xref: /freebsd/contrib/tcpdump/print-isakmp.c (revision f81cdf24ba5436367377f7c8e8f51f6df2a75ca7)
1 /*
2  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the project nor the names of its contributors
14  *    may be used to endorse or promote products derived from this software
15  *    without specific prior written permission.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  *
29  */
30 
31 /* \summary: Internet Security Association and Key Management Protocol (ISAKMP) printer */
32 
33 /* specification: RFC 2407, RFC 2408, RFC 5996 */
34 
35 #ifdef HAVE_CONFIG_H
36 #include <config.h>
37 #endif
38 
39 /* The functions from print-esp.c used in this file are only defined when both
40  * OpenSSL and evp.h are detected. Employ the same preprocessor device here.
41  */
42 #ifndef HAVE_OPENSSL_EVP_H
43 #undef HAVE_LIBCRYPTO
44 #endif
45 
46 #include "netdissect-stdinc.h"
47 
48 #include <string.h>
49 
50 #include "netdissect-ctype.h"
51 
52 #include "netdissect.h"
53 #include "addrtoname.h"
54 #include "extract.h"
55 
56 #include "ip.h"
57 #include "ip6.h"
58 #include "ipproto.h"
59 
60 typedef nd_byte cookie_t[8];
61 typedef nd_byte msgid_t[4];
62 
63 #define PORT_ISAKMP 500
64 
65 /* 3.1 ISAKMP Header Format (IKEv1 and IKEv2)
66          0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
67         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
68         !                          Initiator                            !
69         !                            Cookie                             !
70         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
71         !                          Responder                            !
72         !                            Cookie                             !
73         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
74         !  Next Payload ! MjVer ! MnVer ! Exchange Type !     Flags     !
75         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
76         !                          Message ID                           !
77         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
78         !                            Length                             !
79         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
80 */
81 struct isakmp {
82 	cookie_t i_ck;		/* Initiator Cookie */
83 	cookie_t r_ck;		/* Responder Cookie */
84 	nd_uint8_t np;		/* Next Payload Type */
85 	nd_uint8_t vers;
86 #define ISAKMP_VERS_MAJOR	0xf0
87 #define ISAKMP_VERS_MAJOR_SHIFT	4
88 #define ISAKMP_VERS_MINOR	0x0f
89 #define ISAKMP_VERS_MINOR_SHIFT	0
90 	nd_uint8_t etype;	/* Exchange Type */
91 	nd_uint8_t flags;	/* Flags */
92 	msgid_t msgid;
93 	nd_uint32_t len;	/* Length */
94 };
95 
96 /* Next Payload Type */
97 #define ISAKMP_NPTYPE_NONE   0 /* NONE*/
98 #define ISAKMP_NPTYPE_SA     1 /* Security Association */
99 #define ISAKMP_NPTYPE_P      2 /* Proposal */
100 #define ISAKMP_NPTYPE_T      3 /* Transform */
101 #define ISAKMP_NPTYPE_KE     4 /* Key Exchange */
102 #define ISAKMP_NPTYPE_ID     5 /* Identification */
103 #define ISAKMP_NPTYPE_CERT   6 /* Certificate */
104 #define ISAKMP_NPTYPE_CR     7 /* Certificate Request */
105 #define ISAKMP_NPTYPE_HASH   8 /* Hash */
106 #define ISAKMP_NPTYPE_SIG    9 /* Signature */
107 #define ISAKMP_NPTYPE_NONCE 10 /* Nonce */
108 #define ISAKMP_NPTYPE_N     11 /* Notification */
109 #define ISAKMP_NPTYPE_D     12 /* Delete */
110 #define ISAKMP_NPTYPE_VID   13 /* Vendor ID */
111 #define ISAKMP_NPTYPE_v2E   46 /* v2 Encrypted payload */
112 
113 #define IKEv1_MAJOR_VERSION  1
114 #define IKEv1_MINOR_VERSION  0
115 
116 #define IKEv2_MAJOR_VERSION  2
117 #define IKEv2_MINOR_VERSION  0
118 
119 /* Flags */
120 #define ISAKMP_FLAG_E 0x01 /* Encryption Bit */
121 #define ISAKMP_FLAG_C 0x02 /* Commit Bit */
122 #define ISAKMP_FLAG_extra 0x04
123 
124 /* IKEv2 */
125 #define ISAKMP_FLAG_I (1 << 3)  /* (I)nitiator */
126 #define ISAKMP_FLAG_V (1 << 4)  /* (V)ersion   */
127 #define ISAKMP_FLAG_R (1 << 5)  /* (R)esponse  */
128 
129 
130 /* 3.2 Payload Generic Header
131          0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
132         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
133         ! Next Payload  !   RESERVED    !         Payload Length        !
134         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
135 */
136 struct isakmp_gen {
137 	nd_uint8_t  np;       /* Next Payload */
138 	nd_uint8_t  critical; /* bit 7 - critical, rest is RESERVED */
139 	nd_uint16_t len;      /* Payload Length */
140 };
141 
142 /* 3.3 Data Attributes
143          0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
144         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
145         !A!       Attribute Type        !    AF=0  Attribute Length     !
146         !F!                             !    AF=1  Attribute Value      !
147         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
148         .                   AF=0  Attribute Value                       .
149         .                   AF=1  Not Transmitted                       .
150         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
151 */
152 struct isakmp_data {
153 	nd_uint16_t type;     /* defined by DOI-spec, and Attribute Format */
154 	nd_uint16_t lorv;     /* if f equal 1, Attribute Length */
155 	                      /* if f equal 0, Attribute Value */
156 	/* if f equal 1, Attribute Value */
157 };
158 
159 /* 3.4 Security Association Payload */
160 	/* MAY NOT be used, because of being defined in ipsec-doi. */
161 	/*
162 	If the current payload is the last in the message,
163 	then the value of the next payload field will be 0.
164 	This field MUST NOT contain the
165 	values for the Proposal or Transform payloads as they are considered
166 	part of the security association negotiation.  For example, this
167 	field would contain the value "10" (Nonce payload) in the first
168 	message of a Base Exchange (see Section 4.4) and the value "0" in the
169 	first message of an Identity Protect Exchange (see Section 4.5).
170 	*/
171 struct ikev1_pl_sa {
172 	struct isakmp_gen h;
173 	nd_uint32_t doi; /* Domain of Interpretation */
174 	nd_uint32_t sit; /* Situation */
175 };
176 
177 /* 3.5 Proposal Payload */
178 	/*
179 	The value of the next payload field MUST only contain the value "2"
180 	or "0".  If there are additional Proposal payloads in the message,
181 	then this field will be 2.  If the current Proposal payload is the
182 	last within the security association proposal, then this field will
183 	be 0.
184 	*/
185 struct ikev1_pl_p {
186 	struct isakmp_gen h;
187 	nd_uint8_t p_no;      /* Proposal # */
188 	nd_uint8_t prot_id;   /* Protocol */
189 	nd_uint8_t spi_size;  /* SPI Size */
190 	nd_uint8_t num_t;     /* Number of Transforms */
191 	/* SPI */
192 };
193 
194 /* 3.6 Transform Payload */
195 	/*
196 	The value of the next payload field MUST only contain the value "3"
197 	or "0".  If there are additional Transform payloads in the proposal,
198 	then this field will be 3.  If the current Transform payload is the
199 	last within the proposal, then this field will be 0.
200 	*/
201 struct ikev1_pl_t {
202 	struct isakmp_gen h;
203 	nd_uint8_t  t_no;        /* Transform # */
204 	nd_uint8_t  t_id;        /* Transform-Id */
205 	nd_byte     reserved[2]; /* RESERVED2 */
206 	/* SA Attributes */
207 };
208 
209 /* 3.7 Key Exchange Payload */
210 struct ikev1_pl_ke {
211 	struct isakmp_gen h;
212 	/* Key Exchange Data */
213 };
214 
215 /* 3.8 Identification Payload */
216 	/* MUST NOT to be used, because of being defined in ipsec-doi. */
217 struct ikev1_pl_id {
218 	struct isakmp_gen h;
219 	union {
220 		nd_uint8_t  id_type;   /* ID Type */
221 		nd_uint32_t doi_data;  /* DOI Specific ID Data */
222 	} d;
223 	/* Identification Data */
224 };
225 
226 /* 3.9 Certificate Payload */
227 struct ikev1_pl_cert {
228 	struct isakmp_gen h;
229 	nd_uint8_t encode; /* Cert Encoding */
230 	nd_uint8_t cert;   /* Certificate Data */
231 		/*
232 		This field indicates the type of
233 		certificate or certificate-related information contained in the
234 		Certificate Data field.
235 		*/
236 };
237 
238 /* 3.10 Certificate Request Payload */
239 struct ikev1_pl_cr {
240 	struct isakmp_gen h;
241 	nd_uint8_t num_cert; /* # Cert. Types */
242 	/*
243 	Certificate Types (variable length)
244 	  -- Contains a list of the types of certificates requested,
245 	  sorted in order of preference.  Each individual certificate
246 	  type is 1 octet.  This field is NOT requiredo
247 	*/
248 	/* # Certificate Authorities (1 octet) */
249 	/* Certificate Authorities (variable length) */
250 };
251 
252 /* 3.11 Hash Payload */
253 	/* may not be used, because of having only data. */
254 struct ikev1_pl_hash {
255 	struct isakmp_gen h;
256 	/* Hash Data */
257 };
258 
259 /* 3.12 Signature Payload */
260 	/* may not be used, because of having only data. */
261 struct ikev1_pl_sig {
262 	struct isakmp_gen h;
263 	/* Signature Data */
264 };
265 
266 /* 3.13 Nonce Payload */
267 	/* may not be used, because of having only data. */
268 struct ikev1_pl_nonce {
269 	struct isakmp_gen h;
270 	/* Nonce Data */
271 };
272 
273 /* 3.14 Notification Payload */
274 struct ikev1_pl_n {
275 	struct isakmp_gen h;
276 	nd_uint32_t doi;      /* Domain of Interpretation */
277 	nd_uint8_t  prot_id;  /* Protocol-ID */
278 	nd_uint8_t  spi_size; /* SPI Size */
279 	nd_uint16_t type;     /* Notify Message Type */
280 	/* SPI */
281 	/* Notification Data */
282 };
283 
284 /* 3.14.1 Notify Message Types */
285 /* NOTIFY MESSAGES - ERROR TYPES */
286 #define ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE           1
287 #define ISAKMP_NTYPE_DOI_NOT_SUPPORTED              2
288 #define ISAKMP_NTYPE_SITUATION_NOT_SUPPORTED        3
289 #define ISAKMP_NTYPE_INVALID_COOKIE                 4
290 #define ISAKMP_NTYPE_INVALID_MAJOR_VERSION          5
291 #define ISAKMP_NTYPE_INVALID_MINOR_VERSION          6
292 #define ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE          7
293 #define ISAKMP_NTYPE_INVALID_FLAGS                  8
294 #define ISAKMP_NTYPE_INVALID_MESSAGE_ID             9
295 #define ISAKMP_NTYPE_INVALID_PROTOCOL_ID            10
296 #define ISAKMP_NTYPE_INVALID_SPI                    11
297 #define ISAKMP_NTYPE_INVALID_TRANSFORM_ID           12
298 #define ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED       13
299 #define ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN             14
300 #define ISAKMP_NTYPE_BAD_PROPOSAL_SYNTAX            15
301 #define ISAKMP_NTYPE_PAYLOAD_MALFORMED              16
302 #define ISAKMP_NTYPE_INVALID_KEY_INFORMATION        17
303 #define ISAKMP_NTYPE_INVALID_ID_INFORMATION         18
304 #define ISAKMP_NTYPE_INVALID_CERT_ENCODING          19
305 #define ISAKMP_NTYPE_INVALID_CERTIFICATE            20
306 #define ISAKMP_NTYPE_BAD_CERT_REQUEST_SYNTAX        21
307 #define ISAKMP_NTYPE_INVALID_CERT_AUTHORITY         22
308 #define ISAKMP_NTYPE_INVALID_HASH_INFORMATION       23
309 #define ISAKMP_NTYPE_AUTHENTICATION_FAILED          24
310 #define ISAKMP_NTYPE_INVALID_SIGNATURE              25
311 #define ISAKMP_NTYPE_ADDRESS_NOTIFICATION           26
312 
313 /* 3.15 Delete Payload */
314 struct ikev1_pl_d {
315 	struct isakmp_gen h;
316 	nd_uint32_t doi;      /* Domain of Interpretation */
317 	nd_uint8_t  prot_id;  /* Protocol-Id */
318 	nd_uint8_t  spi_size; /* SPI Size */
319 	nd_uint16_t num_spi;  /* # of SPIs */
320 	/* SPI(es) */
321 };
322 
323 /* IKEv2 (RFC4306) */
324 
325 /* 3.3  Security Association Payload -- generic header */
326 /* 3.3.1.  Proposal Substructure */
327 struct ikev2_p {
328 	struct isakmp_gen h;
329 	nd_uint8_t p_no;      /* Proposal # */
330 	nd_uint8_t prot_id;   /* Protocol */
331 	nd_uint8_t spi_size;  /* SPI Size */
332 	nd_uint8_t num_t;     /* Number of Transforms */
333 };
334 
335 /* 3.3.2.  Transform Substructure */
336 struct ikev2_t {
337 	struct isakmp_gen h;
338 	nd_uint8_t  t_type;    /* Transform Type (ENCR,PRF,INTEG,etc.*/
339 	nd_byte     res2;      /* reserved byte */
340 	nd_uint16_t t_id;     /* Transform ID */
341 };
342 
343 enum ikev2_t_type {
344 	IV2_T_ENCR = 1,
345 	IV2_T_PRF  = 2,
346 	IV2_T_INTEG= 3,
347 	IV2_T_DH   = 4,
348 	IV2_T_ESN  = 5
349 };
350 
351 /* 3.4.  Key Exchange Payload */
