contrib/tcpdump/print-isakmp.c

   1 /*
   2  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  * 3. Neither the name of the project nor the names of its contributors
  14  *    may be used to endorse or promote products derived from this software
  15  *    without specific prior written permission.
  16  *
  17  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  27  * SUCH DAMAGE.
  28  *
  29  */
  30
  31 /* \summary: Internet Security Association and Key Management Protocol (ISAKMP) printer */
  32
  33 #ifdef HAVE_CONFIG_H
  34 #include "config.h"
  35 #endif
  36
  37 /* The functions from print-esp.c used in this file are only defined when both
  38  * OpenSSL and evp.h are detected. Employ the same preprocessor device here.
  39  */
  40 #ifndef HAVE_OPENSSL_EVP_H
  41 #undef HAVE_LIBCRYPTO
  42 #endif
  43
  44 #include <netdissect-stdinc.h>
  45
  46 #include <string.h>
  47
  48 #include "netdissect.h"
  49 #include "addrtoname.h"
  50 #include "extract.h"
  51
  52 #include "ip.h"
  53 #include "ip6.h"
  54 #include "ipproto.h"
  55
  56 /* refer to RFC 2408 */
  57
  58 typedef u_char cookie_t[8];
  59 typedef u_char msgid_t[4];
  60
  61 #define PORT_ISAKMP 500
  62
  63 /* 3.1 ISAKMP Header Format (IKEv1 and IKEv2)
  64          0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
  65         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  66         !                          Initiator                            !
  67         !                            Cookie                             !
  68         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  69         !                          Responder                            !
  70         !                            Cookie                             !
  71         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  72         !  Next Payload ! MjVer ! MnVer ! Exchange Type !     Flags     !
  73         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  74         !                          Message ID                           !
  75         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  76         !                            Length                             !
  77         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  78 */
  79 struct isakmp {
  80         cookie_t i_ck;          /* Initiator Cookie */
  81         cookie_t r_ck;          /* Responder Cookie */
  82         uint8_t np;             /* Next Payload Type */
  83         uint8_t vers;
  84 #define ISAKMP_VERS_MAJOR       0xf0
  85 #define ISAKMP_VERS_MAJOR_SHIFT 4
  86 #define ISAKMP_VERS_MINOR       0x0f
  87 #define ISAKMP_VERS_MINOR_SHIFT 0
  88         uint8_t etype;          /* Exchange Type */
  89         uint8_t flags;          /* Flags */
  90         msgid_t msgid;
  91         uint32_t len;           /* Length */
  92 };
  93
  94 /* Next Payload Type */
  95 #define ISAKMP_NPTYPE_NONE   0 /* NONE*/
  96 #define ISAKMP_NPTYPE_SA     1 /* Security Association */
  97 #define ISAKMP_NPTYPE_P      2 /* Proposal */
  98 #define ISAKMP_NPTYPE_T      3 /* Transform */
  99 #define ISAKMP_NPTYPE_KE     4 /* Key Exchange */
 100 #define ISAKMP_NPTYPE_ID     5 /* Identification */
 101 #define ISAKMP_NPTYPE_CERT   6 /* Certificate */
 102 #define ISAKMP_NPTYPE_CR     7 /* Certificate Request */
 103 #define ISAKMP_NPTYPE_HASH   8 /* Hash */
 104 #define ISAKMP_NPTYPE_SIG    9 /* Signature */
 105 #define ISAKMP_NPTYPE_NONCE 10 /* Nonce */
 106 #define ISAKMP_NPTYPE_N     11 /* Notification */
 107 #define ISAKMP_NPTYPE_D     12 /* Delete */
 108 #define ISAKMP_NPTYPE_VID   13 /* Vendor ID */
 109 #define ISAKMP_NPTYPE_v2E   46 /* v2 Encrypted payload */
 110
 111 #define IKEv1_MAJOR_VERSION  1
 112 #define IKEv1_MINOR_VERSION  0
 113
 114 #define IKEv2_MAJOR_VERSION  2
 115 #define IKEv2_MINOR_VERSION  0
 116
 117 /* Flags */
 118 #define ISAKMP_FLAG_E 0x01 /* Encryption Bit */
 119 #define ISAKMP_FLAG_C 0x02 /* Commit Bit */
 120 #define ISAKMP_FLAG_extra 0x04
 121
 122 /* IKEv2 */
 123 #define ISAKMP_FLAG_I (1 << 3)  /* (I)nitiator */
 124 #define ISAKMP_FLAG_V (1 << 4)  /* (V)ersion   */
 125 #define ISAKMP_FLAG_R (1 << 5)  /* (R)esponse  */
 126
 127
 128 /* 3.2 Payload Generic Header
 129          0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 130         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 131         ! Next Payload  !   RESERVED    !         Payload Length        !
