xref: /freebsd/contrib/tcpdump/print-isakmp.c (revision ec4deee4e4f2aef1b97d9424f25d04e91fd7dc10)
1 /*
2  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the project nor the names of its contributors
14  *    may be used to endorse or promote products derived from this software
15  *    without specific prior written permission.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  *
29  */
30 
31 /* \summary: Internet Security Association and Key Management Protocol (ISAKMP) printer */
32 
33 #ifdef HAVE_CONFIG_H
34 #include "config.h"
35 #endif
36 
37 /* The functions from print-esp.c used in this file are only defined when both
38  * OpenSSL and evp.h are detected. Employ the same preprocessor device here.
39  */
40 #ifndef HAVE_OPENSSL_EVP_H
41 #undef HAVE_LIBCRYPTO
42 #endif
43 
44 #include <netdissect-stdinc.h>
45 
46 #include <string.h>
47 
48 #include "netdissect.h"
49 #include "addrtoname.h"
50 #include "extract.h"
51 
52 #include "ip.h"
53 #include "ip6.h"
54 #include "ipproto.h"
55 
56 /* refer to RFC 2408 */
57 
58 typedef u_char cookie_t[8];
59 typedef u_char msgid_t[4];
60 
61 #define PORT_ISAKMP 500
62 
63 /* 3.1 ISAKMP Header Format (IKEv1 and IKEv2)
64          0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
65         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
66         !                          Initiator                            !
67         !                            Cookie                             !
68         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
69         !                          Responder                            !
70         !                            Cookie                             !
71         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
72         !  Next Payload ! MjVer ! MnVer ! Exchange Type !     Flags     !
73         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
74         !                          Message ID                           !
75         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
76         !                            Length                             !
77         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
78 */
79 struct isakmp {
80 	cookie_t i_ck;		/* Initiator Cookie */
81 	cookie_t r_ck;		/* Responder Cookie */
82 	uint8_t np;		/* Next Payload Type */
83 	uint8_t vers;
84 #define ISAKMP_VERS_MAJOR	0xf0
85 #define ISAKMP_VERS_MAJOR_SHIFT	4
86 #define ISAKMP_VERS_MINOR	0x0f
87 #define ISAKMP_VERS_MINOR_SHIFT	0
88 	uint8_t etype;		/* Exchange Type */
89 	uint8_t flags;		/* Flags */
90 	msgid_t msgid;
91 	uint32_t len;		/* Length */
92 };
93 
94 /* Next Payload Type */
95 #define ISAKMP_NPTYPE_NONE   0 /* NONE*/
96 #define ISAKMP_NPTYPE_SA     1 /* Security Association */
97 #define ISAKMP_NPTYPE_P      2 /* Proposal */
98 #define ISAKMP_NPTYPE_T      3 /* Transform */
99 #define ISAKMP_NPTYPE_KE     4 /* Key Exchange */
100 #define ISAKMP_NPTYPE_ID     5 /* Identification */
101 #define ISAKMP_NPTYPE_CERT   6 /* Certificate */
102 #define ISAKMP_NPTYPE_CR     7 /* Certificate Request */
103 #define ISAKMP_NPTYPE_HASH   8 /* Hash */
104 #define ISAKMP_NPTYPE_SIG    9 /* Signature */
105 #define ISAKMP_NPTYPE_NONCE 10 /* Nonce */
106 #define ISAKMP_NPTYPE_N     11 /* Notification */
107 #define ISAKMP_NPTYPE_D     12 /* Delete */
108 #define ISAKMP_NPTYPE_VID   13 /* Vendor ID */
109 #define ISAKMP_NPTYPE_v2E   46 /* v2 Encrypted payload */
110 
111 #define IKEv1_MAJOR_VERSION  1
112 #define IKEv1_MINOR_VERSION  0
113 
114 #define IKEv2_MAJOR_VERSION  2
115 #define IKEv2_MINOR_VERSION  0
116 
117 /* Flags */
118 #define ISAKMP_FLAG_E 0x01 /* Encryption Bit */
119 #define ISAKMP_FLAG_C 0x02 /* Commit Bit */
120 #define ISAKMP_FLAG_extra 0x04
121 
122 /* IKEv2 */
123 #define ISAKMP_FLAG_I (1 << 3)  /* (I)nitiator */
124 #define ISAKMP_FLAG_V (1 << 4)  /* (V)ersion   */
125 #define ISAKMP_FLAG_R (1 << 5)  /* (R)esponse  */
126 
127 
128 /* 3.2 Payload Generic Header
129          0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
130         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
131         ! Next Payload  !   RESERVED    !         Payload Length        !
132         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
133 */
134 struct isakmp_gen {
135 	uint8_t  np;       /* Next Payload */
136 	uint8_t  critical; /* bit 7 - critical, rest is RESERVED */
137 	uint16_t len;      /* Payload Length */
138 };
139 
140 /* 3.3 Data Attributes
141          0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
142         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
143         !A!       Attribute Type        !    AF=0  Attribute Length     !
144         !F!                             !    AF=1  Attribute Value      !
145         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
146         .                   AF=0  Attribute Value                       .
147         .                   AF=1  Not Transmitted                       .
148         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
149 */
150 struct isakmp_data {
151 	uint16_t type;     /* defined by DOI-spec, and Attribute Format */
152 	uint16_t lorv;     /* if f equal 1, Attribute Length */
153 	                  /* if f equal 0, Attribute Value */
154 	/* if f equal 1, Attribute Value */
155 };
156 
157 /* 3.4 Security Association Payload */
158 	/* MAY NOT be used, because of being defined in ipsec-doi. */
159 	/*
160 	If the current payload is the last in the message,
161 	then the value of the next payload field will be 0.
162 	This field MUST NOT contain the
163 	values for the Proposal or Transform payloads as they are considered
164 	part of the security association negotiation.  For example, this
165 	field would contain the value "10" (Nonce payload) in the first
166 	message of a Base Exchange (see Section 4.4) and the value "0" in the
167 	first message of an Identity Protect Exchange (see Section 4.5).
168 	*/
169 struct ikev1_pl_sa {
170 	struct isakmp_gen h;
171 	uint32_t doi; /* Domain of Interpretation */
172 	uint32_t sit; /* Situation */
173 };
174 
175 /* 3.5 Proposal Payload */
176 	/*
177 	The value of the next payload field MUST only contain the value "2"
178 	or "0".  If there are additional Proposal payloads in the message,
179 	then this field will be 2.  If the current Proposal payload is the
180 	last within the security association proposal, then this field will
181 	be 0.
182 	*/
183 struct ikev1_pl_p {
184 	struct isakmp_gen h;
185 	uint8_t p_no;      /* Proposal # */
186 	uint8_t prot_id;   /* Protocol */
187 	uint8_t spi_size;  /* SPI Size */
188 	uint8_t num_t;     /* Number of Transforms */
189 	/* SPI */
190 };
191 
192 /* 3.6 Transform Payload */
193 	/*
194 	The value of the next payload field MUST only contain the value "3"
195 	or "0".  If there are additional Transform payloads in the proposal,
196 	then this field will be 3.  If the current Transform payload is the
197 	last within the proposal, then this field will be 0.
198 	*/
199 struct ikev1_pl_t {
200 	struct isakmp_gen h;
201 	uint8_t  t_no;     /* Transform # */
202 	uint8_t  t_id;     /* Transform-Id */
203 	uint16_t reserved; /* RESERVED2 */
204 	/* SA Attributes */
205 };
206 
207 /* 3.7 Key Exchange Payload */
208 struct ikev1_pl_ke {
209 	struct isakmp_gen h;
210 	/* Key Exchange Data */
211 };
212 
213 /* 3.8 Identification Payload */
214 	/* MUST NOT to be used, because of being defined in ipsec-doi. */
215 struct ikev1_pl_id {
216 	struct isakmp_gen h;
217 	union {
218 		uint8_t  id_type;   /* ID Type */
219 		uint32_t doi_data;  /* DOI Specific ID Data */
220 	} d;
221 	/* Identification Data */
222 };
223 
224 /* 3.9 Certificate Payload */
225 struct ikev1_pl_cert {
226 	struct isakmp_gen h;
227 	uint8_t encode; /* Cert Encoding */
228 	char   cert;   /* Certificate Data */
229 		/*
230 		This field indicates the type of
231 		certificate or certificate-related information contained in the
232 		Certificate Data field.
233 		*/
234 };
235 
236 /* 3.10 Certificate Request Payload */
237 struct ikev1_pl_cr {
238 	struct isakmp_gen h;
239 	uint8_t num_cert; /* # Cert. Types */
240 	/*
241 	Certificate Types (variable length)
242 	  -- Contains a list of the types of certificates requested,
243 	  sorted in order of preference.  Each individual certificate
244 	  type is 1 octet.  This field is NOT requiredo
245 	*/
246 	/* # Certificate Authorities (1 octet) */
247 	/* Certificate Authorities (variable length) */
248 };
249 
250 /* 3.11 Hash Payload */
251 	/* may not be used, because of having only data. */
252 struct ikev1_pl_hash {
253 	struct isakmp_gen h;
254 	/* Hash Data */
255 };
256 
257 /* 3.12 Signature Payload */
258 	/* may not be used, because of having only data. */
259 struct ikev1_pl_sig {
260 	struct isakmp_gen h;
261 	/* Signature Data */
262 };
263 
264 /* 3.13 Nonce Payload */
265 	/* may not be used, because of having only data. */
266 struct ikev1_pl_nonce {
267 	struct isakmp_gen h;
268 	/* Nonce Data */
269 };
270 
271 /* 3.14 Notification Payload */
272 struct ikev1_pl_n {
273 	struct isakmp_gen h;
274 	uint32_t doi;      /* Domain of Interpretation */
275 	uint8_t  prot_id;  /* Protocol-ID */
276 	uint8_t  spi_size; /* SPI Size */
277 	uint16_t type;     /* Notify Message Type */
278 	/* SPI */
279 	/* Notification Data */
280 };
281 
282 /* 3.14.1 Notify Message Types */
283 /* NOTIFY MESSAGES - ERROR TYPES */
284 #define ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE           1
285 #define ISAKMP_NTYPE_DOI_NOT_SUPPORTED              2
286 #define ISAKMP_NTYPE_SITUATION_NOT_SUPPORTED        3
287 #define ISAKMP_NTYPE_INVALID_COOKIE                 4
288 #define ISAKMP_NTYPE_INVALID_MAJOR_VERSION          5
289 #define ISAKMP_NTYPE_INVALID_MINOR_VERSION          6
290 #define ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE          7
291 #define ISAKMP_NTYPE_INVALID_FLAGS                  8
292 #define ISAKMP_NTYPE_INVALID_MESSAGE_ID             9
293 #define ISAKMP_NTYPE_INVALID_PROTOCOL_ID            10
294 #define ISAKMP_NTYPE_INVALID_SPI                    11
295 #define ISAKMP_NTYPE_INVALID_TRANSFORM_ID           12
296 #define ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED       13
297 #define ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN             14
298 #define ISAKMP_NTYPE_BAD_PROPOSAL_SYNTAX            15
299 #define ISAKMP_NTYPE_PAYLOAD_MALFORMED              16
300 #define ISAKMP_NTYPE_INVALID_KEY_INFORMATION        17
301 #define ISAKMP_NTYPE_INVALID_ID_INFORMATION         18
302 #define ISAKMP_NTYPE_INVALID_CERT_ENCODING          19
303 #define ISAKMP_NTYPE_INVALID_CERTIFICATE            20
304 #define ISAKMP_NTYPE_BAD_CERT_REQUEST_SYNTAX        21
305 #define ISAKMP_NTYPE_INVALID_CERT_AUTHORITY         22
306 #define ISAKMP_NTYPE_INVALID_HASH_INFORMATION       23
307 #define ISAKMP_NTYPE_AUTHENTICATION_FAILED          24
308 #define ISAKMP_NTYPE_INVALID_SIGNATURE              25
309 #define ISAKMP_NTYPE_ADDRESS_NOTIFICATION           26
310 
311 /* 3.15 Delete Payload */
312 struct ikev1_pl_d {
313 	struct isakmp_gen h;
314 	uint32_t doi;      /* Domain of Interpretation */
315 	uint8_t  prot_id;  /* Protocol-Id */
316 	uint8_t  spi_size; /* SPI Size */
317 	uint16_t num_spi;  /* # of SPIs */
318 	/* SPI(es) */
319 };
320 
321 struct ikev1_ph1tab {
322 	struct ikev1_ph1 *head;
323 	struct ikev1_ph1 *tail;
324 	int len;
325 };
326 
327 struct isakmp_ph2tab {
328 	struct ikev1_ph2 *head;
329 	struct ikev1_ph2 *tail;
330 	int len;
331 };
332 
333 /* IKEv2 (RFC4306) */
334 
335 /* 3.3  Security Association Payload -- generic header */
336 /* 3.3.1.  Proposal Substructure */
337 struct ikev2_p {
338 	struct isakmp_gen h;
339 	uint8_t p_no;      /* Proposal # */
340 	uint8_t prot_id;   /* Protocol */
341 	uint8_t spi_size;  /* SPI Size */
342 	uint8_t num_t;     /* Number of Transforms */
343 };
344 
345 /* 3.3.2.  Transform Substructure */
346 struct ikev2_t {
347 	struct isakmp_gen h;
348 	uint8_t t_type;    /* Transform Type (ENCR,PRF,INTEG,etc.*/
349 	uint8_t res2;      /* reserved byte */
350 	uint16_t t_id;     /* Transform ID */
351 };
352 
353 enum ikev2_t_type {
354 	IV2_T_ENCR = 1,
355 	IV2_T_PRF  = 2,
356 	IV2_T_INTEG= 3,
357 	IV2_T_DH   = 4,
358 	IV2_T_ESN  = 5
359 };
360 
361 /* 3.4.  Key Exchange Payload */
362 struct ikev2_ke {
363 	struct isakmp_gen h;
364 	uint16_t  ke_group;
365 	uint16_t  ke_res1;
366 	/* KE data */
367 };
368 
369 
370 /* 3.5.  Identification Payloads */
371 enum ikev2_id_type {
372 	ID_IPV4_ADDR=1,
373 	ID_FQDN=2,
374 	ID_RFC822_ADDR=3,
375 	ID_IPV6_ADDR=5,
376 	ID_DER_ASN1_DN=9,
377 	ID_DER_ASN1_GN=10,
378 	ID_KEY_ID=11
379 };
380 struct ikev2_id {
381 	struct isakmp_gen h;
382 	uint8_t  type;        /* ID type */
383 	uint8_t  res1;
384 	uint16_t res2;
385 	/* SPI */
386 	/* Notification Data */
387 };
388 
389 /* 3.10 Notification Payload */
390 struct ikev2_n {
391 	struct isakmp_gen h;
392 	uint8_t  prot_id;  /* Protocol-ID */
393 	uint8_t  spi_size; /* SPI Size */
394 	uint16_t type;     /* Notify Message Type */
395 };
396 
397 enum ikev2_n_type {
398 	IV2_NOTIFY_UNSUPPORTED_CRITICAL_PAYLOAD            = 1,
399 	IV2_NOTIFY_INVALID_IKE_SPI                         = 4,
400 	IV2_NOTIFY_INVALID_MAJOR_VERSION                   = 5,
401 	IV2_NOTIFY_INVALID_SYNTAX                          = 7,
402 	IV2_NOTIFY_INVALID_MESSAGE_ID                      = 9,