352 struct ikev2_ke {
353 	struct isakmp_gen h;
354 	nd_uint16_t  ke_group;
355 	nd_uint16_t  ke_res1;
356 	/* KE data */
357 };
358 
359 
360 /* 3.5.  Identification Payloads */
361 enum ikev2_id_type {
362 	ID_IPV4_ADDR=1,
363 	ID_FQDN=2,
364 	ID_RFC822_ADDR=3,
365 	ID_IPV6_ADDR=5,
366 	ID_DER_ASN1_DN=9,
367 	ID_DER_ASN1_GN=10,
368 	ID_KEY_ID=11
369 };
370 struct ikev2_id {
371 	struct isakmp_gen h;
372 	nd_uint8_t type;        /* ID type */
373 	nd_byte    res1;
374 	nd_byte    res2[2];
375 	/* SPI */
376 	/* Notification Data */
377 };
378 
379 /* 3.10 Notification Payload */
380 struct ikev2_n {
381 	struct isakmp_gen h;
382 	nd_uint8_t  prot_id;  /* Protocol-ID */
383 	nd_uint8_t  spi_size; /* SPI Size */
384 	nd_uint16_t type;     /* Notify Message Type */
385 };
386 
387 enum ikev2_n_type {
388 	IV2_NOTIFY_UNSUPPORTED_CRITICAL_PAYLOAD            = 1,
389 	IV2_NOTIFY_INVALID_IKE_SPI                         = 4,
390 	IV2_NOTIFY_INVALID_MAJOR_VERSION                   = 5,
391 	IV2_NOTIFY_INVALID_SYNTAX                          = 7,
392 	IV2_NOTIFY_INVALID_MESSAGE_ID                      = 9,
393 	IV2_NOTIFY_INVALID_SPI                             =11,
394 	IV2_NOTIFY_NO_PROPOSAL_CHOSEN                      =14,
395 	IV2_NOTIFY_INVALID_KE_PAYLOAD                      =17,
396 	IV2_NOTIFY_AUTHENTICATION_FAILED                   =24,
397 	IV2_NOTIFY_SINGLE_PAIR_REQUIRED                    =34,
398 	IV2_NOTIFY_NO_ADDITIONAL_SAS                       =35,
399 	IV2_NOTIFY_INTERNAL_ADDRESS_FAILURE                =36,
400 	IV2_NOTIFY_FAILED_CP_REQUIRED                      =37,
401 	IV2_NOTIFY_INVALID_SELECTORS                       =39,
402 	IV2_NOTIFY_INITIAL_CONTACT                         =16384,
403 	IV2_NOTIFY_SET_WINDOW_SIZE                         =16385,
404 	IV2_NOTIFY_ADDITIONAL_TS_POSSIBLE                  =16386,
405 	IV2_NOTIFY_IPCOMP_SUPPORTED                        =16387,
406 	IV2_NOTIFY_NAT_DETECTION_SOURCE_IP                 =16388,
407 	IV2_NOTIFY_NAT_DETECTION_DESTINATION_IP            =16389,
408 	IV2_NOTIFY_COOKIE                                  =16390,
409 	IV2_NOTIFY_USE_TRANSPORT_MODE                      =16391,
410 	IV2_NOTIFY_HTTP_CERT_LOOKUP_SUPPORTED              =16392,
411 	IV2_NOTIFY_REKEY_SA                                =16393,
412 	IV2_NOTIFY_ESP_TFC_PADDING_NOT_SUPPORTED           =16394,
413 	IV2_NOTIFY_NON_FIRST_FRAGMENTS_ALSO                =16395
414 };
415 
416 struct notify_messages {
417 	uint16_t type;
418 	char     *msg;
419 };
420 
421 /* 3.8 Authentication Payload */
422 struct ikev2_auth {
423 	struct isakmp_gen h;
424 	nd_uint8_t  auth_method;  /* Protocol-ID */
425 	nd_byte     reserved[3];
426 	/* authentication data */
427 };
428 
429 enum ikev2_auth_type {
430 	IV2_RSA_SIG = 1,
431 	IV2_SHARED  = 2,
432 	IV2_DSS_SIG = 3
433 };
434 
435 /* refer to RFC 2409 */
436 
437 #if 0
438 /* isakmp sa structure */
439 struct oakley_sa {
440 	uint8_t  proto_id;            /* OAKLEY */
441 	vchar_t   *spi;                /* spi */
442 	uint8_t  dhgrp;               /* DH; group */
443 	uint8_t  auth_t;              /* method of authentication */
444 	uint8_t  prf_t;               /* type of prf */
445 	uint8_t  hash_t;              /* type of hash */
446 	uint8_t  enc_t;               /* type of cipher */
447 	uint8_t  life_t;              /* type of duration of lifetime */
448 	uint32_t ldur;                /* life duration */
449 };
450 #endif
451 
452 /* refer to RFC 2407 */
453 
454 #define IPSEC_DOI 1
455 
456 /* 4.2 IPSEC Situation Definition */
457 #define IPSECDOI_SIT_IDENTITY_ONLY           0x00000001
458 #define IPSECDOI_SIT_SECRECY                 0x00000002
459 #define IPSECDOI_SIT_INTEGRITY               0x00000004
460 
461 /* 4.4.1 IPSEC Security Protocol Identifiers */
462   /* 4.4.2 IPSEC ISAKMP Transform Values */
463 #define IPSECDOI_PROTO_ISAKMP                        1
464 #define   IPSECDOI_KEY_IKE                             1
465 
466 /* 4.4.1 IPSEC Security Protocol Identifiers */
467 #define IPSECDOI_PROTO_IPSEC_AH                      2
468   /* 4.4.3 IPSEC AH Transform Values */
469 #define   IPSECDOI_AH_MD5                              2
470 #define   IPSECDOI_AH_SHA                              3
471 #define   IPSECDOI_AH_DES                              4
472 #define   IPSECDOI_AH_SHA2_256                         5
473 #define   IPSECDOI_AH_SHA2_384                         6
474 #define   IPSECDOI_AH_SHA2_512                         7
475 
476 /* 4.4.1 IPSEC Security Protocol Identifiers */
477 #define IPSECDOI_PROTO_IPSEC_ESP                     3
478   /* 4.4.4 IPSEC ESP Transform Identifiers */
479 #define   IPSECDOI_ESP_DES_IV64                        1
480 #define   IPSECDOI_ESP_DES                             2
481 #define   IPSECDOI_ESP_3DES                            3
482 #define   IPSECDOI_ESP_RC5                             4
483 #define   IPSECDOI_ESP_IDEA                            5
484 #define   IPSECDOI_ESP_CAST                            6
485 #define   IPSECDOI_ESP_BLOWFISH                        7
486 #define   IPSECDOI_ESP_3IDEA                           8
487 #define   IPSECDOI_ESP_DES_IV32                        9
488 #define   IPSECDOI_ESP_RC4                            10
489 #define   IPSECDOI_ESP_NULL                           11
490 #define   IPSECDOI_ESP_RIJNDAEL				12
491 #define   IPSECDOI_ESP_AES				12
492 
493 /* 4.4.1 IPSEC Security Protocol Identifiers */
494 #define IPSECDOI_PROTO_IPCOMP                        4
495   /* 4.4.5 IPSEC IPCOMP Transform Identifiers */
496 #define   IPSECDOI_IPCOMP_OUI                          1
497 #define   IPSECDOI_IPCOMP_DEFLATE                      2
498 #define   IPSECDOI_IPCOMP_LZS                          3
499 
500 /* 4.5 IPSEC Security Association Attributes */
501 #define IPSECDOI_ATTR_SA_LTYPE                1 /* B */
502 #define   IPSECDOI_ATTR_SA_LTYPE_DEFAULT        1
503 #define   IPSECDOI_ATTR_SA_LTYPE_SEC            1
504 #define   IPSECDOI_ATTR_SA_LTYPE_KB             2
505 #define IPSECDOI_ATTR_SA_LDUR                 2 /* V */
506 #define   IPSECDOI_ATTR_SA_LDUR_DEFAULT         28800 /* 8 hours */
507 #define IPSECDOI_ATTR_GRP_DESC                3 /* B */
508 #define IPSECDOI_ATTR_ENC_MODE                4 /* B */
509 	/* default value: host dependent */
510 #define   IPSECDOI_ATTR_ENC_MODE_TUNNEL         1
511 #define   IPSECDOI_ATTR_ENC_MODE_TRNS           2
512 #define IPSECDOI_ATTR_AUTH                    5 /* B */
513 	/* 0 means not to use authentication. */
514 #define   IPSECDOI_ATTR_AUTH_HMAC_MD5           1
515 #define   IPSECDOI_ATTR_AUTH_HMAC_SHA1          2
516 #define   IPSECDOI_ATTR_AUTH_DES_MAC            3
517 #define   IPSECDOI_ATTR_AUTH_KPDK               4 /*RFC-1826(Key/Pad/Data/Key)*/
518 	/*
519 	 * When negotiating ESP without authentication, the Auth
520 	 * Algorithm attribute MUST NOT be included in the proposal.
521 	 * When negotiating ESP without confidentiality, the Auth
522 	 * Algorithm attribute MUST be included in the proposal and
523 	 * the ESP transform ID must be ESP_NULL.
524 	*/
525 #define IPSECDOI_ATTR_KEY_LENGTH              6 /* B */
526 #define IPSECDOI_ATTR_KEY_ROUNDS              7 /* B */
527 #define IPSECDOI_ATTR_COMP_DICT_SIZE          8 /* B */
528 #define IPSECDOI_ATTR_COMP_PRIVALG            9 /* V */
529 
530 /* 4.6.1 Security Association Payload */
531 struct ipsecdoi_sa {
532 	struct isakmp_gen h;
533 	nd_uint32_t doi; /* Domain of Interpretation */
534 	nd_uint32_t sit; /* Situation */
535 };
536 
537 struct ipsecdoi_secrecy_h {
538 	nd_uint16_t len;
539 	nd_uint16_t reserved;
540 };
541 
542 /* 4.6.2.1 Identification Type Values */
543 struct ipsecdoi_id {
544 	struct isakmp_gen h;
545 	nd_uint8_t  type;	/* ID Type */
546 	nd_uint8_t  proto_id;	/* Protocol ID */
547 	nd_uint16_t port;	/* Port */
548 	/* Identification Data */
549 };
550 
551 #define IPSECDOI_ID_IPV4_ADDR                        1
552 #define IPSECDOI_ID_FQDN                             2
553 #define IPSECDOI_ID_USER_FQDN                        3
554 #define IPSECDOI_ID_IPV4_ADDR_SUBNET                 4
555 #define IPSECDOI_ID_IPV6_ADDR                        5
556 #define IPSECDOI_ID_IPV6_ADDR_SUBNET                 6
557 #define IPSECDOI_ID_IPV4_ADDR_RANGE                  7
558 #define IPSECDOI_ID_IPV6_ADDR_RANGE                  8
559 #define IPSECDOI_ID_DER_ASN1_DN                      9
560 #define IPSECDOI_ID_DER_ASN1_GN                      10
561 #define IPSECDOI_ID_KEY_ID                           11
562 
563 /* 4.6.3 IPSEC DOI Notify Message Types */
564 /* Notify Messages - Status Types */
565 #define IPSECDOI_NTYPE_RESPONDER_LIFETIME                  24576
566 #define IPSECDOI_NTYPE_REPLAY_STATUS                       24577
567 #define IPSECDOI_NTYPE_INITIAL_CONTACT                     24578
568 
569 #define DECLARE_PRINTER(func) static const u_char *ike##func##_print( \
570 		netdissect_options *ndo, u_char tpay,	              \
571 		const struct isakmp_gen *ext,			      \
572 		u_int item_len, \
573 		const u_char *end_pointer, \
574 		uint32_t phase,\
575 		uint32_t doi0, \
576 		uint32_t proto0, int depth)
577 
578 DECLARE_PRINTER(v1_sa);
579 DECLARE_PRINTER(v1_p);
580 DECLARE_PRINTER(v1_t);
581 DECLARE_PRINTER(v1_ke);
582 DECLARE_PRINTER(v1_id);
583 DECLARE_PRINTER(v1_cert);
584 DECLARE_PRINTER(v1_cr);
585 DECLARE_PRINTER(v1_sig);
586 DECLARE_PRINTER(v1_hash);
587 DECLARE_PRINTER(v1_nonce);
588 DECLARE_PRINTER(v1_n);
589 DECLARE_PRINTER(v1_d);
590 DECLARE_PRINTER(v1_vid);
591 
592 DECLARE_PRINTER(v2_sa);
593 DECLARE_PRINTER(v2_ke);
594 DECLARE_PRINTER(v2_ID);
595 DECLARE_PRINTER(v2_cert);
596 DECLARE_PRINTER(v2_cr);
597 DECLARE_PRINTER(v2_auth);
598 DECLARE_PRINTER(v2_nonce);
599 DECLARE_PRINTER(v2_n);
600 DECLARE_PRINTER(v2_d);
601 DECLARE_PRINTER(v2_vid);
602 DECLARE_PRINTER(v2_TS);
603 DECLARE_PRINTER(v2_cp);
604 DECLARE_PRINTER(v2_eap);
605 
606 static const u_char *ikev2_e_print(netdissect_options *ndo,
607 				   const struct isakmp *base,
608 				   u_char tpay,
609 				   const struct isakmp_gen *ext,
610 				   u_int item_len,
611 				   const u_char *end_pointer,
612 				   uint32_t phase,
613 				   uint32_t doi0,
614 				   uint32_t proto0, int depth);
615 
616 
617 static const u_char *ike_sub0_print(netdissect_options *ndo,u_char, const struct isakmp_gen *,
618 	const u_char *,	uint32_t, uint32_t, uint32_t, int);
619 static const u_char *ikev1_sub_print(netdissect_options *ndo,u_char, const struct isakmp_gen *,
620 	const u_char *, uint32_t, uint32_t, uint32_t, int);
621 
622 static const u_char *ikev2_sub_print(netdissect_options *ndo,
623 				     const struct isakmp *base,
624 				     u_char np, const struct isakmp_gen *ext,
625 				     const u_char *ep, uint32_t phase,
626 				     uint32_t doi, uint32_t proto,
627 				     int depth);
628 
629 
630 static char *numstr(u_int);
631 
632 static void
633 ikev1_print(netdissect_options *ndo,
634 	    const u_char *bp,  u_int length,
635 	    const u_char *bp2, const struct isakmp *base);
636 
637 #define MAXINITIATORS	20
638 static int ninitiator = 0;
639 union inaddr_u {
640 	nd_ipv4 in4;
641 	nd_ipv6 in6;
642 };
643 static struct {
644 	cookie_t initiator;
645 	u_int version;
646 	union inaddr_u iaddr;
647 	union inaddr_u raddr;
648 } cookiecache[MAXINITIATORS];
649 
650 /* protocol id */
651 static const char *protoidstr[] = {
652 	NULL, "isakmp", "ipsec-ah", "ipsec-esp", "ipcomp",
653 };
654 
655 /* isakmp->np */
656 static const char *npstr[] = {
657 	"none", "sa", "p", "t", "ke", "id", "cert", "cr", "hash", /* 0 - 8 */
658 	"sig", "nonce", "n", "d", "vid",      /* 9 - 13 */
659 	"pay14", "pay15", "pay16", "pay17", "pay18", /* 14- 18 */
660 	"pay19", "pay20", "pay21", "pay22", "pay23", /* 19- 23 */
661 	"pay24", "pay25", "pay26", "pay27", "pay28", /* 24- 28 */
662 	"pay29", "pay30", "pay31", "pay32",          /* 29- 32 */
663 	"v2sa",  "v2ke",  "v2IDi", "v2IDr", "v2cert",/* 33- 37 */
664 	"v2cr",  "v2auth","v2nonce", "v2n",   "v2d",   /* 38- 42 */
665 	"v2vid", "v2TSi", "v2TSr", "v2e",   "v2cp",  /* 43- 47 */
666 	"v2eap",                                     /* 48 */
667 
668 };
669 
670 /* isakmp->np */
671 static const u_char *(*npfunc[])(netdissect_options *ndo, u_char tpay,
672 				 const struct isakmp_gen *ext,
673 				 u_int item_len,