 132         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 133 */
 134 struct isakmp_gen {
 135         uint8_t  np;       /* Next Payload */
 136         uint8_t  critical; /* bit 7 - critical, rest is RESERVED */
 137         uint16_t len;      /* Payload Length */
 138 };
 139
 140 /* 3.3 Data Attributes
 141          0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 142         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 143         !A!       Attribute Type        !    AF=0  Attribute Length     !
 144         !F!                             !    AF=1  Attribute Value      !
 145         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 146         .                   AF=0  Attribute Value                       .
 147         .                   AF=1  Not Transmitted                       .
 148         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 149 */
 150 struct isakmp_data {
 151         uint16_t type;     /* defined by DOI-spec, and Attribute Format */
 152         uint16_t lorv;     /* if f equal 1, Attribute Length */
 153                           /* if f equal 0, Attribute Value */
 154         /* if f equal 1, Attribute Value */
 155 };
 156
 157 /* 3.4 Security Association Payload */
 158         /* MAY NOT be used, because of being defined in ipsec-doi. */
 159         /*
 160         If the current payload is the last in the message,
 161         then the value of the next payload field will be 0.
 162         This field MUST NOT contain the
 163         values for the Proposal or Transform payloads as they are considered
 164         part of the security association negotiation.  For example, this
 165         field would contain the value "10" (Nonce payload) in the first
 166         message of a Base Exchange (see Section 4.4) and the value "0" in the
 167         first message of an Identity Protect Exchange (see Section 4.5).
 168         */
 169 struct ikev1_pl_sa {
 170         struct isakmp_gen h;
 171         uint32_t doi; /* Domain of Interpretation */
 172         uint32_t sit; /* Situation */
 173 };
 174
 175 /* 3.5 Proposal Payload */
 176         /*
 177         The value of the next payload field MUST only contain the value "2"
 178         or "0".  If there are additional Proposal payloads in the message,
 179         then this field will be 2.  If the current Proposal payload is the
 180         last within the security association proposal, then this field will
 181         be 0.
 182         */
 183 struct ikev1_pl_p {
 184         struct isakmp_gen h;
 185         uint8_t p_no;      /* Proposal # */
 186         uint8_t prot_id;   /* Protocol */
 187         uint8_t spi_size;  /* SPI Size */
 188         uint8_t num_t;     /* Number of Transforms */
 189         /* SPI */
 190 };
 191
 192 /* 3.6 Transform Payload */
 193         /*
 194         The value of the next payload field MUST only contain the value "3"
 195         or "0".  If there are additional Transform payloads in the proposal,
 196         then this field will be 3.  If the current Transform payload is the
 197         last within the proposal, then this field will be 0.
 198         */
 199 struct ikev1_pl_t {
 200         struct isakmp_gen h;
 201         uint8_t  t_no;     /* Transform # */
 202         uint8_t  t_id;     /* Transform-Id */
 203         uint16_t reserved; /* RESERVED2 */
 204         /* SA Attributes */
 205 };
 206
 207 /* 3.7 Key Exchange Payload */
 208 struct ikev1_pl_ke {
 209         struct isakmp_gen h;
 210         /* Key Exchange Data */
 211 };
 212
 213 /* 3.8 Identification Payload */
 214         /* MUST NOT to be used, because of being defined in ipsec-doi. */
 215 struct ikev1_pl_id {
 216         struct isakmp_gen h;
 217         union {
 218                 uint8_t  id_type;   /* ID Type */
 219                 uint32_t doi_data;  /* DOI Specific ID Data */
 220         } d;
 221         /* Identification Data */
 222 };
 223
 224 /* 3.9 Certificate Payload */
 225 struct ikev1_pl_cert {
 226         struct isakmp_gen h;
 227         uint8_t encode; /* Cert Encoding */
 228         char   cert;   /* Certificate Data */
 229                 /*
 230                 This field indicates the type of
 231                 certificate or certificate-related information contained in the
