 585 DECLARE_PRINTER(v1_sig); 586 DECLARE_PRINTER(v1_hash); 587 DECLARE_PRINTER(v1_nonce); 588 DECLARE_PRINTER(v1_n); 589 DECLARE_PRINTER(v1_d); 590 DECLARE_PRINTER(v1_vid); 591 592 DECLARE_PRINTER(v2_sa); 593 DECLARE_PRINTER(v2_ke); 594 DECLARE_PRINTER(v2_ID); 595 DECLARE_PRINTER(v2_cert); 596 DECLARE_PRINTER(v2_cr); 597 DECLARE_PRINTER(v2_auth); 598 DECLARE_PRINTER(v2_nonce); 599 DECLARE_PRINTER(v2_n); 600 DECLARE_PRINTER(v2_d); 601 DECLARE_PRINTER(v2_vid); 602 DECLARE_PRINTER(v2_TS); 603 DECLARE_PRINTER(v2_cp); 604 DECLARE_PRINTER(v2_eap); 605 606 static const u_char *ikev2_e_print(netdissect_options *ndo, 607 const struct isakmp *base, 608 u_char tpay, 609 const struct isakmp_gen *ext, 610 u_int item_len, 611 const u_char *end_pointer, 612 uint32_t phase, 613 uint32_t doi0, 614 uint32_t proto0, int depth); 615 616 617 static const u_char *ike_sub0_print(netdissect_options *ndo,u_char, const struct isakmp_gen *, 618 const u_char *, uint32_t, uint32_t, uint32_t, int); 619 static const u_char *ikev1_sub_print(netdissect_options *ndo,u_char, const struct isakmp_gen *, 620 const u_char *, uint32_t, uint32_t, uint32_t, int); 621 622 static const u_char *ikev2_sub_print(netdissect_options *ndo, 623 const struct isakmp *base, 624 u_char np, const struct isakmp_gen *ext, 625 const u_char *ep, uint32_t phase, 626 uint32_t doi, uint32_t proto, 627 int depth); 628 629 630 static char *numstr(u_int); 631 632 static void 633 ikev1_print(netdissect_options *ndo, 634 const u_char *bp, u_int length, 635 const u_char *bp2, const struct isakmp *base); 636 637 #define MAXINITIATORS 20 638 static int ninitiator = 0; 639 union inaddr_u { 640 nd_ipv4 in4; 641 nd_ipv6 in6; 642 }; 643 static struct { 644 cookie_t initiator; 645 u_int version; 646 union inaddr_u iaddr; 647 union inaddr_u raddr; 648 } cookiecache[MAXINITIATORS]; 649 650 /* protocol id */ 651 static const char *protoidstr[] = { 652 NULL, "isakmp", "ipsec-ah", "ipsec-esp", "ipcomp", 653 }; 654 655 /* isakmp->np */ 656 static const char *npstr[] = { 657 "none", "sa", "p", "t", "ke", "id", "cert", "cr", "hash", /* 0 - 8 */ 658 "sig", "nonce", "n", "d", "vid", /* 9 - 13 */ 659 "pay14", "pay15", "pay16", "pay17", "pay18", /* 14- 18 */ 660 "pay19", "pay20", "pay21", "pay22", "pay23", /* 19- 23 */ 661 "pay24", "pay25", "pay26", "pay27", "pay28", /* 24- 28 */ 662 "pay29", "pay30", "pay31", "pay32", /* 29- 32 */ 663 "v2sa", "v2ke", "v2IDi", "v2IDr", "v2cert",/* 33- 37 */ 664 "v2cr", "v2auth","v2nonce", "v2n", "v2d", /* 38- 42 */ 665 "v2vid", "v2TSi", "v2TSr", "v2e", "v2cp", /* 43- 47 */ 666 "v2eap", /* 48 */ 667 668 }; 669 670 /* isakmp->np */ 671 static const u_char *(*npfunc[])(netdissect_options *ndo, u_char tpay, 672 const struct isakmp_gen *ext, 673 u_int item_len, 674 const u_char *end_pointer, 675 uint32_t phase, 676 uint32_t doi0, 677 uint32_t proto0, int depth) = { 678 NULL, 679 ikev1_sa_print, 680 ikev1_p_print, 681 ikev1_t_print, 682 ikev1_ke_print, 683 ikev1_id_print, 684 ikev1_cert_print, 685 ikev1_cr_print, 686 ikev1_hash_print, 687 ikev1_sig_print, 688 ikev1_nonce_print, 689 ikev1_n_print, 690 ikev1_d_print, 691 ikev1_vid_print, /* 13 */ 692 NULL, NULL, NULL, NULL, NULL, /* 14- 18 */ 693 NULL, NULL, NULL, NULL, NULL, /* 19- 23 */ 694 NULL, NULL, NULL, NULL, NULL, /* 24- 28 */ 695 NULL, NULL, NULL, NULL, /* 29- 32 */ 696 ikev2_sa_print, /* 33 */ 697 ikev2_ke_print, /* 34 */ 698 ikev2_ID_print, /* 35 */ 699 ikev2_ID_print, /* 36 */ 700 ikev2_cert_print, /* 37 */ 701 ikev2_cr_print, /* 38 */ 702 ikev2_auth_print, /* 39 */ 703 ikev2_nonce_print, /* 40 */ 704 ikev2_n_print, /* 41 */ 705 ikev2_d_print, /* 42 */ 706 ikev2_vid_print, /* 43 */ 707 ikev2_TS_print, /* 44 */ 708 ikev2_TS_print, /* 45 */ 709 NULL, /* ikev2_e_print,*/ /* 46 - special */ 710 ikev2_cp_print, /* 47 */ 711 ikev2_eap_print, /* 48 */ 712 }; 713 714 /* isakmp->etype */ 715 static const char *etypestr[] = { 716 /* IKEv1 exchange types */ 717 "none", "base", "ident", "auth", "agg", "inf", NULL, NULL, /* 0-7 */ 718 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, /* 8-15 */ 719 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, /* 16-23 */ 720 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, /* 24-31 */ 721 "oakley-quick", "oakley-newgroup", /* 32-33 */ 722 /* IKEv2 exchange types */ 723 "ikev2_init", "ikev2_auth", "child_sa", "inf2" /* 34-37 */ 724 }; 725 726 #define STR_OR_ID(x, tab) \ 727 (((x) < sizeof(tab)/sizeof(tab[0]) && tab[(x)]) ? tab[(x)] : numstr(x)) 728 #define PROTOIDSTR(x) STR_OR_ID(x, protoidstr) 729 #define NPSTR(x) STR_OR_ID(x, npstr) 730 #define ETYPESTR(x) STR_OR_ID(x, etypestr) 731 732 #define CHECKLEN(p, np) \ 733 if (ep < (const u_char *)(p)) { \ 734 ND_PRINT(" [|%s]", NPSTR(np)); \ 735 goto done; \ 736 } 737 738 739 #define NPFUNC(x) \ 740 (((x) < sizeof(npfunc)/sizeof(npfunc[0]) && npfunc[(x)]) \ 741 ? npfunc[(x)] : NULL) 742 743 static int 744 iszero(netdissect_options *ndo, const u_char *p, size_t l) 745 { 746 while (l != 0) { 747 if (GET_U_1(p)) 748 return 0; 749 p++; 750 l--; 751 } 752 return 1; 753 } 754 755 /* find cookie from initiator cache */ 756 static int 757 cookie_find(const cookie_t *in) 758 { 759 int i; 760 761 for (i = 0; i < MAXINITIATORS; i++) { 762 if (memcmp(in, &cookiecache[i].initiator, sizeof(*in)) == 0) 763 return i; 764 } 765 766 return -1; 767 } 768 769 /* record initiator */ 770 static void 771 cookie_record(netdissect_options *ndo, const cookie_t *in, const u_char *bp2) 772 { 773 int i; 774 const struct ip *ip; 775 const struct ip6_hdr *ip6; 776 777 i = cookie_find(in); 778 if (0 <= i) { 779 ninitiator = (i + 1) % MAXINITIATORS; 780 return; 781 } 782 783 ip = (const struct ip *)bp2; 784 switch (IP_V(ip)) { 785 case 4: 786 cookiecache[ninitiator].version = 4; 787 UNALIGNED_MEMCPY(&cookiecache[ninitiator].iaddr.in4, 788 ip->ip_src, sizeof(nd_ipv4)); 789 UNALIGNED_MEMCPY(&cookiecache[ninitiator].raddr.in4, 790 ip->ip_dst, sizeof(nd_ipv4)); 791 break; 792 case 6: 793 ip6 = (const struct ip6_hdr *)bp2; 794 cookiecache[ninitiator].version = 6; 795 UNALIGNED_MEMCPY(&cookiecache[ninitiator].iaddr.in6, 796 ip6->ip6_src, sizeof(nd_ipv6)); 797 UNALIGNED_MEMCPY(&cookiecache[ninitiator].raddr.in6, 798 ip6->ip6_dst, sizeof(nd_ipv6)); 799 break; 800 default: 801 return; 802 } 803 UNALIGNED_MEMCPY(&cookiecache[ninitiator].initiator, in, sizeof(*in)); 804 ninitiator = (ninitiator + 1) % MAXINITIATORS; 805 } 806 807 #define cookie_isinitiator(ndo, x, y) cookie_sidecheck(ndo, (x), (y), 1) 808 #define cookie_isresponder(ndo, x, y) cookie_sidecheck(ndo, (x), (y), 0) 809 static int 810 cookie_sidecheck(netdissect_options *ndo, int i, const u_char *bp2, int initiator) 811 { 812 const struct ip *ip; 813 const struct ip6_hdr *ip6; 814 815 ip = (const struct ip *)bp2; 816 switch (IP_V(ip)) { 817 case 4: 818 if (cookiecache[i].version != 4) 819 return 0; 820 if (initiator) { 821 if (UNALIGNED_MEMCMP(ip->ip_src, &cookiecache[i].iaddr.in4, sizeof(nd_ipv4)) == 0) 822 return 1; 823 } else { 824 if (UNALIGNED_MEMCMP(ip->ip_src, &cookiecache[i].raddr.in4, sizeof(nd_ipv4)) == 0) 825 return 1; 826 } 827 break; 828 case 6: 829 if (cookiecache[i].version != 6) 830 return 0; 831 ip6 = (const struct ip6_hdr *)bp2; 832 if (initiator) { 833 if (UNALIGNED_MEMCMP(ip6->ip6_src, &cookiecache[i].iaddr.in6, sizeof(nd_ipv6)) == 0) 834 return 1; 835 } else { 836 if (UNALIGNED_MEMCMP(ip6->ip6_src, &cookiecache[i].raddr.in6, sizeof(nd_ipv6)) == 0) 837 return 1; 838 } 839 break; 840 default: 841 break; 842 } 843 844 return 0; 845 } 846 847 static void 848 hexprint(netdissect_options *ndo, const uint8_t *loc, size_t len) 849 { 850 const uint8_t *p; 851 size_t i; 852 853 p = loc; 854 for (i = 0; i < len; i++) 855 ND_PRINT("%02x", p[i] & 0xff); 856 } 857 858 static int 859 rawprint(netdissect_options *ndo, const uint8_t *loc, size_t len) 860 { 861 ND_TCHECK_LEN(loc, len); 862 863 hexprint(ndo, loc, len); 864 return 1; 865 trunc: 866 return 0; 867 } 868 869 870 /* 871 * returns false if we run out of data buffer 872 */ 873 static int ike_show_somedata(netdissect_options *ndo, 874 const u_char *cp, const u_char *ep) 875 { 876 /* there is too much data, just show some of it */ 877 const u_char *end = ep - 20; 878 size_t elen = 20; 879 size_t len = ep - cp; 880 if(len > 10) { 881 len = 10; 882 } 883 884 /* really shouldn't happen because of above */ 885 if(end < cp + len) { 886 end = cp+len; 887 elen = ep - end; 888 } 889 890 ND_PRINT(" data=("); 891 if(!rawprint(ndo, (const uint8_t *)(cp), len)) goto trunc; 892 ND_PRINT("..."); 893 if(elen) { 894 if(!rawprint(ndo, (const uint8_t *)(end), elen)) goto trunc; 895 } 896 ND_PRINT(")"); 