674 				 const u_char *end_pointer,
675 				 uint32_t phase,
676 				 uint32_t doi0,
677 				 uint32_t proto0, int depth) = {
678 	NULL,
679 	ikev1_sa_print,
680 	ikev1_p_print,
681 	ikev1_t_print,
682 	ikev1_ke_print,
683 	ikev1_id_print,
684 	ikev1_cert_print,
685 	ikev1_cr_print,
686 	ikev1_hash_print,
687 	ikev1_sig_print,
688 	ikev1_nonce_print,
689 	ikev1_n_print,
690 	ikev1_d_print,
691 	ikev1_vid_print,                  /* 13 */
692 	NULL, NULL, NULL, NULL, NULL,     /* 14- 18 */
693 	NULL, NULL, NULL, NULL, NULL,     /* 19- 23 */
694 	NULL, NULL, NULL, NULL, NULL,     /* 24- 28 */
695 	NULL, NULL, NULL, NULL,           /* 29- 32 */
696 	ikev2_sa_print,                 /* 33 */
697 	ikev2_ke_print,                 /* 34 */
698 	ikev2_ID_print,                 /* 35 */
699 	ikev2_ID_print,                 /* 36 */
700 	ikev2_cert_print,               /* 37 */
701 	ikev2_cr_print,                 /* 38 */
702 	ikev2_auth_print,               /* 39 */
703 	ikev2_nonce_print,              /* 40 */
704 	ikev2_n_print,                  /* 41 */
705 	ikev2_d_print,                  /* 42 */
706 	ikev2_vid_print,                /* 43 */
707 	ikev2_TS_print,                 /* 44 */
708 	ikev2_TS_print,                 /* 45 */
709 	NULL, /* ikev2_e_print,*/       /* 46 - special */
710 	ikev2_cp_print,                 /* 47 */
711 	ikev2_eap_print,                /* 48 */
712 };
713 
714 /* isakmp->etype */
715 static const char *etypestr[] = {
716 /* IKEv1 exchange types */
717 	"none", "base", "ident", "auth", "agg", "inf", NULL, NULL,  /* 0-7 */
718 	NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,  /*  8-15 */
719 	NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,  /* 16-23 */
720 	NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,  /* 24-31 */
721 	"oakley-quick", "oakley-newgroup",               /* 32-33 */
722 /* IKEv2 exchange types */
723 	"ikev2_init", "ikev2_auth", "child_sa", "inf2"   /* 34-37 */
724 };
725 
726 #define STR_OR_ID(x, tab) \
727 	(((x) < sizeof(tab)/sizeof(tab[0]) && tab[(x)])	? tab[(x)] : numstr(x))
728 #define PROTOIDSTR(x)	STR_OR_ID(x, protoidstr)
729 #define NPSTR(x)	STR_OR_ID(x, npstr)
730 #define ETYPESTR(x)	STR_OR_ID(x, etypestr)
731 
732 #define CHECKLEN(p, np)							\
733 		if (ep < (const u_char *)(p)) {				\
734 			ND_PRINT(" [|%s]", NPSTR(np));		\
735 			goto done;					\
736 		}
737 
738 
739 #define NPFUNC(x) \
740 	(((x) < sizeof(npfunc)/sizeof(npfunc[0]) && npfunc[(x)]) \
741 		? npfunc[(x)] : NULL)
742 
743 static int
744 iszero(netdissect_options *ndo, const u_char *p, size_t l)
745 {
746 	while (l != 0) {
747 		if (GET_U_1(p))
748 			return 0;
749 		p++;
750 		l--;
751 	}
752 	return 1;
753 }
754 
755 /* find cookie from initiator cache */
756 static int
757 cookie_find(const cookie_t *in)
758 {
759 	int i;
760 
761 	for (i = 0; i < MAXINITIATORS; i++) {
762 		if (memcmp(in, &cookiecache[i].initiator, sizeof(*in)) == 0)
763 			return i;
764 	}
765 
766 	return -1;
767 }
768 
769 /* record initiator */
770 static void
771 cookie_record(netdissect_options *ndo, const cookie_t *in, const u_char *bp2)
772 {
773 	int i;
774 	const struct ip *ip;
775 	const struct ip6_hdr *ip6;
776 
777 	i = cookie_find(in);
778 	if (0 <= i) {
779 		ninitiator = (i + 1) % MAXINITIATORS;
780 		return;
781 	}
782 
783 	ip = (const struct ip *)bp2;
784 	switch (IP_V(ip)) {
785 	case 4:
786 		cookiecache[ninitiator].version = 4;
787 		UNALIGNED_MEMCPY(&cookiecache[ninitiator].iaddr.in4,
788 				 ip->ip_src, sizeof(nd_ipv4));
789 		UNALIGNED_MEMCPY(&cookiecache[ninitiator].raddr.in4,
790 				 ip->ip_dst, sizeof(nd_ipv4));
791 		break;
792 	case 6:
793 		ip6 = (const struct ip6_hdr *)bp2;
794 		cookiecache[ninitiator].version = 6;
795 		UNALIGNED_MEMCPY(&cookiecache[ninitiator].iaddr.in6,
796 				 ip6->ip6_src, sizeof(nd_ipv6));
797 		UNALIGNED_MEMCPY(&cookiecache[ninitiator].raddr.in6,
798 				 ip6->ip6_dst, sizeof(nd_ipv6));
799 		break;
800 	default:
801 		return;
802 	}
803 	UNALIGNED_MEMCPY(&cookiecache[ninitiator].initiator, in, sizeof(*in));
804 	ninitiator = (ninitiator + 1) % MAXINITIATORS;
805 }
806 
807 #define cookie_isinitiator(ndo, x, y)	cookie_sidecheck(ndo, (x), (y), 1)
808 #define cookie_isresponder(ndo, x, y)	cookie_sidecheck(ndo, (x), (y), 0)
809 static int
810 cookie_sidecheck(netdissect_options *ndo, int i, const u_char *bp2, int initiator)
811 {
812 	const struct ip *ip;
813 	const struct ip6_hdr *ip6;
814 
815 	ip = (const struct ip *)bp2;
816 	switch (IP_V(ip)) {
817 	case 4:
818 		if (cookiecache[i].version != 4)
819 			return 0;
820 		if (initiator) {
821 			if (UNALIGNED_MEMCMP(ip->ip_src, &cookiecache[i].iaddr.in4, sizeof(nd_ipv4)) == 0)
822 				return 1;
823 		} else {
824 			if (UNALIGNED_MEMCMP(ip->ip_src, &cookiecache[i].raddr.in4, sizeof(nd_ipv4)) == 0)
825 				return 1;
826 		}
827 		break;
828 	case 6:
829 		if (cookiecache[i].version != 6)
830 			return 0;
831 		ip6 = (const struct ip6_hdr *)bp2;
832 		if (initiator) {
833 			if (UNALIGNED_MEMCMP(ip6->ip6_src, &cookiecache[i].iaddr.in6, sizeof(nd_ipv6)) == 0)
834 				return 1;
835 		} else {
836 			if (UNALIGNED_MEMCMP(ip6->ip6_src, &cookiecache[i].raddr.in6, sizeof(nd_ipv6)) == 0)
837 				return 1;
838 		}
839 		break;
840 	default:
841 		break;
842 	}
843 
844 	return 0;
845 }
846 
847 static void
848 hexprint(netdissect_options *ndo, const uint8_t *loc, size_t len)
849 {
850 	const uint8_t *p;
851 	size_t i;
852 
853 	p = loc;
854 	for (i = 0; i < len; i++)
855 		ND_PRINT("%02x", p[i] & 0xff);
856 }
857 
858 static int
859 rawprint(netdissect_options *ndo, const uint8_t *loc, size_t len)
860 {
861 	ND_TCHECK_LEN(loc, len);
862 
863 	hexprint(ndo, loc, len);
864 	return 1;
865 trunc:
866 	return 0;
867 }
868 
869 
870 /*
871  * returns false if we run out of data buffer
872  */
873 static int ike_show_somedata(netdissect_options *ndo,
874 			     const u_char *cp, const u_char *ep)
875 {
876 	/* there is too much data, just show some of it */
877 	const u_char *end = ep - 20;
878 	size_t  elen = 20;
879 	size_t  len = ep - cp;
880 	if(len > 10) {
881 		len = 10;
882 	}
883 
884 	/* really shouldn't happen because of above */
885 	if(end < cp + len) {
886 		end = cp+len;
887 		elen = ep - end;
888 	}
889 
890 	ND_PRINT(" data=(");
891 	if(!rawprint(ndo, (const uint8_t *)(cp), len)) goto trunc;
892 	ND_PRINT("...");
893 	if(elen) {
894 		if(!rawprint(ndo, (const uint8_t *)(end), elen)) goto trunc;
895 	}
896 	ND_PRINT(")");
897 	return 1;
898 
899 trunc:
900 	return 0;
901 }
902 
903 struct attrmap {
904 	const char *type;
905 	u_int nvalue;
906 	const char *value[30];	/*XXX*/
907 };
908 
909 static const u_char *
910 ikev1_attrmap_print(netdissect_options *ndo,
911 		    const u_char *p, const u_char *ep2,
912 		    const struct attrmap *map, size_t nmap)
913 {
914 	u_int totlen;
915 	uint32_t t, v;
916 
917 	if (GET_U_1(p) & 0x80)
918 		totlen = 4;
919 	else {
920 		totlen = 4 + GET_BE_U_2(p + 2);
921 	}
922 	if (ep2 < p + totlen) {
923 		ND_PRINT("[|attr]");
924 		return ep2 + 1;
925 	}
926 
927 	ND_PRINT("(");
928 	t = GET_BE_U_2(p) & 0x7fff;
929 	if (map && t < nmap && map[t].type)
930 		ND_PRINT("type=%s ", map[t].type);
931 	else
932 		ND_PRINT("type=#%u ", t);
933 	if (GET_U_1(p) & 0x80) {
934 		ND_PRINT("value=");
935 		v = GET_BE_U_2(p + 2);
936 		if (map && t < nmap && v < map[t].nvalue && map[t].value[v])
937 			ND_PRINT("%s", map[t].value[v]);
938 		else {
939 			if (!rawprint(ndo, (const uint8_t *)(p + 2), 2)) {
940 				ND_PRINT(")");
941 				goto trunc;
942 			}
943 		}
944 	} else {
945 		ND_PRINT("len=%u value=", totlen - 4);
946 		if (!rawprint(ndo, (const uint8_t *)(p + 4), totlen - 4)) {
947 			ND_PRINT(")");
948 			goto trunc;
949 		}
950 	}
951 	ND_PRINT(")");
952 	return p + totlen;
953 
954 trunc:
955 	return NULL;
956 }
957 
958 static const u_char *
959 ikev1_attr_print(netdissect_options *ndo, const u_char *p, const u_char *ep2)
960 {
961 	u_int totlen;
962 	uint32_t t;
963 
964 	if (GET_U_1(p) & 0x80)
965 		totlen = 4;
966 	else {
967 		totlen = 4 + GET_BE_U_2(p + 2);
968 	}
969 	if (ep2 < p + totlen) {
970 		ND_PRINT("[|attr]");
971 		return ep2 + 1;
972 	}
973 
974 	ND_PRINT("(");
975 	t = GET_BE_U_2(p) & 0x7fff;
976 	ND_PRINT("type=#%u ", t);
977 	if (GET_U_1(p) & 0x80) {
978 		ND_PRINT("value=");
979 		t = GET_U_1(p + 2);
980 		if (!rawprint(ndo, (const uint8_t *)(p + 2), 2)) {
981 			ND_PRINT(")");
982 			goto trunc;
983 		}
984 	} else {
985 		ND_PRINT("len=%u value=", totlen - 4);
986 		if (!rawprint(ndo, (const uint8_t *)(p + 4), totlen - 4)) {
987 			ND_PRINT(")");
988 			goto trunc;
989 		}
990 	}
991 	ND_PRINT(")");
992 	return p + totlen;
993 
994 trunc:
995 	return NULL;
996 }
997 
998 static const u_char *
999 ikev1_sa_print(netdissect_options *ndo, u_char tpay _U_,
1000 	       const struct isakmp_gen *ext,
1001 		u_int item_len _U_,
1002 		const u_char *ep, uint32_t phase, uint32_t doi0 _U_,
1003 		uint32_t proto0, int depth)
1004 {
1005 	const struct ikev1_pl_sa *p;
1006 	uint32_t doi, sit, ident;
1007 	const u_char *cp, *np;
1008 	int t;
1009 
1010 	ND_PRINT("%s:", NPSTR(ISAKMP_NPTYPE_SA));
1011 
1012 	p = (const struct ikev1_pl_sa *)ext;
1013 	ND_TCHECK_SIZE(p);
1014 	doi = GET_BE_U_4(p->doi);
1015 	sit = GET_BE_U_4(p->sit);
1016 	if (doi != 1) {
1017 		ND_PRINT(" doi=%u", doi);
1018 		ND_PRINT(" situation=%u", sit);
1019 		return (const u_char *)(p + 1);
1020 	}
1021 
1022 	ND_PRINT(" doi=ipsec");
1023 	ND_PRINT(" situation=");
1024 	t = 0;
1025 	if (sit & 0x01) {
1026 		ND_PRINT("identity");
1027 		t++;
1028 	}
1029 	if (sit & 0x02) {
1030 		ND_PRINT("%ssecrecy", t ? "+" : "");
1031 		t++;
1032 	}
1033 	if (sit & 0x04)
1034 		ND_PRINT("%sintegrity", t ? "+" : "");
1035 
1036 	np = (const u_char *)ext + sizeof(struct ikev1_pl_sa);
1037 	if (sit != 0x01) {
1038 		ident = GET_BE_U_4(ext + 1);
1039 		ND_PRINT(" ident=%u", ident);
1040 		np += sizeof(ident);
1041 	}
1042 
1043 	ext = (const struct isakmp_gen *)np;
1044 	ND_TCHECK_SIZE(ext);
1045 
1046 	cp = ikev1_sub_print(ndo, ISAKMP_NPTYPE_P, ext, ep, phase, doi, proto0,
1047 		depth);
1048 
1049 	return cp;
1050 trunc:
1051 	ND_PRINT(" [|%s]", NPSTR(ISAKMP_NPTYPE_SA));
1052 	return NULL;
1053 }
1054 
1055 static const u_char *
1056 ikev1_p_print(netdissect_options *ndo, u_char tpay _U_,
1057 	      const struct isakmp_gen *ext, u_int item_len _U_,
1058 	       const u_char *ep, uint32_t phase, uint32_t doi0,
1059 	       uint32_t proto0 _U_, int depth)
1060 {
1061 	const struct ikev1_pl_p *p;
1062 	const u_char *cp;
1063 	uint8_t spi_size;
1064 
1065 	ND_PRINT("%s:", NPSTR(ISAKMP_NPTYPE_P));
1066 
1067 	p = (const struct ikev1_pl_p *)ext;
1068 	ND_TCHECK_SIZE(p);
1069 	ND_PRINT(" #%u protoid=%s transform=%u",
1070 		  GET_U_1(p->p_no), PROTOIDSTR(GET_U_1(p->prot_id)),
1071 		  GET_U_1(p->num_t));
1072 	spi_size = GET_U_1(p->spi_size);
1073 	if (spi_size) {
1074 		ND_PRINT(" spi=");
1075 		if (!rawprint(ndo, (const uint8_t *)(p + 1), spi_size))
1076 			goto trunc;
1077 	}
1078 
1079 	ext = (const struct isakmp_gen *)((const u_char *)(p + 1) + spi_size);
1080 	ND_TCHECK_SIZE(ext);
1081 
1082 	cp = ikev1_sub_print(ndo, ISAKMP_NPTYPE_T, ext, ep, phase, doi0,
1083 			     GET_U_1(p->prot_id), depth);
1084 
1085 	return cp;
1086 trunc:
1087 	ND_PRINT(" [|%s]", NPSTR(ISAKMP_NPTYPE_P));
1088 	return NULL;
1089 }
1090 
1091 static const char *ikev1_p_map[] = {
1092 	NULL, "ike",
1093 };
1094 
1095 static const char *ikev2_t_type_map[]={
1096 	NULL, "encr", "prf", "integ", "dh", "esn"
1097 };
1098 
1099 static const char *ah_p_map[] = {
1100 	NULL, "(reserved)", "md5", "sha", "1des",
1101 	"sha2-256", "sha2-384", "sha2-512",
1102 };
1103 
1104 static const char *prf_p_map[] = {
1105 	NULL, "hmac-md5", "hmac-sha", "hmac-tiger",
1106 	"aes128_xcbc"
1107 };
1108 
1109 static const char *integ_p_map[] = {
1110 	NULL, "hmac-md5", "hmac-sha", "dec-mac",
1111 	"kpdk-md5", "aes-xcbc"
1112 };
1113 
1114 static const char *esn_p_map[] = {
1115 	"no-esn", "esn"
1116 };
1117 
1118 static const char *dh_p_map[] = {
1119 	NULL, "modp768",
1120 	"modp1024",    /* group 2 */
1121 	"EC2N 2^155",  /* group 3 */
1122 	"EC2N 2^185",  /* group 4 */
1123 	"modp1536",    /* group 5 */
1124 	"iana-grp06", "iana-grp07", /* reserved */
1125 	"iana-grp08", "iana-grp09",
1126 	"iana-grp10", "iana-grp11",
1127 	"iana-grp12", "iana-grp13",