403 	IV2_NOTIFY_INVALID_SPI                             =11,
404 	IV2_NOTIFY_NO_PROPOSAL_CHOSEN                      =14,
405 	IV2_NOTIFY_INVALID_KE_PAYLOAD                      =17,
406 	IV2_NOTIFY_AUTHENTICATION_FAILED                   =24,
407 	IV2_NOTIFY_SINGLE_PAIR_REQUIRED                    =34,
408 	IV2_NOTIFY_NO_ADDITIONAL_SAS                       =35,
409 	IV2_NOTIFY_INTERNAL_ADDRESS_FAILURE                =36,
410 	IV2_NOTIFY_FAILED_CP_REQUIRED                      =37,
411 	IV2_NOTIFY_INVALID_SELECTORS                       =39,
412 	IV2_NOTIFY_INITIAL_CONTACT                         =16384,
413 	IV2_NOTIFY_SET_WINDOW_SIZE                         =16385,
414 	IV2_NOTIFY_ADDITIONAL_TS_POSSIBLE                  =16386,
415 	IV2_NOTIFY_IPCOMP_SUPPORTED                        =16387,
416 	IV2_NOTIFY_NAT_DETECTION_SOURCE_IP                 =16388,
417 	IV2_NOTIFY_NAT_DETECTION_DESTINATION_IP            =16389,
418 	IV2_NOTIFY_COOKIE                                  =16390,
419 	IV2_NOTIFY_USE_TRANSPORT_MODE                      =16391,
420 	IV2_NOTIFY_HTTP_CERT_LOOKUP_SUPPORTED              =16392,
421 	IV2_NOTIFY_REKEY_SA                                =16393,
422 	IV2_NOTIFY_ESP_TFC_PADDING_NOT_SUPPORTED           =16394,
423 	IV2_NOTIFY_NON_FIRST_FRAGMENTS_ALSO                =16395
424 };
425 
426 struct notify_messages {
427 	uint16_t type;
428 	char     *msg;
429 };
430 
431 /* 3.8 Authentication Payload */
432 struct ikev2_auth {
433 	struct isakmp_gen h;
434 	uint8_t  auth_method;  /* Protocol-ID */
435 	uint8_t  reserved[3];
436 	/* authentication data */
437 };
438 
439 enum ikev2_auth_type {
440 	IV2_RSA_SIG = 1,
441 	IV2_SHARED  = 2,
442 	IV2_DSS_SIG = 3
443 };
444 
445 /* refer to RFC 2409 */
446 
447 #if 0
448 /* isakmp sa structure */
449 struct oakley_sa {
450 	uint8_t  proto_id;            /* OAKLEY */
451 	vchar_t   *spi;                /* spi */
452 	uint8_t  dhgrp;               /* DH; group */
453 	uint8_t  auth_t;              /* method of authentication */
454 	uint8_t  prf_t;               /* type of prf */
455 	uint8_t  hash_t;              /* type of hash */
456 	uint8_t  enc_t;               /* type of cipher */
457 	uint8_t  life_t;              /* type of duration of lifetime */
458 	uint32_t ldur;                /* life duration */
459 };
460 #endif
461 
462 /* refer to RFC 2407 */
463 
464 #define IPSEC_DOI 1
465 
466 /* 4.2 IPSEC Situation Definition */
467 #define IPSECDOI_SIT_IDENTITY_ONLY           0x00000001
468 #define IPSECDOI_SIT_SECRECY                 0x00000002
469 #define IPSECDOI_SIT_INTEGRITY               0x00000004
470 
471 /* 4.4.1 IPSEC Security Protocol Identifiers */
472   /* 4.4.2 IPSEC ISAKMP Transform Values */
473 #define IPSECDOI_PROTO_ISAKMP                        1
474 #define   IPSECDOI_KEY_IKE                             1
475 
476 /* 4.4.1 IPSEC Security Protocol Identifiers */
477 #define IPSECDOI_PROTO_IPSEC_AH                      2
478   /* 4.4.3 IPSEC AH Transform Values */
479 #define   IPSECDOI_AH_MD5                              2
480 #define   IPSECDOI_AH_SHA                              3
481 #define   IPSECDOI_AH_DES                              4
482 #define   IPSECDOI_AH_SHA2_256                         5
483 #define   IPSECDOI_AH_SHA2_384                         6
484 #define   IPSECDOI_AH_SHA2_512                         7
485 
486 /* 4.4.1 IPSEC Security Protocol Identifiers */
487 #define IPSECDOI_PROTO_IPSEC_ESP                     3
488   /* 4.4.4 IPSEC ESP Transform Identifiers */
489 #define   IPSECDOI_ESP_DES_IV64                        1
490 #define   IPSECDOI_ESP_DES                             2
491 #define   IPSECDOI_ESP_3DES                            3
492 #define   IPSECDOI_ESP_RC5                             4
493 #define   IPSECDOI_ESP_IDEA                            5
494 #define   IPSECDOI_ESP_CAST                            6
495 #define   IPSECDOI_ESP_BLOWFISH                        7
496 #define   IPSECDOI_ESP_3IDEA                           8
497 #define   IPSECDOI_ESP_DES_IV32                        9
498 #define   IPSECDOI_ESP_RC4                            10
499 #define   IPSECDOI_ESP_NULL                           11
500 #define   IPSECDOI_ESP_RIJNDAEL				12
501 #define   IPSECDOI_ESP_AES				12
502 
503 /* 4.4.1 IPSEC Security Protocol Identifiers */
504 #define IPSECDOI_PROTO_IPCOMP                        4
505   /* 4.4.5 IPSEC IPCOMP Transform Identifiers */
506 #define   IPSECDOI_IPCOMP_OUI                          1
507 #define   IPSECDOI_IPCOMP_DEFLATE                      2
508 #define   IPSECDOI_IPCOMP_LZS                          3
509 
510 /* 4.5 IPSEC Security Association Attributes */
511 #define IPSECDOI_ATTR_SA_LTYPE                1 /* B */
512 #define   IPSECDOI_ATTR_SA_LTYPE_DEFAULT        1
513 #define   IPSECDOI_ATTR_SA_LTYPE_SEC            1
514 #define   IPSECDOI_ATTR_SA_LTYPE_KB             2
515 #define IPSECDOI_ATTR_SA_LDUR                 2 /* V */
516 #define   IPSECDOI_ATTR_SA_LDUR_DEFAULT         28800 /* 8 hours */
517 #define IPSECDOI_ATTR_GRP_DESC                3 /* B */
518 #define IPSECDOI_ATTR_ENC_MODE                4 /* B */
519 	/* default value: host dependent */
520 #define   IPSECDOI_ATTR_ENC_MODE_TUNNEL         1
521 #define   IPSECDOI_ATTR_ENC_MODE_TRNS           2
522 #define IPSECDOI_ATTR_AUTH                    5 /* B */
523 	/* 0 means not to use authentication. */
524 #define   IPSECDOI_ATTR_AUTH_HMAC_MD5           1
525 #define   IPSECDOI_ATTR_AUTH_HMAC_SHA1          2
526 #define   IPSECDOI_ATTR_AUTH_DES_MAC            3
527 #define   IPSECDOI_ATTR_AUTH_KPDK               4 /*RFC-1826(Key/Pad/Data/Key)*/
528 	/*
529 	 * When negotiating ESP without authentication, the Auth
530 	 * Algorithm attribute MUST NOT be included in the proposal.
531 	 * When negotiating ESP without confidentiality, the Auth
532 	 * Algorithm attribute MUST be included in the proposal and
533 	 * the ESP transform ID must be ESP_NULL.
534 	*/
535 #define IPSECDOI_ATTR_KEY_LENGTH              6 /* B */
536 #define IPSECDOI_ATTR_KEY_ROUNDS              7 /* B */
537 #define IPSECDOI_ATTR_COMP_DICT_SIZE          8 /* B */
538 #define IPSECDOI_ATTR_COMP_PRIVALG            9 /* V */
539 
540 /* 4.6.1 Security Association Payload */
541 struct ipsecdoi_sa {
542 	struct isakmp_gen h;
543 	uint32_t doi; /* Domain of Interpretation */
544 	uint32_t sit; /* Situation */
545 };
546 
547 struct ipsecdoi_secrecy_h {
548 	uint16_t len;
549 	uint16_t reserved;
550 };
551 
552 /* 4.6.2.1 Identification Type Values */
553 struct ipsecdoi_id {
554 	struct isakmp_gen h;
555 	uint8_t  type;		/* ID Type */
556 	uint8_t  proto_id;	/* Protocol ID */
557 	uint16_t port;		/* Port */
558 	/* Identification Data */
559 };
560 
561 #define IPSECDOI_ID_IPV4_ADDR                        1
562 #define IPSECDOI_ID_FQDN                             2
563 #define IPSECDOI_ID_USER_FQDN                        3
564 #define IPSECDOI_ID_IPV4_ADDR_SUBNET                 4
565 #define IPSECDOI_ID_IPV6_ADDR                        5
566 #define IPSECDOI_ID_IPV6_ADDR_SUBNET                 6
567 #define IPSECDOI_ID_IPV4_ADDR_RANGE                  7
568 #define IPSECDOI_ID_IPV6_ADDR_RANGE                  8
569 #define IPSECDOI_ID_DER_ASN1_DN                      9
570 #define IPSECDOI_ID_DER_ASN1_GN                      10
571 #define IPSECDOI_ID_KEY_ID                           11
572 
573 /* 4.6.3 IPSEC DOI Notify Message Types */
574 /* Notify Messages - Status Types */
575 #define IPSECDOI_NTYPE_RESPONDER_LIFETIME                  24576
576 #define IPSECDOI_NTYPE_REPLAY_STATUS                       24577
577 #define IPSECDOI_NTYPE_INITIAL_CONTACT                     24578
578 
579 #define DECLARE_PRINTER(func) static const u_char *ike##func##_print( \
580 		netdissect_options *ndo, u_char tpay,	              \
581 		const struct isakmp_gen *ext,			      \
582 		u_int item_len, \
583 		const u_char *end_pointer, \
584 		uint32_t phase,\
585 		uint32_t doi0, \
586 		uint32_t proto0, int depth)
587 
588 DECLARE_PRINTER(v1_sa);
589 DECLARE_PRINTER(v1_p);
590 DECLARE_PRINTER(v1_t);
591 DECLARE_PRINTER(v1_ke);
592 DECLARE_PRINTER(v1_id);
593 DECLARE_PRINTER(v1_cert);
594 DECLARE_PRINTER(v1_cr);
595 DECLARE_PRINTER(v1_sig);
596 DECLARE_PRINTER(v1_hash);
597 DECLARE_PRINTER(v1_nonce);
598 DECLARE_PRINTER(v1_n);
599 DECLARE_PRINTER(v1_d);
600 DECLARE_PRINTER(v1_vid);
601 
602 DECLARE_PRINTER(v2_sa);
603 DECLARE_PRINTER(v2_ke);
604 DECLARE_PRINTER(v2_ID);
605 DECLARE_PRINTER(v2_cert);
606 DECLARE_PRINTER(v2_cr);
607 DECLARE_PRINTER(v2_auth);
608 DECLARE_PRINTER(v2_nonce);
609 DECLARE_PRINTER(v2_n);
610 DECLARE_PRINTER(v2_d);
611 DECLARE_PRINTER(v2_vid);
612 DECLARE_PRINTER(v2_TS);
613 DECLARE_PRINTER(v2_cp);
614 DECLARE_PRINTER(v2_eap);
615 
616 static const u_char *ikev2_e_print(netdissect_options *ndo,
617 				   struct isakmp *base,
618 				   u_char tpay,
619 				   const struct isakmp_gen *ext,
620 				   u_int item_len,
621 				   const u_char *end_pointer,
622 				   uint32_t phase,
623 				   uint32_t doi0,
624 				   uint32_t proto0, int depth);
625 
626 
627 static const u_char *ike_sub0_print(netdissect_options *ndo,u_char, const struct isakmp_gen *,
628 	const u_char *,	uint32_t, uint32_t, uint32_t, int);
629 static const u_char *ikev1_sub_print(netdissect_options *ndo,u_char, const struct isakmp_gen *,
630 	const u_char *, uint32_t, uint32_t, uint32_t, int);
631 
632 static const u_char *ikev2_sub_print(netdissect_options *ndo,
633 				     struct isakmp *base,
634 				     u_char np, const struct isakmp_gen *ext,
635 				     const u_char *ep, uint32_t phase,
636 				     uint32_t doi, uint32_t proto,
637 				     int depth);
638 
639 
640 static char *numstr(int);
641 
642 static void
643 ikev1_print(netdissect_options *ndo,
644 	    const u_char *bp,  u_int length,
645 	    const u_char *bp2, struct isakmp *base);
646 
647 #define MAXINITIATORS	20
648 static int ninitiator = 0;
649 union inaddr_u {
650 	struct in_addr in4;
651 	struct in6_addr in6;
652 };
653 static struct {
654 	cookie_t initiator;
655 	u_int version;
656 	union inaddr_u iaddr;
657 	union inaddr_u raddr;
658 } cookiecache[MAXINITIATORS];
659 
660 /* protocol id */
661 static const char *protoidstr[] = {
662 	NULL, "isakmp", "ipsec-ah", "ipsec-esp", "ipcomp",
663 };
664 
665 /* isakmp->np */
666 static const char *npstr[] = {
667 	"none", "sa", "p", "t", "ke", "id", "cert", "cr", "hash", /* 0 - 8 */
668 	"sig", "nonce", "n", "d", "vid",      /* 9 - 13 */
669 	"pay14", "pay15", "pay16", "pay17", "pay18", /* 14- 18 */
670 	"pay19", "pay20", "pay21", "pay22", "pay23", /* 19- 23 */
671 	"pay24", "pay25", "pay26", "pay27", "pay28", /* 24- 28 */
672 	"pay29", "pay30", "pay31", "pay32",          /* 29- 32 */
673 	"v2sa",  "v2ke",  "v2IDi", "v2IDr", "v2cert",/* 33- 37 */
674 	"v2cr",  "v2auth","v2nonce", "v2n",   "v2d",   /* 38- 42 */
675 	"v2vid", "v2TSi", "v2TSr", "v2e",   "v2cp",  /* 43- 47 */
676 	"v2eap",                                     /* 48 */
677 
678 };
679 
680 /* isakmp->np */
681 static const u_char *(*npfunc[])(netdissect_options *ndo, u_char tpay,
682 				 const struct isakmp_gen *ext,
683 				 u_int item_len,
684 				 const u_char *end_pointer,
685 				 uint32_t phase,
686 				 uint32_t doi0,
687 				 uint32_t proto0, int depth) = {
688 	NULL,
689 	ikev1_sa_print,
690 	ikev1_p_print,
691 	ikev1_t_print,
692 	ikev1_ke_print,
693 	ikev1_id_print,
694 	ikev1_cert_print,
695 	ikev1_cr_print,
696 	ikev1_hash_print,
697 	ikev1_sig_print,
698 	ikev1_nonce_print,
699 	ikev1_n_print,
700 	ikev1_d_print,
701 	ikev1_vid_print,                  /* 13 */
702 	NULL, NULL, NULL, NULL, NULL,     /* 14- 18 */
703 	NULL, NULL, NULL, NULL, NULL,     /* 19- 23 */
704 	NULL, NULL, NULL, NULL, NULL,     /* 24- 28 */
705 	NULL, NULL, NULL, NULL,           /* 29- 32 */
706 	ikev2_sa_print,                 /* 33 */
707 	ikev2_ke_print,                 /* 34 */
708 	ikev2_ID_print,                 /* 35 */
709 	ikev2_ID_print,                 /* 36 */
710 	ikev2_cert_print,               /* 37 */
711 	ikev2_cr_print,                 /* 38 */
712 	ikev2_auth_print,               /* 39 */
713 	ikev2_nonce_print,              /* 40 */
714 	ikev2_n_print,                  /* 41 */
715 	ikev2_d_print,                  /* 42 */
716 	ikev2_vid_print,                /* 43 */
717 	ikev2_TS_print,                 /* 44 */
718 	ikev2_TS_print,                 /* 45 */
719 	NULL, /* ikev2_e_print,*/       /* 46 - special */
720 	ikev2_cp_print,                 /* 47 */
721 	ikev2_eap_print,                /* 48 */
722 };
723 
724 /* isakmp->etype */
725 static const char *etypestr[] = {
726 /* IKEv1 exchange types */
727 	"none", "base", "ident", "auth", "agg", "inf", NULL, NULL,  /* 0-7 */
728 	NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,  /*  8-15 */
729 	NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,  /* 16-23 */
730 	NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,  /* 24-31 */
731 	"oakley-quick", "oakley-newgroup",               /* 32-33 */
732 /* IKEv2 exchange types */
733 	"ikev2_init", "ikev2_auth", "child_sa", "inf2"   /* 34-37 */
734 };
735 
736 #define STR_OR_ID(x, tab) \
737 	(((x) < sizeof(tab)/sizeof(tab[0]) && tab[(x)])	? tab[(x)] : numstr(x))
738 #define PROTOIDSTR(x)	STR_OR_ID(x, protoidstr)
739 #define NPSTR(x)	STR_OR_ID(x, npstr)
740 #define ETYPESTR(x)	STR_OR_ID(x, etypestr)
741 
742 #define CHECKLEN(p, np)							\
743 		if (ep < (const u_char *)(p)) {				\