897 return 1; 898 899 trunc: 900 return 0; 901 } 902 903 struct attrmap { 904 const char *type; 905 u_int nvalue; 906 const char *value[30]; /*XXX*/ 907 }; 908 909 static const u_char * 910 ikev1_attrmap_print(netdissect_options *ndo, 911 const u_char *p, const u_char *ep2, 912 const struct attrmap *map, size_t nmap) 913 { 914 u_int totlen; 915 uint32_t t, v; 916 917 if (GET_U_1(p) & 0x80) 918 totlen = 4; 919 else { 920 totlen = 4 + GET_BE_U_2(p + 2); 921 } 922 if (ep2 < p + totlen) { 923 ND_PRINT("[|attr]"); 924 return ep2 + 1; 925 } 926 927 ND_PRINT("("); 928 t = GET_BE_U_2(p) & 0x7fff; 929 if (map && t < nmap && map[t].type) 930 ND_PRINT("type=%s ", map[t].type); 931 else 932 ND_PRINT("type=#%u ", t); 933 if (GET_U_1(p) & 0x80) { 934 ND_PRINT("value="); 935 v = GET_BE_U_2(p + 2); 936 if (map && t < nmap && v < map[t].nvalue && map[t].value[v]) 937 ND_PRINT("%s", map[t].value[v]); 938 else { 939 if (!rawprint(ndo, (const uint8_t *)(p + 2), 2)) { 940 ND_PRINT(")"); 941 goto trunc; 942 } 943 } 944 } else { 945 ND_PRINT("len=%u value=", totlen - 4); 946 if (!rawprint(ndo, (const uint8_t *)(p + 4), totlen - 4)) { 947 ND_PRINT(")"); 948 goto trunc; 949 } 950 } 951 ND_PRINT(")"); 952 return p + totlen; 953 954 trunc: 955 return NULL; 956 } 957 958 static const u_char * 959 ikev1_attr_print(netdissect_options *ndo, const u_char *p, const u_char *ep2) 960 { 961 u_int totlen; 962 uint32_t t; 963 964 if (GET_U_1(p) & 0x80) 965 totlen = 4; 966 else { 967 totlen = 4 + GET_BE_U_2(p + 2); 968 } 969 if (ep2 < p + totlen) { 970 ND_PRINT("[|attr]"); 971 return ep2 + 1; 972 } 973 974 ND_PRINT("("); 975 t = GET_BE_U_2(p) & 0x7fff; 976 ND_PRINT("type=#%u ", t); 977 if (GET_U_1(p) & 0x80) { 978 ND_PRINT("value="); 979 t = GET_U_1(p + 2); 980 if (!rawprint(ndo, (const uint8_t *)(p + 2), 2)) { 981 ND_PRINT(")"); 982 goto trunc; 983 } 984 } else { 985 ND_PRINT("len=%u value=", totlen - 4); 986 if (!rawprint(ndo, (const uint8_t *)(p + 4), totlen - 4)) { 987 ND_PRINT(")"); 988 goto trunc; 989 } 990 } 991 ND_PRINT(")"); 992 return p + totlen; 993 994 trunc: 995 return NULL; 996 } 997 998 static const u_char * 999 ikev1_sa_print(netdissect_options *ndo, u_char tpay _U_, 1000 const struct isakmp_gen *ext, 1001 u_int item_len _U_, 1002 const u_char *ep, uint32_t phase, uint32_t doi0 _U_, 1003 uint32_t proto0, int depth) 1004 { 1005 const struct ikev1_pl_sa *p; 1006 uint32_t doi, sit, ident; 1007 const u_char *cp, *np; 1008 int t; 1009 1010 ND_PRINT("%s:", NPSTR(ISAKMP_NPTYPE_SA)); 1011 1012 p = (const struct ikev1_pl_sa *)ext; 1013 ND_TCHECK_SIZE(p); 1014 doi = GET_BE_U_4(p->doi); 1015 sit = GET_BE_U_4(p->sit); 1016 if (doi != 1) { 1017 ND_PRINT(" doi=%u", doi); 1018 ND_PRINT(" situation=%u", sit); 1019 return (const u_char *)(p + 1); 1020 } 1021 1022 ND_PRINT(" doi=ipsec"); 1023 ND_PRINT(" situation="); 1024 t = 0; 1025 if (sit & 0x01) { 1026 ND_PRINT("identity"); 1027 t++; 1028 } 1029 if (sit & 0x02) { 1030 ND_PRINT("%ssecrecy", t ? "+" : ""); 1031 t++; 1032 } 1033 if (sit & 0x04) 1034 ND_PRINT("%sintegrity", t ? "+" : ""); 1035 1036 np = (const u_char *)ext + sizeof(struct ikev1_pl_sa); 1037 if (sit != 0x01) { 1038 ident = GET_BE_U_4(ext + 1); 1039 ND_PRINT(" ident=%u", ident); 1040 np += sizeof(ident); 1041 } 1042 1043 ext = (const struct isakmp_gen *)np; 1044 ND_TCHECK_SIZE(ext); 1045 1046 cp = ikev1_sub_print(ndo, ISAKMP_NPTYPE_P, ext, ep, phase, doi, proto0, 1047 depth); 1048 1049 return cp; 1050 trunc: 1051 ND_PRINT(" [|%s]", NPSTR(ISAKMP_NPTYPE_SA)); 1052 return NULL; 1053 } 1054 1055 static const u_char * 1056 ikev1_p_print(netdissect_options *ndo, u_char tpay _U_, 1057 const struct isakmp_gen *ext, u_int item_len _U_, 1058 const u_char *ep, uint32_t phase, uint32_t doi0, 1059 uint32_t proto0 _U_, int depth) 1060 { 1061 const struct ikev1_pl_p *p; 1062 const u_char *cp; 1063 uint8_t spi_size; 1064 1065 ND_PRINT("%s:", NPSTR(ISAKMP_NPTYPE_P)); 1066 1067 p = (const struct ikev1_pl_p *)ext; 1068 ND_TCHECK_SIZE(p); 1069 ND_PRINT(" #%u protoid=%s transform=%u", 1070 GET_U_1(p->p_no), PROTOIDSTR(GET_U_1(p->prot_id)), 1071 GET_U_1(p->num_t)); 1072 spi_size = GET_U_1(p->spi_size); 1073 if (spi_size) { 1074 ND_PRINT(" spi="); 1075 if (!rawprint(ndo, (const uint8_t *)(p + 1), spi_size)) 1076 goto trunc; 1077 } 1078 1079 ext = (const struct isakmp_gen *)((const u_char *)(p + 1) + spi_size); 1080 ND_TCHECK_SIZE(ext); 1081 1082 cp = ikev1_sub_print(ndo, ISAKMP_NPTYPE_T, ext, ep, phase, doi0, 1083 GET_U_1(p->prot_id), depth); 1084 1085 return cp; 1086 trunc: 1087 ND_PRINT(" [|%s]", NPSTR(ISAKMP_NPTYPE_P)); 1088 return NULL; 1089 } 1090 1091 static const char *ikev1_p_map[] = { 1092 NULL, "ike", 1093 }; 1094 1095 static const char *ikev2_t_type_map[]={ 1096 NULL, "encr", "prf", "integ", "dh", "esn" 1097 }; 1098 1099 static const char *ah_p_map[] = { 1100 NULL, "(reserved)", "md5", "sha", "1des", 1101 "sha2-256", "sha2-384", "sha2-512", 1102 }; 1103 1104 static const char *prf_p_map[] = { 1105 NULL, "hmac-md5", "hmac-sha", "hmac-tiger", 1106 "aes128_xcbc" 1107 }; 1108 1109 static const char *integ_p_map[] = { 1110 NULL, "hmac-md5", "hmac-sha", "dec-mac", 1111 "kpdk-md5", "aes-xcbc" 1112 }; 1113 1114 static const char *esn_p_map[] = { 1115 "no-esn", "esn" 1116 }; 1117 1118 static const char *dh_p_map[] = { 1119 NULL, "modp768", 1120 "modp1024", /* group 2 */ 1121 "EC2N 2^155", /* group 3 */ 1122 "EC2N 2^185", /* group 4 */ 1123 "modp1536", /* group 5 */ 1124 "iana-grp06", "iana-grp07", /* reserved */ 1125 "iana-grp08", "iana-grp09", 1126 "iana-grp10", "iana-grp11", 1127 "iana-grp12", "iana-grp13", 1128 "modp2048", /* group 14 */ 1129 "modp3072", /* group 15 */ 1130 "modp4096", /* group 16 */ 1131 "modp6144", /* group 17 */ 1132 "modp8192", /* group 18 */ 1133 }; 1134 1135 static const char *esp_p_map[] = { 1136 NULL, "1des-iv64", "1des", "3des", "rc5", "idea", "cast", 1137 "blowfish", "3idea", "1des-iv32", "rc4", "null", "aes" 1138 }; 1139 1140 static const char *ipcomp_p_map[] = { 1141 NULL, "oui", "deflate", "lzs", 1142 }; 1143 1144 static const struct attrmap ipsec_t_map[] = { 1145 { NULL, 0, { NULL } }, 1146 { "lifetype", 3, { NULL, "sec", "kb", }, }, 1147 { "life", 0, { NULL } }, 1148 { "group desc", 18, { NULL, "modp768", 1149 "modp1024", /* group 2 */ 1150 "EC2N 2^155", /* group 3 */ 1151 "EC2N 2^185", /* group 4 */ 1152 "modp1536", /* group 5 */ 1153 "iana-grp06", "iana-grp07", /* reserved */ 1154 "iana-grp08", "iana-grp09", 1155 "iana-grp10", "iana-grp11", 1156 "iana-grp12", "iana-grp13", 1157 "modp2048", /* group 14 */ 1158 "modp3072", /* group 15 */ 1159 "modp4096", /* group 16 */ 1160 "modp6144", /* group 17 */ 1161 "modp8192", /* group 18 */ 1162 }, }, 1163 { "enc mode", 3, { NULL, "tunnel", "transport", }, }, 1164 { "auth", 5, { NULL, "hmac-md5", "hmac-sha1", "1des-mac", "keyed", }, }, 1165 { "keylen", 0, { NULL } }, 1166 { "rounds", 0, { NULL } }, 1167 { "dictsize", 0, { NULL } }, 1168 { "privalg", 0, { NULL } }, 1169 }; 1170 1171 static const struct attrmap encr_t_map[] = { 1172 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 0, 1 */ 1173 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 2, 3 */ 1174 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 4, 5 */ 1175 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 6, 7 */ 1176 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 8, 9 */ 1177 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 10,11*/ 1178 { NULL, 0, { NULL } }, { NULL, 0, { NULL } }, /* 12,13*/ 1179 { "keylen", 14, { NULL }}, 1180 }; 1181 1182 static const struct attrmap oakley_t_map[] = { 1183 { NULL, 0, { NULL } }, 1184 { "enc", 8, { NULL, "1des", "idea", "blowfish", "rc5", 1185 "3des", "cast", "aes", }, }, 1186 { "hash", 7, { NULL, "md5", "sha1", "tiger", 1187 "sha2-256", "sha2-384", "sha2-512", }, }, 1188 { "auth", 6, { NULL, "preshared", "dss", "rsa sig", "rsa enc", 1189 "rsa enc revised", }, }, 1190 { "group desc", 18, { NULL, "modp768", 1191 "modp1024", /* group 2 */ 1192 "EC2N 2^155", /* group 3 */ 1193 "EC2N 2^185", /* group 4 */ 1194 "modp1536", /* group 5 */ 1195 "iana-grp06", "iana-grp07", /* reserved */ 1196 "iana-grp08", "iana-grp09", 1197 "iana-grp10", "iana-grp11", 1198 "iana-grp12", "iana-grp13", 1199 "modp2048", /* group 14 */ 1200 "modp3072", /* group 15 */ 1201 "modp4096", /* group 16 */ 1202 "modp6144", /* group 17 */ 1203 "modp8192", /* group 18 */ 1204 }, }, 1205 { "group type", 4, { NULL, "MODP", "ECP", "EC2N", }, }, 1206 { "group prime", 0, { NULL } }, 1207 { "group gen1", 0, { NULL } }, 1208 { "group gen2", 0, { NULL } }, 1209 { "group curve A", 0, { NULL } }, 1210 { "group curve B", 0, { NULL } }, 1211 { "lifetype", 3, { NULL, "sec", "kb", }, }, 1212 { "lifeduration", 0, { NULL } }, 1213 { "prf", 0, { NULL } }, 1214 { "keylen", 0, { NULL } }, 1215 { "field", 0, { NULL } }, 1216 { "order", 0, { NULL } }, 1217 }; 1218 1219 static const u_char * 1220 ikev1_t_print(netdissect_options *ndo, u_char tpay _U_, 1221 const struct isakmp_gen *ext, u_int item_len, 1222 const u_char *ep, uint32_t phase _U_, uint32_t doi _U_, 1223 uint32_t proto, int depth _U_) 1224 { 1225 const struct ikev1_pl_t *p; 1226 const u_char *cp; 1227 const char *idstr; 1228 const struct attrmap *map; 1229 size_t nmap; 1230 const u_char *ep2; 1231 1232 ND_PRINT("%s:", NPSTR(ISAKMP_NPTYPE_T)); 1233 1234 p = (const struct ikev1_pl_t *)ext; 1235 ND_TCHECK_SIZE(p); 1236 1237 switch (proto) { 1238 case 1: 1239 idstr = STR_OR_ID(GET_U_1(p->t_id), ikev1_p_map); 1240 map = oakley_t_map; 1241 nmap = sizeof(oakley_t_map)/sizeof(oakley_t_map[0]); 1242 break; 1243 case 2: 1244 idstr = STR_OR_ID(GET_U_1(p->t_id), ah_p_map); 1245 map = ipsec_t_map; 1246 nmap = sizeof(ipsec_t_map)/sizeof(ipsec_t_map[0]); 1247 break; 1248 case 3: 1249 idstr = STR_OR_ID(GET_U_1(p->t_id), esp_p_map); 1250 map = ipsec_t_map; 1251 nmap = sizeof(ipsec_t_map)/sizeof(ipsec_t_map[0]); 1252 break; 1253 case 4: 1254 idstr = STR_OR_ID(GET_U_1(p->t_id), ipcomp_p_map); 1255 map = ipsec_t_map; 1256 nmap = sizeof(ipsec_t_map)/sizeof(ipsec_t_map[0]); 1257 break; 1258 default: 1259 idstr = NULL; 1260 map = NULL; 1261 nmap = 0; 1262 break; 1263 } 1264 1265 if (idstr) 1266 ND_PRINT(" #%u id=%s ", GET_U_1(p->t_no), idstr); 1267 else 1268 ND_PRINT(" #%u id=%u ", GET_U_1(p->t_no), GET_U_1(p->t_id)); 1269 cp = (const u_char *)(p + 1); 1270 ep2 = (const u_char *)p + item_len; 1271 while (cp < ep && cp < ep2) { 1272 if (map && nmap) 1273 cp = ikev1_attrmap_print(ndo, cp, ep2, map, nmap); 1274 else 1275 cp = ikev1_attr_print(ndo, cp, ep2); 1276 if (cp == NULL) 1277 goto trunc; 1278 } 1279 if (ep < ep2) 1280 ND_PRINT("..."); 1281 return cp; 1282 trunc: 1283 ND_PRINT(" [|%s]", NPSTR(ISAKMP_NPTYPE_T)); 1284 return NULL; 1285 } 1286 1287 static const u_char * 1288 ikev1_ke_print(netdissect_options *ndo, u_char tpay _U_, 1289 const struct isakmp_gen *ext, u_int item_len, 1290 const u_char *ep _U_, uint32_t phase _U_, uint32_t doi _U_, 1291 uint32_t proto _U_, int depth _U_) 1292 { 1293 ND_PRINT("%s:", NPSTR(ISAKMP_NPTYPE_KE)); 1294 1295 ND_TCHECK_SIZE(ext); 1296 /* 1297 * Our caller has ensured that the length is >= 4. 1298 */ 1299 ND_PRINT(" key len=%u", item_len - 4); 1300 if (2 < ndo->ndo_vflag && item_len > 4) { 1301 /* Print the entire payload in hex */ 1302 ND_PRINT(" "); 1303 if (!rawprint(ndo, (const uint8_t *)(ext + 1), item_len - 4)) 1304 goto trunc; 1305 } 1306 return (const u_char *)ext + item_len; 1307 trunc: 1308 ND_PRINT(" [|%s]", NPSTR(ISAKMP_NPTYPE_KE)); 1309 return NULL; 1310 } 1311 1312 static const u_char * 1313 ikev1_id_print(netdissect_options *ndo, u_char tpay _U_, 1314 const struct isakmp_gen *ext, u_int item_len, 1315 const u_char *ep _U_, uint32_t phase, uint32_t doi _U_, 1316 uint32_t proto _U_, int depth _U_) 1317 { 1318 #define USE_IPSECDOI_IN_PHASE1 1 1319 const struct ikev1_pl_id *p; 1320 static const char *idtypestr[] = { 1321 "IPv4", "IPv4net", "IPv6", "IPv6net", 1322 }; 1323 static const char *ipsecidtypestr[] = { 1324 NULL, "IPv4", "FQDN", "user FQDN", "IPv4net", "IPv6", 1325 "IPv6net", "IPv4range", "IPv6range", "ASN1 DN", "ASN1 GN", 1326 "keyid", 1327 }; 1328 u_int len; 1329 const u_char *data; 1330 1331 ND_PRINT("%s:", NPSTR(ISAKMP_NPTYPE_ID)); 1332 1333 p = (const struct ikev1_pl_id *)ext; 1334 ND_TCHECK_SIZE(p); 1335 if (sizeof(*p) < item_len) { 1336 data = (const u_char *)(p + 1); 1337 len = item_len - sizeof(*p); 1338 } else { 1339 data = NULL; 1340 len = 0; 1341 } 1342 1343 #if 0 /*debug*/ 1344 ND_PRINT(" [phase=%u doi=%u proto=%u]", phase, doi, proto); 1345 #endif 1346 switch (phase) { 1347 #ifndef USE_IPSECDOI_IN_PHASE1 1348 case 1: 1349 #endif 1350 default: 1351 ND_PRINT(" idtype=%s", 1352 STR_OR_ID(GET_U_1(p->d.id_type), idtypestr)); 1353 ND_PRINT(" doi_data=%u", 1354 GET_BE_U_4(p->d.doi_data) & 0xffffff); 1355 break; 1356 1357 #ifdef USE_IPSECDOI_IN_PHASE1 1358 case 1: 1359 #endif 1360 case 2: 1361 { 1362 const struct ipsecdoi_id *doi_p; 1363 const char *p_name; 1364 uint8_t type, proto_id; 1365 1366 doi_p = (const struct ipsecdoi_id *)ext; 1367 ND_TCHECK_SIZE(doi_p); 1368 type = GET_U_1(doi_p->type); 1369 ND_PRINT(" idtype=%s", STR_OR_ID(type, ipsecidtypestr)); 1370 /* A protocol ID of 0 DOES NOT mean IPPROTO_IP! */ 1371 proto_id = GET_U_1(doi_p->proto_id); 1372 if (!ndo->ndo_nflag && proto_id && (p_name = netdb_protoname(proto_id)) != NULL) 1373 ND_PRINT(" protoid=%s", p_name); 1374 else 1375 ND_PRINT(" protoid=%u", proto_id); 1376 ND_PRINT(" port=%u", GET_BE_U_2(doi_p->port)); 1377 if (!len) 1378 break; 1379 if (data == NULL) 1380 goto trunc; 1381 ND_TCHECK_LEN(data, len); 1382 switch (type) { 1383 case IPSECDOI_ID_IPV4_ADDR: 1384 if (len < 4) 1385 ND_PRINT(" len=%u [bad: < 4]", len); 1386 else 1387 ND_PRINT(" len=%u %s", len, GET_IPADDR_STRING(data)); 1388 len = 0; 1389 break; 1390 case IPSECDOI_ID_FQDN: 1391 case IPSECDOI_ID_USER_FQDN: 1392 { 1393 u_int i; 1394 ND_PRINT(" len=%u ", len); 1395 for (i = 0; i < len; i++) 1396 fn_print_char(ndo, GET_U_1(data + i)); 1397 len = 0; 1398 break; 1399 } 1400 case IPSECDOI_ID_IPV4_ADDR_SUBNET: 1401 { 1402 const u_char *mask; 1403 if (len < 8) 1404 ND_PRINT(" len=%u [bad: < 8]", len); 1405 else { 1406 mask = data + sizeof(nd_ipv4); 1407 ND_PRINT(" len=%u %s/%u.%u.%u.%u", len, 1408 GET_IPADDR_STRING(data), 1409 GET_U_1(mask), GET_U_1(mask + 1), 1410 GET_U_1(mask + 2), 1411 GET_U_1(mask + 3)); 1412 } 1413 len = 0; 1414 break; 1415 } 1416 case IPSECDOI_ID_IPV6_ADDR: 1417 if (len < 16) 1418 ND_PRINT(" len=%u [bad: < 16]", len); 1419 else 1420 ND_PRINT(" len=%u %s", len, GET_IP6ADDR_STRING(data)); 1421 len = 0; 1422 break; 1423 case IPSECDOI_ID_IPV6_ADDR_SUBNET: 1424 { 1425 const u_char *mask; 1426 if (len < 32) 1427 ND_PRINT(" len=%u [bad: < 32]", len); 1428 else { 1429 mask = (const u_char *)(data + sizeof(nd_ipv6)); 1430 /*XXX*/ 1431 ND_PRINT(" len=%u %s/0x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x", len, 1432 GET_IP6ADDR_STRING(data), 1433 GET_U_1(mask), GET_U_1(mask + 1), 1434 GET_U_1(mask + 2), 1435 GET_U_1(mask + 3), 1436 GET_U_1(mask + 4), 1437 GET_U_1(mask + 5), 1438 GET_U_1(mask + 6), 1439 GET_U_1(mask + 7), 1440 GET_U_1(mask + 8), 1441 GET_U_1(mask + 9), 1442 GET_U_1(mask + 10), 1443 GET_U_1(mask + 11), 1444 GET_U_1(mask + 12), 1445 GET_U_1(mask + 13), 1446 GET_U_1(mask + 14), 1447 GET_U_1(mask + 15)); 1448 } 1449 len = 0; 1450 break; 1451 } 1452 case IPSECDOI_ID_IPV4_ADDR_RANGE: 1453 if (len < 8) 1454 ND_PRINT(" len=%u [bad: < 8]", len); 1455 else { 1456 ND_PRINT(" len=%u %s-%s", len, 1457 GET_IPADDR_STRING(data), 1458 GET_IPADDR_STRING(data + sizeof(nd_ipv4))); 1459 } 1460 len = 0; 1461 break; 1462 case IPSECDOI_ID_IPV6_ADDR_RANGE: 1463 if (len < 32) 1464 ND_PRINT(" len=%u [bad: < 32]", len); 1465 else { 1466 ND_PRINT(" len=%u %s-%s", len, 1467 GET_IP6ADDR_STRING(data), 1468 GET_IP6ADDR_STRING(data + sizeof(nd_ipv6))); 1469 } 1470 len = 0; 1471 break; 1472 case IPSECDOI_ID_DER_ASN1_DN: 1473 case IPSECDOI_ID_DER_ASN1_GN: 1474 case IPSECDOI_ID_KEY_ID: 1475 break; 1476 } 1477 break; 1478 } 1479 } 1480 if (data && len) { 1481 ND_PRINT(" len=%u", len); 1482 if (2 < ndo->ndo_vflag) { 1483 ND_PRINT(" "); 1484 if (!rawprint(ndo, (const uint8_t *)data, len)) 1485 goto trunc; 1486 } 1487 } 1488 return (const u_char *)ext + item_len; 1489 trunc: 1490 ND_PRINT(" [|%s]", NPSTR(ISAKMP_NPTYPE_ID)); 1491 return NULL; 1492 } 1493 1494 static const u_char * 1495 ikev1_cert_print(netdissect_options *ndo, u_char tpay _U_, 1496 const struct isakmp_gen *ext, u_int item_len, 1497 const u_char *ep _U_, uint32_t phase _U_, 1498 uint32_t doi0 _U_, 1499 uint32_t proto0 _U_, int depth _U_) 1500 { 1501 const struct ikev1_pl_cert *p; 1502 static const char *certstr[] = { 1503 "none", "pkcs7", "pgp", "dns", 1504 "x509sign", "x509ke", "kerberos", "crl", 1505 "arl", "spki", "x509attr", 1506 }; 1507 1508 ND_PRINT("%s:", NPSTR(ISAKMP_NPTYPE_CERT)); 1509 1510 p = (const struct ikev1_pl_cert *)ext; 1511 ND_TCHECK_SIZE(p); 1512 /* 1513 * Our caller has ensured that the length is >= 4. 