 232                 Certificate Data field.
 233                 */
 234 };
 235
 236 /* 3.10 Certificate Request Payload */
 237 struct ikev1_pl_cr {
 238         struct isakmp_gen h;
 239         uint8_t num_cert; /* # Cert. Types */
 240         /*
 241         Certificate Types (variable length)
 242           -- Contains a list of the types of certificates requested,
 243           sorted in order of preference.  Each individual certificate
 244           type is 1 octet.  This field is NOT requiredo
 245         */
 246         /* # Certificate Authorities (1 octet) */
 247         /* Certificate Authorities (variable length) */
 248 };
 249
 250 /* 3.11 Hash Payload */
 251         /* may not be used, because of having only data. */
 252 struct ikev1_pl_hash {
 253         struct isakmp_gen h;
 254         /* Hash Data */
 255 };
 256
 257 /* 3.12 Signature Payload */
 258         /* may not be used, because of having only data. */
 259 struct ikev1_pl_sig {
 260         struct isakmp_gen h;
 261         /* Signature Data */
 262 };
 263
 264 /* 3.13 Nonce Payload */
 265         /* may not be used, because of having only data. */
 266 struct ikev1_pl_nonce {
 267         struct isakmp_gen h;
 268         /* Nonce Data */
 269 };
 270
 271 /* 3.14 Notification Payload */
 272 struct ikev1_pl_n {
 273         struct isakmp_gen h;
 274         uint32_t doi;      /* Domain of Interpretation */
 275         uint8_t  prot_id;  /* Protocol-ID */
 276         uint8_t  spi_size; /* SPI Size */
 277         uint16_t type;     /* Notify Message Type */
 278         /* SPI */
 279         /* Notification Data */
 280 };
 281
 282 /* 3.14.1 Notify Message Types */
 283 /* NOTIFY MESSAGES - ERROR TYPES */
 284 #define ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE           1
 285 #define ISAKMP_NTYPE_DOI_NOT_SUPPORTED              2
 286 #define ISAKMP_NTYPE_SITUATION_NOT_SUPPORTED        3
 287 #define ISAKMP_NTYPE_INVALID_COOKIE                 4
 288 #define ISAKMP_NTYPE_INVALID_MAJOR_VERSION          5
 289 #define ISAKMP_NTYPE_INVALID_MINOR_VERSION          6
 290 #define ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE          7
 291 #define ISAKMP_NTYPE_INVALID_FLAGS                  8
 292 #define ISAKMP_NTYPE_INVALID_MESSAGE_ID             9
 293 #define ISAKMP_NTYPE_INVALID_PROTOCOL_ID            10
 294 #define ISAKMP_NTYPE_INVALID_SPI                    11
 295 #define ISAKMP_NTYPE_INVALID_TRANSFORM_ID           12
 296 #define ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED       13
 297 #define ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN             14
 298 #define ISAKMP_NTYPE_BAD_PROPOSAL_SYNTAX            15
 299 #define ISAKMP_NTYPE_PAYLOAD_MALFORMED              16
 300 #define ISAKMP_NTYPE_INVALID_KEY_INFORMATION        17
 301 #define ISAKMP_NTYPE_INVALID_ID_INFORMATION         18
 302 #define ISAKMP_NTYPE_INVALID_CERT_ENCODING          19
 303 #define ISAKMP_NTYPE_INVALID_CERTIFICATE            20
 304 #define ISAKMP_NTYPE_BAD_CERT_REQUEST_SYNTAX        21
 305 #define ISAKMP_NTYPE_INVALID_CERT_AUTHORITY         22
 306 #define ISAKMP_NTYPE_INVALID_HASH_INFORMATION       23
 307 #define ISAKMP_NTYPE_AUTHENTICATION_FAILED          24
 308 #define ISAKMP_NTYPE_INVALID_SIGNATURE              25
 309 #define ISAKMP_NTYPE_ADDRESS_NOTIFICATION           26
 310
 311 /* 3.15 Delete Payload */
 312 struct ikev1_pl_d {
 313         struct isakmp_gen h;
 314         uint32_t doi;      /* Domain of Interpretation */
 315         uint8_t  prot_id;  /* Protocol-Id */
 316         uint8_t  spi_size; /* SPI Size */
 317         uint16_t num_spi;  /* # of SPIs */
 318         /* SPI(es) */
 319 };
 320
 321 struct ikev1_ph1tab {
 322         struct ikev1_ph1 *head;
 323         struct ikev1_ph1 *tail;
 324         int len;
 325 };
 326
 327 struct isakmp_ph2tab {
 328         struct ikev1_ph2 *head;
 329         struct ikev1_ph2 *tail;
 330         int len;