744 			ND_PRINT((ndo," [|%s]", NPSTR(np)));		\
745 			goto done;					\
746 		}
747 
748 
749 #define NPFUNC(x) \
750 	(((x) < sizeof(npfunc)/sizeof(npfunc[0]) && npfunc[(x)]) \
751 		? npfunc[(x)] : NULL)
752 
753 static int
754 iszero(const u_char *p, size_t l)
755 {
756 	while (l--) {
757 		if (*p++)
758 			return 0;
759 	}
760 	return 1;
761 }
762 
763 /* find cookie from initiator cache */
764 static int
765 cookie_find(cookie_t *in)
766 {
767 	int i;
768 
769 	for (i = 0; i < MAXINITIATORS; i++) {
770 		if (memcmp(in, &cookiecache[i].initiator, sizeof(*in)) == 0)
771 			return i;
772 	}
773 
774 	return -1;
775 }
776 
777 /* record initiator */
778 static void
779 cookie_record(cookie_t *in, const u_char *bp2)
780 {
781 	int i;
782 	const struct ip *ip;
783 	const struct ip6_hdr *ip6;
784 
785 	i = cookie_find(in);
786 	if (0 <= i) {
787 		ninitiator = (i + 1) % MAXINITIATORS;
788 		return;
789 	}
790 
791 	ip = (const struct ip *)bp2;
792 	switch (IP_V(ip)) {
793 	case 4:
794 		cookiecache[ninitiator].version = 4;
795 		UNALIGNED_MEMCPY(&cookiecache[ninitiator].iaddr.in4, &ip->ip_src, sizeof(struct in_addr));
796 		UNALIGNED_MEMCPY(&cookiecache[ninitiator].raddr.in4, &ip->ip_dst, sizeof(struct in_addr));
797 		break;
798 	case 6:
799 		ip6 = (const struct ip6_hdr *)bp2;
800 		cookiecache[ninitiator].version = 6;
801 		UNALIGNED_MEMCPY(&cookiecache[ninitiator].iaddr.in6, &ip6->ip6_src, sizeof(struct in6_addr));
802 		UNALIGNED_MEMCPY(&cookiecache[ninitiator].raddr.in6, &ip6->ip6_dst, sizeof(struct in6_addr));
803 		break;
804 	default:
805 		return;
806 	}
807 	UNALIGNED_MEMCPY(&cookiecache[ninitiator].initiator, in, sizeof(*in));
808 	ninitiator = (ninitiator + 1) % MAXINITIATORS;
809 }
810 
811 #define cookie_isinitiator(x, y)	cookie_sidecheck((x), (y), 1)
812 #define cookie_isresponder(x, y)	cookie_sidecheck((x), (y), 0)
813 static int
814 cookie_sidecheck(int i, const u_char *bp2, int initiator)
815 {
816 	const struct ip *ip;
817 	const struct ip6_hdr *ip6;
818 
819 	ip = (const struct ip *)bp2;
820 	switch (IP_V(ip)) {
821 	case 4:
822 		if (cookiecache[i].version != 4)
823 			return 0;
824 		if (initiator) {
825 			if (UNALIGNED_MEMCMP(&ip->ip_src, &cookiecache[i].iaddr.in4, sizeof(struct in_addr)) == 0)
826 				return 1;
827 		} else {
828 			if (UNALIGNED_MEMCMP(&ip->ip_src, &cookiecache[i].raddr.in4, sizeof(struct in_addr)) == 0)
829 				return 1;
830 		}
831 		break;
832 	case 6:
833 		if (cookiecache[i].version != 6)
834 			return 0;
835 		ip6 = (const struct ip6_hdr *)bp2;
836 		if (initiator) {
837 			if (UNALIGNED_MEMCMP(&ip6->ip6_src, &cookiecache[i].iaddr.in6, sizeof(struct in6_addr)) == 0)
838 				return 1;
839 		} else {
840 			if (UNALIGNED_MEMCMP(&ip6->ip6_src, &cookiecache[i].raddr.in6, sizeof(struct in6_addr)) == 0)
841 				return 1;
842 		}
843 		break;
844 	default:
845 		break;
846 	}
847 
848 	return 0;
849 }
850 
851 static void
852 hexprint(netdissect_options *ndo, const uint8_t *loc, size_t len)
853 {
854 	const uint8_t *p;
855 	size_t i;
856 
857 	p = loc;
858 	for (i = 0; i < len; i++)
859 		ND_PRINT((ndo,"%02x", p[i] & 0xff));
860 }
861 
862 static int
863 rawprint(netdissect_options *ndo, const uint8_t *loc, size_t len)
864 {
865 	ND_TCHECK2(*loc, len);
866 
867 	hexprint(ndo, loc, len);
868 	return 1;
869 trunc:
870 	return 0;
871 }
872 
873 
874 /*
875  * returns false if we run out of data buffer
876  */
877 static int ike_show_somedata(netdissect_options *ndo,
878 			     const u_char *cp, const u_char *ep)
879 {
880 	/* there is too much data, just show some of it */
881 	const u_char *end = ep - 20;
882 	int  elen = 20;
883 	int   len = ep - cp;
884 	if(len > 10) {
885 		len = 10;
886 	}
887 
888 	/* really shouldn't happen because of above */
889 	if(end < cp + len) {
890 		end = cp+len;
891 		elen = ep - end;
892 	}
893 
894 	ND_PRINT((ndo," data=("));
895 	if(!rawprint(ndo, (const uint8_t *)(cp), len)) goto trunc;
896 	ND_PRINT((ndo, "..."));
897 	if(elen) {
898 		if(!rawprint(ndo, (const uint8_t *)(end), elen)) goto trunc;
899 	}
900 	ND_PRINT((ndo,")"));
901 	return 1;
902 
903 trunc:
904 	return 0;
905 }
906 
907 struct attrmap {
908 	const char *type;
909 	u_int nvalue;
910 	const char *value[30];	/*XXX*/
911 };
912 
913 static const u_char *
914 ikev1_attrmap_print(netdissect_options *ndo,
915 		    const u_char *p, const u_char *ep2,
916 		    const struct attrmap *map, size_t nmap)
917 {
918 	int totlen;
919 	uint32_t t, v;
920 
921 	ND_TCHECK(p[0]);
922 	if (p[0] & 0x80)
923 		totlen = 4;
924 	else {
925 		ND_TCHECK_16BITS(&p[2]);
926 		totlen = 4 + EXTRACT_16BITS(&p[2]);
927 	}
928 	if (ep2 < p + totlen) {
929 		ND_PRINT((ndo,"[|attr]"));
930 		return ep2 + 1;
931 	}
932 
933 	ND_TCHECK_16BITS(&p[0]);
934 	ND_PRINT((ndo,"("));
935 	t = EXTRACT_16BITS(&p[0]) & 0x7fff;
936 	if (map && t < nmap && map[t].type)
937 		ND_PRINT((ndo,"type=%s ", map[t].type));
938 	else
939 		ND_PRINT((ndo,"type=#%d ", t));
940 	if (p[0] & 0x80) {
941 		ND_PRINT((ndo,"value="));
942 		ND_TCHECK_16BITS(&p[2]);
943 		v = EXTRACT_16BITS(&p[2]);
944 		if (map && t < nmap && v < map[t].nvalue && map[t].value[v])
945 			ND_PRINT((ndo,"%s", map[t].value[v]));
946 		else {
947 			if (!rawprint(ndo, (const uint8_t *)&p[2], 2)) {
948 				ND_PRINT((ndo,")"));
949 				goto trunc;
950 			}
951 		}
952 	} else {
953 		ND_PRINT((ndo,"len=%d value=", totlen - 4));
954 		if (!rawprint(ndo, (const uint8_t *)&p[4], totlen - 4)) {
955 			ND_PRINT((ndo,")"));
956 			goto trunc;
957 		}
958 	}
959 	ND_PRINT((ndo,")"));
960 	return p + totlen;
961 
962 trunc:
963 	return NULL;
964 }
965 
966 static const u_char *
967 ikev1_attr_print(netdissect_options *ndo, const u_char *p, const u_char *ep2)
968 {
969 	int totlen;
970 	uint32_t t;
971 
972 	ND_TCHECK(p[0]);
973 	if (p[0] & 0x80)
974 		totlen = 4;
975 	else {
976 		ND_TCHECK_16BITS(&p[2]);
977 		totlen = 4 + EXTRACT_16BITS(&p[2]);
978 	}
979 	if (ep2 < p + totlen) {
980 		ND_PRINT((ndo,"[|attr]"));
981 		return ep2 + 1;
982 	}
983 
984 	ND_TCHECK_16BITS(&p[0]);
985 	ND_PRINT((ndo,"("));
986 	t = EXTRACT_16BITS(&p[0]) & 0x7fff;
987 	ND_PRINT((ndo,"type=#%d ", t));
988 	if (p[0] & 0x80) {
989 		ND_PRINT((ndo,"value="));
990 		t = p[2];
991 		if (!rawprint(ndo, (const uint8_t *)&p[2], 2)) {
992 			ND_PRINT((ndo,")"));
993 			goto trunc;
994 		}
995 	} else {
996 		ND_PRINT((ndo,"len=%d value=", totlen - 4));
997 		if (!rawprint(ndo, (const uint8_t *)&p[4], totlen - 4)) {
998 			ND_PRINT((ndo,")"));
999 			goto trunc;
1000 		}
1001 	}
1002 	ND_PRINT((ndo,")"));
1003 	return p + totlen;
1004 
1005 trunc:
1006 	return NULL;
1007 }
1008 
1009 static const u_char *
1010 ikev1_sa_print(netdissect_options *ndo, u_char tpay _U_,
1011 	       const struct isakmp_gen *ext,
1012 		u_int item_len _U_,
1013 		const u_char *ep, uint32_t phase, uint32_t doi0 _U_,
1014 		uint32_t proto0, int depth)
1015 {
1016 	const struct ikev1_pl_sa *p;
1017 	struct ikev1_pl_sa sa;
1018 	uint32_t doi, sit, ident;
1019 	const u_char *cp, *np;
1020 	int t;
1021 
1022 	ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_SA)));
1023 
1024 	p = (const struct ikev1_pl_sa *)ext;
1025 	ND_TCHECK(*p);
1026 	UNALIGNED_MEMCPY(&sa, ext, sizeof(sa));
1027 	doi = ntohl(sa.doi);
1028 	sit = ntohl(sa.sit);
1029 	if (doi != 1) {
1030 		ND_PRINT((ndo," doi=%d", doi));
1031 		ND_PRINT((ndo," situation=%u", (uint32_t)ntohl(sa.sit)));
1032 		return (const u_char *)(p + 1);
1033 	}
1034 
1035 	ND_PRINT((ndo," doi=ipsec"));
1036 	ND_PRINT((ndo," situation="));
1037 	t = 0;
1038 	if (sit & 0x01) {
1039 		ND_PRINT((ndo,"identity"));
1040 		t++;
1041 	}
1042 	if (sit & 0x02) {
1043 		ND_PRINT((ndo,"%ssecrecy", t ? "+" : ""));
1044 		t++;
1045 	}
1046 	if (sit & 0x04)
1047 		ND_PRINT((ndo,"%sintegrity", t ? "+" : ""));
1048 
1049 	np = (const u_char *)ext + sizeof(sa);
1050 	if (sit != 0x01) {
1051 		ND_TCHECK2(*(ext + 1), sizeof(ident));
1052 		UNALIGNED_MEMCPY(&ident, ext + 1, sizeof(ident));
1053 		ND_PRINT((ndo," ident=%u", (uint32_t)ntohl(ident)));
1054 		np += sizeof(ident);
1055 	}
1056 
1057 	ext = (const struct isakmp_gen *)np;
1058 	ND_TCHECK(*ext);
1059 
1060 	cp = ikev1_sub_print(ndo, ISAKMP_NPTYPE_P, ext, ep, phase, doi, proto0,
1061 		depth);
1062 
1063 	return cp;
1064 trunc:
1065 	ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_SA)));
1066 	return NULL;
1067 }
1068 
1069 static const u_char *
1070 ikev1_p_print(netdissect_options *ndo, u_char tpay _U_,
1071 	      const struct isakmp_gen *ext, u_int item_len _U_,
1072 	       const u_char *ep, uint32_t phase, uint32_t doi0,
1073 	       uint32_t proto0 _U_, int depth)
1074 {
1075 	const struct ikev1_pl_p *p;
1076 	struct ikev1_pl_p prop;
1077 	const u_char *cp;
1078 
1079 	ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_P)));
1080 
1081 	p = (const struct ikev1_pl_p *)ext;
1082 	ND_TCHECK(*p);
1083 	UNALIGNED_MEMCPY(&prop, ext, sizeof(prop));
1084 	ND_PRINT((ndo," #%d protoid=%s transform=%d",
1085 		  prop.p_no, PROTOIDSTR(prop.prot_id), prop.num_t));
1086 	if (prop.spi_size) {
1087 		ND_PRINT((ndo," spi="));
1088 		if (!rawprint(ndo, (const uint8_t *)(p + 1), prop.spi_size))
1089 			goto trunc;
1090 	}
1091 
1092 	ext = (const struct isakmp_gen *)((const u_char *)(p + 1) + prop.spi_size);
1093 	ND_TCHECK(*ext);
1094 
1095 	cp = ikev1_sub_print(ndo, ISAKMP_NPTYPE_T, ext, ep, phase, doi0,
1096 			     prop.prot_id, depth);
1097 
1098 	return cp;
1099 trunc:
1100 	ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_P)));
1101 	return NULL;
1102 }
1103 
1104 static const char *ikev1_p_map[] = {
1105 	NULL, "ike",
1106 };
1107 
1108 static const char *ikev2_t_type_map[]={
1109 	NULL, "encr", "prf", "integ", "dh", "esn"
1110 };
1111 
1112 static const char *ah_p_map[] = {
1113 	NULL, "(reserved)", "md5", "sha", "1des",
1114 	"sha2-256", "sha2-384", "sha2-512",
1115 };
1116 
1117 static const char *prf_p_map[] = {
1118 	NULL, "hmac-md5", "hmac-sha", "hmac-tiger",
1119 	"aes128_xcbc"
1120 };
1121 
1122 static const char *integ_p_map[] = {
1123 	NULL, "hmac-md5", "hmac-sha", "dec-mac",
1124 	"kpdk-md5", "aes-xcbc"
1125 };
1126 
1127 static const char *esn_p_map[] = {
1128 	"no-esn", "esn"
1129 };
1130 
1131 static const char *dh_p_map[] = {
1132 	NULL, "modp768",
1133 	"modp1024",    /* group 2 */
1134 	"EC2N 2^155",  /* group 3 */
1135 	"EC2N 2^185",  /* group 4 */
1136 	"modp1536",    /* group 5 */
1137 	"iana-grp06", "iana-grp07", /* reserved */
1138 	"iana-grp08", "iana-grp09",
1139 	"iana-grp10", "iana-grp11",
1140 	"iana-grp12", "iana-grp13",
1141 	"modp2048",    /* group 14 */
1142 	"modp3072",    /* group 15 */
1143 	"modp4096",    /* group 16 */
1144 	"modp6144",    /* group 17 */
1145 	"modp8192",    /* group 18 */
1146 };
1147 
1148 static const char *esp_p_map[] = {
1149 	NULL, "1des-iv64", "1des", "3des", "rc5", "idea", "cast",
1150 	"blowfish", "3idea", "1des-iv32", "rc4", "null", "aes"
1151 };
1152 
1153 static const char *ipcomp_p_map[] = {
1154 	NULL, "oui", "deflate", "lzs",
1155 };
1156 
1157 static const struct attrmap ipsec_t_map[] = {
1158 	{ NULL,	0, { NULL } },
1159 	{ "lifetype", 3, { NULL, "sec", "kb", }, },
1160 	{ "life", 0, { NULL } },
1161 	{ "group desc", 18,	{ NULL, "modp768",
1162 				  "modp1024",    /* group 2 */
1163 				  "EC2N 2^155",  /* group 3 */
1164 				  "EC2N 2^185",  /* group 4 */
1165 				  "modp1536",    /* group 5 */
1166 				  "iana-grp06", "iana-grp07", /* reserved */
1167 				  "iana-grp08", "iana-grp09",
1168 				  "iana-grp10", "iana-grp11",
1169 				  "iana-grp12", "iana-grp13",
1170 				  "modp2048",    /* group 14 */
1171 				  "modp3072",    /* group 15 */
1172 				  "modp4096",    /* group 16 */
1173 				  "modp6144",    /* group 17 */
1174 				  "modp8192",    /* group 18 */
1175 		}, },
1176 	{ "enc mode", 3, { NULL, "tunnel", "transport", }, },
1177 	{ "auth", 5, { NULL, "hmac-md5", "hmac-sha1", "1des-mac", "keyed", }, },
1178 	{ "keylen", 0, { NULL } },
1179 	{ "rounds", 0, { NULL } },
1180 	{ "dictsize", 0, { NULL } },
1181 	{ "privalg", 0, { NULL } },
1182 };
1183 
1184 static const struct attrmap encr_t_map[] = {
1185 	{ NULL,	0, { NULL } }, 	{ NULL,	0, { NULL } },  /* 0, 1 */
1186 	{ NULL,	0, { NULL } },	{ NULL,	0, { NULL } },  /* 2, 3 */
1187 	{ NULL,	0, { NULL } },	{ NULL,	0, { NULL } },  /* 4, 5 */
1188 	{ NULL,	0, { NULL } },	{ NULL,	0, { NULL } },  /* 6, 7 */
1189 	{ NULL,	0, { NULL } },	{ NULL,	0, { NULL } },  /* 8, 9 */
1190 	{ NULL,	0, { NULL } },	{ NULL,	0, { NULL } },  /* 10,11*/
1191 	{ NULL,	0, { NULL } },	{ NULL,	0, { NULL } },  /* 12,13*/
1192 	{ "keylen", 14, { NULL }},
1193 };
1194 
1195 static const struct attrmap oakley_t_map[] = {
1196 	{ NULL,	0, { NULL } },
1197 	{ "enc", 8,	{ NULL, "1des", "idea", "blowfish", "rc5",
1198 		 	  "3des", "cast", "aes", }, },
1199 	{ "hash", 7,	{ NULL, "md5", "sha1", "tiger",
1200 			  "sha2-256", "sha2-384", "sha2-512", }, },
1201 	{ "auth", 6,	{ NULL, "preshared", "dss", "rsa sig", "rsa enc",
1202 			  "rsa enc revised", }, },
1203 	{ "group desc", 18,	{ NULL, "modp768",
1204 				  "modp1024",    /* group 2 */
1205 				  "EC2N 2^155",  /* group 3 */
1206 				  "EC2N 2^185",  /* group 4 */
1207 				  "modp1536",    /* group 5 */
1208 				  "iana-grp06", "iana-grp07", /* reserved */
1209 				  "iana-grp08", "iana-grp09",
1210 				  "iana-grp10", "iana-grp11",
1211 				  "iana-grp12", "iana-grp13",
1212 				  "modp2048",    /* group 14 */
1213 				  "modp3072",    /* group 15 */
1214 				  "modp4096",    /* group 16 */