1514 */ 1515 ND_PRINT(" len=%u", item_len - 4); 1516 ND_PRINT(" type=%s", STR_OR_ID(GET_U_1(p->encode), certstr)); 1517 if (2 < ndo->ndo_vflag && 4 < item_len) { 1518 /* Print the entire payload in hex */ 1519 ND_PRINT(" "); 1520 if (!rawprint(ndo, (const uint8_t *)(ext + 1), item_len - 4)) 1521 goto trunc; 1522 } 1523 return (const u_char *)ext + item_len; 1524 trunc: 1525 ND_PRINT(" [|%s]", NPSTR(ISAKMP_NPTYPE_CERT)); 1526 return NULL; 1527 } 1528 1529 static const u_char * 1530 ikev1_cr_print(netdissect_options *ndo, u_char tpay _U_, 1531 const struct isakmp_gen *ext, u_int item_len, 1532 const u_char *ep _U_, uint32_t phase _U_, uint32_t doi0 _U_, 1533 uint32_t proto0 _U_, int depth _U_) 1534 { 1535 const struct ikev1_pl_cert *p; 1536 static const char *certstr[] = { 1537 "none", "pkcs7", "pgp", "dns", 1538 "x509sign", "x509ke", "kerberos", "crl", 1539 "arl", "spki", "x509attr", 1540 }; 1541 1542 ND_PRINT("%s:", NPSTR(ISAKMP_NPTYPE_CR)); 1543 1544 p = (const struct ikev1_pl_cert *)ext; 1545 ND_TCHECK_SIZE(p); 1546 /* 1547 * Our caller has ensured that the length is >= 4. 1548 */ 1549 ND_PRINT(" len=%u", item_len - 4); 1550 ND_PRINT(" type=%s", STR_OR_ID(GET_U_1(p->encode), certstr)); 1551 if (2 < ndo->ndo_vflag && 4 < item_len) { 1552 /* Print the entire payload in hex */ 1553 ND_PRINT(" "); 1554 if (!rawprint(ndo, (const uint8_t *)(ext + 1), item_len - 4)) 1555 goto trunc; 1556 } 1557 return (const u_char *)ext + item_len; 1558 trunc: 1559 ND_PRINT(" [|%s]", NPSTR(ISAKMP_NPTYPE_CR)); 1560 return NULL; 1561 } 1562 1563 static const u_char * 1564 ikev1_hash_print(netdissect_options *ndo, u_char tpay _U_, 1565 const struct isakmp_gen *ext, u_int item_len, 1566 const u_char *ep _U_, uint32_t phase _U_, uint32_t doi _U_, 1567 uint32_t proto _U_, int depth _U_) 1568 { 1569 ND_PRINT("%s:", NPSTR(ISAKMP_NPTYPE_HASH)); 1570 1571 ND_TCHECK_SIZE(ext); 1572 /* 1573 * Our caller has ensured that the length is >= 4. 1574 */ 1575 ND_PRINT(" len=%u", item_len - 4); 1576 if (2 < ndo->ndo_vflag && 4 < item_len) { 1577 /* Print the entire payload in hex */ 1578 ND_PRINT(" "); 1579 if (!rawprint(ndo, (const uint8_t *)(ext + 1), item_len - 4)) 1580 goto trunc; 1581 } 1582 return (const u_char *)ext + item_len; 1583 trunc: 1584 ND_PRINT(" [|%s]", NPSTR(ISAKMP_NPTYPE_HASH)); 1585 return NULL; 1586 } 1587 1588 static const u_char * 1589 ikev1_sig_print(netdissect_options *ndo, u_char tpay _U_, 1590 const struct isakmp_gen *ext, u_int item_len, 1591 const u_char *ep _U_, uint32_t phase _U_, uint32_t doi _U_, 1592 uint32_t proto _U_, int depth _U_) 1593 { 1594 ND_PRINT("%s:", NPSTR(ISAKMP_NPTYPE_SIG)); 1595 1596 ND_TCHECK_SIZE(ext); 1597 /* 1598 * Our caller has ensured that the length is >= 4. 1599 */ 1600 ND_PRINT(" len=%u", item_len - 4); 1601 if (2 < ndo->ndo_vflag && 4 < item_len) { 1602 /* Print the entire payload in hex */ 1603 ND_PRINT(" "); 1604 if (!rawprint(ndo, (const uint8_t *)(ext + 1), item_len - 4)) 1605 goto trunc; 1606 } 1607 return (const u_char *)ext + item_len; 1608 trunc: 1609 ND_PRINT(" [|%s]", NPSTR(ISAKMP_NPTYPE_SIG)); 1610 return NULL; 1611 } 1612 1613 static const u_char * 1614 ikev1_nonce_print(netdissect_options *ndo, u_char tpay _U_, 1615 const struct isakmp_gen *ext, 1616 u_int item_len, 1617 const u_char *ep, 1618 uint32_t phase _U_, uint32_t doi _U_, 1619 uint32_t proto _U_, int depth _U_) 1620 { 1621 ND_PRINT("%s:", NPSTR(ISAKMP_NPTYPE_NONCE)); 1622 1623 ND_TCHECK_SIZE(ext); 1624 /* 1625 * Our caller has ensured that the length is >= 4. 1626 */ 1627 ND_PRINT(" n len=%u", item_len - 4); 1628 if (item_len > 4) { 1629 if (ndo->ndo_vflag > 2) { 1630 ND_PRINT(" "); 1631 if (!rawprint(ndo, (const uint8_t *)(ext + 1), item_len - 4)) 1632 goto trunc; 1633 } else if (ndo->ndo_vflag > 1) { 1634 ND_PRINT(" "); 1635 if (!ike_show_somedata(ndo, (const u_char *)(ext + 1), ep)) 1636 goto trunc; 1637 } 1638 } 1639 return (const u_char *)ext + item_len; 1640 trunc: 1641 ND_PRINT(" [|%s]", NPSTR(ISAKMP_NPTYPE_NONCE)); 1642 return NULL; 1643 } 1644 1645 static const u_char * 1646 ikev1_n_print(netdissect_options *ndo, u_char tpay _U_, 1647 const struct isakmp_gen *ext, u_int item_len, 1648 const u_char *ep, uint32_t phase _U_, uint32_t doi0 _U_, 1649 uint32_t proto0 _U_, int depth _U_) 1650 { 1651 const struct ikev1_pl_n *p; 1652 const u_char *cp; 1653 const u_char *ep2; 1654 uint32_t doi; 1655 uint32_t proto; 1656 uint16_t type; 1657 uint8_t spi_size; 1658 static const char *notify_error_str[] = { 1659 NULL, "INVALID-PAYLOAD-TYPE", 1660 "DOI-NOT-SUPPORTED", "SITUATION-NOT-SUPPORTED", 1661 "INVALID-COOKIE", "INVALID-MAJOR-VERSION", 1662 "INVALID-MINOR-VERSION", "INVALID-EXCHANGE-TYPE", 1663 "INVALID-FLAGS", "INVALID-MESSAGE-ID", 1664 "INVALID-PROTOCOL-ID", "INVALID-SPI", 1665 "INVALID-TRANSFORM-ID", "ATTRIBUTES-NOT-SUPPORTED", 1666 "NO-PROPOSAL-CHOSEN", "BAD-PROPOSAL-SYNTAX", 1667 "PAYLOAD-MALFORMED", "INVALID-KEY-INFORMATION", 1668 "INVALID-ID-INFORMATION", "INVALID-CERT-ENCODING", 1669 "INVALID-CERTIFICATE", "CERT-TYPE-UNSUPPORTED", 1670 "INVALID-CERT-AUTHORITY", "INVALID-HASH-INFORMATION", 1671 "AUTHENTICATION-FAILED", "INVALID-SIGNATURE", 1672 "ADDRESS-NOTIFICATION", "NOTIFY-SA-LIFETIME", 1673 "CERTIFICATE-UNAVAILABLE", "UNSUPPORTED-EXCHANGE-TYPE", 1674 "UNEQUAL-PAYLOAD-LENGTHS", 1675 }; 1676 static const char *ipsec_notify_error_str[] = { 1677 "RESERVED", 1678 }; 1679 static const char *notify_status_str[] = { 1680 "CONNECTED", 1681 }; 1682 static const char *ipsec_notify_status_str[] = { 1683 "RESPONDER-LIFETIME", "REPLAY-STATUS", 1684 "INITIAL-CONTACT", 1685 }; 1686 /* NOTE: these macro must be called with x in proper range */ 1687 1688 /* 0 - 8191 */ 1689 #define NOTIFY_ERROR_STR(x) \ 1690 STR_OR_ID((x), notify_error_str) 1691 1692 /* 8192 - 16383 */ 1693 #define IPSEC_NOTIFY_ERROR_STR(x) \ 1694 STR_OR_ID((u_int)((x) - 8192), ipsec_notify_error_str) 1695 1696 /* 16384 - 24575 */ 1697 #define NOTIFY_STATUS_STR(x) \ 1698 STR_OR_ID((u_int)((x) - 16384), notify_status_str) 1699 1700 /* 24576 - 32767 */ 1701 #define IPSEC_NOTIFY_STATUS_STR(x) \ 1702 STR_OR_ID((u_int)((x) - 24576), ipsec_notify_status_str) 1703 1704 ND_PRINT("%s:", NPSTR(ISAKMP_NPTYPE_N)); 1705 1706 p = (const struct ikev1_pl_n *)ext; 1707 ND_TCHECK_SIZE(p); 1708 doi = GET_BE_U_4(p->doi); 1709 proto = GET_U_1(p->prot_id); 1710 if (doi != 1) { 1711 ND_PRINT(" doi=%u", doi); 1712 ND_PRINT(" proto=%u", proto); 1713 type = GET_BE_U_2(p->type); 1714 if (type < 8192) 1715 ND_PRINT(" type=%s", NOTIFY_ERROR_STR(type)); 1716 else if (type < 16384) 1717 ND_PRINT(" type=%s", numstr(type)); 1718 else if (type < 24576) 1719 ND_PRINT(" type=%s", NOTIFY_STATUS_STR(type)); 1720 else 1721 ND_PRINT(" type=%s", numstr(type)); 1722 spi_size = GET_U_1(p->spi_size); 1723 if (spi_size) { 1724 ND_PRINT(" spi="); 1725 if (!rawprint(ndo, (const uint8_t *)(p + 1), spi_size)) 1726 goto trunc; 1727 } 1728 return (const u_char *)(p + 1) + spi_size; 1729 } 1730 1731 ND_PRINT(" doi=ipsec"); 1732 ND_PRINT(" proto=%s", PROTOIDSTR(proto)); 1733 type = GET_BE_U_2(p->type); 1734 if (type < 8192) 1735 ND_PRINT(" type=%s", NOTIFY_ERROR_STR(type)); 1736 else if (type < 16384) 1737 ND_PRINT(" type=%s", IPSEC_NOTIFY_ERROR_STR(type)); 1738 else if (type < 24576) 1739 ND_PRINT(" type=%s", NOTIFY_STATUS_STR(type)); 1740 else if (type < 32768) 1741 ND_PRINT(" type=%s", IPSEC_NOTIFY_STATUS_STR(type)); 1742 else 1743 ND_PRINT(" type=%s", numstr(type)); 1744 spi_size = GET_U_1(p->spi_size); 1745 if (spi_size) { 1746 ND_PRINT(" spi="); 1747 if (!rawprint(ndo, (const uint8_t *)(p + 1), spi_size)) 1748 goto trunc; 1749 } 1750 1751 cp = (const u_char *)(p + 1) + spi_size; 1752 ep2 = (const u_char *)p + item_len; 1753 1754 if (cp < ep) { 1755 switch (type) { 1756 case IPSECDOI_NTYPE_RESPONDER_LIFETIME: 1757 { 1758 const struct attrmap *map = oakley_t_map; 1759 size_t nmap = sizeof(oakley_t_map)/sizeof(oakley_t_map[0]); 1760 ND_PRINT(" attrs=("); 1761 while (cp < ep && cp < ep2) { 1762 cp = ikev1_attrmap_print(ndo, cp, ep2, map, nmap); 1763 if (cp == NULL) { 1764 ND_PRINT(")"); 1765 goto trunc; 1766 } 1767 } 1768 ND_PRINT(")"); 1769 break; 1770 } 1771 case IPSECDOI_NTYPE_REPLAY_STATUS: 1772 ND_PRINT(" status=("); 1773 ND_PRINT("replay detection %sabled", 1774 GET_BE_U_4(cp) ? "en" : "dis"); 1775 ND_PRINT(")"); 1776 break; 1777 default: 1778 /* 1779 * XXX - fill in more types here; see, for example, 1780 * draft-ietf-ipsec-notifymsg-04. 