 331 };
 332
 333 /* IKEv2 (RFC4306) */
 334
 335 /* 3.3  Security Association Payload -- generic header */
 336 /* 3.3.1.  Proposal Substructure */
 337 struct ikev2_p {
 338         struct isakmp_gen h;
 339         uint8_t p_no;      /* Proposal # */
 340         uint8_t prot_id;   /* Protocol */
 341         uint8_t spi_size;  /* SPI Size */
 342         uint8_t num_t;     /* Number of Transforms */
 343 };
 344
 345 /* 3.3.2.  Transform Substructure */
 346 struct ikev2_t {
 347         struct isakmp_gen h;
 348         uint8_t t_type;    /* Transform Type (ENCR,PRF,INTEG,etc.*/
 349         uint8_t res2;      /* reserved byte */
 350         uint16_t t_id;     /* Transform ID */
 351 };
 352
 353 enum ikev2_t_type {
 354         IV2_T_ENCR = 1,
 355         IV2_T_PRF  = 2,
 356         IV2_T_INTEG= 3,
 357         IV2_T_DH   = 4,
 358         IV2_T_ESN  = 5
 359 };
 360
 361 /* 3.4.  Key Exchange Payload */
 362 struct ikev2_ke {
 363         struct isakmp_gen h;
 364         uint16_t  ke_group;
 365         uint16_t  ke_res1;
 366         /* KE data */
 367 };
 368
 369
 370 /* 3.5.  Identification Payloads */
 371 enum ikev2_id_type {
 372         ID_IPV4_ADDR=1,
 373         ID_FQDN=2,
 374         ID_RFC822_ADDR=3,
 375         ID_IPV6_ADDR=5,
 376         ID_DER_ASN1_DN=9,
 377         ID_DER_ASN1_GN=10,
 378         ID_KEY_ID=11
 379 };
 380 struct ikev2_id {
 381         struct isakmp_gen h;
 382         uint8_t  type;        /* ID type */
 383         uint8_t  res1;
 384         uint16_t res2;
 385         /* SPI */
 386         /* Notification Data */
 387 };
 388
 389 /* 3.10 Notification Payload */
 390 struct ikev2_n {
 391         struct isakmp_gen h;
 392         uint8_t  prot_id;  /* Protocol-ID */
 393         uint8_t  spi_size; /* SPI Size */
 394         uint16_t type;     /* Notify Message Type */
 395 };
 396
 397 enum ikev2_n_type {
 398         IV2_NOTIFY_UNSUPPORTED_CRITICAL_PAYLOAD            = 1,
 399         IV2_NOTIFY_INVALID_IKE_SPI                         = 4,
 400         IV2_NOTIFY_INVALID_MAJOR_VERSION                   = 5,
 401         IV2_NOTIFY_INVALID_SYNTAX                          = 7,
 402         IV2_NOTIFY_INVALID_MESSAGE_ID                      = 9,
 403         IV2_NOTIFY_INVALID_SPI                             =11,
 404         IV2_NOTIFY_NO_PROPOSAL_CHOSEN                      =14,
 405         IV2_NOTIFY_INVALID_KE_PAYLOAD                      =17,
 406         IV2_NOTIFY_AUTHENTICATION_FAILED                   =24,
 407         IV2_NOTIFY_SINGLE_PAIR_REQUIRED                    =34,
 408         IV2_NOTIFY_NO_ADDITIONAL_SAS                       =35,
 409         IV2_NOTIFY_INTERNAL_ADDRESS_FAILURE                =36,
 410         IV2_NOTIFY_FAILED_CP_REQUIRED                      =37,
 411         IV2_NOTIFY_INVALID_SELECTORS                       =39,
 412         IV2_NOTIFY_INITIAL_CONTACT                         =16384,
 413         IV2_NOTIFY_SET_WINDOW_SIZE                         =16385,
 414         IV2_NOTIFY_ADDITIONAL_TS_POSSIBLE                  =16386,
 415         IV2_NOTIFY_IPCOMP_SUPPORTED                        =16387,
 416         IV2_NOTIFY_NAT_DETECTION_SOURCE_IP                 =16388,
 417         IV2_NOTIFY_NAT_DETECTION_DESTINATION_IP            =16389,
 418         IV2_NOTIFY_COOKIE                                  =16390,
 419         IV2_NOTIFY_USE_TRANSPORT_MODE                      =16391,
 420         IV2_NOTIFY_HTTP_CERT_LOOKUP_SUPPORTED              =16392,
 421         IV2_NOTIFY_REKEY_SA                                =16393,
 422         IV2_NOTIFY_ESP_TFC_PADDING_NOT_SUPPORTED           =16394,
 423         IV2_NOTIFY_NON_FIRST_FRAGMENTS_ALSO                =16395
 424 };
 425
 426 struct notify_messages {
 427         uint16_t type;
 428         char     *msg;
 429 };
 430
 431 /* 3.8 Authentication Payload */
 432 struct ikev2_auth {
 433         struct isakmp_gen h;