1215 				  "modp6144",    /* group 17 */
1216 				  "modp8192",    /* group 18 */
1217 		}, },
1218 	{ "group type", 4,	{ NULL, "MODP", "ECP", "EC2N", }, },
1219 	{ "group prime", 0, { NULL } },
1220 	{ "group gen1", 0, { NULL } },
1221 	{ "group gen2", 0, { NULL } },
1222 	{ "group curve A", 0, { NULL } },
1223 	{ "group curve B", 0, { NULL } },
1224 	{ "lifetype", 3,	{ NULL, "sec", "kb", }, },
1225 	{ "lifeduration", 0, { NULL } },
1226 	{ "prf", 0, { NULL } },
1227 	{ "keylen", 0, { NULL } },
1228 	{ "field", 0, { NULL } },
1229 	{ "order", 0, { NULL } },
1230 };
1231 
1232 static const u_char *
1233 ikev1_t_print(netdissect_options *ndo, u_char tpay _U_,
1234 	      const struct isakmp_gen *ext, u_int item_len,
1235 	      const u_char *ep, uint32_t phase _U_, uint32_t doi _U_,
1236 	      uint32_t proto, int depth _U_)
1237 {
1238 	const struct ikev1_pl_t *p;
1239 	struct ikev1_pl_t t;
1240 	const u_char *cp;
1241 	const char *idstr;
1242 	const struct attrmap *map;
1243 	size_t nmap;
1244 	const u_char *ep2;
1245 
1246 	ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_T)));
1247 
1248 	p = (const struct ikev1_pl_t *)ext;
1249 	ND_TCHECK(*p);
1250 	UNALIGNED_MEMCPY(&t, ext, sizeof(t));
1251 
1252 	switch (proto) {
1253 	case 1:
1254 		idstr = STR_OR_ID(t.t_id, ikev1_p_map);
1255 		map = oakley_t_map;
1256 		nmap = sizeof(oakley_t_map)/sizeof(oakley_t_map[0]);
1257 		break;
1258 	case 2:
1259 		idstr = STR_OR_ID(t.t_id, ah_p_map);
1260 		map = ipsec_t_map;
1261 		nmap = sizeof(ipsec_t_map)/sizeof(ipsec_t_map[0]);
1262 		break;
1263 	case 3:
1264 		idstr = STR_OR_ID(t.t_id, esp_p_map);
1265 		map = ipsec_t_map;
1266 		nmap = sizeof(ipsec_t_map)/sizeof(ipsec_t_map[0]);
1267 		break;
1268 	case 4:
1269 		idstr = STR_OR_ID(t.t_id, ipcomp_p_map);
1270 		map = ipsec_t_map;
1271 		nmap = sizeof(ipsec_t_map)/sizeof(ipsec_t_map[0]);
1272 		break;
1273 	default:
1274 		idstr = NULL;
1275 		map = NULL;
1276 		nmap = 0;
1277 		break;
1278 	}
1279 
1280 	if (idstr)
1281 		ND_PRINT((ndo," #%d id=%s ", t.t_no, idstr));
1282 	else
1283 		ND_PRINT((ndo," #%d id=%d ", t.t_no, t.t_id));
1284 	cp = (const u_char *)(p + 1);
1285 	ep2 = (const u_char *)p + item_len;
1286 	while (cp < ep && cp < ep2) {
1287 		if (map && nmap)
1288 			cp = ikev1_attrmap_print(ndo, cp, ep2, map, nmap);
1289 		else
1290 			cp = ikev1_attr_print(ndo, cp, ep2);
1291 		if (cp == NULL)
1292 			goto trunc;
1293 	}
1294 	if (ep < ep2)
1295 		ND_PRINT((ndo,"..."));
1296 	return cp;
1297 trunc:
1298 	ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_T)));
1299 	return NULL;
1300 }
1301 
1302 static const u_char *
1303 ikev1_ke_print(netdissect_options *ndo, u_char tpay _U_,
1304 	       const struct isakmp_gen *ext, u_int item_len _U_,
1305 	       const u_char *ep _U_, uint32_t phase _U_, uint32_t doi _U_,
1306 	       uint32_t proto _U_, int depth _U_)
1307 {
1308 	struct isakmp_gen e;
1309 
1310 	ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_KE)));
1311 
1312 	ND_TCHECK(*ext);
1313 	UNALIGNED_MEMCPY(&e, ext, sizeof(e));
1314 	ND_PRINT((ndo," key len=%d", ntohs(e.len) - 4));
1315 	if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1316 		/* Print the entire payload in hex */
1317 		ND_PRINT((ndo," "));
1318 		if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4))
1319 			goto trunc;
1320 	}
1321 	return (const u_char *)ext + ntohs(e.len);
1322 trunc:
1323 	ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_KE)));
1324 	return NULL;
1325 }
1326 
1327 static const u_char *
1328 ikev1_id_print(netdissect_options *ndo, u_char tpay _U_,
1329 	       const struct isakmp_gen *ext, u_int item_len,
1330 	       const u_char *ep _U_, uint32_t phase, uint32_t doi _U_,
1331 	       uint32_t proto _U_, int depth _U_)
1332 {
1333 #define USE_IPSECDOI_IN_PHASE1	1
1334 	const struct ikev1_pl_id *p;
1335 	struct ikev1_pl_id id;
1336 	static const char *idtypestr[] = {
1337 		"IPv4", "IPv4net", "IPv6", "IPv6net",
1338 	};
1339 	static const char *ipsecidtypestr[] = {
1340 		NULL, "IPv4", "FQDN", "user FQDN", "IPv4net", "IPv6",
1341 		"IPv6net", "IPv4range", "IPv6range", "ASN1 DN", "ASN1 GN",
1342 		"keyid",
1343 	};
1344 	int len;
1345 	const u_char *data;
1346 
1347 	ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_ID)));
1348 
1349 	p = (const struct ikev1_pl_id *)ext;
1350 	ND_TCHECK(*p);
1351 	UNALIGNED_MEMCPY(&id, ext, sizeof(id));
1352 	if (sizeof(*p) < item_len) {
1353 		data = (const u_char *)(p + 1);
1354 		len = item_len - sizeof(*p);
1355 	} else {
1356 		data = NULL;
1357 		len = 0;
1358 	}
1359 
1360 #if 0 /*debug*/
1361 	ND_PRINT((ndo," [phase=%d doi=%d proto=%d]", phase, doi, proto));
1362 #endif
1363 	switch (phase) {
1364 #ifndef USE_IPSECDOI_IN_PHASE1
1365 	case 1:
1366 #endif
1367 	default:
1368 		ND_PRINT((ndo," idtype=%s", STR_OR_ID(id.d.id_type, idtypestr)));
1369 		ND_PRINT((ndo," doi_data=%u",
1370 			  (uint32_t)(ntohl(id.d.doi_data) & 0xffffff)));
1371 		break;
1372 
1373 #ifdef USE_IPSECDOI_IN_PHASE1
1374 	case 1:
1375 #endif
1376 	case 2:
1377 	    {
1378 		const struct ipsecdoi_id *doi_p;
1379 		struct ipsecdoi_id doi_id;
1380 		const char *p_name;
1381 
1382 		doi_p = (const struct ipsecdoi_id *)ext;
1383 		ND_TCHECK(*doi_p);
1384 		UNALIGNED_MEMCPY(&doi_id, ext, sizeof(doi_id));
1385 		ND_PRINT((ndo," idtype=%s", STR_OR_ID(doi_id.type, ipsecidtypestr)));
1386 		/* A protocol ID of 0 DOES NOT mean IPPROTO_IP! */
1387 		if (!ndo->ndo_nflag && doi_id.proto_id && (p_name = netdb_protoname(doi_id.proto_id)) != NULL)
1388 			ND_PRINT((ndo," protoid=%s", p_name));
1389 		else
1390 			ND_PRINT((ndo," protoid=%u", doi_id.proto_id));
1391 		ND_PRINT((ndo," port=%d", ntohs(doi_id.port)));
1392 		if (!len)
1393 			break;
1394 		if (data == NULL)
1395 			goto trunc;
1396 		ND_TCHECK2(*data, len);
1397 		switch (doi_id.type) {
1398 		case IPSECDOI_ID_IPV4_ADDR:
1399 			if (len < 4)
1400 				ND_PRINT((ndo," len=%d [bad: < 4]", len));
1401 			else
1402 				ND_PRINT((ndo," len=%d %s", len, ipaddr_string(ndo, data)));
1403 			len = 0;
1404 			break;
1405 		case IPSECDOI_ID_FQDN:
1406 		case IPSECDOI_ID_USER_FQDN:
1407 		    {
1408 			int i;
1409 			ND_PRINT((ndo," len=%d ", len));
1410 			for (i = 0; i < len; i++)
1411 				safeputchar(ndo, data[i]);
1412 			len = 0;
1413 			break;
1414 		    }
1415 		case IPSECDOI_ID_IPV4_ADDR_SUBNET:
1416 		    {
1417 			const u_char *mask;
1418 			if (len < 8)
1419 				ND_PRINT((ndo," len=%d [bad: < 8]", len));
1420 			else {
1421 				mask = data + sizeof(struct in_addr);
1422 				ND_PRINT((ndo," len=%d %s/%u.%u.%u.%u", len,
1423 					  ipaddr_string(ndo, data),
1424 					  mask[0], mask[1], mask[2], mask[3]));
1425 			}
1426 			len = 0;
1427 			break;
1428 		    }
1429 		case IPSECDOI_ID_IPV6_ADDR:
1430 			if (len < 16)
1431 				ND_PRINT((ndo," len=%d [bad: < 16]", len));
1432 			else
1433 				ND_PRINT((ndo," len=%d %s", len, ip6addr_string(ndo, data)));
1434 			len = 0;
1435 			break;
1436 		case IPSECDOI_ID_IPV6_ADDR_SUBNET:
1437 		    {
1438 			const u_char *mask;
1439 			if (len < 32)
1440 				ND_PRINT((ndo," len=%d [bad: < 32]", len));
1441 			else {
1442 				mask = (const u_char *)(data + sizeof(struct in6_addr));
1443 				/*XXX*/
1444 				ND_PRINT((ndo," len=%d %s/0x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x", len,
1445 					  ip6addr_string(ndo, data),
1446 					  mask[0], mask[1], mask[2], mask[3],
1447 					  mask[4], mask[5], mask[6], mask[7],
1448 					  mask[8], mask[9], mask[10], mask[11],
1449 					  mask[12], mask[13], mask[14], mask[15]));
1450 			}
1451 			len = 0;
1452 			break;
1453 		    }
1454 		case IPSECDOI_ID_IPV4_ADDR_RANGE:
1455 			if (len < 8)
1456 				ND_PRINT((ndo," len=%d [bad: < 8]", len));
1457 			else {
1458 				ND_PRINT((ndo," len=%d %s-%s", len,
1459 					  ipaddr_string(ndo, data),
1460 					  ipaddr_string(ndo, data + sizeof(struct in_addr))));
1461 			}
1462 			len = 0;
1463 			break;
1464 		case IPSECDOI_ID_IPV6_ADDR_RANGE:
1465 			if (len < 32)
1466 				ND_PRINT((ndo," len=%d [bad: < 32]", len));
1467 			else {
1468 				ND_PRINT((ndo," len=%d %s-%s", len,
1469 					  ip6addr_string(ndo, data),
1470 					  ip6addr_string(ndo, data + sizeof(struct in6_addr))));
1471 			}
1472 			len = 0;
1473 			break;
1474 		case IPSECDOI_ID_DER_ASN1_DN:
1475 		case IPSECDOI_ID_DER_ASN1_GN:
1476 		case IPSECDOI_ID_KEY_ID:
1477 			break;
1478 		}
1479 		break;
1480 	    }
1481 	}
1482 	if (data && len) {
1483 		ND_PRINT((ndo," len=%d", len));
1484 		if (2 < ndo->ndo_vflag) {
1485 			ND_PRINT((ndo," "));
1486 			if (!rawprint(ndo, (const uint8_t *)data, len))
1487 				goto trunc;
1488 		}
1489 	}
1490 	return (const u_char *)ext + item_len;
1491 trunc:
1492 	ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_ID)));
1493 	return NULL;
1494 }
1495 
1496 static const u_char *
1497 ikev1_cert_print(netdissect_options *ndo, u_char tpay _U_,
1498 		 const struct isakmp_gen *ext, u_int item_len,
1499 		 const u_char *ep _U_, uint32_t phase _U_,
1500 		 uint32_t doi0 _U_,
1501 		 uint32_t proto0 _U_, int depth _U_)
1502 {
1503 	const struct ikev1_pl_cert *p;
1504 	struct ikev1_pl_cert cert;
1505 	static const char *certstr[] = {
1506 		"none",	"pkcs7", "pgp", "dns",
1507 		"x509sign", "x509ke", "kerberos", "crl",
1508 		"arl", "spki", "x509attr",
1509 	};
1510 
1511 	ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_CERT)));
1512 
1513 	p = (const struct ikev1_pl_cert *)ext;
1514 	ND_TCHECK(*p);
1515 	UNALIGNED_MEMCPY(&cert, ext, sizeof(cert));
1516 	ND_PRINT((ndo," len=%d", item_len - 4));
1517 	ND_PRINT((ndo," type=%s", STR_OR_ID((cert.encode), certstr)));
1518 	if (2 < ndo->ndo_vflag && 4 < item_len) {
1519 		/* Print the entire payload in hex */
1520 		ND_PRINT((ndo," "));
1521 		if (!rawprint(ndo, (const uint8_t *)(ext + 1), item_len - 4))
1522 			goto trunc;
1523 	}
1524 	return (const u_char *)ext + item_len;
1525 trunc:
1526 	ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_CERT)));
1527 	return NULL;
1528 }
1529 
1530 static const u_char *
1531 ikev1_cr_print(netdissect_options *ndo, u_char tpay _U_,
1532 	       const struct isakmp_gen *ext, u_int item_len,
1533 	       const u_char *ep _U_, uint32_t phase _U_, uint32_t doi0 _U_,
1534 	       uint32_t proto0 _U_, int depth _U_)
1535 {
1536 	const struct ikev1_pl_cert *p;
1537 	struct ikev1_pl_cert cert;
1538 	static const char *certstr[] = {
1539 		"none",	"pkcs7", "pgp", "dns",
1540 		"x509sign", "x509ke", "kerberos", "crl",
1541 		"arl", "spki", "x509attr",
1542 	};
1543 
1544 	ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_CR)));
1545 
1546 	p = (const struct ikev1_pl_cert *)ext;
1547 	ND_TCHECK(*p);
1548 	UNALIGNED_MEMCPY(&cert, ext, sizeof(cert));
1549 	ND_PRINT((ndo," len=%d", item_len - 4));
1550 	ND_PRINT((ndo," type=%s", STR_OR_ID((cert.encode), certstr)));
1551 	if (2 < ndo->ndo_vflag && 4 < item_len) {
1552 		/* Print the entire payload in hex */
1553 		ND_PRINT((ndo," "));
1554 		if (!rawprint(ndo, (const uint8_t *)(ext + 1), item_len - 4))
1555 			goto trunc;
1556 	}
1557 	return (const u_char *)ext + item_len;
1558 trunc:
1559 	ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_CR)));
1560 	return NULL;
1561 }
1562 
1563 static const u_char *
1564 ikev1_hash_print(netdissect_options *ndo, u_char tpay _U_,
1565 		 const struct isakmp_gen *ext, u_int item_len _U_,
1566 		 const u_char *ep _U_, uint32_t phase _U_, uint32_t doi _U_,
1567 		 uint32_t proto _U_, int depth _U_)
1568 {
1569 	struct isakmp_gen e;
1570 
1571 	ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_HASH)));
1572 
1573 	ND_TCHECK(*ext);
1574 	UNALIGNED_MEMCPY(&e, ext, sizeof(e));
1575 	ND_PRINT((ndo," len=%d", ntohs(e.len) - 4));
1576 	if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1577 		/* Print the entire payload in hex */
1578 		ND_PRINT((ndo," "));
1579 		if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4))
1580 			goto trunc;
1581 	}
1582 	return (const u_char *)ext + ntohs(e.len);
1583 trunc:
1584 	ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_HASH)));
1585 	return NULL;
1586 }
1587 
1588 static const u_char *
1589 ikev1_sig_print(netdissect_options *ndo, u_char tpay _U_,
1590 		const struct isakmp_gen *ext, u_int item_len _U_,
1591 		const u_char *ep _U_, uint32_t phase _U_, uint32_t doi _U_,
1592 		uint32_t proto _U_, int depth _U_)
1593 {
1594 	struct isakmp_gen e;
1595 
1596 	ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_SIG)));
1597 
1598 	ND_TCHECK(*ext);
1599 	UNALIGNED_MEMCPY(&e, ext, sizeof(e));
1600 	ND_PRINT((ndo," len=%d", ntohs(e.len) - 4));
1601 	if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1602 		/* Print the entire payload in hex */
1603 		ND_PRINT((ndo," "));
1604 		if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4))
1605 			goto trunc;
1606 	}
1607 	return (const u_char *)ext + ntohs(e.len);
1608 trunc:
1609 	ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_SIG)));
1610 	return NULL;
1611 }
1612 
1613 static const u_char *
1614 ikev1_nonce_print(netdissect_options *ndo, u_char tpay _U_,
1615 		  const struct isakmp_gen *ext,
1616 		  u_int item_len _U_,
1617 		  const u_char *ep,
1618 		  uint32_t phase _U_, uint32_t doi _U_,
1619 		  uint32_t proto _U_, int depth _U_)
1620 {
1621 	struct isakmp_gen e;
1622 
1623 	ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_NONCE)));
1624 
1625 	ND_TCHECK(*ext);
1626 	UNALIGNED_MEMCPY(&e, ext, sizeof(e));
1627 	/*
1628 	 * Our caller has ensured that the length is >= 4.