1781 */ 1782 if (ndo->ndo_vflag > 3) { 1783 ND_PRINT(" data=("); 1784 if (!rawprint(ndo, (const uint8_t *)(cp), ep - cp)) 1785 goto trunc; 1786 ND_PRINT(")"); 1787 } else { 1788 if (!ike_show_somedata(ndo, cp, ep)) 1789 goto trunc; 1790 } 1791 break; 1792 } 1793 } 1794 return (const u_char *)ext + item_len; 1795 trunc: 1796 ND_PRINT(" [|%s]", NPSTR(ISAKMP_NPTYPE_N)); 1797 return NULL; 1798 } 1799 1800 static const u_char * 1801 ikev1_d_print(netdissect_options *ndo, u_char tpay _U_, 1802 const struct isakmp_gen *ext, u_int item_len _U_, 1803 const u_char *ep _U_, uint32_t phase _U_, uint32_t doi0 _U_, 1804 uint32_t proto0 _U_, int depth _U_) 1805 { 1806 const struct ikev1_pl_d *p; 1807 const uint8_t *q; 1808 uint32_t doi; 1809 uint32_t proto; 1810 uint8_t spi_size; 1811 uint16_t num_spi; 1812 u_int i; 1813 1814 ND_PRINT("%s:", NPSTR(ISAKMP_NPTYPE_D)); 1815 1816 p = (const struct ikev1_pl_d *)ext; 1817 ND_TCHECK_SIZE(p); 1818 doi = GET_BE_U_4(p->doi); 1819 proto = GET_U_1(p->prot_id); 1820 if (doi != 1) { 1821 ND_PRINT(" doi=%u", doi); 1822 ND_PRINT(" proto=%u", proto); 1823 } else { 1824 ND_PRINT(" doi=ipsec"); 1825 ND_PRINT(" proto=%s", PROTOIDSTR(proto)); 1826 } 1827 spi_size = GET_U_1(p->spi_size); 1828 ND_PRINT(" spilen=%u", spi_size); 1829 num_spi = GET_BE_U_2(p->num_spi); 1830 ND_PRINT(" nspi=%u", num_spi); 1831 ND_PRINT(" spi="); 1832 q = (const uint8_t *)(p + 1); 1833 for (i = 0; i < num_spi; i++) { 1834 if (i != 0) 1835 ND_PRINT(","); 1836 if (!rawprint(ndo, (const uint8_t *)q, spi_size)) 1837 goto trunc; 1838 q += spi_size; 1839 } 1840 return q; 1841 trunc: 1842 ND_PRINT(" [|%s]", NPSTR(ISAKMP_NPTYPE_D)); 1843 return NULL; 1844 } 1845 1846 static const u_char * 1847 ikev1_vid_print(netdissect_options *ndo, u_char tpay _U_, 1848 const struct isakmp_gen *ext, 1849 u_int item_len, const u_char *ep _U_, 1850 uint32_t phase _U_, uint32_t doi _U_, 1851 uint32_t proto _U_, int depth _U_) 1852 { 1853 ND_PRINT("%s:", NPSTR(ISAKMP_NPTYPE_VID)); 1854 1855 ND_TCHECK_SIZE(ext); 1856 /* 1857 * Our caller has ensured that the length is >= 4. 1858 */ 1859 ND_PRINT(" len=%u", item_len - 4); 1860 if (2 < ndo->ndo_vflag && 4 < item_len) { 1861 /* Print the entire payload in hex */ 1862 ND_PRINT(" "); 1863 if (!rawprint(ndo, (const uint8_t *)(ext + 1), item_len - 4)) 1864 goto trunc; 1865 } 1866 return (const u_char *)ext + item_len; 1867 trunc: 1868 ND_PRINT(" [|%s]", NPSTR(ISAKMP_NPTYPE_VID)); 1869 return NULL; 1870 } 1871 1872 /************************************************************/ 1873 /* */ 1874 /* IKE v2 - rfc4306 - dissector */ 1875 /* */ 1876 /************************************************************/ 1877 1878 static void 1879 ikev2_pay_print(netdissect_options *ndo, const char *payname, uint8_t critical) 1880 { 1881 ND_PRINT("%s%s:", payname, critical&0x80 ? "[C]" : ""); 1882 } 1883 1884 static const u_char * 1885 ikev2_gen_print(netdissect_options *ndo, u_char tpay, 1886 const struct isakmp_gen *ext, u_int item_len) 1887 { 1888 const struct isakmp_gen *p = (const struct isakmp_gen *)ext; 1889 1890 ND_TCHECK_SIZE(ext); 1891 ikev2_pay_print(ndo, NPSTR(tpay), GET_U_1(p->critical)); 1892 1893 /* 1894 * Our caller has ensured that the length is >= 4. 1895 */ 1896 ND_PRINT(" len=%u", item_len - 4); 1897 if (2 < ndo->ndo_vflag && 4 < item_len) { 1898 /* Print the entire payload in hex */ 1899 ND_PRINT(" "); 1900 if (!rawprint(ndo, (const uint8_t *)(ext + 1), item_len - 4)) 1901 goto trunc; 1902 } 1903 return (const u_char *)ext + item_len; 1904 trunc: 1905 ND_PRINT(" [|%s]", NPSTR(tpay)); 1906 return NULL; 1907 } 1908 1909 static const u_char * 1910 ikev2_t_print(netdissect_options *ndo, int tcount, 1911 const struct isakmp_gen *ext, u_int item_len, 1912 const u_char *ep) 1913 { 1914 const struct ikev2_t *p; 1915 uint16_t t_id; 1916 uint8_t t_type; 1917 const u_char *cp; 1918 const char *idstr; 1919 const struct attrmap *map; 1920 size_t nmap; 1921 const u_char *ep2; 1922 1923 p = (const struct ikev2_t *)ext; 1924 ND_TCHECK_SIZE(p); 1925 ikev2_pay_print(ndo, NPSTR(ISAKMP_NPTYPE_T), GET_U_1(p->h.critical)); 1926 1927 t_id = GET_BE_U_2(p->t_id); 1928 1929 map = NULL; 1930 nmap = 0; 1931 1932 t_type = GET_U_1(p->t_type); 1933 switch (t_type) { 1934 case IV2_T_ENCR: 1935 idstr = STR_OR_ID(t_id, esp_p_map); 1936 map = encr_t_map; 1937 nmap = sizeof(encr_t_map)/sizeof(encr_t_map[0]); 1938 break; 1939 1940 case IV2_T_PRF: 1941 idstr = STR_OR_ID(t_id, prf_p_map); 1942 break; 1943 1944 case IV2_T_INTEG: 1945 idstr = STR_OR_ID(t_id, integ_p_map); 1946 break; 1947 1948 case IV2_T_DH: 1949 idstr = STR_OR_ID(t_id, dh_p_map); 1950 break; 1951 1952 case IV2_T_ESN: 1953 idstr = STR_OR_ID(t_id, esn_p_map); 1954 break; 1955 1956 default: 1957 idstr = NULL; 1958 break; 1959 } 1960 1961 if (idstr) 1962 ND_PRINT(" #%u type=%s id=%s ", tcount, 1963 STR_OR_ID(t_type, ikev2_t_type_map), 1964 idstr); 1965 else 1966 ND_PRINT(" #%u type=%s id=%u ", tcount, 1967 STR_OR_ID(t_type, ikev2_t_type_map), 1968 t_id); 1969 cp = (const u_char *)(p + 1); 1970 ep2 = (const u_char *)p + item_len; 1971 while (cp < ep && cp < ep2) { 1972 if (map && nmap) { 1973 cp = ikev1_attrmap_print(ndo, cp, ep2, map, nmap); 1974 } else 1975 cp = ikev1_attr_print(ndo, cp, ep2); 1976 if (cp == NULL) 1977 goto trunc; 1978 } 1979 if (ep < ep2) 1980 ND_PRINT("..."); 1981 return cp; 1982 trunc: 1983 ND_PRINT(" [|%s]", NPSTR(ISAKMP_NPTYPE_T)); 1984 return NULL; 1985 } 1986 1987 static const u_char * 1988 ikev2_p_print(netdissect_options *ndo, u_char tpay _U_, int pcount _U_, 1989 const struct isakmp_gen *ext, u_int oprop_length, 1990 const u_char *ep, int depth) 1991 { 1992 const struct ikev2_p *p; 1993 u_int prop_length; 1994 uint8_t spi_size; 1995 const u_char *cp; 1996 int i; 1997 int tcount; 1998 u_char np; 1999 u_int item_len; 2000 2001 p = (const struct ikev2_p *)ext; 2002 ND_TCHECK_SIZE(p); 2003 2004 ikev2_pay_print(ndo, NPSTR(ISAKMP_NPTYPE_P), GET_U_1(p->h.critical)); 2005 2006 /* 2007 * ikev2_sa_print() guarantees that this is >= 4. 2008 */ 2009 prop_length = oprop_length - 4; 2010 ND_PRINT(" #%u protoid=%s transform=%u len=%u", 2011 GET_U_1(p->p_no), PROTOIDSTR(GET_U_1(p->prot_id)), 2012 GET_U_1(p->num_t), oprop_length); 2013 cp = (const u_char *)(p + 1); 2014 2015 spi_size = GET_U_1(p->spi_size); 2016 if (spi_size) { 2017 if (prop_length < spi_size) 2018 goto toolong; 2019 ND_PRINT(" spi="); 2020 if (!rawprint(ndo, (const uint8_t *)cp, spi_size)) 2021 goto trunc; 2022 cp += spi_size; 2023 prop_length -= spi_size; 2024 } 2025 2026 /* 2027 * Print the transforms. 2028 */ 2029 tcount = 0; 2030 for (np = ISAKMP_NPTYPE_T; np != 0; np = GET_U_1(ext->np)) { 2031 tcount++; 2032 ext = (const struct isakmp_gen *)cp; 2033 if (prop_length < sizeof(*ext)) 2034 goto toolong; 2035 ND_TCHECK_SIZE(ext); 2036 2037 /* 2038 * Since we can't have a payload length of less than 4 bytes, 2039 * we need to bail out here if the generic header is nonsensical 2040 * or truncated, otherwise we could loop forever processing 2041 * zero-length items or otherwise misdissect the packet. 2042 */ 2043 item_len = GET_BE_U_2(ext->len); 2044 if (item_len <= 4) 2045 goto trunc; 2046 2047 if (prop_length < item_len) 2048 goto toolong; 2049 ND_TCHECK_LEN(cp, item_len); 2050 2051 depth++; 2052 ND_PRINT("\n"); 2053 for (i = 0; i < depth; i++) 2054 ND_PRINT(" "); 2055 ND_PRINT("("); 2056 if (np == ISAKMP_NPTYPE_T) { 2057 cp = ikev2_t_print(ndo, tcount, ext, item_len, ep); 2058 if (cp == NULL) { 2059 /* error, already reported */ 2060 return NULL; 2061 } 2062 } else { 2063 ND_PRINT("%s", NPSTR(np)); 2064 cp += item_len; 2065 } 2066 ND_PRINT(")"); 2067 depth--; 2068 prop_length -= item_len; 2069 } 2070 return cp; 2071 toolong: 2072 /* 2073 * Skip the rest of the proposal. 2074 */ 2075 cp += prop_length; 2076 ND_PRINT(" [|%s]", NPSTR(ISAKMP_NPTYPE_P)); 2077 return cp; 2078 trunc: 2079 ND_PRINT(" [|%s]", NPSTR(ISAKMP_NPTYPE_P)); 2080 return NULL; 2081 } 2082 2083 static const u_char * 2084 ikev2_sa_print(netdissect_options *ndo, u_char tpay, 2085 const struct isakmp_gen *ext1, 2086 u_int osa_length, const u_char *ep, 2087 uint32_t phase _U_, uint32_t doi _U_, 2088 uint32_t proto _U_, int depth) 2089 { 2090 const struct isakmp_gen *ext; 2091 u_int sa_length; 2092 const u_char *cp; 2093 int i; 2094 int pcount; 2095 u_char np; 2096 u_int item_len; 2097 2098 ND_TCHECK_SIZE(ext1); 2099 ikev2_pay_print(ndo, "sa", GET_U_1(ext1->critical)); 2100 2101 /* 2102 * ikev2_sub0_print() guarantees that this is >= 4. 2103 */ 2104 osa_length= GET_BE_U_2(ext1->len); 2105 sa_length = osa_length - 4; 2106 ND_PRINT(" len=%u", sa_length); 2107 2108 /* 2109 * Print the payloads. 2110 */ 2111 cp = (const u_char *)(ext1 + 1); 2112 pcount = 0; 2113 for (np = ISAKMP_NPTYPE_P; np != 0; np = GET_U_1(ext->np)) { 2114 pcount++; 2115 ext = (const struct isakmp_gen *)cp; 2116 if (sa_length < sizeof(*ext)) 2117 goto toolong; 2118 ND_TCHECK_SIZE(ext); 2119 2120 /* 2121 * Since we can't have a payload length of less than 4 bytes, 2122 * we need to bail out here if the generic header is nonsensical 2123 * or truncated, otherwise we could loop forever processing 2124 * zero-length items or otherwise misdissect the packet. 