1128 	"modp2048",    /* group 14 */
1129 	"modp3072",    /* group 15 */
1130 	"modp4096",    /* group 16 */
1131 	"modp6144",    /* group 17 */
1132 	"modp8192",    /* group 18 */
1133 };
1134 
1135 static const char *esp_p_map[] = {
1136 	NULL, "1des-iv64", "1des", "3des", "rc5", "idea", "cast",
1137 	"blowfish", "3idea", "1des-iv32", "rc4", "null", "aes"
1138 };
1139 
1140 static const char *ipcomp_p_map[] = {
1141 	NULL, "oui", "deflate", "lzs",
1142 };
1143 
1144 static const struct attrmap ipsec_t_map[] = {
1145 	{ NULL,	0, { NULL } },
1146 	{ "lifetype", 3, { NULL, "sec", "kb", }, },
1147 	{ "life", 0, { NULL } },
1148 	{ "group desc", 18,	{ NULL, "modp768",
1149 				  "modp1024",    /* group 2 */
1150 				  "EC2N 2^155",  /* group 3 */
1151 				  "EC2N 2^185",  /* group 4 */
1152 				  "modp1536",    /* group 5 */
1153 				  "iana-grp06", "iana-grp07", /* reserved */
1154 				  "iana-grp08", "iana-grp09",
1155 				  "iana-grp10", "iana-grp11",
1156 				  "iana-grp12", "iana-grp13",
1157 				  "modp2048",    /* group 14 */
1158 				  "modp3072",    /* group 15 */
1159 				  "modp4096",    /* group 16 */
1160 				  "modp6144",    /* group 17 */
1161 				  "modp8192",    /* group 18 */
1162 		}, },
1163 	{ "enc mode", 3, { NULL, "tunnel", "transport", }, },
1164 	{ "auth", 5, { NULL, "hmac-md5", "hmac-sha1", "1des-mac", "keyed", }, },
1165 	{ "keylen", 0, { NULL } },
1166 	{ "rounds", 0, { NULL } },
1167 	{ "dictsize", 0, { NULL } },
1168 	{ "privalg", 0, { NULL } },
1169 };
1170 
1171 static const struct attrmap encr_t_map[] = {
1172 	{ NULL,	0, { NULL } },	{ NULL,	0, { NULL } },  /* 0, 1 */
1173 	{ NULL,	0, { NULL } },	{ NULL,	0, { NULL } },  /* 2, 3 */
1174 	{ NULL,	0, { NULL } },	{ NULL,	0, { NULL } },  /* 4, 5 */
1175 	{ NULL,	0, { NULL } },	{ NULL,	0, { NULL } },  /* 6, 7 */
1176 	{ NULL,	0, { NULL } },	{ NULL,	0, { NULL } },  /* 8, 9 */
1177 	{ NULL,	0, { NULL } },	{ NULL,	0, { NULL } },  /* 10,11*/
1178 	{ NULL,	0, { NULL } },	{ NULL,	0, { NULL } },  /* 12,13*/
1179 	{ "keylen", 14, { NULL }},
1180 };
1181 
1182 static const struct attrmap oakley_t_map[] = {
1183 	{ NULL,	0, { NULL } },
1184 	{ "enc", 8,	{ NULL, "1des", "idea", "blowfish", "rc5",
1185 			  "3des", "cast", "aes", }, },
1186 	{ "hash", 7,	{ NULL, "md5", "sha1", "tiger",
1187 			  "sha2-256", "sha2-384", "sha2-512", }, },
1188 	{ "auth", 6,	{ NULL, "preshared", "dss", "rsa sig", "rsa enc",
1189 			  "rsa enc revised", }, },
1190 	{ "group desc", 18,	{ NULL, "modp768",
1191 				  "modp1024",    /* group 2 */
1192 				  "EC2N 2^155",  /* group 3 */
1193 				  "EC2N 2^185",  /* group 4 */
1194 				  "modp1536",    /* group 5 */
1195 				  "iana-grp06", "iana-grp07", /* reserved */
1196 				  "iana-grp08", "iana-grp09",
1197 				  "iana-grp10", "iana-grp11",
1198 				  "iana-grp12", "iana-grp13",
1199 				  "modp2048",    /* group 14 */
1200 				  "modp3072",    /* group 15 */
1201 				  "modp4096",    /* group 16 */
1202 				  "modp6144",    /* group 17 */
1203 				  "modp8192",    /* group 18 */
1204 		}, },
1205 	{ "group type", 4,	{ NULL, "MODP", "ECP", "EC2N", }, },
1206 	{ "group prime", 0, { NULL } },
1207 	{ "group gen1", 0, { NULL } },
1208 	{ "group gen2", 0, { NULL } },
1209 	{ "group curve A", 0, { NULL } },
1210 	{ "group curve B", 0, { NULL } },
1211 	{ "lifetype", 3,	{ NULL, "sec", "kb", }, },
1212 	{ "lifeduration", 0, { NULL } },
1213 	{ "prf", 0, { NULL } },
1214 	{ "keylen", 0, { NULL } },
1215 	{ "field", 0, { NULL } },
1216 	{ "order", 0, { NULL } },
1217 };
1218 
1219 static const u_char *
1220 ikev1_t_print(netdissect_options *ndo, u_char tpay _U_,
1221 	      const struct isakmp_gen *ext, u_int item_len,
1222 	      const u_char *ep, uint32_t phase _U_, uint32_t doi _U_,
1223 	      uint32_t proto, int depth _U_)
1224 {
1225 	const struct ikev1_pl_t *p;
1226 	const u_char *cp;
1227 	const char *idstr;
1228 	const struct attrmap *map;
1229 	size_t nmap;
1230 	const u_char *ep2;
1231 
1232 	ND_PRINT("%s:", NPSTR(ISAKMP_NPTYPE_T));
1233 
1234 	p = (const struct ikev1_pl_t *)ext;
1235 	ND_TCHECK_SIZE(p);
1236 
1237 	switch (proto) {
1238 	case 1:
1239 		idstr = STR_OR_ID(GET_U_1(p->t_id), ikev1_p_map);
1240 		map = oakley_t_map;
1241 		nmap = sizeof(oakley_t_map)/sizeof(oakley_t_map[0]);
1242 		break;
1243 	case 2:
1244 		idstr = STR_OR_ID(GET_U_1(p->t_id), ah_p_map);
1245 		map = ipsec_t_map;
1246 		nmap = sizeof(ipsec_t_map)/sizeof(ipsec_t_map[0]);
1247 		break;
1248 	case 3:
1249 		idstr = STR_OR_ID(GET_U_1(p->t_id), esp_p_map);
1250 		map = ipsec_t_map;
1251 		nmap = sizeof(ipsec_t_map)/sizeof(ipsec_t_map[0]);
1252 		break;
1253 	case 4:
1254 		idstr = STR_OR_ID(GET_U_1(p->t_id), ipcomp_p_map);
1255 		map = ipsec_t_map;
1256 		nmap = sizeof(ipsec_t_map)/sizeof(ipsec_t_map[0]);
1257 		break;
1258 	default:
1259 		idstr = NULL;
1260 		map = NULL;
1261 		nmap = 0;
1262 		break;
1263 	}
1264 
1265 	if (idstr)
1266 		ND_PRINT(" #%u id=%s ", GET_U_1(p->t_no), idstr);
1267 	else
1268 		ND_PRINT(" #%u id=%u ", GET_U_1(p->t_no), GET_U_1(p->t_id));
1269 	cp = (const u_char *)(p + 1);
1270 	ep2 = (const u_char *)p + item_len;
1271 	while (cp < ep && cp < ep2) {
1272 		if (map && nmap)
1273 			cp = ikev1_attrmap_print(ndo, cp, ep2, map, nmap);
1274 		else
1275 			cp = ikev1_attr_print(ndo, cp, ep2);
1276 		if (cp == NULL)
1277 			goto trunc;
1278 	}
1279 	if (ep < ep2)
1280 		ND_PRINT("...");
1281 	return cp;
1282 trunc:
1283 	ND_PRINT(" [|%s]", NPSTR(ISAKMP_NPTYPE_T));
1284 	return NULL;
1285 }
1286 
1287 static const u_char *
1288 ikev1_ke_print(netdissect_options *ndo, u_char tpay _U_,
1289 	       const struct isakmp_gen *ext, u_int item_len,
1290 	       const u_char *ep _U_, uint32_t phase _U_, uint32_t doi _U_,
1291 	       uint32_t proto _U_, int depth _U_)
1292 {
1293 	ND_PRINT("%s:", NPSTR(ISAKMP_NPTYPE_KE));
1294 
1295 	ND_TCHECK_SIZE(ext);
1296 	/*
1297 	 * Our caller has ensured that the length is >= 4.
1298 	 */
1299 	ND_PRINT(" key len=%u", item_len - 4);
1300 	if (2 < ndo->ndo_vflag && item_len > 4) {
1301 		/* Print the entire payload in hex */
1302 		ND_PRINT(" ");
1303 		if (!rawprint(ndo, (const uint8_t *)(ext + 1), item_len - 4))
1304 			goto trunc;
1305 	}
1306 	return (const u_char *)ext + item_len;
1307 trunc:
1308 	ND_PRINT(" [|%s]", NPSTR(ISAKMP_NPTYPE_KE));
1309 	return NULL;
1310 }
1311 
1312 static const u_char *
1313 ikev1_id_print(netdissect_options *ndo, u_char tpay _U_,
1314 	       const struct isakmp_gen *ext, u_int item_len,
1315 	       const u_char *ep _U_, uint32_t phase, uint32_t doi _U_,
1316 	       uint32_t proto _U_, int depth _U_)
1317 {
1318 #define USE_IPSECDOI_IN_PHASE1	1
1319 	const struct ikev1_pl_id *p;
1320 	static const char *idtypestr[] = {
1321 		"IPv4", "IPv4net", "IPv6", "IPv6net",
1322 	};
1323 	static const char *ipsecidtypestr[] = {
1324 		NULL, "IPv4", "FQDN", "user FQDN", "IPv4net", "IPv6",
1325 		"IPv6net", "IPv4range", "IPv6range", "ASN1 DN", "ASN1 GN",
1326 		"keyid",
1327 	};
1328 	u_int len;
1329 	const u_char *data;
1330 
1331 	ND_PRINT("%s:", NPSTR(ISAKMP_NPTYPE_ID));
1332 
1333 	p = (const struct ikev1_pl_id *)ext;
1334 	ND_TCHECK_SIZE(p);
1335 	if (sizeof(*p) < item_len) {
1336 		data = (const u_char *)(p + 1);
1337 		len = item_len - sizeof(*p);
1338 	} else {
1339 		data = NULL;
1340 		len = 0;
1341 	}
1342 
1343 #if 0 /*debug*/
1344 	ND_PRINT(" [phase=%u doi=%u proto=%u]", phase, doi, proto);
1345 #endif
1346 	switch (phase) {
1347 #ifndef USE_IPSECDOI_IN_PHASE1
1348 	case 1:
1349 #endif
1350 	default:
1351 		ND_PRINT(" idtype=%s",
1352 			 STR_OR_ID(GET_U_1(p->d.id_type), idtypestr));
1353 		ND_PRINT(" doi_data=%u",
1354 			  GET_BE_U_4(p->d.doi_data) & 0xffffff);
1355 		break;
1356 
1357 #ifdef USE_IPSECDOI_IN_PHASE1
1358 	case 1:
1359 #endif
1360 	case 2:
1361 	    {
1362 		const struct ipsecdoi_id *doi_p;
1363 		const char *p_name;
1364 		uint8_t type, proto_id;
1365 
1366 		doi_p = (const struct ipsecdoi_id *)ext;
1367 		ND_TCHECK_SIZE(doi_p);
1368 		type = GET_U_1(doi_p->type);
1369 		ND_PRINT(" idtype=%s", STR_OR_ID(type, ipsecidtypestr));
1370 		/* A protocol ID of 0 DOES NOT mean IPPROTO_IP! */
1371 		proto_id = GET_U_1(doi_p->proto_id);
1372 		if (!ndo->ndo_nflag && proto_id && (p_name = netdb_protoname(proto_id)) != NULL)
1373 			ND_PRINT(" protoid=%s", p_name);
1374 		else
1375 			ND_PRINT(" protoid=%u", proto_id);
1376 		ND_PRINT(" port=%u", GET_BE_U_2(doi_p->port));
1377 		if (!len)
1378 			break;
1379 		if (data == NULL)
1380 			goto trunc;
1381 		ND_TCHECK_LEN(data, len);
1382 		switch (type) {
1383 		case IPSECDOI_ID_IPV4_ADDR:
1384 			if (len < 4)
1385 				ND_PRINT(" len=%u [bad: < 4]", len);
1386 			else
1387 				ND_PRINT(" len=%u %s", len, GET_IPADDR_STRING(data));
1388 			len = 0;
1389 			break;
1390 		case IPSECDOI_ID_FQDN:
1391 		case IPSECDOI_ID_USER_FQDN:
1392 		    {
1393 			u_int i;
1394 			ND_PRINT(" len=%u ", len);
1395 			for (i = 0; i < len; i++)
1396 				fn_print_char(ndo, GET_U_1(data + i));
1397 			len = 0;
1398 			break;
1399 		    }
1400 		case IPSECDOI_ID_IPV4_ADDR_SUBNET:
1401 		    {
1402 			const u_char *mask;
1403 			if (len < 8)
1404 				ND_PRINT(" len=%u [bad: < 8]", len);
1405 			else {
1406 				mask = data + sizeof(nd_ipv4);
1407 				ND_PRINT(" len=%u %s/%u.%u.%u.%u", len,
1408 					  GET_IPADDR_STRING(data),
1409 					  GET_U_1(mask), GET_U_1(mask + 1),
1410 					  GET_U_1(mask + 2),
1411 					  GET_U_1(mask + 3));
1412 			}
1413 			len = 0;
1414 			break;
1415 		    }
1416 		case IPSECDOI_ID_IPV6_ADDR:
1417 			if (len < 16)
1418 				ND_PRINT(" len=%u [bad: < 16]", len);
1419 			else
1420 				ND_PRINT(" len=%u %s", len, GET_IP6ADDR_STRING(data));
1421 			len = 0;
1422 			break;
1423 		case IPSECDOI_ID_IPV6_ADDR_SUBNET:
1424 		    {
1425 			const u_char *mask;
1426 			if (len < 32)
1427 				ND_PRINT(" len=%u [bad: < 32]", len);
1428 			else {
1429 				mask = (const u_char *)(data + sizeof(nd_ipv6));
1430 				/*XXX*/
1431 				ND_PRINT(" len=%u %s/0x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x", len,
1432 					  GET_IP6ADDR_STRING(data),
1433 					  GET_U_1(mask), GET_U_1(mask + 1),
1434 					  GET_U_1(mask + 2),
1435 					  GET_U_1(mask + 3),
1436 					  GET_U_1(mask + 4),
1437 					  GET_U_1(mask + 5),
1438 					  GET_U_1(mask + 6),
1439 					  GET_U_1(mask + 7),
1440 					  GET_U_1(mask + 8),
1441 					  GET_U_1(mask + 9),
1442 					  GET_U_1(mask + 10),
1443 					  GET_U_1(mask + 11),
1444 					  GET_U_1(mask + 12),
1445 					  GET_U_1(mask + 13),
1446 					  GET_U_1(mask + 14),
1447 					  GET_U_1(mask + 15));
1448 			}
1449 			len = 0;
1450 			break;
1451 		    }
1452 		case IPSECDOI_ID_IPV4_ADDR_RANGE:
1453 			if (len < 8)
1454 				ND_PRINT(" len=%u [bad: < 8]", len);
1455 			else {
1456 				ND_PRINT(" len=%u %s-%s", len,
1457 					  GET_IPADDR_STRING(data),
1458 					  GET_IPADDR_STRING(data + sizeof(nd_ipv4)));
1459 			}
1460 			len = 0;
1461 			break;
1462 		case IPSECDOI_ID_IPV6_ADDR_RANGE:
1463 			if (len < 32)
1464 				ND_PRINT(" len=%u [bad: < 32]", len);
1465 			else {
1466 				ND_PRINT(" len=%u %s-%s", len,
1467 					  GET_IP6ADDR_STRING(data),
1468 					  GET_IP6ADDR_STRING(data + sizeof(nd_ipv6)));
1469 			}
1470 			len = 0;
1471 			break;
1472 		case IPSECDOI_ID_DER_ASN1_DN:
1473 		case IPSECDOI_ID_DER_ASN1_GN:
1474 		case IPSECDOI_ID_KEY_ID:
1475 			break;
1476 		}
1477 		break;
1478 	    }
1479 	}
1480 	if (data && len) {
1481 		ND_PRINT(" len=%u", len);
1482 		if (2 < ndo->ndo_vflag) {
1483 			ND_PRINT(" ");
1484 			if (!rawprint(ndo, (const uint8_t *)data, len))
1485 				goto trunc;
1486 		}
1487 	}
1488 	return (const u_char *)ext + item_len;
1489 trunc:
1490 	ND_PRINT(" [|%s]", NPSTR(ISAKMP_NPTYPE_ID));
1491 	return NULL;
1492 }
1493 
1494 static const u_char *
1495 ikev1_cert_print(netdissect_options *ndo, u_char tpay _U_,
1496 		 const struct isakmp_gen *ext, u_int item_len,
1497 		 const u_char *ep _U_, uint32_t phase _U_,
1498 		 uint32_t doi0 _U_,
1499 		 uint32_t proto0 _U_, int depth _U_)
1500 {
1501 	const struct ikev1_pl_cert *p;
1502 	static const char *certstr[] = {
1503 		"none",	"pkcs7", "pgp", "dns",
1504 		"x509sign", "x509ke", "kerberos", "crl",
1505 		"arl", "spki", "x509attr",
1506 	};
1507 
1508 	ND_PRINT("%s:", NPSTR(ISAKMP_NPTYPE_CERT));
1509 
1510 	p = (const struct ikev1_pl_cert *)ext;
1511 	ND_TCHECK_SIZE(p);
1512 	/*
1513 	 * Our caller has ensured that the length is >= 4.