1629 	 */
1630 	ND_PRINT((ndo," n len=%u", ntohs(e.len) - 4));
1631 	if (ntohs(e.len) > 4) {
1632 		if (ndo->ndo_vflag > 2) {
1633 			ND_PRINT((ndo, " "));
1634 			if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4))
1635 				goto trunc;
1636 		} else if (ndo->ndo_vflag > 1) {
1637 			ND_PRINT((ndo, " "));
1638 			if (!ike_show_somedata(ndo, (const u_char *)(ext + 1), ep))
1639 				goto trunc;
1640 		}
1641 	}
1642 	return (const u_char *)ext + ntohs(e.len);
1643 trunc:
1644 	ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_NONCE)));
1645 	return NULL;
1646 }
1647 
1648 static const u_char *
1649 ikev1_n_print(netdissect_options *ndo, u_char tpay _U_,
1650 	      const struct isakmp_gen *ext, u_int item_len,
1651 	      const u_char *ep, uint32_t phase _U_, uint32_t doi0 _U_,
1652 	      uint32_t proto0 _U_, int depth _U_)
1653 {
1654 	const struct ikev1_pl_n *p;
1655 	struct ikev1_pl_n n;
1656 	const u_char *cp;
1657 	const u_char *ep2;
1658 	uint32_t doi;
1659 	uint32_t proto;
1660 	static const char *notify_error_str[] = {
1661 		NULL,				"INVALID-PAYLOAD-TYPE",
1662 		"DOI-NOT-SUPPORTED",		"SITUATION-NOT-SUPPORTED",
1663 		"INVALID-COOKIE",		"INVALID-MAJOR-VERSION",
1664 		"INVALID-MINOR-VERSION",	"INVALID-EXCHANGE-TYPE",
1665 		"INVALID-FLAGS",		"INVALID-MESSAGE-ID",
1666 		"INVALID-PROTOCOL-ID",		"INVALID-SPI",
1667 		"INVALID-TRANSFORM-ID",		"ATTRIBUTES-NOT-SUPPORTED",
1668 		"NO-PROPOSAL-CHOSEN",		"BAD-PROPOSAL-SYNTAX",
1669 		"PAYLOAD-MALFORMED",		"INVALID-KEY-INFORMATION",
1670 		"INVALID-ID-INFORMATION",	"INVALID-CERT-ENCODING",
1671 		"INVALID-CERTIFICATE",		"CERT-TYPE-UNSUPPORTED",
1672 		"INVALID-CERT-AUTHORITY",	"INVALID-HASH-INFORMATION",
1673 		"AUTHENTICATION-FAILED",	"INVALID-SIGNATURE",
1674 		"ADDRESS-NOTIFICATION",		"NOTIFY-SA-LIFETIME",
1675 		"CERTIFICATE-UNAVAILABLE",	"UNSUPPORTED-EXCHANGE-TYPE",
1676 		"UNEQUAL-PAYLOAD-LENGTHS",
1677 	};
1678 	static const char *ipsec_notify_error_str[] = {
1679 		"RESERVED",
1680 	};
1681 	static const char *notify_status_str[] = {
1682 		"CONNECTED",
1683 	};
1684 	static const char *ipsec_notify_status_str[] = {
1685 		"RESPONDER-LIFETIME",		"REPLAY-STATUS",
1686 		"INITIAL-CONTACT",
1687 	};
1688 /* NOTE: these macro must be called with x in proper range */
1689 
1690 /* 0 - 8191 */
1691 #define NOTIFY_ERROR_STR(x) \
1692 	STR_OR_ID((x), notify_error_str)
1693 
1694 /* 8192 - 16383 */
1695 #define IPSEC_NOTIFY_ERROR_STR(x) \
1696 	STR_OR_ID((u_int)((x) - 8192), ipsec_notify_error_str)
1697 
1698 /* 16384 - 24575 */
1699 #define NOTIFY_STATUS_STR(x) \
1700 	STR_OR_ID((u_int)((x) - 16384), notify_status_str)
1701 
1702 /* 24576 - 32767 */
1703 #define IPSEC_NOTIFY_STATUS_STR(x) \
1704 	STR_OR_ID((u_int)((x) - 24576), ipsec_notify_status_str)
1705 
1706 	ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_N)));
1707 
1708 	p = (const struct ikev1_pl_n *)ext;
1709 	ND_TCHECK(*p);
1710 	UNALIGNED_MEMCPY(&n, ext, sizeof(n));
1711 	doi = ntohl(n.doi);
1712 	proto = n.prot_id;
1713 	if (doi != 1) {
1714 		ND_PRINT((ndo," doi=%d", doi));
1715 		ND_PRINT((ndo," proto=%d", proto));
1716 		if (ntohs(n.type) < 8192)
1717 			ND_PRINT((ndo," type=%s", NOTIFY_ERROR_STR(ntohs(n.type))));
1718 		else if (ntohs(n.type) < 16384)
1719 			ND_PRINT((ndo," type=%s", numstr(ntohs(n.type))));
1720 		else if (ntohs(n.type) < 24576)
1721 			ND_PRINT((ndo," type=%s", NOTIFY_STATUS_STR(ntohs(n.type))));
1722 		else
1723 			ND_PRINT((ndo," type=%s", numstr(ntohs(n.type))));
1724 		if (n.spi_size) {
1725 			ND_PRINT((ndo," spi="));
1726 			if (!rawprint(ndo, (const uint8_t *)(p + 1), n.spi_size))
1727 				goto trunc;
1728 		}
1729 		return (const u_char *)(p + 1) + n.spi_size;
1730 	}
1731 
1732 	ND_PRINT((ndo," doi=ipsec"));
1733 	ND_PRINT((ndo," proto=%s", PROTOIDSTR(proto)));
1734 	if (ntohs(n.type) < 8192)
1735 		ND_PRINT((ndo," type=%s", NOTIFY_ERROR_STR(ntohs(n.type))));
1736 	else if (ntohs(n.type) < 16384)
1737 		ND_PRINT((ndo," type=%s", IPSEC_NOTIFY_ERROR_STR(ntohs(n.type))));
1738 	else if (ntohs(n.type) < 24576)
1739 		ND_PRINT((ndo," type=%s", NOTIFY_STATUS_STR(ntohs(n.type))));
1740 	else if (ntohs(n.type) < 32768)
1741 		ND_PRINT((ndo," type=%s", IPSEC_NOTIFY_STATUS_STR(ntohs(n.type))));
1742 	else
1743 		ND_PRINT((ndo," type=%s", numstr(ntohs(n.type))));
1744 	if (n.spi_size) {
1745 		ND_PRINT((ndo," spi="));
1746 		if (!rawprint(ndo, (const uint8_t *)(p + 1), n.spi_size))
1747 			goto trunc;
1748 	}
1749 
1750 	cp = (const u_char *)(p + 1) + n.spi_size;
1751 	ep2 = (const u_char *)p + item_len;
1752 
1753 	if (cp < ep) {
1754 		switch (ntohs(n.type)) {
1755 		case IPSECDOI_NTYPE_RESPONDER_LIFETIME:
1756 		    {
1757 			const struct attrmap *map = oakley_t_map;
1758 			size_t nmap = sizeof(oakley_t_map)/sizeof(oakley_t_map[0]);
1759 			ND_PRINT((ndo," attrs=("));
1760 			while (cp < ep && cp < ep2) {
1761 				cp = ikev1_attrmap_print(ndo, cp, ep2, map, nmap);
1762 				if (cp == NULL) {
1763 					ND_PRINT((ndo,")"));
1764 					goto trunc;
1765 				}
1766 			}
1767 			ND_PRINT((ndo,")"));
1768 			break;
1769 		    }
1770 		case IPSECDOI_NTYPE_REPLAY_STATUS:
1771 			ND_PRINT((ndo," status=("));
1772 			ND_TCHECK_32BITS(cp);
1773 			ND_PRINT((ndo,"replay detection %sabled",
1774 				  EXTRACT_32BITS(cp) ? "en" : "dis"));
1775 			ND_PRINT((ndo,")"));
1776 			break;
1777 		default:
1778 			/*
1779 			 * XXX - fill in more types here; see, for example,
1780 			 * draft-ietf-ipsec-notifymsg-04.