2125 */ 2126 item_len = GET_BE_U_2(ext->len); 2127 if (item_len <= 4) 2128 goto trunc; 2129 2130 if (sa_length < item_len) 2131 goto toolong; 2132 ND_TCHECK_LEN(cp, item_len); 2133 2134 depth++; 2135 ND_PRINT("\n"); 2136 for (i = 0; i < depth; i++) 2137 ND_PRINT(" "); 2138 ND_PRINT("("); 2139 if (np == ISAKMP_NPTYPE_P) { 2140 cp = ikev2_p_print(ndo, np, pcount, ext, item_len, 2141 ep, depth); 2142 if (cp == NULL) { 2143 /* error, already reported */ 2144 return NULL; 2145 } 2146 } else { 2147 ND_PRINT("%s", NPSTR(np)); 2148 cp += item_len; 2149 } 2150 ND_PRINT(")"); 2151 depth--; 2152 sa_length -= item_len; 2153 } 2154 return cp; 2155 toolong: 2156 /* 2157 * Skip the rest of the SA. 2158 */ 2159 cp += sa_length; 2160 ND_PRINT(" [|%s]", NPSTR(tpay)); 2161 return cp; 2162 trunc: 2163 ND_PRINT(" [|%s]", NPSTR(tpay)); 2164 return NULL; 2165 } 2166 2167 static const u_char * 2168 ikev2_ke_print(netdissect_options *ndo, u_char tpay, 2169 const struct isakmp_gen *ext, 2170 u_int item_len, const u_char *ep _U_, 2171 uint32_t phase _U_, uint32_t doi _U_, 2172 uint32_t proto _U_, int depth _U_) 2173 { 2174 const struct ikev2_ke *k; 2175 2176 k = (const struct ikev2_ke *)ext; 2177 ND_TCHECK_SIZE(k); 2178 ikev2_pay_print(ndo, NPSTR(tpay), GET_U_1(k->h.critical)); 2179 2180 if (item_len < 8) { 2181 ND_PRINT(" len=%u < 8", item_len); 2182 return (const u_char *)ext + item_len; 2183 } 2184 ND_PRINT(" len=%u group=%s", item_len - 8, 2185 STR_OR_ID(GET_BE_U_2(k->ke_group), dh_p_map)); 2186 2187 if (2 < ndo->ndo_vflag && 8 < item_len) { 2188 ND_PRINT(" "); 2189 if (!rawprint(ndo, (const uint8_t *)(k + 1), item_len - 8)) 2190 goto trunc; 2191 } 2192 return (const u_char *)ext + item_len; 2193 trunc: 2194 ND_PRINT(" [|%s]", NPSTR(tpay)); 2195 return NULL; 2196 } 2197 2198 static const u_char * 2199 ikev2_ID_print(netdissect_options *ndo, u_char tpay, 2200 const struct isakmp_gen *ext, 2201 u_int item_len, const u_char *ep _U_, 2202 uint32_t phase _U_, uint32_t doi _U_, 2203 uint32_t proto _U_, int depth _U_) 2204 { 2205 const struct ikev2_id *idp; 2206 u_int idtype_len, i; 2207 unsigned int dumpascii, dumphex; 2208 const unsigned char *typedata; 2209 2210 idp = (const struct ikev2_id *)ext; 2211 ND_TCHECK_SIZE(idp); 2212 ikev2_pay_print(ndo, NPSTR(tpay), GET_U_1(idp->h.critical)); 2213 2214 /* 2215 * Our caller has ensured that the length is >= 4. 2216 */ 2217 ND_PRINT(" len=%u", item_len - 4); 2218 if (2 < ndo->ndo_vflag && 4 < item_len) { 2219 /* Print the entire payload in hex */ 2220 ND_PRINT(" "); 2221 if (!rawprint(ndo, (const uint8_t *)(ext + 1), item_len - 4)) 2222 goto trunc; 2223 } 2224 2225 idtype_len =item_len - sizeof(struct ikev2_id); 2226 dumpascii = 0; 2227 dumphex = 0; 2228 typedata = (const unsigned char *)(ext)+sizeof(struct ikev2_id); 2229 2230 switch(GET_U_1(idp->type)) { 2231 case ID_IPV4_ADDR: 2232 ND_PRINT(" ipv4:"); 2233 dumphex=1; 2234 break; 2235 case ID_FQDN: 2236 ND_PRINT(" fqdn:"); 2237 dumpascii=1; 2238 break; 2239 case ID_RFC822_ADDR: 2240 ND_PRINT(" rfc822:"); 2241 dumpascii=1; 2242 break; 2243 case ID_IPV6_ADDR: 2244 ND_PRINT(" ipv6:"); 2245 dumphex=1; 2246 break; 2247 case ID_DER_ASN1_DN: 2248 ND_PRINT(" dn:"); 2249 dumphex=1; 2250 break; 2251 case ID_DER_ASN1_GN: 2252 ND_PRINT(" gn:"); 2253 dumphex=1; 2254 break; 2255 case ID_KEY_ID: 2256 ND_PRINT(" keyid:"); 2257 dumphex=1; 2258 break; 2259 } 2260 2261 if(dumpascii) { 2262 ND_TCHECK_LEN(typedata, idtype_len); 2263 for(i=0; i<idtype_len; i++) { 2264 if(ND_ASCII_ISPRINT(GET_U_1(typedata + i))) { 2265 ND_PRINT("%c", GET_U_1(typedata + i)); 2266 } else { 2267 ND_PRINT("."); 2268 } 2269 } 2270 } 2271 if(dumphex) { 2272 if (!rawprint(ndo, (const uint8_t *)typedata, idtype_len)) 2273 goto trunc; 2274 } 2275 2276 return (const u_char *)ext + item_len; 2277 trunc: 2278 ND_PRINT(" [|%s]", NPSTR(tpay)); 2279 return NULL; 2280 } 2281 2282 static const u_char * 2283 ikev2_cert_print(netdissect_options *ndo, u_char tpay, 2284 const struct isakmp_gen *ext, 2285 u_int item_len, const u_char *ep _U_, 2286 uint32_t phase _U_, uint32_t doi _U_, 2287 uint32_t proto _U_, int depth _U_) 2288 { 2289 return ikev2_gen_print(ndo, tpay, ext, item_len); 2290 } 2291 2292 static const u_char * 2293 ikev2_cr_print(netdissect_options *ndo, u_char tpay, 2294 const struct isakmp_gen *ext, 2295 u_int item_len, const u_char *ep _U_, 2296 uint32_t phase _U_, uint32_t doi _U_, 2297 uint32_t proto _U_, int depth _U_) 2298 { 2299 return ikev2_gen_print(ndo, tpay, ext, item_len); 2300 } 2301 2302 static const u_char * 2303 ikev2_auth_print(netdissect_options *ndo, u_char tpay, 2304 const struct isakmp_gen *ext, 2305 u_int item_len, const u_char *ep, 2306 uint32_t phase _U_, uint32_t doi _U_, 2307 uint32_t proto _U_, int depth _U_) 2308 { 2309 const struct ikev2_auth *p; 2310 const char *v2_auth[]={ "invalid", "rsasig", 2311 "shared-secret", "dsssig" }; 2312 const u_char *authdata = (const u_char *)ext + sizeof(struct ikev2_auth); 2313 2314 ND_TCHECK_LEN(ext, sizeof(struct ikev2_auth)); 2315 p = (const struct ikev2_auth *)ext; 2316 ikev2_pay_print(ndo, NPSTR(tpay), GET_U_1(p->h.critical)); 2317 2318 /* 2319 * Our caller has ensured that the length is >= 4. 2320 */ 2321 ND_PRINT(" len=%u method=%s", item_len-4, 2322 STR_OR_ID(GET_U_1(p->auth_method), v2_auth)); 2323 if (item_len > 4) { 2324 if (ndo->ndo_vflag > 1) { 2325 ND_PRINT(" authdata=("); 2326 if (!rawprint(ndo, (const uint8_t *)authdata, item_len - sizeof(struct ikev2_auth))) 2327 goto trunc; 2328 ND_PRINT(") "); 2329 } else if (ndo->ndo_vflag) { 2330 if (!ike_show_somedata(ndo, authdata, ep)) 2331 goto trunc; 2332 } 2333 } 2334 2335 return (const u_char *)ext + item_len; 2336 trunc: 2337 ND_PRINT(" [|%s]", NPSTR(tpay)); 2338 return NULL; 2339 } 2340 2341 static const u_char * 2342 ikev2_nonce_print(netdissect_options *ndo, u_char tpay, 2343 const struct isakmp_gen *ext, 2344 u_int item_len, const u_char *ep, 2345 uint32_t phase _U_, uint32_t doi _U_, 2346 uint32_t proto _U_, int depth _U_) 2347 { 2348 ND_TCHECK_SIZE(ext); 2349 ikev2_pay_print(ndo, "nonce", GET_U_1(ext->critical)); 2350 2351 /* 2352 * Our caller has ensured that the length is >= 4. 2353 */ 2354 ND_PRINT(" len=%u", item_len - 4); 2355 if (1 < ndo->ndo_vflag && 4 < item_len) { 2356 ND_PRINT(" nonce=("); 2357 if (!rawprint(ndo, (const uint8_t *)(ext + 1), item_len - 4)) 2358 goto trunc; 2359 ND_PRINT(") "); 2360 } else if(ndo->ndo_vflag && 4 < item_len) { 2361 if(!ike_show_somedata(ndo, (const u_char *)(ext+1), ep)) goto trunc; 2362 } 2363 2364 return (const u_char *)ext + item_len; 2365 trunc: 2366 ND_PRINT(" [|%s]", NPSTR(tpay)); 2367 return NULL; 2368 } 2369 2370 /* notify payloads */ 2371 static const u_char * 2372 ikev2_n_print(netdissect_options *ndo, u_char tpay _U_, 2373 const struct isakmp_gen *ext, 2374 u_int item_len, const u_char *ep, 2375 uint32_t phase _U_, uint32_t doi _U_, 2376 uint32_t proto _U_, int depth _U_) 2377 { 2378 const struct ikev2_n *p; 2379 uint16_t type; 2380 uint8_t spi_size; 2381 const u_char *cp; 2382 u_char showspi, showsomedata; 2383 const char *notify_name; 2384 2385 p = (const struct ikev2_n *)ext; 2386 ND_TCHECK_SIZE(p); 2387 ikev2_pay_print(ndo, NPSTR(ISAKMP_NPTYPE_N), GET_U_1(p->h.critical)); 2388 2389 showspi = 1; 2390 showsomedata=0; 2391 notify_name=NULL; 2392 2393 ND_PRINT(" prot_id=%s", PROTOIDSTR(GET_U_1(p->prot_id))); 2394 2395 type = GET_BE_U_2(p->type); 2396 2397 /* notify space is annoying sparse */ 2398 switch(type) { 2399 case IV2_NOTIFY_UNSUPPORTED_CRITICAL_PAYLOAD: 2400 notify_name = "unsupported_critical_payload"; 2401 showspi = 0; 2402 break; 2403 2404 case IV2_NOTIFY_INVALID_IKE_SPI: 2405 notify_name = "invalid_ike_spi"; 2406 showspi = 1; 2407 break; 2408 2409 case IV2_NOTIFY_INVALID_MAJOR_VERSION: 2410 notify_name = "invalid_major_version"; 2411 showspi = 0; 2412 break; 2413 2414 case IV2_NOTIFY_INVALID_SYNTAX: 2415 notify_name = "invalid_syntax"; 2416 showspi = 1; 2417 break; 2418 2419 case IV2_NOTIFY_INVALID_MESSAGE_ID: 2420 notify_name = "invalid_message_id"; 2421 showspi = 1; 2422 break; 2423 2424 case IV2_NOTIFY_INVALID_SPI: 2425 notify_name = "invalid_spi"; 2426 showspi = 1; 2427 break; 2428 2429 case IV2_NOTIFY_NO_PROPOSAL_CHOSEN: 2430 notify_name = "no_protocol_chosen"; 2431 showspi = 1; 2432 break; 2433 2434 case IV2_NOTIFY_INVALID_KE_PAYLOAD: 2435 notify_name = "invalid_ke_payload"; 2436 showspi = 1; 2437 break; 2438 2439 case IV2_NOTIFY_AUTHENTICATION_FAILED: 2440 notify_name = "authentication_failed"; 2441 showspi = 1; 2442 break; 2443 2444 case IV2_NOTIFY_SINGLE_PAIR_REQUIRED: 