1514 	 */
1515 	ND_PRINT(" len=%u", item_len - 4);
1516 	ND_PRINT(" type=%s", STR_OR_ID(GET_U_1(p->encode), certstr));
1517 	if (2 < ndo->ndo_vflag && 4 < item_len) {
1518 		/* Print the entire payload in hex */
1519 		ND_PRINT(" ");
1520 		if (!rawprint(ndo, (const uint8_t *)(ext + 1), item_len - 4))
1521 			goto trunc;
1522 	}
1523 	return (const u_char *)ext + item_len;
1524 trunc:
1525 	ND_PRINT(" [|%s]", NPSTR(ISAKMP_NPTYPE_CERT));
1526 	return NULL;
1527 }
1528 
1529 static const u_char *
1530 ikev1_cr_print(netdissect_options *ndo, u_char tpay _U_,
1531 	       const struct isakmp_gen *ext, u_int item_len,
1532 	       const u_char *ep _U_, uint32_t phase _U_, uint32_t doi0 _U_,
1533 	       uint32_t proto0 _U_, int depth _U_)
1534 {
1535 	const struct ikev1_pl_cert *p;
1536 	static const char *certstr[] = {
1537 		"none",	"pkcs7", "pgp", "dns",
1538 		"x509sign", "x509ke", "kerberos", "crl",
1539 		"arl", "spki", "x509attr",
1540 	};
1541 
1542 	ND_PRINT("%s:", NPSTR(ISAKMP_NPTYPE_CR));
1543 
1544 	p = (const struct ikev1_pl_cert *)ext;
1545 	ND_TCHECK_SIZE(p);
1546 	/*
1547 	 * Our caller has ensured that the length is >= 4.
1548 	 */
1549 	ND_PRINT(" len=%u", item_len - 4);
1550 	ND_PRINT(" type=%s", STR_OR_ID(GET_U_1(p->encode), certstr));
1551 	if (2 < ndo->ndo_vflag && 4 < item_len) {
1552 		/* Print the entire payload in hex */
1553 		ND_PRINT(" ");
1554 		if (!rawprint(ndo, (const uint8_t *)(ext + 1), item_len - 4))
1555 			goto trunc;
1556 	}
1557 	return (const u_char *)ext + item_len;
1558 trunc:
1559 	ND_PRINT(" [|%s]", NPSTR(ISAKMP_NPTYPE_CR));
1560 	return NULL;
1561 }
1562 
1563 static const u_char *
1564 ikev1_hash_print(netdissect_options *ndo, u_char tpay _U_,
1565 		 const struct isakmp_gen *ext, u_int item_len,
1566 		 const u_char *ep _U_, uint32_t phase _U_, uint32_t doi _U_,
1567 		 uint32_t proto _U_, int depth _U_)
1568 {
1569 	ND_PRINT("%s:", NPSTR(ISAKMP_NPTYPE_HASH));
1570 
1571 	ND_TCHECK_SIZE(ext);
1572 	/*
1573 	 * Our caller has ensured that the length is >= 4.
1574 	 */
1575 	ND_PRINT(" len=%u", item_len - 4);
1576 	if (2 < ndo->ndo_vflag && 4 < item_len) {
1577 		/* Print the entire payload in hex */
1578 		ND_PRINT(" ");
1579 		if (!rawprint(ndo, (const uint8_t *)(ext + 1), item_len - 4))
1580 			goto trunc;
1581 	}
1582 	return (const u_char *)ext + item_len;
1583 trunc:
1584 	ND_PRINT(" [|%s]", NPSTR(ISAKMP_NPTYPE_HASH));
1585 	return NULL;
1586 }
1587 
1588 static const u_char *
1589 ikev1_sig_print(netdissect_options *ndo, u_char tpay _U_,
1590 		const struct isakmp_gen *ext, u_int item_len,
1591 		const u_char *ep _U_, uint32_t phase _U_, uint32_t doi _U_,
1592 		uint32_t proto _U_, int depth _U_)
1593 {
1594 	ND_PRINT("%s:", NPSTR(ISAKMP_NPTYPE_SIG));
1595 
1596 	ND_TCHECK_SIZE(ext);
1597 	/*
1598 	 * Our caller has ensured that the length is >= 4.
1599 	 */
1600 	ND_PRINT(" len=%u", item_len - 4);
1601 	if (2 < ndo->ndo_vflag && 4 < item_len) {
1602 		/* Print the entire payload in hex */
1603 		ND_PRINT(" ");
1604 		if (!rawprint(ndo, (const uint8_t *)(ext + 1), item_len - 4))
1605 			goto trunc;
1606 	}
1607 	return (const u_char *)ext + item_len;
1608 trunc:
1609 	ND_PRINT(" [|%s]", NPSTR(ISAKMP_NPTYPE_SIG));
1610 	return NULL;
1611 }
1612 
1613 static const u_char *
1614 ikev1_nonce_print(netdissect_options *ndo, u_char tpay _U_,
1615 		  const struct isakmp_gen *ext,
1616 		  u_int item_len,
1617 		  const u_char *ep,
1618 		  uint32_t phase _U_, uint32_t doi _U_,
1619 		  uint32_t proto _U_, int depth _U_)
1620 {
1621 	ND_PRINT("%s:", NPSTR(ISAKMP_NPTYPE_NONCE));
1622 
1623 	ND_TCHECK_SIZE(ext);
1624 	/*
1625 	 * Our caller has ensured that the length is >= 4.
1626 	 */
1627 	ND_PRINT(" n len=%u", item_len - 4);
1628 	if (item_len > 4) {
1629 		if (ndo->ndo_vflag > 2) {
1630 			ND_PRINT(" ");
1631 			if (!rawprint(ndo, (const uint8_t *)(ext + 1), item_len - 4))
1632 				goto trunc;
1633 		} else if (ndo->ndo_vflag > 1) {
1634 			ND_PRINT(" ");
1635 			if (!ike_show_somedata(ndo, (const u_char *)(ext + 1), ep))
1636 				goto trunc;
1637 		}
1638 	}
1639 	return (const u_char *)ext + item_len;
1640 trunc:
1641 	ND_PRINT(" [|%s]", NPSTR(ISAKMP_NPTYPE_NONCE));
1642 	return NULL;
1643 }
1644 
1645 static const u_char *
1646 ikev1_n_print(netdissect_options *ndo, u_char tpay _U_,
1647 	      const struct isakmp_gen *ext, u_int item_len,
1648 	      const u_char *ep, uint32_t phase _U_, uint32_t doi0 _U_,
1649 	      uint32_t proto0 _U_, int depth _U_)
1650 {
1651 	const struct ikev1_pl_n *p;
1652 	const u_char *cp;
1653 	const u_char *ep2;
1654 	uint32_t doi;
1655 	uint32_t proto;
1656 	uint16_t type;
1657 	uint8_t spi_size;
1658 	static const char *notify_error_str[] = {
1659 		NULL,				"INVALID-PAYLOAD-TYPE",
1660 		"DOI-NOT-SUPPORTED",		"SITUATION-NOT-SUPPORTED",
1661 		"INVALID-COOKIE",		"INVALID-MAJOR-VERSION",
1662 		"INVALID-MINOR-VERSION",	"INVALID-EXCHANGE-TYPE",
1663 		"INVALID-FLAGS",		"INVALID-MESSAGE-ID",
1664 		"INVALID-PROTOCOL-ID",		"INVALID-SPI",
1665 		"INVALID-TRANSFORM-ID",		"ATTRIBUTES-NOT-SUPPORTED",
1666 		"NO-PROPOSAL-CHOSEN",		"BAD-PROPOSAL-SYNTAX",
1667 		"PAYLOAD-MALFORMED",		"INVALID-KEY-INFORMATION",
1668 		"INVALID-ID-INFORMATION",	"INVALID-CERT-ENCODING",
1669 		"INVALID-CERTIFICATE",		"CERT-TYPE-UNSUPPORTED",
1670 		"INVALID-CERT-AUTHORITY",	"INVALID-HASH-INFORMATION",
1671 		"AUTHENTICATION-FAILED",	"INVALID-SIGNATURE",
1672 		"ADDRESS-NOTIFICATION",		"NOTIFY-SA-LIFETIME",
1673 		"CERTIFICATE-UNAVAILABLE",	"UNSUPPORTED-EXCHANGE-TYPE",
1674 		"UNEQUAL-PAYLOAD-LENGTHS",
1675 	};
1676 	static const char *ipsec_notify_error_str[] = {
1677 		"RESERVED",
1678 	};
1679 	static const char *notify_status_str[] = {
1680 		"CONNECTED",
1681 	};
1682 	static const char *ipsec_notify_status_str[] = {
1683 		"RESPONDER-LIFETIME",		"REPLAY-STATUS",
1684 		"INITIAL-CONTACT",
1685 	};
1686 /* NOTE: these macro must be called with x in proper range */
1687 
1688 /* 0 - 8191 */
1689 #define NOTIFY_ERROR_STR(x) \
1690 	STR_OR_ID((x), notify_error_str)
1691 
1692 /* 8192 - 16383 */
1693 #define IPSEC_NOTIFY_ERROR_STR(x) \
1694 	STR_OR_ID((u_int)((x) - 8192), ipsec_notify_error_str)
1695 
1696 /* 16384 - 24575 */
1697 #define NOTIFY_STATUS_STR(x) \
1698 	STR_OR_ID((u_int)((x) - 16384), notify_status_str)
1699 
1700 /* 24576 - 32767 */
1701 #define IPSEC_NOTIFY_STATUS_STR(x) \
1702 	STR_OR_ID((u_int)((x) - 24576), ipsec_notify_status_str)
1703 
1704 	ND_PRINT("%s:", NPSTR(ISAKMP_NPTYPE_N));
1705 
1706 	p = (const struct ikev1_pl_n *)ext;
1707 	ND_TCHECK_SIZE(p);
1708 	doi = GET_BE_U_4(p->doi);
1709 	proto = GET_U_1(p->prot_id);
1710 	if (doi != 1) {
1711 		ND_PRINT(" doi=%u", doi);
1712 		ND_PRINT(" proto=%u", proto);
1713 		type = GET_BE_U_2(p->type);
1714 		if (type < 8192)
1715 			ND_PRINT(" type=%s", NOTIFY_ERROR_STR(type));
1716 		else if (type < 16384)
1717 			ND_PRINT(" type=%s", numstr(type));
1718 		else if (type < 24576)
1719 			ND_PRINT(" type=%s", NOTIFY_STATUS_STR(type));
1720 		else
1721 			ND_PRINT(" type=%s", numstr(type));
1722 		spi_size = GET_U_1(p->spi_size);
1723 		if (spi_size) {
1724 			ND_PRINT(" spi=");
1725 			if (!rawprint(ndo, (const uint8_t *)(p + 1), spi_size))
1726 				goto trunc;
1727 		}
1728 		return (const u_char *)(p + 1) + spi_size;
1729 	}
1730 
1731 	ND_PRINT(" doi=ipsec");
1732 	ND_PRINT(" proto=%s", PROTOIDSTR(proto));
1733 	type = GET_BE_U_2(p->type);
1734 	if (type < 8192)
1735 		ND_PRINT(" type=%s", NOTIFY_ERROR_STR(type));
1736 	else if (type < 16384)
1737 		ND_PRINT(" type=%s", IPSEC_NOTIFY_ERROR_STR(type));
1738 	else if (type < 24576)
1739 		ND_PRINT(" type=%s", NOTIFY_STATUS_STR(type));
1740 	else if (type < 32768)
1741 		ND_PRINT(" type=%s", IPSEC_NOTIFY_STATUS_STR(type));
1742 	else
1743 		ND_PRINT(" type=%s", numstr(type));
1744 	spi_size = GET_U_1(p->spi_size);
1745 	if (spi_size) {
1746 		ND_PRINT(" spi=");
1747 		if (!rawprint(ndo, (const uint8_t *)(p + 1), spi_size))
1748 			goto trunc;
1749 	}
1750 
1751 	cp = (const u_char *)(p + 1) + spi_size;
1752 	ep2 = (const u_char *)p + item_len;
1753 
1754 	if (cp < ep) {
1755 		switch (type) {
1756 		case IPSECDOI_NTYPE_RESPONDER_LIFETIME:
1757 		    {
1758 			const struct attrmap *map = oakley_t_map;
1759 			size_t nmap = sizeof(oakley_t_map)/sizeof(oakley_t_map[0]);
1760 			ND_PRINT(" attrs=(");
1761 			while (cp < ep && cp < ep2) {
1762 				cp = ikev1_attrmap_print(ndo, cp, ep2, map, nmap);
1763 				if (cp == NULL) {
1764 					ND_PRINT(")");
1765 					goto trunc;
1766 				}
1767 			}
1768 			ND_PRINT(")");
1769 			break;
1770 		    }
1771 		case IPSECDOI_NTYPE_REPLAY_STATUS:
1772 			ND_PRINT(" status=(");
1773 			ND_PRINT("replay detection %sabled",
1774 				  GET_BE_U_4(cp) ? "en" : "dis");
1775 			ND_PRINT(")");
1776 			break;
1777 		default:
1778 			/*
1779 			 * XXX - fill in more types here; see, for example,
1780 			 * draft-ietf-ipsec-notifymsg-04.
1781 			 */
1782 			if (ndo->ndo_vflag > 3) {
1783 				ND_PRINT(" data=(");
1784 				if (!rawprint(ndo, (const uint8_t *)(cp), ep - cp))
1785 					goto trunc;
1786 				ND_PRINT(")");
1787 			} else {
1788 				if (!ike_show_somedata(ndo, cp, ep))
1789 					goto trunc;
1790 			}
1791 			break;
1792 		}
1793 	}
1794 	return (const u_char *)ext + item_len;
1795 trunc:
1796 	ND_PRINT(" [|%s]", NPSTR(ISAKMP_NPTYPE_N));
1797 	return NULL;
1798 }
1799 
1800 static const u_char *
1801 ikev1_d_print(netdissect_options *ndo, u_char tpay _U_,
1802 	      const struct isakmp_gen *ext, u_int item_len _U_,
1803 	      const u_char *ep _U_, uint32_t phase _U_, uint32_t doi0 _U_,
1804 	      uint32_t proto0 _U_, int depth _U_)
1805 {
1806 	const struct ikev1_pl_d *p;
1807 	const uint8_t *q;
1808 	uint32_t doi;
1809 	uint32_t proto;
1810 	uint8_t spi_size;
1811 	uint16_t num_spi;
1812 	u_int i;
1813 
1814 	ND_PRINT("%s:", NPSTR(ISAKMP_NPTYPE_D));
1815 
1816 	p = (const struct ikev1_pl_d *)ext;
1817 	ND_TCHECK_SIZE(p);
1818 	doi = GET_BE_U_4(p->doi);
1819 	proto = GET_U_1(p->prot_id);
1820 	if (doi != 1) {
1821 		ND_PRINT(" doi=%u", doi);
1822 		ND_PRINT(" proto=%u", proto);
1823 	} else {
1824 		ND_PRINT(" doi=ipsec");
1825 		ND_PRINT(" proto=%s", PROTOIDSTR(proto));
1826 	}
1827 	spi_size = GET_U_1(p->spi_size);
1828 	ND_PRINT(" spilen=%u", spi_size);
1829 	num_spi = GET_BE_U_2(p->num_spi);
1830 	ND_PRINT(" nspi=%u", num_spi);
1831 	ND_PRINT(" spi=");
1832 	q = (const uint8_t *)(p + 1);
1833 	for (i = 0; i < num_spi; i++) {
1834 		if (i != 0)
1835 			ND_PRINT(",");
1836 		if (!rawprint(ndo, (const uint8_t *)q, spi_size))
1837 			goto trunc;
1838 		q += spi_size;
1839 	}
1840 	return q;
1841 trunc:
1842 	ND_PRINT(" [|%s]", NPSTR(ISAKMP_NPTYPE_D));
1843 	return NULL;
1844 }
1845 
1846 static const u_char *
1847 ikev1_vid_print(netdissect_options *ndo, u_char tpay _U_,
1848 		const struct isakmp_gen *ext,
1849 		u_int item_len, const u_char *ep _U_,
1850 		uint32_t phase _U_, uint32_t doi _U_,
1851 		uint32_t proto _U_, int depth _U_)
1852 {
1853 	ND_PRINT("%s:", NPSTR(ISAKMP_NPTYPE_VID));
1854 
1855 	ND_TCHECK_SIZE(ext);
1856 	/*
1857 	 * Our caller has ensured that the length is >= 4.