1781 			 */
1782 			if (ndo->ndo_vflag > 3) {
1783 				ND_PRINT((ndo," data=("));
1784 				if (!rawprint(ndo, (const uint8_t *)(cp), ep - cp))
1785 					goto trunc;
1786 				ND_PRINT((ndo,")"));
1787 			} else {
1788 				if (!ike_show_somedata(ndo, cp, ep))
1789 					goto trunc;
1790 			}
1791 			break;
1792 		}
1793 	}
1794 	return (const u_char *)ext + item_len;
1795 trunc:
1796 	ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_N)));
1797 	return NULL;
1798 }
1799 
1800 static const u_char *
1801 ikev1_d_print(netdissect_options *ndo, u_char tpay _U_,
1802 	      const struct isakmp_gen *ext, u_int item_len _U_,
1803 	      const u_char *ep _U_, uint32_t phase _U_, uint32_t doi0 _U_,
1804 	      uint32_t proto0 _U_, int depth _U_)
1805 {
1806 	const struct ikev1_pl_d *p;
1807 	struct ikev1_pl_d d;
1808 	const uint8_t *q;
1809 	uint32_t doi;
1810 	uint32_t proto;
1811 	int i;
1812 
1813 	ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_D)));
1814 
1815 	p = (const struct ikev1_pl_d *)ext;
1816 	ND_TCHECK(*p);
1817 	UNALIGNED_MEMCPY(&d, ext, sizeof(d));
1818 	doi = ntohl(d.doi);
1819 	proto = d.prot_id;
1820 	if (doi != 1) {
1821 		ND_PRINT((ndo," doi=%u", doi));
1822 		ND_PRINT((ndo," proto=%u", proto));
1823 	} else {
1824 		ND_PRINT((ndo," doi=ipsec"));
1825 		ND_PRINT((ndo," proto=%s", PROTOIDSTR(proto)));
1826 	}
1827 	ND_PRINT((ndo," spilen=%u", d.spi_size));
1828 	ND_PRINT((ndo," nspi=%u", ntohs(d.num_spi)));
1829 	ND_PRINT((ndo," spi="));
1830 	q = (const uint8_t *)(p + 1);
1831 	for (i = 0; i < ntohs(d.num_spi); i++) {
1832 		if (i != 0)
1833 			ND_PRINT((ndo,","));
1834 		if (!rawprint(ndo, (const uint8_t *)q, d.spi_size))
1835 			goto trunc;
1836 		q += d.spi_size;
1837 	}
1838 	return q;
1839 trunc:
1840 	ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_D)));
1841 	return NULL;
1842 }
1843 
1844 static const u_char *
1845 ikev1_vid_print(netdissect_options *ndo, u_char tpay _U_,
1846 		const struct isakmp_gen *ext,
1847 		u_int item_len _U_, const u_char *ep _U_,
1848 		uint32_t phase _U_, uint32_t doi _U_,
1849 		uint32_t proto _U_, int depth _U_)
1850 {
1851 	struct isakmp_gen e;
1852 
1853 	ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_VID)));
1854 
1855 	ND_TCHECK(*ext);
1856 	UNALIGNED_MEMCPY(&e, ext, sizeof(e));
1857 	ND_PRINT((ndo," len=%d", ntohs(e.len) - 4));
1858 	if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1859 		/* Print the entire payload in hex */
1860 		ND_PRINT((ndo," "));
1861 		if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4))
1862 			goto trunc;
1863 	}
1864 	return (const u_char *)ext + ntohs(e.len);
1865 trunc:
1866 	ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_VID)));
1867 	return NULL;
1868 }
1869 
1870 /************************************************************/
1871 /*                                                          */
1872 /*              IKE v2 - rfc4306 - dissector                */
1873 /*                                                          */
1874 /************************************************************/
1875 
1876 static void
1877 ikev2_pay_print(netdissect_options *ndo, const char *payname, int critical)
1878 {
1879 	ND_PRINT((ndo,"%s%s:", payname, critical&0x80 ? "[C]" : ""));
1880 }
1881 
1882 static const u_char *
1883 ikev2_gen_print(netdissect_options *ndo, u_char tpay,
1884 		const struct isakmp_gen *ext)
1885 {
1886 	struct isakmp_gen e;
1887 
1888 	ND_TCHECK(*ext);
1889 	UNALIGNED_MEMCPY(&e, ext, sizeof(e));
1890 	ikev2_pay_print(ndo, NPSTR(tpay), e.critical);
1891 
1892 	ND_PRINT((ndo," len=%d", ntohs(e.len) - 4));
1893 	if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1894 		/* Print the entire payload in hex */
1895 		ND_PRINT((ndo," "));
1896 		if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4))
1897 			goto trunc;
1898 	}
1899 	return (const u_char *)ext + ntohs(e.len);
1900 trunc:
1901 	ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
1902 	return NULL;
1903 }
1904 
1905 static const u_char *
1906 ikev2_t_print(netdissect_options *ndo, int tcount,
1907 	      const struct isakmp_gen *ext, u_int item_len,
1908 	      const u_char *ep)
1909 {
1910 	const struct ikev2_t *p;
1911 	struct ikev2_t t;
1912 	uint16_t  t_id;
1913 	const u_char *cp;
1914 	const char *idstr;
1915 	const struct attrmap *map;
1916 	size_t nmap;
1917 	const u_char *ep2;
1918 
1919 	p = (const struct ikev2_t *)ext;
1920 	ND_TCHECK(*p);
1921 	UNALIGNED_MEMCPY(&t, ext, sizeof(t));
1922 	ikev2_pay_print(ndo, NPSTR(ISAKMP_NPTYPE_T), t.h.critical);
1923 
1924 	t_id = ntohs(t.t_id);
1925 
1926 	map = NULL;
1927 	nmap = 0;
1928 
1929 	switch (t.t_type) {
1930 	case IV2_T_ENCR:
1931 		idstr = STR_OR_ID(t_id, esp_p_map);
1932 		map = encr_t_map;
1933 		nmap = sizeof(encr_t_map)/sizeof(encr_t_map[0]);
1934 		break;
1935 
1936 	case IV2_T_PRF:
1937 		idstr = STR_OR_ID(t_id, prf_p_map);
1938 		break;
1939 
1940 	case IV2_T_INTEG:
1941 		idstr = STR_OR_ID(t_id, integ_p_map);
1942 		break;
1943 
1944 	case IV2_T_DH:
1945 		idstr = STR_OR_ID(t_id, dh_p_map);
1946 		break;
1947 
1948 	case IV2_T_ESN:
1949 		idstr = STR_OR_ID(t_id, esn_p_map);
1950 		break;
1951 
1952 	default:
1953 		idstr = NULL;
1954 		break;
1955 	}
1956 
1957 	if (idstr)
1958 		ND_PRINT((ndo," #%u type=%s id=%s ", tcount,
1959 			  STR_OR_ID(t.t_type, ikev2_t_type_map),
1960 			  idstr));
1961 	else
1962 		ND_PRINT((ndo," #%u type=%s id=%u ", tcount,
1963 			  STR_OR_ID(t.t_type, ikev2_t_type_map),
1964 			  t.t_id));
1965 	cp = (const u_char *)(p + 1);
1966 	ep2 = (const u_char *)p + item_len;
1967 	while (cp < ep && cp < ep2) {
1968 		if (map && nmap) {
1969 			cp = ikev1_attrmap_print(ndo, cp, ep2, map, nmap);
1970 		} else
1971 			cp = ikev1_attr_print(ndo, cp, ep2);
1972 		if (cp == NULL)
1973 			goto trunc;
1974 	}
1975 	if (ep < ep2)
1976 		ND_PRINT((ndo,"..."));
1977 	return cp;
1978 trunc:
1979 	ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_T)));
1980 	return NULL;
1981 }
1982 
1983 static const u_char *
1984 ikev2_p_print(netdissect_options *ndo, u_char tpay _U_, int pcount _U_,
1985 	      const struct isakmp_gen *ext, u_int oprop_length,
1986 	      const u_char *ep, int depth)
1987 {
1988 	const struct ikev2_p *p;
1989 	struct ikev2_p prop;
1990 	u_int prop_length;
1991 	const u_char *cp;
1992 	int i;
1993 	int tcount;
1994 	u_char np;
1995 	struct isakmp_gen e;
1996 	u_int item_len;
1997 
1998 	p = (const struct ikev2_p *)ext;
1999 	ND_TCHECK(*p);
2000 	UNALIGNED_MEMCPY(&prop, ext, sizeof(prop));
2001 
2002 	ikev2_pay_print(ndo, NPSTR(ISAKMP_NPTYPE_P), prop.h.critical);
2003 
2004 	/*
2005 	 * ikev2_sa_print() guarantees that this is >= 4.
2006 	 */
2007 	prop_length = oprop_length - 4;
2008 	ND_PRINT((ndo," #%u protoid=%s transform=%d len=%u",
2009 		  prop.p_no,  PROTOIDSTR(prop.prot_id),
2010 		  prop.num_t, oprop_length));
2011 	cp = (const u_char *)(p + 1);
2012 
2013 	if (prop.spi_size) {
2014 		if (prop_length < prop.spi_size)
2015 			goto toolong;
2016 		ND_PRINT((ndo," spi="));
2017 		if (!rawprint(ndo, (const uint8_t *)cp, prop.spi_size))
2018 			goto trunc;
2019 		cp += prop.spi_size;
2020 		prop_length -= prop.spi_size;
2021 	}
2022 
2023 	/*
2024 	 * Print the transforms.
2025 	 */
2026 	tcount = 0;
2027 	for (np = ISAKMP_NPTYPE_T; np != 0; np = e.np) {
2028 		tcount++;
2029 		ext = (const struct isakmp_gen *)cp;
2030 		if (prop_length < sizeof(*ext))
2031 			goto toolong;
2032 		ND_TCHECK(*ext);
2033 		UNALIGNED_MEMCPY(&e, ext, sizeof(e));
2034 
2035 		/*
2036 		 * Since we can't have a payload length of less than 4 bytes,
2037 		 * we need to bail out here if the generic header is nonsensical
2038 		 * or truncated, otherwise we could loop forever processing
2039 		 * zero-length items or otherwise misdissect the packet.
2040 		 */
2041 		item_len = ntohs(e.len);
2042 		if (item_len <= 4)
2043 			goto trunc;
2044 
2045 		if (prop_length < item_len)
2046 			goto toolong;
2047 		ND_TCHECK2(*cp, item_len);
2048 
2049 		depth++;
2050 		ND_PRINT((ndo,"\n"));
2051 		for (i = 0; i < depth; i++)
2052 			ND_PRINT((ndo,"    "));
2053 		ND_PRINT((ndo,"("));
2054 		if (np == ISAKMP_NPTYPE_T) {
2055 			cp = ikev2_t_print(ndo, tcount, ext, item_len, ep);
2056 			if (cp == NULL) {
2057 				/* error, already reported */
2058 				return NULL;
2059 			}
2060 		} else {
2061 			ND_PRINT((ndo, "%s", NPSTR(np)));
2062 			cp += item_len;
2063 		}
2064 		ND_PRINT((ndo,")"));
2065 		depth--;
2066 		prop_length -= item_len;
2067 	}
2068 	return cp;
2069 toolong:
2070 	/*
2071 	 * Skip the rest of the proposal.
2072 	 */
2073 	cp += prop_length;
2074 	ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_P)));
2075 	return cp;
2076 trunc:
2077 	ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_P)));
2078 	return NULL;
2079 }
2080 
2081 static const u_char *
2082 ikev2_sa_print(netdissect_options *ndo, u_char tpay,
2083 		const struct isakmp_gen *ext1,
2084 		u_int osa_length, const u_char *ep,
2085 		uint32_t phase _U_, uint32_t doi _U_,
2086 		uint32_t proto _U_, int depth)
2087 {
2088 	const struct isakmp_gen *ext;
2089 	struct isakmp_gen e;
2090 	u_int sa_length;
2091 	const u_char *cp;
2092 	int i;
2093 	int pcount;
2094 	u_char np;
2095 	u_int item_len;
2096 
2097 	ND_TCHECK(*ext1);
2098 	UNALIGNED_MEMCPY(&e, ext1, sizeof(e));
2099 	ikev2_pay_print(ndo, "sa", e.critical);
2100 
2101 	/*
2102 	 * ikev2_sub0_print() guarantees that this is >= 4.
2103 	 */
2104 	osa_length= ntohs(e.len);
2105 	sa_length = osa_length - 4;
2106 	ND_PRINT((ndo," len=%d", sa_length));
2107 
2108 	/*
2109 	 * Print the payloads.
2110 	 */
2111 	cp = (const u_char *)(ext1 + 1);
2112 	pcount = 0;
2113 	for (np = ISAKMP_NPTYPE_P; np != 0; np = e.np) {
2114 		pcount++;
2115 		ext = (const struct isakmp_gen *)cp;
2116 		if (sa_length < sizeof(*ext))
2117 			goto toolong;
2118 		ND_TCHECK(*ext);
2119 		UNALIGNED_MEMCPY(&e, ext, sizeof(e));
2120 
2121 		/*
2122 		 * Since we can't have a payload length of less than 4 bytes,
2123 		 * we need to bail out here if the generic header is nonsensical
2124 		 * or truncated, otherwise we could loop forever processing
2125 		 * zero-length items or otherwise misdissect the packet.
2126 		 */
2127 		item_len = ntohs(e.len);
2128 		if (item_len <= 4)
2129 			goto trunc;
2130 
2131 		if (sa_length < item_len)
2132 			goto toolong;
2133 		ND_TCHECK2(*cp, item_len);
2134 
2135 		depth++;
2136 		ND_PRINT((ndo,"\n"));
2137 		for (i = 0; i < depth; i++)
2138 			ND_PRINT((ndo,"    "));
2139 		ND_PRINT((ndo,"("));
2140 		if (np == ISAKMP_NPTYPE_P) {
2141 			cp = ikev2_p_print(ndo, np, pcount, ext, item_len,
2142 					   ep, depth);
2143 			if (cp == NULL) {
2144 				/* error, already reported */
2145 				return NULL;
2146 			}
2147 		} else {
2148 			ND_PRINT((ndo, "%s", NPSTR(np)));
2149 			cp += item_len;
2150 		}
2151 		ND_PRINT((ndo,")"));
2152 		depth--;
2153 		sa_length -= item_len;
2154 	}
2155 	return cp;
2156 toolong:
2157 	/*
2158 	 * Skip the rest of the SA.
2159 	 */
2160 	cp += sa_length;
2161 	ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
2162 	return cp;
2163 trunc:
2164 	ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
2165 	return NULL;
2166 }
2167 
2168 static const u_char *
2169 ikev2_ke_print(netdissect_options *ndo, u_char tpay,
2170 		const struct isakmp_gen *ext,
2171 		u_int item_len _U_, const u_char *ep _U_,
2172 		uint32_t phase _U_, uint32_t doi _U_,
2173 		uint32_t proto _U_, int depth _U_)
2174 {
2175 	struct ikev2_ke ke;
2176 	const struct ikev2_ke *k;
2177 
2178 	k = (const struct ikev2_ke *)ext;
2179 	ND_TCHECK(*k);
2180 	UNALIGNED_MEMCPY(&ke, ext, sizeof(ke));
2181 	ikev2_pay_print(ndo, NPSTR(tpay), ke.h.critical);
2182 
2183 	ND_PRINT((ndo," len=%u group=%s", ntohs(ke.h.len) - 8,
2184 		  STR_OR_ID(ntohs(ke.ke_group), dh_p_map)));
2185 
2186 	if (2 < ndo->ndo_vflag && 8 < ntohs(ke.h.len)) {
2187 		ND_PRINT((ndo," "));
2188 		if (!rawprint(ndo, (const uint8_t *)(k + 1), ntohs(ke.h.len) - 8))
2189 			goto trunc;
2190 	}
2191 	return (const u_char *)ext + ntohs(ke.h.len);
2192 trunc:
2193 	ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
2194 	return NULL;
2195 }
2196 
2197 static const u_char *
2198 ikev2_ID_print(netdissect_options *ndo, u_char tpay,
2199 		const struct isakmp_gen *ext,
2200 		u_int item_len _U_, const u_char *ep _U_,
2201 		uint32_t phase _U_, uint32_t doi _U_,
2202 		uint32_t proto _U_, int depth _U_)
2203 {
2204 	const struct ikev2_id *idp;
2205 	struct ikev2_id id;
2206 	int id_len, idtype_len, i;
2207 	unsigned int dumpascii, dumphex;
2208 	const unsigned char *typedata;
2209 
2210 	idp = (const struct ikev2_id *)ext;
2211 	ND_TCHECK(*idp);
2212 	UNALIGNED_MEMCPY(&id, ext, sizeof(id));
2213 	ikev2_pay_print(ndo, NPSTR(tpay), id.h.critical);
2214 
2215 	id_len = ntohs(id.h.len);
2216 
2217 	ND_PRINT((ndo," len=%d", id_len - 4));
2218 	if (2 < ndo->ndo_vflag && 4 < id_len) {
2219 		/* Print the entire payload in hex */
2220 		ND_PRINT((ndo," "));
2221 		if (!rawprint(ndo, (const uint8_t *)(ext + 1), id_len - 4))
2222 			goto trunc;
2223 	}
2224 
2225 	idtype_len =id_len - sizeof(struct ikev2_id);
2226 	dumpascii = 0;
2227 	dumphex   = 0;
2228 	typedata  = (const unsigned char *)(ext)+sizeof(struct ikev2_id);
2229 
2230 	switch(id.type) {
2231 	case ID_IPV4_ADDR:
2232 		ND_PRINT((ndo, " ipv4:"));
2233 		dumphex=1;
2234 		break;
2235 	case ID_FQDN:
2236 		ND_PRINT((ndo, " fqdn:"));
2237 		dumpascii=1;
2238 		break;
2239 	case ID_RFC822_ADDR:
2240 		ND_PRINT((ndo, " rfc822:"));
2241 		dumpascii=1;
2242 		break;
2243 	case ID_IPV6_ADDR:
2244 		ND_PRINT((ndo, " ipv6:"));
2245 		dumphex=1;
2246 		break;
2247 	case ID_DER_ASN1_DN:
2248 		ND_PRINT((ndo, " dn:"));
2249 		dumphex=1;
2250 		break;
2251 	case ID_DER_ASN1_GN:
2252 		ND_PRINT((ndo, " gn:"));
2253 		dumphex=1;
2254 		break;
2255 	case ID_KEY_ID:
2256 		ND_PRINT((ndo, " keyid:"));
2257 		dumphex=1;
2258 		break;
2259 	}
2260 
2261 	if(dumpascii) {
2262 		ND_TCHECK2(*typedata, idtype_len);
2263 		for(i=0; i<idtype_len; i++) {
2264 			if(ND_ISPRINT(typedata[i])) {
2265 				ND_PRINT((ndo, "%c", typedata[i]));
2266 			} else {
2267 				ND_PRINT((ndo, "."));
2268 			}
2269 		}
2270 	}
2271 	if(dumphex) {
2272 		if (!rawprint(ndo, (const uint8_t *)typedata, idtype_len))
2273 			goto trunc;
2274 	}
2275 
2276 	return (const u_char *)ext + id_len;
2277 trunc:
2278 	ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
2279 	return NULL;
2280 }
2281 
2282 static const u_char *
2283 ikev2_cert_print(netdissect_options *ndo, u_char tpay,
2284 		const struct isakmp_gen *ext,
2285 		u_int item_len _U_, const u_char *ep _U_,
2286 		uint32_t phase _U_, uint32_t doi _U_,
2287 		uint32_t proto _U_, int depth _U_)
2288 {
2289 	return ikev2_gen_print(ndo, tpay, ext);
2290 }
2291 
2292 static const u_char *
2293 ikev2_cr_print(netdissect_options *ndo, u_char tpay,
2294 		const struct isakmp_gen *ext,
2295 		u_int item_len _U_, const u_char *ep _U_,
2296 		uint32_t phase _U_, uint32_t doi _U_,
2297 		uint32_t proto _U_, int depth _U_)
2298 {
2299 	return ikev2_gen_print(ndo, tpay, ext);
2300 }
2301 
2302 static const u_char *
2303 ikev2_auth_print(netdissect_options *ndo, u_char tpay,
2304 		const struct isakmp_gen *ext,
2305 		u_int item_len _U_, const u_char *ep,
2306 		uint32_t phase _U_, uint32_t doi _U_,
2307 		uint32_t proto _U_, int depth _U_)
2308 {
2309 	struct ikev2_auth a;
2310 	const char *v2_auth[]={ "invalid", "rsasig",
2311 				"shared-secret", "dsssig" };
2312 	const u_char *authdata = (const u_char*)ext + sizeof(a);
2313 	unsigned int len;
2314 
2315 	ND_TCHECK2(*ext, sizeof(a));
2316 	UNALIGNED_MEMCPY(&a, ext, sizeof(a));
2317 	ikev2_pay_print(ndo, NPSTR(tpay), a.h.critical);
2318 	len = ntohs(a.h.len);
2319 
2320 	/*
2321 	 * Our caller has ensured that the length is >= 4.