2445 notify_name = "single_pair_required"; 2446 showspi = 1; 2447 break; 2448 2449 case IV2_NOTIFY_NO_ADDITIONAL_SAS: 2450 notify_name = "no_additional_sas"; 2451 showspi = 0; 2452 break; 2453 2454 case IV2_NOTIFY_INTERNAL_ADDRESS_FAILURE: 2455 notify_name = "internal_address_failure"; 2456 showspi = 0; 2457 break; 2458 2459 case IV2_NOTIFY_FAILED_CP_REQUIRED: 2460 notify_name = "failed:cp_required"; 2461 showspi = 0; 2462 break; 2463 2464 case IV2_NOTIFY_INVALID_SELECTORS: 2465 notify_name = "invalid_selectors"; 2466 showspi = 0; 2467 break; 2468 2469 case IV2_NOTIFY_INITIAL_CONTACT: 2470 notify_name = "initial_contact"; 2471 showspi = 0; 2472 break; 2473 2474 case IV2_NOTIFY_SET_WINDOW_SIZE: 2475 notify_name = "set_window_size"; 2476 showspi = 0; 2477 break; 2478 2479 case IV2_NOTIFY_ADDITIONAL_TS_POSSIBLE: 2480 notify_name = "additional_ts_possible"; 2481 showspi = 0; 2482 break; 2483 2484 case IV2_NOTIFY_IPCOMP_SUPPORTED: 2485 notify_name = "ipcomp_supported"; 2486 showspi = 0; 2487 break; 2488 2489 case IV2_NOTIFY_NAT_DETECTION_SOURCE_IP: 2490 notify_name = "nat_detection_source_ip"; 2491 showspi = 1; 2492 break; 2493 2494 case IV2_NOTIFY_NAT_DETECTION_DESTINATION_IP: 2495 notify_name = "nat_detection_destination_ip"; 2496 showspi = 1; 2497 break; 2498 2499 case IV2_NOTIFY_COOKIE: 2500 notify_name = "cookie"; 2501 showspi = 1; 2502 showsomedata= 1; 2503 break; 2504 2505 case IV2_NOTIFY_USE_TRANSPORT_MODE: 2506 notify_name = "use_transport_mode"; 2507 showspi = 0; 2508 break; 2509 2510 case IV2_NOTIFY_HTTP_CERT_LOOKUP_SUPPORTED: 2511 notify_name = "http_cert_lookup_supported"; 2512 showspi = 0; 2513 break; 2514 2515 case IV2_NOTIFY_REKEY_SA: 2516 notify_name = "rekey_sa"; 2517 showspi = 1; 2518 break; 2519 2520 case IV2_NOTIFY_ESP_TFC_PADDING_NOT_SUPPORTED: 2521 notify_name = "tfc_padding_not_supported"; 2522 showspi = 0; 2523 break; 2524 2525 case IV2_NOTIFY_NON_FIRST_FRAGMENTS_ALSO: 2526 notify_name = "non_first_fragment_also"; 2527 showspi = 0; 2528 break; 2529 2530 default: 2531 if (type < 8192) { 2532 notify_name="error"; 2533 } else if(type < 16384) { 2534 notify_name="private-error"; 2535 } else if(type < 40960) { 2536 notify_name="status"; 2537 } else { 2538 notify_name="private-status"; 2539 } 2540 } 2541 2542 if(notify_name) { 2543 ND_PRINT(" type=%u(%s)", type, notify_name); 2544 } 2545 2546 2547 spi_size = GET_U_1(p->spi_size); 2548 if (showspi && spi_size) { 2549 ND_PRINT(" spi="); 2550 if (!rawprint(ndo, (const uint8_t *)(p + 1), spi_size)) 2551 goto trunc; 2552 } 2553 2554 cp = (const u_char *)(p + 1) + spi_size; 2555 2556 if (cp < ep) { 2557 if (ndo->ndo_vflag > 3 || (showsomedata && ep-cp < 30)) { 2558 ND_PRINT(" data=("); 2559 if (!rawprint(ndo, (const uint8_t *)(cp), ep - cp)) 2560 goto trunc; 2561 2562 ND_PRINT(")"); 2563 } else if (showsomedata) { 2564 if (!ike_show_somedata(ndo, cp, ep)) 2565 goto trunc; 2566 } 2567 } 2568 2569 return (const u_char *)ext + item_len; 2570 trunc: 2571 ND_PRINT(" [|%s]", NPSTR(ISAKMP_NPTYPE_N)); 2572 return NULL; 2573 } 2574 2575 static const u_char * 2576 ikev2_d_print(netdissect_options *ndo, u_char tpay, 2577 const struct isakmp_gen *ext, 2578 u_int item_len, const u_char *ep _U_, 2579 uint32_t phase _U_, uint32_t doi _U_, 2580 uint32_t proto _U_, int depth _U_) 2581 { 2582 return ikev2_gen_print(ndo, tpay, ext, item_len); 2583 } 2584 2585 static const u_char * 2586 ikev2_vid_print(netdissect_options *ndo, u_char tpay, 2587 const struct isakmp_gen *ext, 2588 u_int item_len, const u_char *ep _U_, 2589 uint32_t phase _U_, uint32_t doi _U_, 2590 uint32_t proto _U_, int depth _U_) 2591 { 2592 const u_char *vid; 2593 u_int i, len; 2594 2595 ND_TCHECK_SIZE(ext); 2596 ikev2_pay_print(ndo, NPSTR(tpay), GET_U_1(ext->critical)); 2597 2598 /* 2599 * Our caller has ensured that the length is >= 4. 2600 */ 2601 ND_PRINT(" len=%u vid=", item_len - 4); 2602 2603 vid = (const u_char *)(ext+1); 2604 len = item_len - 4; 2605 ND_TCHECK_LEN(vid, len); 2606 for(i=0; i<len; i++) { 2607 if(ND_ASCII_ISPRINT(GET_U_1(vid + i))) 2608 ND_PRINT("%c", GET_U_1(vid + i)); 2609 else ND_PRINT("."); 2610 } 2611 if (2 < ndo->ndo_vflag && 4 < len) { 2612 /* Print the entire payload in hex */ 2613 ND_PRINT(" "); 2614 if (!rawprint(ndo, (const uint8_t *)(ext + 1), item_len - 4)) 2615 goto trunc; 2616 } 2617 return (const u_char *)ext + item_len; 2618 trunc: 2619 ND_PRINT(" [|%s]", NPSTR(tpay)); 2620 return NULL; 2621 } 2622 2623 static const u_char * 2624 ikev2_TS_print(netdissect_options *ndo, u_char tpay, 2625 const struct isakmp_gen *ext, 2626 u_int item_len, const u_char *ep _U_, 2627 uint32_t phase _U_, uint32_t doi _U_, 2628 uint32_t proto _U_, int depth _U_) 2629 { 2630 return ikev2_gen_print(ndo, tpay, ext, item_len); 2631 } 2632 2633 static const u_char * 2634 ikev2_e_print(netdissect_options *ndo, 2635 #ifndef HAVE_LIBCRYPTO 2636 _U_ 2637 #endif 2638 const struct isakmp *base, 2639 u_char tpay, 2640 const struct isakmp_gen *ext, 2641 u_int item_len, const u_char *ep _U_, 2642 #ifndef HAVE_LIBCRYPTO 2643 _U_ 2644 #endif 2645 uint32_t phase, 2646 #ifndef HAVE_LIBCRYPTO 2647 _U_ 2648 #endif 2649 uint32_t doi, 2650 #ifndef HAVE_LIBCRYPTO 2651 _U_ 2652 #endif 2653 uint32_t proto, 2654 #ifndef HAVE_LIBCRYPTO 2655 _U_ 2656 #endif 2657 int depth) 2658 { 2659 const u_char *dat; 2660 u_int dlen; 2661 #ifdef HAVE_LIBCRYPTO 2662 uint8_t np; 2663 #endif 2664 2665 ND_TCHECK_SIZE(ext); 2666 ikev2_pay_print(ndo, NPSTR(tpay), GET_U_1(ext->critical)); 2667 2668 dlen = item_len-4; 2669 2670 ND_PRINT(" len=%u", dlen); 2671 if (2 < ndo->ndo_vflag && 4 < dlen) { 2672 ND_PRINT(" "); 2673 if (!rawprint(ndo, (const uint8_t *)(ext + 1), dlen)) 2674 goto trunc; 2675 } 2676 2677 dat = (const u_char *)(ext+1); 2678 ND_TCHECK_LEN(dat, dlen); 2679 2680 #ifdef HAVE_LIBCRYPTO 2681 np = GET_U_1(ext->np); 2682 2683 /* try to decrypt it! */ 2684 if(esp_decrypt_buffer_by_ikev2_print(ndo, 2685 GET_U_1(base->flags) & ISAKMP_FLAG_I, 2686 base->i_ck, base->r_ck, 2687 dat, dat+dlen)) { 2688 2689 ext = (const struct isakmp_gen *)ndo->ndo_packetp; 2690 2691 /* got it decrypted, print stuff inside. */ 2692 ikev2_sub_print(ndo, base, np, ext, 2693 ndo->ndo_snapend, phase, doi, proto, depth+1); 2694 2695 /* 2696 * esp_decrypt_buffer_by_ikev2_print pushed information 2697 * on the buffer stack; we're done with the buffer, so 2698 * pop it (which frees the buffer) 2699 */ 2700 nd_pop_packet_info(ndo); 2701 } 2702 #endif 2703 2704 2705 /* always return NULL, because E must be at end, and NP refers 2706 * to what was inside. 2707 */ 2708 return NULL; 2709 trunc: 2710 ND_PRINT(" [|%s]", NPSTR(tpay)); 2711 return NULL; 2712 } 2713 2714 static const u_char * 2715 ikev2_cp_print(netdissect_options *ndo, u_char tpay, 2716 const struct isakmp_gen *ext, 2717 u_int item_len, const u_char *ep _U_, 2718 uint32_t phase _U_, uint32_t doi _U_, 2719 uint32_t proto _U_, int depth _U_) 2720 { 2721 return ikev2_gen_print(ndo, tpay, ext, item_len); 2722 } 2723 2724 static const u_char * 2725 ikev2_eap_print(netdissect_options *ndo, u_char tpay, 2726 const struct isakmp_gen *ext, 2727 u_int item_len, const u_char *ep _U_, 2728 uint32_t phase _U_, uint32_t doi _U_, 2729 uint32_t proto _U_, int depth _U_) 2730 { 2731 return ikev2_gen_print(ndo, tpay, ext, item_len); 2732 } 2733 2734 static const u_char * 2735 ike_sub0_print(netdissect_options *ndo, 2736 u_char np, const struct isakmp_gen *ext, const u_char *ep, 2737 2738 uint32_t phase, uint32_t doi, uint32_t proto, int depth) 2739 { 2740 const u_char *cp; 2741 u_int item_len; 2742 2743 cp = (const u_char *)ext; 2744 ND_TCHECK_SIZE(ext); 2745 2746 /* 2747 * Since we can't have a payload length of less than 4 bytes, 2748 * we need to bail out here if the generic header is nonsensical 2749 * or truncated, otherwise we could loop forever processing 2750 * zero-length items or otherwise misdissect the packet. 