1858 	 */
1859 	ND_PRINT(" len=%u", item_len - 4);
1860 	if (2 < ndo->ndo_vflag && 4 < item_len) {
1861 		/* Print the entire payload in hex */
1862 		ND_PRINT(" ");
1863 		if (!rawprint(ndo, (const uint8_t *)(ext + 1), item_len - 4))
1864 			goto trunc;
1865 	}
1866 	return (const u_char *)ext + item_len;
1867 trunc:
1868 	ND_PRINT(" [|%s]", NPSTR(ISAKMP_NPTYPE_VID));
1869 	return NULL;
1870 }
1871 
1872 /************************************************************/
1873 /*                                                          */
1874 /*              IKE v2 - rfc4306 - dissector                */
1875 /*                                                          */
1876 /************************************************************/
1877 
1878 static void
1879 ikev2_pay_print(netdissect_options *ndo, const char *payname, uint8_t critical)
1880 {
1881 	ND_PRINT("%s%s:", payname, critical&0x80 ? "[C]" : "");
1882 }
1883 
1884 static const u_char *
1885 ikev2_gen_print(netdissect_options *ndo, u_char tpay,
1886 		const struct isakmp_gen *ext, u_int item_len)
1887 {
1888 	const struct isakmp_gen *p = (const struct isakmp_gen *)ext;
1889 
1890 	ND_TCHECK_SIZE(ext);
1891 	ikev2_pay_print(ndo, NPSTR(tpay), GET_U_1(p->critical));
1892 
1893 	/*
1894 	 * Our caller has ensured that the length is >= 4.
1895 	 */
1896 	ND_PRINT(" len=%u", item_len - 4);
1897 	if (2 < ndo->ndo_vflag && 4 < item_len) {
1898 		/* Print the entire payload in hex */
1899 		ND_PRINT(" ");
1900 		if (!rawprint(ndo, (const uint8_t *)(ext + 1), item_len - 4))
1901 			goto trunc;
1902 	}
1903 	return (const u_char *)ext + item_len;
1904 trunc:
1905 	ND_PRINT(" [|%s]", NPSTR(tpay));
1906 	return NULL;
1907 }
1908 
1909 static const u_char *
1910 ikev2_t_print(netdissect_options *ndo, int tcount,
1911 	      const struct isakmp_gen *ext, u_int item_len,
1912 	      const u_char *ep)
1913 {
1914 	const struct ikev2_t *p;
1915 	uint16_t  t_id;
1916 	uint8_t t_type;
1917 	const u_char *cp;
1918 	const char *idstr;
1919 	const struct attrmap *map;
1920 	size_t nmap;
1921 	const u_char *ep2;
1922 
1923 	p = (const struct ikev2_t *)ext;
1924 	ND_TCHECK_SIZE(p);
1925 	ikev2_pay_print(ndo, NPSTR(ISAKMP_NPTYPE_T), GET_U_1(p->h.critical));
1926 
1927 	t_id = GET_BE_U_2(p->t_id);
1928 
1929 	map = NULL;
1930 	nmap = 0;
1931 
1932 	t_type = GET_U_1(p->t_type);
1933 	switch (t_type) {
1934 	case IV2_T_ENCR:
1935 		idstr = STR_OR_ID(t_id, esp_p_map);
1936 		map = encr_t_map;
1937 		nmap = sizeof(encr_t_map)/sizeof(encr_t_map[0]);
1938 		break;
1939 
1940 	case IV2_T_PRF:
1941 		idstr = STR_OR_ID(t_id, prf_p_map);
1942 		break;
1943 
1944 	case IV2_T_INTEG:
1945 		idstr = STR_OR_ID(t_id, integ_p_map);
1946 		break;
1947 
1948 	case IV2_T_DH:
1949 		idstr = STR_OR_ID(t_id, dh_p_map);
1950 		break;
1951 
1952 	case IV2_T_ESN:
1953 		idstr = STR_OR_ID(t_id, esn_p_map);
1954 		break;
1955 
1956 	default:
1957 		idstr = NULL;
1958 		break;
1959 	}
1960 
1961 	if (idstr)
1962 		ND_PRINT(" #%u type=%s id=%s ", tcount,
1963 			  STR_OR_ID(t_type, ikev2_t_type_map),
1964 			  idstr);
1965 	else
1966 		ND_PRINT(" #%u type=%s id=%u ", tcount,
1967 			  STR_OR_ID(t_type, ikev2_t_type_map),
1968 			  t_id);
1969 	cp = (const u_char *)(p + 1);
1970 	ep2 = (const u_char *)p + item_len;
1971 	while (cp < ep && cp < ep2) {
1972 		if (map && nmap) {
1973 			cp = ikev1_attrmap_print(ndo, cp, ep2, map, nmap);
1974 		} else
1975 			cp = ikev1_attr_print(ndo, cp, ep2);
1976 		if (cp == NULL)
1977 			goto trunc;
1978 	}
1979 	if (ep < ep2)
1980 		ND_PRINT("...");
1981 	return cp;
1982 trunc:
1983 	ND_PRINT(" [|%s]", NPSTR(ISAKMP_NPTYPE_T));
1984 	return NULL;
1985 }
1986 
1987 static const u_char *
1988 ikev2_p_print(netdissect_options *ndo, u_char tpay _U_, int pcount _U_,
1989 	      const struct isakmp_gen *ext, u_int oprop_length,
1990 	      const u_char *ep, int depth)
1991 {
1992 	const struct ikev2_p *p;
1993 	u_int prop_length;
1994 	uint8_t spi_size;
1995 	const u_char *cp;
1996 	int i;
1997 	int tcount;
1998 	u_char np;
1999 	u_int item_len;
2000 
2001 	p = (const struct ikev2_p *)ext;
2002 	ND_TCHECK_SIZE(p);
2003 
2004 	ikev2_pay_print(ndo, NPSTR(ISAKMP_NPTYPE_P), GET_U_1(p->h.critical));
2005 
2006 	/*
2007 	 * ikev2_sa_print() guarantees that this is >= 4.
2008 	 */
2009 	prop_length = oprop_length - 4;
2010 	ND_PRINT(" #%u protoid=%s transform=%u len=%u",
2011 		  GET_U_1(p->p_no),  PROTOIDSTR(GET_U_1(p->prot_id)),
2012 		  GET_U_1(p->num_t), oprop_length);
2013 	cp = (const u_char *)(p + 1);
2014 
2015 	spi_size = GET_U_1(p->spi_size);
2016 	if (spi_size) {
2017 		if (prop_length < spi_size)
2018 			goto toolong;
2019 		ND_PRINT(" spi=");
2020 		if (!rawprint(ndo, (const uint8_t *)cp, spi_size))
2021 			goto trunc;
2022 		cp += spi_size;
2023 		prop_length -= spi_size;
2024 	}
2025 
2026 	/*
2027 	 * Print the transforms.
2028 	 */
2029 	tcount = 0;
2030 	for (np = ISAKMP_NPTYPE_T; np != 0; np = GET_U_1(ext->np)) {
2031 		tcount++;
2032 		ext = (const struct isakmp_gen *)cp;
2033 		if (prop_length < sizeof(*ext))
2034 			goto toolong;
2035 		ND_TCHECK_SIZE(ext);
2036 
2037 		/*
2038 		 * Since we can't have a payload length of less than 4 bytes,
2039 		 * we need to bail out here if the generic header is nonsensical
2040 		 * or truncated, otherwise we could loop forever processing
2041 		 * zero-length items or otherwise misdissect the packet.
2042 		 */
2043 		item_len = GET_BE_U_2(ext->len);
2044 		if (item_len <= 4)
2045 			goto trunc;
2046 
2047 		if (prop_length < item_len)
2048 			goto toolong;
2049 		ND_TCHECK_LEN(cp, item_len);
2050 
2051 		depth++;
2052 		ND_PRINT("\n");
2053 		for (i = 0; i < depth; i++)
2054 			ND_PRINT("    ");
2055 		ND_PRINT("(");
2056 		if (np == ISAKMP_NPTYPE_T) {
2057 			cp = ikev2_t_print(ndo, tcount, ext, item_len, ep);
2058 			if (cp == NULL) {
2059 				/* error, already reported */
2060 				return NULL;
2061 			}
2062 		} else {
2063 			ND_PRINT("%s", NPSTR(np));
2064 			cp += item_len;
2065 		}
2066 		ND_PRINT(")");
2067 		depth--;
2068 		prop_length -= item_len;
2069 	}
2070 	return cp;
2071 toolong:
2072 	/*
2073 	 * Skip the rest of the proposal.
2074 	 */
2075 	cp += prop_length;
2076 	ND_PRINT(" [|%s]", NPSTR(ISAKMP_NPTYPE_P));
2077 	return cp;
2078 trunc:
2079 	ND_PRINT(" [|%s]", NPSTR(ISAKMP_NPTYPE_P));
2080 	return NULL;
2081 }
2082 
2083 static const u_char *
2084 ikev2_sa_print(netdissect_options *ndo, u_char tpay,
2085 		const struct isakmp_gen *ext1,
2086 		u_int osa_length, const u_char *ep,
2087 		uint32_t phase _U_, uint32_t doi _U_,
2088 		uint32_t proto _U_, int depth)
2089 {
2090 	const struct isakmp_gen *ext;
2091 	u_int sa_length;
2092 	const u_char *cp;
2093 	int i;
2094 	int pcount;
2095 	u_char np;
2096 	u_int item_len;
2097 
2098 	ND_TCHECK_SIZE(ext1);
2099 	ikev2_pay_print(ndo, "sa", GET_U_1(ext1->critical));
2100 
2101 	/*
2102 	 * ikev2_sub0_print() guarantees that this is >= 4.
2103 	 */
2104 	osa_length= GET_BE_U_2(ext1->len);
2105 	sa_length = osa_length - 4;
2106 	ND_PRINT(" len=%u", sa_length);
2107 
2108 	/*
2109 	 * Print the payloads.
2110 	 */
2111 	cp = (const u_char *)(ext1 + 1);
2112 	pcount = 0;
2113 	for (np = ISAKMP_NPTYPE_P; np != 0; np = GET_U_1(ext->np)) {
2114 		pcount++;
2115 		ext = (const struct isakmp_gen *)cp;
2116 		if (sa_length < sizeof(*ext))
2117 			goto toolong;
2118 		ND_TCHECK_SIZE(ext);
2119 
2120 		/*
2121 		 * Since we can't have a payload length of less than 4 bytes,
2122 		 * we need to bail out here if the generic header is nonsensical
2123 		 * or truncated, otherwise we could loop forever processing
2124 		 * zero-length items or otherwise misdissect the packet.
2125 		 */
2126 		item_len = GET_BE_U_2(ext->len);
2127 		if (item_len <= 4)
2128 			goto trunc;
2129 
2130 		if (sa_length < item_len)
2131 			goto toolong;
2132 		ND_TCHECK_LEN(cp, item_len);
2133 
2134 		depth++;
2135 		ND_PRINT("\n");
2136 		for (i = 0; i < depth; i++)
2137 			ND_PRINT("    ");
2138 		ND_PRINT("(");
2139 		if (np == ISAKMP_NPTYPE_P) {
2140 			cp = ikev2_p_print(ndo, np, pcount, ext, item_len,
2141 					   ep, depth);
2142 			if (cp == NULL) {
2143 				/* error, already reported */
2144 				return NULL;
2145 			}
2146 		} else {
2147 			ND_PRINT("%s", NPSTR(np));
2148 			cp += item_len;
2149 		}
2150 		ND_PRINT(")");
2151 		depth--;
2152 		sa_length -= item_len;
2153 	}
2154 	return cp;
2155 toolong:
2156 	/*
2157 	 * Skip the rest of the SA.
2158 	 */
2159 	cp += sa_length;
2160 	ND_PRINT(" [|%s]", NPSTR(tpay));
2161 	return cp;
2162 trunc:
2163 	ND_PRINT(" [|%s]", NPSTR(tpay));
2164 	return NULL;
2165 }
2166 
2167 static const u_char *
2168 ikev2_ke_print(netdissect_options *ndo, u_char tpay,
2169 		const struct isakmp_gen *ext,
2170 		u_int item_len, const u_char *ep _U_,
2171 		uint32_t phase _U_, uint32_t doi _U_,
2172 		uint32_t proto _U_, int depth _U_)
2173 {
2174 	const struct ikev2_ke *k;
2175 
2176 	k = (const struct ikev2_ke *)ext;
2177 	ND_TCHECK_SIZE(k);
2178 	ikev2_pay_print(ndo, NPSTR(tpay), GET_U_1(k->h.critical));
2179 
2180 	if (item_len < 8) {
2181 		ND_PRINT(" len=%u < 8", item_len);
2182 		return (const u_char *)ext + item_len;
2183 	}
2184 	ND_PRINT(" len=%u group=%s", item_len - 8,
2185 		  STR_OR_ID(GET_BE_U_2(k->ke_group), dh_p_map));
2186 
2187 	if (2 < ndo->ndo_vflag && 8 < item_len) {
2188 		ND_PRINT(" ");
2189 		if (!rawprint(ndo, (const uint8_t *)(k + 1), item_len - 8))
2190 			goto trunc;
2191 	}
2192 	return (const u_char *)ext + item_len;
2193 trunc:
2194 	ND_PRINT(" [|%s]", NPSTR(tpay));
2195 	return NULL;
2196 }
2197 
2198 static const u_char *
2199 ikev2_ID_print(netdissect_options *ndo, u_char tpay,
2200 		const struct isakmp_gen *ext,
2201 		u_int item_len, const u_char *ep _U_,
2202 		uint32_t phase _U_, uint32_t doi _U_,
2203 		uint32_t proto _U_, int depth _U_)
2204 {
2205 	const struct ikev2_id *idp;
2206 	u_int idtype_len, i;
2207 	unsigned int dumpascii, dumphex;
2208 	const unsigned char *typedata;
2209 
2210 	idp = (const struct ikev2_id *)ext;
2211 	ND_TCHECK_SIZE(idp);
2212 	ikev2_pay_print(ndo, NPSTR(tpay), GET_U_1(idp->h.critical));
2213 
2214 	/*
2215 	 * Our caller has ensured that the length is >= 4.
2216 	 */
2217 	ND_PRINT(" len=%u", item_len - 4);
2218 	if (2 < ndo->ndo_vflag && 4 < item_len) {
2219 		/* Print the entire payload in hex */
2220 		ND_PRINT(" ");
2221 		if (!rawprint(ndo, (const uint8_t *)(ext + 1), item_len - 4))
2222 			goto trunc;
2223 	}
2224 
2225 	idtype_len =item_len - sizeof(struct ikev2_id);
2226 	dumpascii = 0;
2227 	dumphex   = 0;
2228 	typedata  = (const unsigned char *)(ext)+sizeof(struct ikev2_id);
2229 
2230 	switch(GET_U_1(idp->type)) {
2231 	case ID_IPV4_ADDR:
2232 		ND_PRINT(" ipv4:");
2233 		dumphex=1;
2234 		break;
2235 	case ID_FQDN:
2236 		ND_PRINT(" fqdn:");
2237 		dumpascii=1;
2238 		break;
2239 	case ID_RFC822_ADDR:
2240 		ND_PRINT(" rfc822:");
2241 		dumpascii=1;
2242 		break;
2243 	case ID_IPV6_ADDR:
2244 		ND_PRINT(" ipv6:");
2245 		dumphex=1;
2246 		break;
2247 	case ID_DER_ASN1_DN:
2248 		ND_PRINT(" dn:");
2249 		dumphex=1;
2250 		break;
2251 	case ID_DER_ASN1_GN:
2252 		ND_PRINT(" gn:");
2253 		dumphex=1;
2254 		break;
2255 	case ID_KEY_ID:
2256 		ND_PRINT(" keyid:");
2257 		dumphex=1;
2258 		break;
2259 	}
2260 
2261 	if(dumpascii) {
2262 		ND_TCHECK_LEN(typedata, idtype_len);
2263 		for(i=0; i<idtype_len; i++) {
2264 			if(ND_ASCII_ISPRINT(GET_U_1(typedata + i))) {
2265 				ND_PRINT("%c", GET_U_1(typedata + i));
2266 			} else {
2267 				ND_PRINT(".");
2268 			}
2269 		}
2270 	}
2271 	if(dumphex) {
2272 		if (!rawprint(ndo, (const uint8_t *)typedata, idtype_len))
2273 			goto trunc;
2274 	}
2275 
2276 	return (const u_char *)ext + item_len;
2277 trunc:
2278 	ND_PRINT(" [|%s]", NPSTR(tpay));
2279 	return NULL;
2280 }
2281 
2282 static const u_char *
2283 ikev2_cert_print(netdissect_options *ndo, u_char tpay,
2284 		const struct isakmp_gen *ext,
2285 		u_int item_len, const u_char *ep _U_,
2286 		uint32_t phase _U_, uint32_t doi _U_,
2287 		uint32_t proto _U_, int depth _U_)
2288 {
2289 	return ikev2_gen_print(ndo, tpay, ext, item_len);
2290 }
2291 
2292 static const u_char *
2293 ikev2_cr_print(netdissect_options *ndo, u_char tpay,
2294 		const struct isakmp_gen *ext,
2295 		u_int item_len, const u_char *ep _U_,
2296 		uint32_t phase _U_, uint32_t doi _U_,
2297 		uint32_t proto _U_, int depth _U_)
2298 {
2299 	return ikev2_gen_print(ndo, tpay, ext, item_len);
2300 }
2301 
2302 static const u_char *
2303 ikev2_auth_print(netdissect_options *ndo, u_char tpay,
2304 		const struct isakmp_gen *ext,
2305 		u_int item_len, const u_char *ep,
2306 		uint32_t phase _U_, uint32_t doi _U_,
2307 		uint32_t proto _U_, int depth _U_)
2308 {
2309 	const struct ikev2_auth *p;
2310 	const char *v2_auth[]={ "invalid", "rsasig",
2311 				"shared-secret", "dsssig" };
2312 	const u_char *authdata = (const u_char *)ext + sizeof(struct ikev2_auth);
2313 
2314 	ND_TCHECK_LEN(ext, sizeof(struct ikev2_auth));
2315 	p = (const struct ikev2_auth *)ext;
2316 	ikev2_pay_print(ndo, NPSTR(tpay), GET_U_1(p->h.critical));
2317 
2318 	/*
2319 	 * Our caller has ensured that the length is >= 4.