2322 	 */
2323 	ND_PRINT((ndo," len=%u method=%s", len-4,
2324 		  STR_OR_ID(a.auth_method, v2_auth)));
2325 	if (len > 4) {
2326 		if (ndo->ndo_vflag > 1) {
2327 			ND_PRINT((ndo, " authdata=("));
2328 			if (!rawprint(ndo, (const uint8_t *)authdata, len - sizeof(a)))
2329 				goto trunc;
2330 			ND_PRINT((ndo, ") "));
2331 		} else if (ndo->ndo_vflag) {
2332 			if (!ike_show_somedata(ndo, authdata, ep))
2333 				goto trunc;
2334 		}
2335 	}
2336 
2337 	return (const u_char *)ext + len;
2338 trunc:
2339 	ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
2340 	return NULL;
2341 }
2342 
2343 static const u_char *
2344 ikev2_nonce_print(netdissect_options *ndo, u_char tpay,
2345 		const struct isakmp_gen *ext,
2346 		u_int item_len _U_, const u_char *ep,
2347 		uint32_t phase _U_, uint32_t doi _U_,
2348 		uint32_t proto _U_, int depth _U_)
2349 {
2350 	struct isakmp_gen e;
2351 
2352 	ND_TCHECK(*ext);
2353 	UNALIGNED_MEMCPY(&e, ext, sizeof(e));
2354 	ikev2_pay_print(ndo, "nonce", e.critical);
2355 
2356 	ND_PRINT((ndo," len=%d", ntohs(e.len) - 4));
2357 	if (1 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
2358 		ND_PRINT((ndo," nonce=("));
2359 		if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4))
2360 			goto trunc;
2361 		ND_PRINT((ndo,") "));
2362 	} else if(ndo->ndo_vflag && 4 < ntohs(e.len)) {
2363 		if(!ike_show_somedata(ndo, (const u_char *)(ext+1), ep)) goto trunc;
2364 	}
2365 
2366 	return (const u_char *)ext + ntohs(e.len);
2367 trunc:
2368 	ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
2369 	return NULL;
2370 }
2371 
2372 /* notify payloads */
2373 static const u_char *
2374 ikev2_n_print(netdissect_options *ndo, u_char tpay _U_,
2375 		const struct isakmp_gen *ext,
2376 		u_int item_len, const u_char *ep,
2377 		uint32_t phase _U_, uint32_t doi _U_,
2378 		uint32_t proto _U_, int depth _U_)
2379 {
2380 	const struct ikev2_n *p;
2381 	struct ikev2_n n;
2382 	const u_char *cp;
2383 	u_char showspi, showsomedata;
2384 	const char *notify_name;
2385 	uint32_t type;
2386 
2387 	p = (const struct ikev2_n *)ext;
2388 	ND_TCHECK(*p);
2389 	UNALIGNED_MEMCPY(&n, ext, sizeof(n));
2390 	ikev2_pay_print(ndo, NPSTR(ISAKMP_NPTYPE_N), n.h.critical);
2391 
2392 	showspi = 1;
2393 	showsomedata=0;
2394 	notify_name=NULL;
2395 
2396 	ND_PRINT((ndo," prot_id=%s", PROTOIDSTR(n.prot_id)));
2397 
2398 	type = ntohs(n.type);
2399 
2400 	/* notify space is annoying sparse */
2401 	switch(type) {
2402 	case IV2_NOTIFY_UNSUPPORTED_CRITICAL_PAYLOAD:
2403 		notify_name = "unsupported_critical_payload";
2404 		showspi = 0;
2405 		break;
2406 
2407 	case IV2_NOTIFY_INVALID_IKE_SPI:
2408 		notify_name = "invalid_ike_spi";
2409 		showspi = 1;
2410 		break;
2411 
2412 	case IV2_NOTIFY_INVALID_MAJOR_VERSION:
2413 		notify_name = "invalid_major_version";
2414 		showspi = 0;
2415 		break;
2416 
2417 	case IV2_NOTIFY_INVALID_SYNTAX:
2418 		notify_name = "invalid_syntax";
2419 		showspi = 1;
2420 		break;
2421 
2422 	case IV2_NOTIFY_INVALID_MESSAGE_ID:
2423 		notify_name = "invalid_message_id";
2424 		showspi = 1;
2425 		break;
2426 
2427 	case IV2_NOTIFY_INVALID_SPI:
2428 		notify_name = "invalid_spi";
2429 		showspi = 1;
2430 		break;
2431 
2432 	case IV2_NOTIFY_NO_PROPOSAL_CHOSEN:
2433 		notify_name = "no_protocol_chosen";
2434 		showspi = 1;
2435 		break;
2436 
2437 	case IV2_NOTIFY_INVALID_KE_PAYLOAD:
2438 		notify_name = "invalid_ke_payload";
2439 		showspi = 1;
2440 		break;
2441 
2442 	case IV2_NOTIFY_AUTHENTICATION_FAILED:
2443 		notify_name = "authentication_failed";
2444 		showspi = 1;
2445 		break;
2446 
2447 	case IV2_NOTIFY_SINGLE_PAIR_REQUIRED:
2448 		notify_name = "single_pair_required";
2449 		showspi = 1;
2450 		break;
2451 
2452 	case IV2_NOTIFY_NO_ADDITIONAL_SAS:
2453 		notify_name = "no_additional_sas";
2454 		showspi = 0;
2455 		break;
2456 
2457 	case IV2_NOTIFY_INTERNAL_ADDRESS_FAILURE:
2458 		notify_name = "internal_address_failure";
2459 		showspi = 0;
2460 		break;
2461 
2462 	case IV2_NOTIFY_FAILED_CP_REQUIRED:
2463 		notify_name = "failed:cp_required";
2464 		showspi = 0;
2465 		break;
2466 
2467 	case IV2_NOTIFY_INVALID_SELECTORS:
2468 		notify_name = "invalid_selectors";
2469 		showspi = 0;
2470 		break;
2471 
2472 	case IV2_NOTIFY_INITIAL_CONTACT:
2473 		notify_name = "initial_contact";
2474 		showspi = 0;
2475 		break;
2476 
2477 	case IV2_NOTIFY_SET_WINDOW_SIZE:
2478 		notify_name = "set_window_size";
2479 		showspi = 0;
2480 		break;
2481 
2482 	case IV2_NOTIFY_ADDITIONAL_TS_POSSIBLE:
2483 		notify_name = "additional_ts_possible";
2484 		showspi = 0;
2485 		break;
2486 
2487 	case IV2_NOTIFY_IPCOMP_SUPPORTED:
2488 		notify_name = "ipcomp_supported";
2489 		showspi = 0;
2490 		break;
2491 
2492 	case IV2_NOTIFY_NAT_DETECTION_SOURCE_IP:
2493 		notify_name = "nat_detection_source_ip";
2494 		showspi = 1;
2495 		break;
2496 
2497 	case IV2_NOTIFY_NAT_DETECTION_DESTINATION_IP:
2498 		notify_name = "nat_detection_destination_ip";
2499 		showspi = 1;
2500 		break;
2501 
2502 	case IV2_NOTIFY_COOKIE:
2503 		notify_name = "cookie";
2504 		showspi = 1;
2505 		showsomedata= 1;
2506 		break;
2507 
2508 	case IV2_NOTIFY_USE_TRANSPORT_MODE:
2509 		notify_name = "use_transport_mode";
2510 		showspi = 0;
2511 		break;
2512 
2513 	case IV2_NOTIFY_HTTP_CERT_LOOKUP_SUPPORTED:
2514 		notify_name = "http_cert_lookup_supported";
2515 		showspi = 0;
2516 		break;
2517 
2518 	case IV2_NOTIFY_REKEY_SA:
2519 		notify_name = "rekey_sa";
2520 		showspi = 1;
2521 		break;
2522 
2523 	case IV2_NOTIFY_ESP_TFC_PADDING_NOT_SUPPORTED:
2524 		notify_name = "tfc_padding_not_supported";
2525 		showspi = 0;
2526 		break;
2527 
2528 	case IV2_NOTIFY_NON_FIRST_FRAGMENTS_ALSO:
2529 		notify_name = "non_first_fragment_also";
2530 		showspi = 0;
2531 		break;
2532 
2533 	default:
2534 		if (type < 8192) {
2535 			notify_name="error";
2536 		} else if(type < 16384) {
2537 			notify_name="private-error";
2538 		} else if(type < 40960) {
2539 			notify_name="status";
2540 		} else {
2541 			notify_name="private-status";
2542 		}
2543 	}
2544 
2545 	if(notify_name) {
2546 		ND_PRINT((ndo," type=%u(%s)", type, notify_name));
2547 	}
2548 
2549 
2550 	if (showspi && n.spi_size) {
2551 		ND_PRINT((ndo," spi="));
2552 		if (!rawprint(ndo, (const uint8_t *)(p + 1), n.spi_size))
2553 			goto trunc;
2554 	}
2555 
2556 	cp = (const u_char *)(p + 1) + n.spi_size;
2557 
2558 	if (cp < ep) {
2559 		if (ndo->ndo_vflag > 3 || (showsomedata && ep-cp < 30)) {
2560 			ND_PRINT((ndo," data=("));
2561 			if (!rawprint(ndo, (const uint8_t *)(cp), ep - cp))
2562 				goto trunc;
2563 
2564 			ND_PRINT((ndo,")"));
2565 		} else if (showsomedata) {
2566 			if (!ike_show_somedata(ndo, cp, ep))
2567 				goto trunc;
2568 		}
2569 	}
2570 
2571 	return (const u_char *)ext + item_len;
2572 trunc:
2573 	ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_N)));
2574 	return NULL;
2575 }
2576 
2577 static const u_char *
2578 ikev2_d_print(netdissect_options *ndo, u_char tpay,
2579 		const struct isakmp_gen *ext,
2580 		u_int item_len _U_, const u_char *ep _U_,
2581 		uint32_t phase _U_, uint32_t doi _U_,
2582 		uint32_t proto _U_, int depth _U_)
2583 {
2584 	return ikev2_gen_print(ndo, tpay, ext);
2585 }
2586 
2587 static const u_char *
2588 ikev2_vid_print(netdissect_options *ndo, u_char tpay,
2589 		const struct isakmp_gen *ext,
2590 		u_int item_len _U_, const u_char *ep _U_,
2591 		uint32_t phase _U_, uint32_t doi _U_,
2592 		uint32_t proto _U_, int depth _U_)
2593 {
2594 	struct isakmp_gen e;
2595 	const u_char *vid;
2596 	int i, len;
2597 
2598 	ND_TCHECK(*ext);
2599 	UNALIGNED_MEMCPY(&e, ext, sizeof(e));
2600 	ikev2_pay_print(ndo, NPSTR(tpay), e.critical);
2601 	ND_PRINT((ndo," len=%d vid=", ntohs(e.len) - 4));
2602 
2603 	vid = (const u_char *)(ext+1);
2604 	len = ntohs(e.len) - 4;
2605 	ND_TCHECK2(*vid, len);
2606 	for(i=0; i<len; i++) {
2607 		if(ND_ISPRINT(vid[i])) ND_PRINT((ndo, "%c", vid[i]));
2608 		else ND_PRINT((ndo, "."));
2609 	}
2610 	if (2 < ndo->ndo_vflag && 4 < len) {
2611 		/* Print the entire payload in hex */
2612 		ND_PRINT((ndo," "));
2613 		if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4))
2614 			goto trunc;
2615 	}
2616 	return (const u_char *)ext + ntohs(e.len);
2617 trunc:
2618 	ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
2619 	return NULL;
2620 }
2621 
2622 static const u_char *
2623 ikev2_TS_print(netdissect_options *ndo, u_char tpay,
2624 		const struct isakmp_gen *ext,
2625 		u_int item_len _U_, const u_char *ep _U_,
2626 		uint32_t phase _U_, uint32_t doi _U_,
2627 		uint32_t proto _U_, int depth _U_)
2628 {
2629 	return ikev2_gen_print(ndo, tpay, ext);
2630 }
2631 
2632 static const u_char *
2633 ikev2_e_print(netdissect_options *ndo,
2634 #ifndef HAVE_LIBCRYPTO
2635 	      _U_
2636 #endif
2637 	      struct isakmp *base,
2638 	      u_char tpay,
2639 	      const struct isakmp_gen *ext,
2640 	      u_int item_len _U_, const u_char *ep _U_,
2641 #ifndef HAVE_LIBCRYPTO
2642 	      _U_
2643 #endif
2644 	      uint32_t phase,
2645 #ifndef HAVE_LIBCRYPTO
2646 	      _U_
2647 #endif
2648 	      uint32_t doi,
2649 #ifndef HAVE_LIBCRYPTO
2650 	      _U_
2651 #endif
2652 	      uint32_t proto,
2653 #ifndef HAVE_LIBCRYPTO
2654 	      _U_
2655 #endif
2656 	      int depth)
2657 {
2658 	struct isakmp_gen e;
2659 	const u_char *dat;
2660 	volatile int dlen;
2661 
2662 	ND_TCHECK(*ext);
2663 	UNALIGNED_MEMCPY(&e, ext, sizeof(e));
2664 	ikev2_pay_print(ndo, NPSTR(tpay), e.critical);
2665 
2666 	dlen = ntohs(e.len)-4;
2667 
2668 	ND_PRINT((ndo," len=%d", dlen));
2669 	if (2 < ndo->ndo_vflag && 4 < dlen) {
2670 		ND_PRINT((ndo," "));
2671 		if (!rawprint(ndo, (const uint8_t *)(ext + 1), dlen))
2672 			goto trunc;
2673 	}
2674 
2675 	dat = (const u_char *)(ext+1);
2676 	ND_TCHECK2(*dat, dlen);
2677 
2678 #ifdef HAVE_LIBCRYPTO
2679 	/* try to decypt it! */
2680 	if(esp_print_decrypt_buffer_by_ikev2(ndo,
2681 					     base->flags & ISAKMP_FLAG_I,
2682 					     base->i_ck, base->r_ck,
2683 					     dat, dat+dlen)) {
2684 
2685 		ext = (const struct isakmp_gen *)ndo->ndo_packetp;
2686 
2687 		/* got it decrypted, print stuff inside. */
2688 		ikev2_sub_print(ndo, base, e.np, ext, ndo->ndo_snapend,
2689 				phase, doi, proto, depth+1);
2690 	}
2691 #endif
2692 
2693 
2694 	/* always return NULL, because E must be at end, and NP refers
2695 	 * to what was inside.