2751 */ 2752 item_len = GET_BE_U_2(ext->len); 2753 if (item_len <= 4) 2754 return NULL; 2755 2756 if (NPFUNC(np)) { 2757 /* 2758 * XXX - what if item_len is too short, or too long, 2759 * for this payload type? 2760 */ 2761 cp = (*npfunc[np])(ndo, np, ext, item_len, ep, phase, doi, proto, depth); 2762 } else { 2763 ND_PRINT("%s", NPSTR(np)); 2764 cp += item_len; 2765 } 2766 2767 return cp; 2768 trunc: 2769 nd_print_trunc(ndo); 2770 return NULL; 2771 } 2772 2773 static const u_char * 2774 ikev1_sub_print(netdissect_options *ndo, 2775 u_char np, const struct isakmp_gen *ext, const u_char *ep, 2776 uint32_t phase, uint32_t doi, uint32_t proto, int depth) 2777 { 2778 const u_char *cp; 2779 int i; 2780 u_int item_len; 2781 2782 cp = (const u_char *)ext; 2783 2784 while (np) { 2785 ND_TCHECK_SIZE(ext); 2786 2787 item_len = GET_BE_U_2(ext->len); 2788 ND_TCHECK_LEN(ext, item_len); 2789 2790 depth++; 2791 ND_PRINT("\n"); 2792 for (i = 0; i < depth; i++) 2793 ND_PRINT(" "); 2794 ND_PRINT("("); 2795 cp = ike_sub0_print(ndo, np, ext, ep, phase, doi, proto, depth); 2796 ND_PRINT(")"); 2797 depth--; 2798 2799 if (cp == NULL) { 2800 /* Zero-length subitem */ 2801 return NULL; 2802 } 2803 2804 np = GET_U_1(ext->np); 2805 ext = (const struct isakmp_gen *)cp; 2806 } 2807 return cp; 2808 trunc: 2809 ND_PRINT(" [|%s]", NPSTR(np)); 2810 return NULL; 2811 } 2812 2813 static char * 2814 numstr(u_int x) 2815 { 2816 static char buf[20]; 2817 snprintf(buf, sizeof(buf), "#%u", x); 2818 return buf; 2819 } 2820 2821 static void 2822 ikev1_print(netdissect_options *ndo, 2823 const u_char *bp, u_int length, 2824 const u_char *bp2, const struct isakmp *base) 2825 { 2826 const struct isakmp *p; 2827 const u_char *ep; 2828 u_int flags; 2829 u_char np; 2830 int i; 2831 u_int phase; 2832 2833 p = (const struct isakmp *)bp; 2834 ep = ndo->ndo_snapend; 2835 2836 phase = (GET_BE_U_4(base->msgid) == 0) ? 1 : 2; 2837 if (phase == 1) 2838 ND_PRINT(" phase %u", phase); 2839 else 2840 ND_PRINT(" phase %u/others", phase); 2841 2842 i = cookie_find(&base->i_ck); 2843 if (i < 0) { 2844 if (iszero(ndo, base->r_ck, sizeof(base->r_ck))) { 2845 /* the first packet */ 2846 ND_PRINT(" I"); 2847 if (bp2) 2848 cookie_record(ndo, &base->i_ck, bp2); 2849 } else 2850 ND_PRINT(" ?"); 2851 } else { 2852 if (bp2 && cookie_isinitiator(ndo, i, bp2)) 2853 ND_PRINT(" I"); 2854 else if (bp2 && cookie_isresponder(ndo, i, bp2)) 2855 ND_PRINT(" R"); 2856 else 2857 ND_PRINT(" ?"); 2858 } 2859 2860 ND_PRINT(" %s", ETYPESTR(GET_U_1(base->etype))); 2861 flags = GET_U_1(base->flags); 2862 if (flags) { 2863 ND_PRINT("[%s%s]", flags & ISAKMP_FLAG_E ? "E" : "", 2864 flags & ISAKMP_FLAG_C ? "C" : ""); 2865 } 2866 2867 if (ndo->ndo_vflag) { 2868 const struct isakmp_gen *ext; 2869 2870 ND_PRINT(":"); 2871 2872 np = GET_U_1(base->np); 2873 2874 /* regardless of phase... */ 2875 if (flags & ISAKMP_FLAG_E) { 2876 /* 2877 * encrypted, nothing we can do right now. 2878 * we hope to decrypt the packet in the future... 2879 */ 2880 ND_PRINT(" [encrypted %s]", NPSTR(np)); 2881 goto done; 2882 } 2883 2884 CHECKLEN(p + 1, np); 2885 ext = (const struct isakmp_gen *)(p + 1); 2886 ikev1_sub_print(ndo, np, ext, ep, phase, 0, 0, 0); 2887 } 2888 2889 done: 2890 if (ndo->ndo_vflag) { 2891 if (GET_BE_U_4(base->len) != length) { 2892 ND_PRINT(" (len mismatch: isakmp %u/ip %u)", 2893 GET_BE_U_4(base->len), length); 2894 } 2895 } 2896 } 2897 2898 static const u_char * 2899 ikev2_sub0_print(netdissect_options *ndo, const struct isakmp *base, 2900 u_char np, 2901 const struct isakmp_gen *ext, const u_char *ep, 2902 uint32_t phase, uint32_t doi, uint32_t proto, int depth) 2903 { 2904 const u_char *cp; 2905 u_int item_len; 2906 2907 cp = (const u_char *)ext; 2908 ND_TCHECK_SIZE(ext); 2909 2910 /* 2911 * Since we can't have a payload length of less than 4 bytes, 2912 * we need to bail out here if the generic header is nonsensical 2913 * or truncated, otherwise we could loop forever processing 2914 * zero-length items or otherwise misdissect the packet. 2915 */ 2916 item_len = GET_BE_U_2(ext->len); 2917 if (item_len <= 4) 2918 return NULL; 2919 2920 if (np == ISAKMP_NPTYPE_v2E) { 2921 cp = ikev2_e_print(ndo, base, np, ext, item_len, 2922 ep, phase, doi, proto, depth); 2923 } else if (NPFUNC(np)) { 2924 /* 2925 * XXX - what if item_len is too short, or too long, 2926 * for this payload type? 2927 */ 2928 cp = (*npfunc[np])(ndo, np, ext, item_len, 2929 ep, phase, doi, proto, depth); 2930 } else { 2931 ND_PRINT("%s", NPSTR(np)); 2932 cp += item_len; 2933 } 2934 2935 return cp; 2936 trunc: 2937 nd_print_trunc(ndo); 2938 return NULL; 2939 } 2940 2941 static const u_char * 2942 ikev2_sub_print(netdissect_options *ndo, 2943 const struct isakmp *base, 2944 u_char np, const struct isakmp_gen *ext, const u_char *ep, 2945 uint32_t phase, uint32_t doi, uint32_t proto, int depth) 2946 { 2947 const u_char *cp; 2948 int i; 2949 2950 cp = (const u_char *)ext; 2951 while (np) { 2952 ND_TCHECK_SIZE(ext); 2953 2954 ND_TCHECK_LEN(ext, GET_BE_U_2(ext->len)); 2955 2956 depth++; 2957 ND_PRINT("\n"); 2958 for (i = 0; i < depth; i++) 2959 ND_PRINT(" "); 2960 ND_PRINT("("); 2961 cp = ikev2_sub0_print(ndo, base, np, 2962 ext, ep, phase, doi, proto, depth); 2963 ND_PRINT(")"); 2964 depth--; 2965 2966 if (cp == NULL) { 2967 /* Zero-length subitem */ 2968 return NULL; 2969 } 2970 2971 np = GET_U_1(ext->np); 2972 ext = (const struct isakmp_gen *)cp; 2973 } 2974 return cp; 2975 trunc: 2976 ND_PRINT(" [|%s]", NPSTR(np)); 2977 return NULL; 2978 } 2979 2980 static void 2981 ikev2_print(netdissect_options *ndo, 2982 const u_char *bp, u_int length, 2983 const u_char *bp2 _U_, const struct isakmp *base) 2984 { 2985 const struct isakmp *p; 2986 const u_char *ep; 2987 uint8_t flags; 2988 u_char np; 2989 u_int phase; 2990 2991 p = (const struct isakmp *)bp; 2992 ep = ndo->ndo_snapend; 2993 2994 phase = (GET_BE_U_4(base->msgid) == 0) ? 1 : 2; 2995 if (phase == 1) 2996 ND_PRINT(" parent_sa"); 2997 else 2998 ND_PRINT(" child_sa "); 2999 3000 ND_PRINT(" %s", ETYPESTR(GET_U_1(base->etype))); 3001 flags = GET_U_1(base->flags); 3002 if (flags) { 3003 ND_PRINT("[%s%s%s]", 3004 flags & ISAKMP_FLAG_I ? "I" : "", 3005 flags & ISAKMP_FLAG_V ? "V" : "", 3006 flags & ISAKMP_FLAG_R ? "R" : ""); 3007 } 3008 3009 if (ndo->ndo_vflag) { 3010 const struct isakmp_gen *ext; 3011 3012 ND_PRINT(":"); 3013 3014 np = GET_U_1(base->np); 3015 3016 /* regardless of phase... */ 3017 if (flags & ISAKMP_FLAG_E) { 3018 /* 3019 * encrypted, nothing we can do right now. 3020 * we hope to decrypt the packet in the future... 3021 */ 3022 ND_PRINT(" [encrypted %s]", NPSTR(np)); 3023 goto done; 3024 } 3025 3026 CHECKLEN(p + 1, np) 3027 ext = (const struct isakmp_gen *)(p + 1); 3028 ikev2_sub_print(ndo, base, np, ext, ep, phase, 0, 0, 0); 3029 } 3030 3031 done: 3032 if (ndo->ndo_vflag) { 3033 if (GET_BE_U_4(base->len) != length) { 3034 ND_PRINT(" (len mismatch: isakmp %u/ip %u)", 3035 GET_BE_U_4(base->len), length); 3036 } 3037 } 3038 } 3039 3040 void 3041 isakmp_print(netdissect_options *ndo, 3042 const u_char *bp, u_int length, 3043 const u_char *bp2) 3044 { 3045 const struct isakmp *p; 3046 const u_char *ep; 3047 u_int major, minor; 3048 3049 ndo->ndo_protocol = "isakmp"; 3050 #ifdef HAVE_LIBCRYPTO 3051 /* initialize SAs */ 3052 if (ndo->ndo_sa_list_head == NULL) { 3053 if (ndo->ndo_espsecret) 3054 esp_decodesecret_print(ndo); 3055 } 3056 #endif 3057 3058 p = (const struct isakmp *)bp; 3059 ep = ndo->ndo_snapend; 3060 3061 if ((const struct isakmp *)ep < p + 1) { 3062 nd_print_trunc(ndo); 3063 return; 3064 } 3065 3066 ND_PRINT("isakmp"); 3067 major = (GET_U_1(p->vers) & ISAKMP_VERS_MAJOR) 3068 >> ISAKMP_VERS_MAJOR_SHIFT; 3069 minor = (GET_U_1(p->vers) & ISAKMP_VERS_MINOR) 3070 >> ISAKMP_VERS_MINOR_SHIFT; 3071 3072 if (ndo->ndo_vflag) { 3073 ND_PRINT(" %u.%u", major, minor); 3074 } 3075 3076 if (ndo->ndo_vflag) { 3077 ND_PRINT(" msgid "); 3078 hexprint(ndo, p->msgid, sizeof(p->msgid)); 3079 } 3080 3081 if (1 < ndo->ndo_vflag) { 3082 ND_PRINT(" cookie "); 3083 hexprint(ndo, p->i_ck, sizeof(p->i_ck)); 3084 ND_PRINT("->"); 3085 hexprint(ndo, p->r_ck, sizeof(p->r_ck)); 3086 } 3087 ND_PRINT(":"); 3088 3089 switch(major) { 3090 case IKEv1_MAJOR_VERSION: 3091 ikev1_print(ndo, bp, length, bp2, p); 3092 break; 3093 3094 case IKEv2_MAJOR_VERSION: 3095 ikev2_print(ndo, bp, length, bp2, p); 3096 break; 3097 } 3098 } 3099 3100 void 3101 isakmp_rfc3948_print(netdissect_options *ndo, 3102 const u_char *bp, u_int length, 3103 const u_char *bp2, int ver, int fragmented, u_int ttl_hl) 3104 { 3105 ndo->ndo_protocol = "isakmp_rfc3948"; 3106 if(length == 1 && GET_U_1(bp)==0xff) { 3107 ND_PRINT("isakmp-nat-keep-alive"); 3108 return; 3109 } 3110 3111 if(length < 4) { 3112 goto trunc; 3113 } 3114 3115 /* 3116 * see if this is an IKE packet 3117 */ 3118 if (GET_BE_U_4(bp) == 0) { 3119 ND_PRINT("NONESP-encap: "); 3120 isakmp_print(ndo, bp+4, length-4, bp2); 3121 return; 3122 } 3123 3124 /* must be an ESP packet */ 3125 { 3126 ND_PRINT("UDP-encap: "); 3127 3128 esp_print(ndo, bp, length, bp2, ver, fragmented, ttl_hl); 3129 3130 /* 3131 * Either this has decrypted the payload and 3132 * printed it, in which case there's nothing more 3133 * to do, or it hasn't, in which case there's 3134 * nothing more to do. 3135 */ 3136 return; 3137 } 3138 3139 trunc: 3140 nd_print_trunc(ndo); 3141 } 3142