2320 	 */
2321 	ND_PRINT(" len=%u method=%s", item_len-4,
2322 		  STR_OR_ID(GET_U_1(p->auth_method), v2_auth));
2323 	if (item_len > 4) {
2324 		if (ndo->ndo_vflag > 1) {
2325 			ND_PRINT(" authdata=(");
2326 			if (!rawprint(ndo, (const uint8_t *)authdata, item_len - sizeof(struct ikev2_auth)))
2327 				goto trunc;
2328 			ND_PRINT(") ");
2329 		} else if (ndo->ndo_vflag) {
2330 			if (!ike_show_somedata(ndo, authdata, ep))
2331 				goto trunc;
2332 		}
2333 	}
2334 
2335 	return (const u_char *)ext + item_len;
2336 trunc:
2337 	ND_PRINT(" [|%s]", NPSTR(tpay));
2338 	return NULL;
2339 }
2340 
2341 static const u_char *
2342 ikev2_nonce_print(netdissect_options *ndo, u_char tpay,
2343 		const struct isakmp_gen *ext,
2344 		u_int item_len, const u_char *ep,
2345 		uint32_t phase _U_, uint32_t doi _U_,
2346 		uint32_t proto _U_, int depth _U_)
2347 {
2348 	ND_TCHECK_SIZE(ext);
2349 	ikev2_pay_print(ndo, "nonce", GET_U_1(ext->critical));
2350 
2351 	/*
2352 	 * Our caller has ensured that the length is >= 4.
2353 	 */
2354 	ND_PRINT(" len=%u", item_len - 4);
2355 	if (1 < ndo->ndo_vflag && 4 < item_len) {
2356 		ND_PRINT(" nonce=(");
2357 		if (!rawprint(ndo, (const uint8_t *)(ext + 1), item_len - 4))
2358 			goto trunc;
2359 		ND_PRINT(") ");
2360 	} else if(ndo->ndo_vflag && 4 < item_len) {
2361 		if(!ike_show_somedata(ndo, (const u_char *)(ext+1), ep)) goto trunc;
2362 	}
2363 
2364 	return (const u_char *)ext + item_len;
2365 trunc:
2366 	ND_PRINT(" [|%s]", NPSTR(tpay));
2367 	return NULL;
2368 }
2369 
2370 /* notify payloads */
2371 static const u_char *
2372 ikev2_n_print(netdissect_options *ndo, u_char tpay _U_,
2373 		const struct isakmp_gen *ext,
2374 		u_int item_len, const u_char *ep,
2375 		uint32_t phase _U_, uint32_t doi _U_,
2376 		uint32_t proto _U_, int depth _U_)
2377 {
2378 	const struct ikev2_n *p;
2379 	uint16_t type;
2380 	uint8_t spi_size;
2381 	const u_char *cp;
2382 	u_char showspi, showsomedata;
2383 	const char *notify_name;
2384 
2385 	p = (const struct ikev2_n *)ext;
2386 	ND_TCHECK_SIZE(p);
2387 	ikev2_pay_print(ndo, NPSTR(ISAKMP_NPTYPE_N), GET_U_1(p->h.critical));
2388 
2389 	showspi = 1;
2390 	showsomedata=0;
2391 	notify_name=NULL;
2392 
2393 	ND_PRINT(" prot_id=%s", PROTOIDSTR(GET_U_1(p->prot_id)));
2394 
2395 	type = GET_BE_U_2(p->type);
2396 
2397 	/* notify space is annoying sparse */
2398 	switch(type) {
2399 	case IV2_NOTIFY_UNSUPPORTED_CRITICAL_PAYLOAD:
2400 		notify_name = "unsupported_critical_payload";
2401 		showspi = 0;
2402 		break;
2403 
2404 	case IV2_NOTIFY_INVALID_IKE_SPI:
2405 		notify_name = "invalid_ike_spi";
2406 		showspi = 1;
2407 		break;
2408 
2409 	case IV2_NOTIFY_INVALID_MAJOR_VERSION:
2410 		notify_name = "invalid_major_version";
2411 		showspi = 0;
2412 		break;
2413 
2414 	case IV2_NOTIFY_INVALID_SYNTAX:
2415 		notify_name = "invalid_syntax";
2416 		showspi = 1;
2417 		break;
2418 
2419 	case IV2_NOTIFY_INVALID_MESSAGE_ID:
2420 		notify_name = "invalid_message_id";
2421 		showspi = 1;
2422 		break;
2423 
2424 	case IV2_NOTIFY_INVALID_SPI:
2425 		notify_name = "invalid_spi";
2426 		showspi = 1;
2427 		break;
2428 
2429 	case IV2_NOTIFY_NO_PROPOSAL_CHOSEN:
2430 		notify_name = "no_protocol_chosen";
2431 		showspi = 1;
2432 		break;
2433 
2434 	case IV2_NOTIFY_INVALID_KE_PAYLOAD:
2435 		notify_name = "invalid_ke_payload";
2436 		showspi = 1;
2437 		break;
2438 
2439 	case IV2_NOTIFY_AUTHENTICATION_FAILED:
2440 		notify_name = "authentication_failed";
2441 		showspi = 1;
2442 		break;
2443 
2444 	case IV2_NOTIFY_SINGLE_PAIR_REQUIRED:
2445 		notify_name = "single_pair_required";
2446 		showspi = 1;
2447 		break;
2448 
2449 	case IV2_NOTIFY_NO_ADDITIONAL_SAS:
2450 		notify_name = "no_additional_sas";
2451 		showspi = 0;
2452 		break;
2453 
2454 	case IV2_NOTIFY_INTERNAL_ADDRESS_FAILURE:
2455 		notify_name = "internal_address_failure";
2456 		showspi = 0;
2457 		break;
2458 
2459 	case IV2_NOTIFY_FAILED_CP_REQUIRED:
2460 		notify_name = "failed:cp_required";
2461 		showspi = 0;
2462 		break;
2463 
2464 	case IV2_NOTIFY_INVALID_SELECTORS:
2465 		notify_name = "invalid_selectors";
2466 		showspi = 0;
2467 		break;
2468 
2469 	case IV2_NOTIFY_INITIAL_CONTACT:
2470 		notify_name = "initial_contact";
2471 		showspi = 0;
2472 		break;
2473 
2474 	case IV2_NOTIFY_SET_WINDOW_SIZE:
2475 		notify_name = "set_window_size";
2476 		showspi = 0;
2477 		break;
2478 
2479 	case IV2_NOTIFY_ADDITIONAL_TS_POSSIBLE:
2480 		notify_name = "additional_ts_possible";
2481 		showspi = 0;
2482 		break;
2483 
2484 	case IV2_NOTIFY_IPCOMP_SUPPORTED:
2485 		notify_name = "ipcomp_supported";
2486 		showspi = 0;
2487 		break;
2488 
2489 	case IV2_NOTIFY_NAT_DETECTION_SOURCE_IP:
2490 		notify_name = "nat_detection_source_ip";
2491 		showspi = 1;
2492 		break;
2493 
2494 	case IV2_NOTIFY_NAT_DETECTION_DESTINATION_IP:
2495 		notify_name = "nat_detection_destination_ip";
2496 		showspi = 1;
2497 		break;
2498 
2499 	case IV2_NOTIFY_COOKIE:
2500 		notify_name = "cookie";
2501 		showspi = 1;
2502 		showsomedata= 1;
2503 		break;
2504 
2505 	case IV2_NOTIFY_USE_TRANSPORT_MODE:
2506 		notify_name = "use_transport_mode";
2507 		showspi = 0;
2508 		break;
2509 
2510 	case IV2_NOTIFY_HTTP_CERT_LOOKUP_SUPPORTED:
2511 		notify_name = "http_cert_lookup_supported";
2512 		showspi = 0;
2513 		break;
2514 
2515 	case IV2_NOTIFY_REKEY_SA:
2516 		notify_name = "rekey_sa";
2517 		showspi = 1;
2518 		break;
2519 
2520 	case IV2_NOTIFY_ESP_TFC_PADDING_NOT_SUPPORTED:
2521 		notify_name = "tfc_padding_not_supported";
2522 		showspi = 0;
2523 		break;
2524 
2525 	case IV2_NOTIFY_NON_FIRST_FRAGMENTS_ALSO:
2526 		notify_name = "non_first_fragment_also";
2527 		showspi = 0;
2528 		break;
2529 
2530 	default:
2531 		if (type < 8192) {
2532 			notify_name="error";
2533 		} else if(type < 16384) {
2534 			notify_name="private-error";
2535 		} else if(type < 40960) {
2536 			notify_name="status";
2537 		} else {
2538 			notify_name="private-status";
2539 		}
2540 	}
2541 
2542 	if(notify_name) {
2543 		ND_PRINT(" type=%u(%s)", type, notify_name);
2544 	}
2545 
2546 
2547 	spi_size = GET_U_1(p->spi_size);
2548 	if (showspi && spi_size) {
2549 		ND_PRINT(" spi=");
2550 		if (!rawprint(ndo, (const uint8_t *)(p + 1), spi_size))
2551 			goto trunc;
2552 	}
2553 
2554 	cp = (const u_char *)(p + 1) + spi_size;
2555 
2556 	if (cp < ep) {
2557 		if (ndo->ndo_vflag > 3 || (showsomedata && ep-cp < 30)) {
2558 			ND_PRINT(" data=(");
2559 			if (!rawprint(ndo, (const uint8_t *)(cp), ep - cp))
2560 				goto trunc;
2561 
2562 			ND_PRINT(")");
2563 		} else if (showsomedata) {
2564 			if (!ike_show_somedata(ndo, cp, ep))
2565 				goto trunc;
2566 		}
2567 	}
2568 
2569 	return (const u_char *)ext + item_len;
2570 trunc:
2571 	ND_PRINT(" [|%s]", NPSTR(ISAKMP_NPTYPE_N));
2572 	return NULL;
2573 }
2574 
2575 static const u_char *
2576 ikev2_d_print(netdissect_options *ndo, u_char tpay,
2577 		const struct isakmp_gen *ext,
2578 		u_int item_len, const u_char *ep _U_,
2579 		uint32_t phase _U_, uint32_t doi _U_,
2580 		uint32_t proto _U_, int depth _U_)
2581 {
2582 	return ikev2_gen_print(ndo, tpay, ext, item_len);
2583 }
2584 
2585 static const u_char *
2586 ikev2_vid_print(netdissect_options *ndo, u_char tpay,
2587 		const struct isakmp_gen *ext,
2588 		u_int item_len, const u_char *ep _U_,
2589 		uint32_t phase _U_, uint32_t doi _U_,
2590 		uint32_t proto _U_, int depth _U_)
2591 {
2592 	const u_char *vid;
2593 	u_int i, len;
2594 
2595 	ND_TCHECK_SIZE(ext);
2596 	ikev2_pay_print(ndo, NPSTR(tpay), GET_U_1(ext->critical));
2597 
2598 	/*
2599 	 * Our caller has ensured that the length is >= 4.
2600 	 */
2601 	ND_PRINT(" len=%u vid=", item_len - 4);
2602 
2603 	vid = (const u_char *)(ext+1);
2604 	len = item_len - 4;
2605 	ND_TCHECK_LEN(vid, len);
2606 	for(i=0; i<len; i++) {
2607 		if(ND_ASCII_ISPRINT(GET_U_1(vid + i)))
2608 			ND_PRINT("%c", GET_U_1(vid + i));
2609 		else ND_PRINT(".");
2610 	}
2611 	if (2 < ndo->ndo_vflag && 4 < len) {
2612 		/* Print the entire payload in hex */
2613 		ND_PRINT(" ");
2614 		if (!rawprint(ndo, (const uint8_t *)(ext + 1), item_len - 4))
2615 			goto trunc;
2616 	}
2617 	return (const u_char *)ext + item_len;
2618 trunc:
2619 	ND_PRINT(" [|%s]", NPSTR(tpay));
2620 	return NULL;
2621 }
2622 
2623 static const u_char *
2624 ikev2_TS_print(netdissect_options *ndo, u_char tpay,
2625 		const struct isakmp_gen *ext,
2626 		u_int item_len, const u_char *ep _U_,
2627 		uint32_t phase _U_, uint32_t doi _U_,
2628 		uint32_t proto _U_, int depth _U_)
2629 {
2630 	return ikev2_gen_print(ndo, tpay, ext, item_len);
2631 }
2632 
2633 static const u_char *
2634 ikev2_e_print(netdissect_options *ndo,
2635 #ifndef HAVE_LIBCRYPTO
2636 	      _U_
2637 #endif
2638 	      const struct isakmp *base,
2639 	      u_char tpay,
2640 	      const struct isakmp_gen *ext,
2641 	      u_int item_len, const u_char *ep _U_,
2642 #ifndef HAVE_LIBCRYPTO
2643 	      _U_
2644 #endif
2645 	      uint32_t phase,
2646 #ifndef HAVE_LIBCRYPTO
2647 	      _U_
2648 #endif
2649 	      uint32_t doi,
2650 #ifndef HAVE_LIBCRYPTO
2651 	      _U_
2652 #endif
2653 	      uint32_t proto,
2654 #ifndef HAVE_LIBCRYPTO
2655 	      _U_
2656 #endif
2657 	      int depth)
2658 {
2659 	const u_char *dat;
2660 	u_int dlen;
2661 #ifdef HAVE_LIBCRYPTO
2662 	uint8_t np;
2663 #endif
2664 
2665 	ND_TCHECK_SIZE(ext);
2666 	ikev2_pay_print(ndo, NPSTR(tpay), GET_U_1(ext->critical));
2667 
2668 	dlen = item_len-4;
2669 
2670 	ND_PRINT(" len=%u", dlen);
2671 	if (2 < ndo->ndo_vflag && 4 < dlen) {
2672 		ND_PRINT(" ");
2673 		if (!rawprint(ndo, (const uint8_t *)(ext + 1), dlen))
2674 			goto trunc;
2675 	}
2676 
2677 	dat = (const u_char *)(ext+1);
2678 	ND_TCHECK_LEN(dat, dlen);
2679 
2680 #ifdef HAVE_LIBCRYPTO
2681 	np = GET_U_1(ext->np);
2682 
2683 	/* try to decrypt it! */
2684 	if(esp_decrypt_buffer_by_ikev2_print(ndo,
2685 					     GET_U_1(base->flags) & ISAKMP_FLAG_I,
2686 					     base->i_ck, base->r_ck,
2687 					     dat, dat+dlen)) {
2688 
2689 		ext = (const struct isakmp_gen *)ndo->ndo_packetp;
2690 
2691 		/* got it decrypted, print stuff inside. */
2692 		ikev2_sub_print(ndo, base, np, ext,
2693 				ndo->ndo_snapend, phase, doi, proto, depth+1);
2694 
2695 		/*
2696 		 * esp_decrypt_buffer_by_ikev2_print pushed information
2697 		 * on the buffer stack; we're done with the buffer, so
2698 		 * pop it (which frees the buffer)
2699 		 */
2700 		nd_pop_packet_info(ndo);
2701 	}
2702 #endif
2703 
2704 
2705 	/* always return NULL, because E must be at end, and NP refers
2706 	 * to what was inside.