2696 	 */
2697 	return NULL;
2698 trunc:
2699 	ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
2700 	return NULL;
2701 }
2702 
2703 static const u_char *
2704 ikev2_cp_print(netdissect_options *ndo, u_char tpay,
2705 		const struct isakmp_gen *ext,
2706 		u_int item_len _U_, const u_char *ep _U_,
2707 		uint32_t phase _U_, uint32_t doi _U_,
2708 		uint32_t proto _U_, int depth _U_)
2709 {
2710 	return ikev2_gen_print(ndo, tpay, ext);
2711 }
2712 
2713 static const u_char *
2714 ikev2_eap_print(netdissect_options *ndo, u_char tpay,
2715 		const struct isakmp_gen *ext,
2716 		u_int item_len _U_, const u_char *ep _U_,
2717 		uint32_t phase _U_, uint32_t doi _U_,
2718 		uint32_t proto _U_, int depth _U_)
2719 {
2720 	return ikev2_gen_print(ndo, tpay, ext);
2721 }
2722 
2723 static const u_char *
2724 ike_sub0_print(netdissect_options *ndo,
2725 		 u_char np, const struct isakmp_gen *ext, const u_char *ep,
2726 
2727 	       uint32_t phase, uint32_t doi, uint32_t proto, int depth)
2728 {
2729 	const u_char *cp;
2730 	struct isakmp_gen e;
2731 	u_int item_len;
2732 
2733 	cp = (const u_char *)ext;
2734 	ND_TCHECK(*ext);
2735 	UNALIGNED_MEMCPY(&e, ext, sizeof(e));
2736 
2737 	/*
2738 	 * Since we can't have a payload length of less than 4 bytes,
2739 	 * we need to bail out here if the generic header is nonsensical
2740 	 * or truncated, otherwise we could loop forever processing
2741 	 * zero-length items or otherwise misdissect the packet.
2742 	 */
2743 	item_len = ntohs(e.len);
2744 	if (item_len <= 4)
2745 		return NULL;
2746 
2747 	if (NPFUNC(np)) {
2748 		/*
2749 		 * XXX - what if item_len is too short, or too long,
2750 		 * for this payload type?
2751 		 */
2752 		cp = (*npfunc[np])(ndo, np, ext, item_len, ep, phase, doi, proto, depth);
2753 	} else {
2754 		ND_PRINT((ndo,"%s", NPSTR(np)));
2755 		cp += item_len;
2756 	}
2757 
2758 	return cp;
2759 trunc:
2760 	ND_PRINT((ndo," [|isakmp]"));
2761 	return NULL;
2762 }
2763 
2764 static const u_char *
2765 ikev1_sub_print(netdissect_options *ndo,
2766 		u_char np, const struct isakmp_gen *ext, const u_char *ep,
2767 		uint32_t phase, uint32_t doi, uint32_t proto, int depth)
2768 {
2769 	const u_char *cp;
2770 	int i;
2771 	struct isakmp_gen e;
2772 
2773 	cp = (const u_char *)ext;
2774 
2775 	while (np) {
2776 		ND_TCHECK(*ext);
2777 		UNALIGNED_MEMCPY(&e, ext, sizeof(e));
2778 
2779 		ND_TCHECK2(*ext, ntohs(e.len));
2780 
2781 		depth++;
2782 		ND_PRINT((ndo,"\n"));
2783 		for (i = 0; i < depth; i++)
2784 			ND_PRINT((ndo,"    "));
2785 		ND_PRINT((ndo,"("));
2786 		cp = ike_sub0_print(ndo, np, ext, ep, phase, doi, proto, depth);
2787 		ND_PRINT((ndo,")"));
2788 		depth--;
2789 
2790 		if (cp == NULL) {
2791 			/* Zero-length subitem */
2792 			return NULL;
2793 		}
2794 
2795 		np = e.np;
2796 		ext = (const struct isakmp_gen *)cp;
2797 	}
2798 	return cp;
2799 trunc:
2800 	ND_PRINT((ndo," [|%s]", NPSTR(np)));
2801 	return NULL;
2802 }
2803 
2804 static char *
2805 numstr(int x)
2806 {
2807 	static char buf[20];
2808 	snprintf(buf, sizeof(buf), "#%d", x);
2809 	return buf;
2810 }
2811 
2812 static void
2813 ikev1_print(netdissect_options *ndo,
2814 	    const u_char *bp,  u_int length,
2815 	    const u_char *bp2, struct isakmp *base)
2816 {
2817 	const struct isakmp *p;
2818 	const u_char *ep;
2819 	u_char np;
2820 	int i;
2821 	int phase;
2822 
2823 	p = (const struct isakmp *)bp;
2824 	ep = ndo->ndo_snapend;
2825 
2826 	phase = (EXTRACT_32BITS(base->msgid) == 0) ? 1 : 2;
2827 	if (phase == 1)
2828 		ND_PRINT((ndo," phase %d", phase));
2829 	else
2830 		ND_PRINT((ndo," phase %d/others", phase));
2831 
2832 	i = cookie_find(&base->i_ck);
2833 	if (i < 0) {
2834 		if (iszero((const u_char *)&base->r_ck, sizeof(base->r_ck))) {
2835 			/* the first packet */
2836 			ND_PRINT((ndo," I"));
2837 			if (bp2)
2838 				cookie_record(&base->i_ck, bp2);
2839 		} else
2840 			ND_PRINT((ndo," ?"));
2841 	} else {
2842 		if (bp2 && cookie_isinitiator(i, bp2))
2843 			ND_PRINT((ndo," I"));
2844 		else if (bp2 && cookie_isresponder(i, bp2))
2845 			ND_PRINT((ndo," R"));
2846 		else
2847 			ND_PRINT((ndo," ?"));
2848 	}
2849 
2850 	ND_PRINT((ndo," %s", ETYPESTR(base->etype)));
2851 	if (base->flags) {
2852 		ND_PRINT((ndo,"[%s%s]", base->flags & ISAKMP_FLAG_E ? "E" : "",
2853 			  base->flags & ISAKMP_FLAG_C ? "C" : ""));
2854 	}
2855 
2856 	if (ndo->ndo_vflag) {
2857 		const struct isakmp_gen *ext;
2858 
2859 		ND_PRINT((ndo,":"));
2860 
2861 		/* regardless of phase... */
2862 		if (base->flags & ISAKMP_FLAG_E) {
2863 			/*
2864 			 * encrypted, nothing we can do right now.
2865 			 * we hope to decrypt the packet in the future...
2866 			 */
2867 			ND_PRINT((ndo," [encrypted %s]", NPSTR(base->np)));
2868 			goto done;
2869 		}
2870 
2871 		CHECKLEN(p + 1, base->np);
2872 		np = base->np;
2873 		ext = (const struct isakmp_gen *)(p + 1);
2874 		ikev1_sub_print(ndo, np, ext, ep, phase, 0, 0, 0);
2875 	}
2876 
2877 done:
2878 	if (ndo->ndo_vflag) {
2879 		if (ntohl(base->len) != length) {
2880 			ND_PRINT((ndo," (len mismatch: isakmp %u/ip %u)",
2881 				  (uint32_t)ntohl(base->len), length));
2882 		}
2883 	}
2884 }
2885 
2886 static const u_char *
2887 ikev2_sub0_print(netdissect_options *ndo, struct isakmp *base,
2888 		 u_char np,
2889 		 const struct isakmp_gen *ext, const u_char *ep,
2890 		 uint32_t phase, uint32_t doi, uint32_t proto, int depth)
2891 {
2892 	const u_char *cp;
2893 	struct isakmp_gen e;
2894 	u_int item_len;
2895 
2896 	cp = (const u_char *)ext;
2897 	ND_TCHECK(*ext);
2898 	UNALIGNED_MEMCPY(&e, ext, sizeof(e));
2899 
2900 	/*
2901 	 * Since we can't have a payload length of less than 4 bytes,
2902 	 * we need to bail out here if the generic header is nonsensical
2903 	 * or truncated, otherwise we could loop forever processing
2904 	 * zero-length items or otherwise misdissect the packet.
2905 	 */
2906 	item_len = ntohs(e.len);
2907 	if (item_len <= 4)
2908 		return NULL;
2909 
2910 	if (np == ISAKMP_NPTYPE_v2E) {
2911 		cp = ikev2_e_print(ndo, base, np, ext, item_len,
2912 				   ep, phase, doi, proto, depth);
2913 	} else if (NPFUNC(np)) {
2914 		/*
2915 		 * XXX - what if item_len is too short, or too long,
2916 		 * for this payload type?
2917 		 */
2918 		cp = (*npfunc[np])(ndo, np, ext, item_len,
2919 				   ep, phase, doi, proto, depth);
2920 	} else {
2921 		ND_PRINT((ndo,"%s", NPSTR(np)));
2922 		cp += item_len;
2923 	}
2924 
2925 	return cp;
2926 trunc:
2927 	ND_PRINT((ndo," [|isakmp]"));
2928 	return NULL;
2929 }
2930 
2931 static const u_char *
2932 ikev2_sub_print(netdissect_options *ndo,
2933 		struct isakmp *base,
2934 		u_char np, const struct isakmp_gen *ext, const u_char *ep,
2935 		uint32_t phase, uint32_t doi, uint32_t proto, int depth)
2936 {
2937 	const u_char *cp;
2938 	int i;
2939 	struct isakmp_gen e;
2940 
2941 	cp = (const u_char *)ext;
2942 	while (np) {
2943 		ND_TCHECK(*ext);
2944 		UNALIGNED_MEMCPY(&e, ext, sizeof(e));
2945 
2946 		ND_TCHECK2(*ext, ntohs(e.len));
2947 
2948 		depth++;
2949 		ND_PRINT((ndo,"\n"));
2950 		for (i = 0; i < depth; i++)
2951 			ND_PRINT((ndo,"    "));
2952 		ND_PRINT((ndo,"("));
2953 		cp = ikev2_sub0_print(ndo, base, np,
2954 				      ext, ep, phase, doi, proto, depth);
2955 		ND_PRINT((ndo,")"));
2956 		depth--;
2957 
2958 		if (cp == NULL) {
2959 			/* Zero-length subitem */
2960 			return NULL;
2961 		}
2962 
2963 		np = e.np;
2964 		ext = (const struct isakmp_gen *)cp;
2965 	}
2966 	return cp;
2967 trunc:
2968 	ND_PRINT((ndo," [|%s]", NPSTR(np)));
2969 	return NULL;
2970 }
2971 
2972 static void
2973 ikev2_print(netdissect_options *ndo,
2974 	    const u_char *bp,  u_int length,
2975 	    const u_char *bp2 _U_, struct isakmp *base)
2976 {
2977 	const struct isakmp *p;
2978 	const u_char *ep;
2979 	u_char np;
2980 	int phase;
2981 
2982 	p = (const struct isakmp *)bp;
2983 	ep = ndo->ndo_snapend;
2984 
2985 	phase = (EXTRACT_32BITS(base->msgid) == 0) ? 1 : 2;
2986 	if (phase == 1)
2987 		ND_PRINT((ndo, " parent_sa"));
2988 	else
2989 		ND_PRINT((ndo, " child_sa "));
2990 
2991 	ND_PRINT((ndo, " %s", ETYPESTR(base->etype)));
2992 	if (base->flags) {
2993 		ND_PRINT((ndo, "[%s%s%s]",
2994 			  base->flags & ISAKMP_FLAG_I ? "I" : "",
2995 			  base->flags & ISAKMP_FLAG_V ? "V" : "",
2996 			  base->flags & ISAKMP_FLAG_R ? "R" : ""));
2997 	}
2998 
2999 	if (ndo->ndo_vflag) {
3000 		const struct isakmp_gen *ext;
3001 
3002 		ND_PRINT((ndo, ":"));
3003 
3004 		/* regardless of phase... */
3005 		if (base->flags & ISAKMP_FLAG_E) {
3006 			/*
3007 			 * encrypted, nothing we can do right now.
3008 			 * we hope to decrypt the packet in the future...
3009 			 */
3010 			ND_PRINT((ndo, " [encrypted %s]", NPSTR(base->np)));
3011 			goto done;
3012 		}
3013 
3014 		CHECKLEN(p + 1, base->np)
3015 
3016 		np = base->np;
3017 		ext = (const struct isakmp_gen *)(p + 1);
3018 		ikev2_sub_print(ndo, base, np, ext, ep, phase, 0, 0, 0);
3019 	}
3020 
3021 done:
3022 	if (ndo->ndo_vflag) {
3023 		if (ntohl(base->len) != length) {
3024 			ND_PRINT((ndo, " (len mismatch: isakmp %u/ip %u)",
3025 				  (uint32_t)ntohl(base->len), length));
3026 		}
3027 	}
3028 }
3029 
3030 void
3031 isakmp_print(netdissect_options *ndo,
3032 	     const u_char *bp, u_int length,
3033 	     const u_char *bp2)
3034 {
3035 	const struct isakmp *p;
3036 	struct isakmp base;
3037 	const u_char *ep;
3038 	int major, minor;
3039 
3040 #ifdef HAVE_LIBCRYPTO
3041 	/* initialize SAs */
3042 	if (ndo->ndo_sa_list_head == NULL) {
3043 		if (ndo->ndo_espsecret)
3044 			esp_print_decodesecret(ndo);
3045 	}
3046 #endif
3047 
3048 	p = (const struct isakmp *)bp;
3049 	ep = ndo->ndo_snapend;
3050 
3051 	if ((const struct isakmp *)ep < p + 1) {
3052 		ND_PRINT((ndo,"[|isakmp]"));
3053 		return;
3054 	}
3055 
3056 	UNALIGNED_MEMCPY(&base, p, sizeof(base));
3057 
3058 	ND_PRINT((ndo,"isakmp"));
3059 	major = (base.vers & ISAKMP_VERS_MAJOR)
3060 		>> ISAKMP_VERS_MAJOR_SHIFT;
3061 	minor = (base.vers & ISAKMP_VERS_MINOR)
3062 		>> ISAKMP_VERS_MINOR_SHIFT;
3063 
3064 	if (ndo->ndo_vflag) {
3065 		ND_PRINT((ndo," %d.%d", major, minor));
3066 	}
3067 
3068 	if (ndo->ndo_vflag) {
3069 		ND_PRINT((ndo," msgid "));
3070 		hexprint(ndo, (const uint8_t *)&base.msgid, sizeof(base.msgid));
3071 	}
3072 
3073 	if (1 < ndo->ndo_vflag) {
3074 		ND_PRINT((ndo," cookie "));
3075 		hexprint(ndo, (const uint8_t *)&base.i_ck, sizeof(base.i_ck));
3076 		ND_PRINT((ndo,"->"));
3077 		hexprint(ndo, (const uint8_t *)&base.r_ck, sizeof(base.r_ck));
3078 	}
3079 	ND_PRINT((ndo,":"));
3080 
3081 	switch(major) {
3082 	case IKEv1_MAJOR_VERSION:
3083 		ikev1_print(ndo, bp, length, bp2, &base);
3084 		break;
3085 
3086 	case IKEv2_MAJOR_VERSION:
3087 		ikev2_print(ndo, bp, length, bp2, &base);
3088 		break;
3089 	}
3090 }
3091 
3092 void
3093 isakmp_rfc3948_print(netdissect_options *ndo,
3094 		     const u_char *bp, u_int length,
3095 		     const u_char *bp2)
3096 {
3097 	ND_TCHECK(bp[0]);
3098 	if(length == 1 && bp[0]==0xff) {
3099 		ND_PRINT((ndo, "isakmp-nat-keep-alive"));
3100 		return;
3101 	}
3102 
3103 	if(length < 4) {
3104 		goto trunc;
3105 	}
3106 	ND_TCHECK(bp[3]);
3107 
3108 	/*
3109 	 * see if this is an IKE packet
3110 	 */
3111 	if(bp[0]==0 && bp[1]==0 && bp[2]==0 && bp[3]==0) {
3112 		ND_PRINT((ndo, "NONESP-encap: "));
3113 		isakmp_print(ndo, bp+4, length-4, bp2);
3114 		return;
3115 	}
3116 
3117 	/* must be an ESP packet */
3118 	{
3119 		int nh, enh, padlen;
3120 		int advance;
3121 
3122 		ND_PRINT((ndo, "UDP-encap: "));
3123 
3124 		advance = esp_print(ndo, bp, length, bp2, &enh, &padlen);
3125 		if(advance <= 0)
3126 			return;
3127 
3128 		bp += advance;
3129 		length -= advance + padlen;
3130 		nh = enh & 0xff;
3131 
3132 		ip_print_inner(ndo, bp, length, nh, bp2);
3133 		return;
3134 	}
3135 
3136 trunc:
3137 	ND_PRINT((ndo,"[|isakmp]"));
3138 	return;
3139 }
3140 
3141 /*
3142  * Local Variables:
3143  * c-style: whitesmith
3144  * c-basic-offset: 8
3145  * End:
3146  */
3147