2707 	 */
2708 	return NULL;
2709 trunc:
2710 	ND_PRINT(" [|%s]", NPSTR(tpay));
2711 	return NULL;
2712 }
2713 
2714 static const u_char *
2715 ikev2_cp_print(netdissect_options *ndo, u_char tpay,
2716 		const struct isakmp_gen *ext,
2717 		u_int item_len, const u_char *ep _U_,
2718 		uint32_t phase _U_, uint32_t doi _U_,
2719 		uint32_t proto _U_, int depth _U_)
2720 {
2721 	return ikev2_gen_print(ndo, tpay, ext, item_len);
2722 }
2723 
2724 static const u_char *
2725 ikev2_eap_print(netdissect_options *ndo, u_char tpay,
2726 		const struct isakmp_gen *ext,
2727 		u_int item_len, const u_char *ep _U_,
2728 		uint32_t phase _U_, uint32_t doi _U_,
2729 		uint32_t proto _U_, int depth _U_)
2730 {
2731 	return ikev2_gen_print(ndo, tpay, ext, item_len);
2732 }
2733 
2734 static const u_char *
2735 ike_sub0_print(netdissect_options *ndo,
2736 		 u_char np, const struct isakmp_gen *ext, const u_char *ep,
2737 
2738 	       uint32_t phase, uint32_t doi, uint32_t proto, int depth)
2739 {
2740 	const u_char *cp;
2741 	u_int item_len;
2742 
2743 	cp = (const u_char *)ext;
2744 	ND_TCHECK_SIZE(ext);
2745 
2746 	/*
2747 	 * Since we can't have a payload length of less than 4 bytes,
2748 	 * we need to bail out here if the generic header is nonsensical
2749 	 * or truncated, otherwise we could loop forever processing
2750 	 * zero-length items or otherwise misdissect the packet.
2751 	 */
2752 	item_len = GET_BE_U_2(ext->len);
2753 	if (item_len <= 4)
2754 		return NULL;
2755 
2756 	if (NPFUNC(np)) {
2757 		/*
2758 		 * XXX - what if item_len is too short, or too long,
2759 		 * for this payload type?
2760 		 */
2761 		cp = (*npfunc[np])(ndo, np, ext, item_len, ep, phase, doi, proto, depth);
2762 	} else {
2763 		ND_PRINT("%s", NPSTR(np));
2764 		cp += item_len;
2765 	}
2766 
2767 	return cp;
2768 trunc:
2769 	nd_print_trunc(ndo);
2770 	return NULL;
2771 }
2772 
2773 static const u_char *
2774 ikev1_sub_print(netdissect_options *ndo,
2775 		u_char np, const struct isakmp_gen *ext, const u_char *ep,
2776 		uint32_t phase, uint32_t doi, uint32_t proto, int depth)
2777 {
2778 	const u_char *cp;
2779 	int i;
2780 	u_int item_len;
2781 
2782 	cp = (const u_char *)ext;
2783 
2784 	while (np) {
2785 		ND_TCHECK_SIZE(ext);
2786 
2787 		item_len = GET_BE_U_2(ext->len);
2788 		ND_TCHECK_LEN(ext, item_len);
2789 
2790 		depth++;
2791 		ND_PRINT("\n");
2792 		for (i = 0; i < depth; i++)
2793 			ND_PRINT("    ");
2794 		ND_PRINT("(");
2795 		cp = ike_sub0_print(ndo, np, ext, ep, phase, doi, proto, depth);
2796 		ND_PRINT(")");
2797 		depth--;
2798 
2799 		if (cp == NULL) {
2800 			/* Zero-length subitem */
2801 			return NULL;
2802 		}
2803 
2804 		np = GET_U_1(ext->np);
2805 		ext = (const struct isakmp_gen *)cp;
2806 	}
2807 	return cp;
2808 trunc:
2809 	ND_PRINT(" [|%s]", NPSTR(np));
2810 	return NULL;
2811 }
2812 
2813 static char *
2814 numstr(u_int x)
2815 {
2816 	static char buf[20];
2817 	snprintf(buf, sizeof(buf), "#%u", x);
2818 	return buf;
2819 }
2820 
2821 static void
2822 ikev1_print(netdissect_options *ndo,
2823 	    const u_char *bp,  u_int length,
2824 	    const u_char *bp2, const struct isakmp *base)
2825 {
2826 	const struct isakmp *p;
2827 	const u_char *ep;
2828 	u_int flags;
2829 	u_char np;
2830 	int i;
2831 	u_int phase;
2832 
2833 	p = (const struct isakmp *)bp;
2834 	ep = ndo->ndo_snapend;
2835 
2836 	phase = (GET_BE_U_4(base->msgid) == 0) ? 1 : 2;
2837 	if (phase == 1)
2838 		ND_PRINT(" phase %u", phase);
2839 	else
2840 		ND_PRINT(" phase %u/others", phase);
2841 
2842 	i = cookie_find(&base->i_ck);
2843 	if (i < 0) {
2844 		if (iszero(ndo, base->r_ck, sizeof(base->r_ck))) {
2845 			/* the first packet */
2846 			ND_PRINT(" I");
2847 			if (bp2)
2848 				cookie_record(ndo, &base->i_ck, bp2);
2849 		} else
2850 			ND_PRINT(" ?");
2851 	} else {
2852 		if (bp2 && cookie_isinitiator(ndo, i, bp2))
2853 			ND_PRINT(" I");
2854 		else if (bp2 && cookie_isresponder(ndo, i, bp2))
2855 			ND_PRINT(" R");
2856 		else
2857 			ND_PRINT(" ?");
2858 	}
2859 
2860 	ND_PRINT(" %s", ETYPESTR(GET_U_1(base->etype)));
2861 	flags = GET_U_1(base->flags);
2862 	if (flags) {
2863 		ND_PRINT("[%s%s]", flags & ISAKMP_FLAG_E ? "E" : "",
2864 			  flags & ISAKMP_FLAG_C ? "C" : "");
2865 	}
2866 
2867 	if (ndo->ndo_vflag) {
2868 		const struct isakmp_gen *ext;
2869 
2870 		ND_PRINT(":");
2871 
2872 		np = GET_U_1(base->np);
2873 
2874 		/* regardless of phase... */
2875 		if (flags & ISAKMP_FLAG_E) {
2876 			/*
2877 			 * encrypted, nothing we can do right now.
2878 			 * we hope to decrypt the packet in the future...
2879 			 */
2880 			ND_PRINT(" [encrypted %s]", NPSTR(np));
2881 			goto done;
2882 		}
2883 
2884 		CHECKLEN(p + 1, np);
2885 		ext = (const struct isakmp_gen *)(p + 1);
2886 		ikev1_sub_print(ndo, np, ext, ep, phase, 0, 0, 0);
2887 	}
2888 
2889 done:
2890 	if (ndo->ndo_vflag) {
2891 		if (GET_BE_U_4(base->len) != length) {
2892 			ND_PRINT(" (len mismatch: isakmp %u/ip %u)",
2893 				  GET_BE_U_4(base->len), length);
2894 		}
2895 	}
2896 }
2897 
2898 static const u_char *
2899 ikev2_sub0_print(netdissect_options *ndo, const struct isakmp *base,
2900 		 u_char np,
2901 		 const struct isakmp_gen *ext, const u_char *ep,
2902 		 uint32_t phase, uint32_t doi, uint32_t proto, int depth)
2903 {
2904 	const u_char *cp;
2905 	u_int item_len;
2906 
2907 	cp = (const u_char *)ext;
2908 	ND_TCHECK_SIZE(ext);
2909 
2910 	/*
2911 	 * Since we can't have a payload length of less than 4 bytes,
2912 	 * we need to bail out here if the generic header is nonsensical
2913 	 * or truncated, otherwise we could loop forever processing
2914 	 * zero-length items or otherwise misdissect the packet.
2915 	 */
2916 	item_len = GET_BE_U_2(ext->len);
2917 	if (item_len <= 4)
2918 		return NULL;
2919 
2920 	if (np == ISAKMP_NPTYPE_v2E) {
2921 		cp = ikev2_e_print(ndo, base, np, ext, item_len,
2922 				   ep, phase, doi, proto, depth);
2923 	} else if (NPFUNC(np)) {
2924 		/*
2925 		 * XXX - what if item_len is too short, or too long,
2926 		 * for this payload type?
2927 		 */
2928 		cp = (*npfunc[np])(ndo, np, ext, item_len,
2929 				   ep, phase, doi, proto, depth);
2930 	} else {
2931 		ND_PRINT("%s", NPSTR(np));
2932 		cp += item_len;
2933 	}
2934 
2935 	return cp;
2936 trunc:
2937 	nd_print_trunc(ndo);
2938 	return NULL;
2939 }
2940 
2941 static const u_char *
2942 ikev2_sub_print(netdissect_options *ndo,
2943 		const struct isakmp *base,
2944 		u_char np, const struct isakmp_gen *ext, const u_char *ep,
2945 		uint32_t phase, uint32_t doi, uint32_t proto, int depth)
2946 {
2947 	const u_char *cp;
2948 	int i;
2949 
2950 	cp = (const u_char *)ext;
2951 	while (np) {
2952 		ND_TCHECK_SIZE(ext);
2953 
2954 		ND_TCHECK_LEN(ext, GET_BE_U_2(ext->len));
2955 
2956 		depth++;
2957 		ND_PRINT("\n");
2958 		for (i = 0; i < depth; i++)
2959 			ND_PRINT("    ");
2960 		ND_PRINT("(");
2961 		cp = ikev2_sub0_print(ndo, base, np,
2962 				      ext, ep, phase, doi, proto, depth);
2963 		ND_PRINT(")");
2964 		depth--;
2965 
2966 		if (cp == NULL) {
2967 			/* Zero-length subitem */
2968 			return NULL;
2969 		}
2970 
2971 		np = GET_U_1(ext->np);
2972 		ext = (const struct isakmp_gen *)cp;
2973 	}
2974 	return cp;
2975 trunc:
2976 	ND_PRINT(" [|%s]", NPSTR(np));
2977 	return NULL;
2978 }
2979 
2980 static void
2981 ikev2_print(netdissect_options *ndo,
2982 	    const u_char *bp,  u_int length,
2983 	    const u_char *bp2 _U_, const struct isakmp *base)
2984 {
2985 	const struct isakmp *p;
2986 	const u_char *ep;
2987 	uint8_t flags;
2988 	u_char np;
2989 	u_int phase;
2990 
2991 	p = (const struct isakmp *)bp;
2992 	ep = ndo->ndo_snapend;
2993 
2994 	phase = (GET_BE_U_4(base->msgid) == 0) ? 1 : 2;
2995 	if (phase == 1)
2996 		ND_PRINT(" parent_sa");
2997 	else
2998 		ND_PRINT(" child_sa ");
2999 
3000 	ND_PRINT(" %s", ETYPESTR(GET_U_1(base->etype)));
3001 	flags = GET_U_1(base->flags);
3002 	if (flags) {
3003 		ND_PRINT("[%s%s%s]",
3004 			  flags & ISAKMP_FLAG_I ? "I" : "",
3005 			  flags & ISAKMP_FLAG_V ? "V" : "",
3006 			  flags & ISAKMP_FLAG_R ? "R" : "");
3007 	}
3008 
3009 	if (ndo->ndo_vflag) {
3010 		const struct isakmp_gen *ext;
3011 
3012 		ND_PRINT(":");
3013 
3014 		np = GET_U_1(base->np);
3015 
3016 		/* regardless of phase... */
3017 		if (flags & ISAKMP_FLAG_E) {
3018 			/*
3019 			 * encrypted, nothing we can do right now.
3020 			 * we hope to decrypt the packet in the future...
3021 			 */
3022 			ND_PRINT(" [encrypted %s]", NPSTR(np));
3023 			goto done;
3024 		}
3025 
3026 		CHECKLEN(p + 1, np)
3027 		ext = (const struct isakmp_gen *)(p + 1);
3028 		ikev2_sub_print(ndo, base, np, ext, ep, phase, 0, 0, 0);
3029 	}
3030 
3031 done:
3032 	if (ndo->ndo_vflag) {
3033 		if (GET_BE_U_4(base->len) != length) {
3034 			ND_PRINT(" (len mismatch: isakmp %u/ip %u)",
3035 				  GET_BE_U_4(base->len), length);
3036 		}
3037 	}
3038 }
3039 
3040 void
3041 isakmp_print(netdissect_options *ndo,
3042 	     const u_char *bp, u_int length,
3043 	     const u_char *bp2)
3044 {
3045 	const struct isakmp *p;
3046 	const u_char *ep;
3047 	u_int major, minor;
3048 
3049 	ndo->ndo_protocol = "isakmp";
3050 #ifdef HAVE_LIBCRYPTO
3051 	/* initialize SAs */
3052 	if (ndo->ndo_sa_list_head == NULL) {
3053 		if (ndo->ndo_espsecret)
3054 			esp_decodesecret_print(ndo);
3055 	}
3056 #endif
3057 
3058 	p = (const struct isakmp *)bp;
3059 	ep = ndo->ndo_snapend;
3060 
3061 	if ((const struct isakmp *)ep < p + 1) {
3062 		nd_print_trunc(ndo);
3063 		return;
3064 	}
3065 
3066 	ND_PRINT("isakmp");
3067 	major = (GET_U_1(p->vers) & ISAKMP_VERS_MAJOR)
3068 		>> ISAKMP_VERS_MAJOR_SHIFT;
3069 	minor = (GET_U_1(p->vers) & ISAKMP_VERS_MINOR)
3070 		>> ISAKMP_VERS_MINOR_SHIFT;
3071 
3072 	if (ndo->ndo_vflag) {
3073 		ND_PRINT(" %u.%u", major, minor);
3074 	}
3075 
3076 	if (ndo->ndo_vflag) {
3077 		ND_PRINT(" msgid ");
3078 		hexprint(ndo, p->msgid, sizeof(p->msgid));
3079 	}
3080 
3081 	if (1 < ndo->ndo_vflag) {
3082 		ND_PRINT(" cookie ");
3083 		hexprint(ndo, p->i_ck, sizeof(p->i_ck));
3084 		ND_PRINT("->");
3085 		hexprint(ndo, p->r_ck, sizeof(p->r_ck));
3086 	}
3087 	ND_PRINT(":");
3088 
3089 	switch(major) {
3090 	case IKEv1_MAJOR_VERSION:
3091 		ikev1_print(ndo, bp, length, bp2, p);
3092 		break;
3093 
3094 	case IKEv2_MAJOR_VERSION:
3095 		ikev2_print(ndo, bp, length, bp2, p);
3096 		break;
3097 	}
3098 }
3099 
3100 void
3101 isakmp_rfc3948_print(netdissect_options *ndo,
3102 		     const u_char *bp, u_int length,
3103 		     const u_char *bp2, int ver, int fragmented, u_int ttl_hl)
3104 {
3105 	ndo->ndo_protocol = "isakmp_rfc3948";
3106 	if(length == 1 && GET_U_1(bp)==0xff) {
3107 		ND_PRINT("isakmp-nat-keep-alive");
3108 		return;
3109 	}
3110 
3111 	if(length < 4) {
3112 		goto trunc;
3113 	}
3114 
3115 	/*
3116 	 * see if this is an IKE packet
3117 	 */
3118 	if (GET_BE_U_4(bp) == 0) {
3119 		ND_PRINT("NONESP-encap: ");
3120 		isakmp_print(ndo, bp+4, length-4, bp2);
3121 		return;
3122 	}
3123 
3124 	/* must be an ESP packet */
3125 	{
3126 		ND_PRINT("UDP-encap: ");
3127 
3128 		esp_print(ndo, bp, length, bp2, ver, fragmented, ttl_hl);
3129 
3130 		/*
3131 		 * Either this has decrypted the payload and
3132 		 * printed it, in which case there's nothing more
3133 		 * to do, or it hasn't, in which case there's
3134 		 * nothing more to do.
3135 		 */
3136 		return;
3137 	}
3138 
3139 trunc:
3140 	nd_print_trunc(ndo);
3141 }
3142