 434         uint8_t  auth_method;  /* Protocol-ID */
 435         uint8_t  reserved[3];
 436         /* authentication data */
 437 };
 438
 439 enum ikev2_auth_type {
 440         IV2_RSA_SIG = 1,
 441         IV2_SHARED  = 2,
 442         IV2_DSS_SIG = 3
 443 };
 444
 445 /* refer to RFC 2409 */
 446
 447 #if 0
 448 /* isakmp sa structure */
 449 struct oakley_sa {
 450         uint8_t  proto_id;            /* OAKLEY */
 451         vchar_t   *spi;                /* spi */
 452         uint8_t  dhgrp;               /* DH; group */
 453         uint8_t  auth_t;              /* method of authentication */
 454         uint8_t  prf_t;               /* type of prf */
 455         uint8_t  hash_t;              /* type of hash */
 456         uint8_t  enc_t;               /* type of cipher */
 457         uint8_t  life_t;              /* type of duration of lifetime */
 458         uint32_t ldur;                /* life duration */
 459 };
 460 #endif
 461
 462 /* refer to RFC 2407 */
 463
 464 #define IPSEC_DOI 1
 465
 466 /* 4.2 IPSEC Situation Definition */
 467 #define IPSECDOI_SIT_IDENTITY_ONLY           0x00000001
 468 #define IPSECDOI_SIT_SECRECY                 0x00000002
 469 #define IPSECDOI_SIT_INTEGRITY               0x00000004
 470
 471 /* 4.4.1 IPSEC Security Protocol Identifiers */
 472   /* 4.4.2 IPSEC ISAKMP Transform Values */
 473 #define IPSECDOI_PROTO_ISAKMP                        1
 474 #define   IPSECDOI_KEY_IKE                             1
 475
 476 /* 4.4.1 IPSEC Security Protocol Identifiers */
 477 #define IPSECDOI_PROTO_IPSEC_AH                      2
 478   /* 4.4.3 IPSEC AH Transform Values */
 479 #define   IPSECDOI_AH_MD5                              2
 480 #define   IPSECDOI_AH_SHA                              3
 481 #define   IPSECDOI_AH_DES                              4
 482 #define   IPSECDOI_AH_SHA2_256                         5
 483 #define   IPSECDOI_AH_SHA2_384                         6
 484 #define   IPSECDOI_AH_SHA2_512                         7
 485
 486 /* 4.4.1 IPSEC Security Protocol Identifiers */
 487 #define IPSECDOI_PROTO_IPSEC_ESP                     3
 488   /* 4.4.4 IPSEC ESP Transform Identifiers */
 489 #define   IPSECDOI_ESP_DES_IV64                        1
 490 #define   IPSECDOI_ESP_DES                             2
 491 #define   IPSECDOI_ESP_3DES                            3
 492 #define   IPSECDOI_ESP_RC5                             4
 493 #define   IPSECDOI_ESP_IDEA                            5
 494 #define   IPSECDOI_ESP_CAST                            6
 495 #define   IPSECDOI_ESP_BLOWFISH                        7
 496 #define   IPSECDOI_ESP_3IDEA                           8
 497 #define   IPSECDOI_ESP_DES_IV32                        9
 498 #define   IPSECDOI_ESP_RC4                            10
 499 #define   IPSECDOI_ESP_NULL                           11
 500 #define   IPSECDOI_ESP_RIJNDAEL                         12
 501 #define   IPSECDOI_ESP_AES                              12
 502
 503 /* 4.4.1 IPSEC Security Protocol Identifiers */
 504 #define IPSECDOI_PROTO_IPCOMP                        4
 505   /* 4.4.5 IPSEC IPCOMP Transform Identifiers */
 506 #define   IPSECDOI_IPCOMP_OUI                          1
 507 #define   IPSECDOI_IPCOMP_DEFLATE                      2
 508 #define   IPSECDOI_IPCOMP_LZS                          3
 509
 510 /* 4.5 IPSEC Security Association Attributes */
 511 #define IPSECDOI_ATTR_SA_LTYPE                1 /* B */
 512 #define   IPSECDOI_ATTR_SA_LTYPE_DEFAULT        1
 513 #define   IPSECDOI_ATTR_SA_LTYPE_SEC            1
 514 #define   IPSECDOI_ATTR_SA_LTYPE_KB             2
 515 #define IPSECDOI_ATTR_SA_LDUR                 2 /* V */
 516 #define   IPSECDOI_ATTR_SA_LDUR_DEFAULT         28800 /* 8 hours */
 517 #define IPSECDOI_ATTR_GRP_DESC                3 /* B */
 518 #define IPSECDOI_ATTR_ENC_MODE                4 /* B */
 519         /* default value: host dependent */
 520 #define   IPSECDOI_ATTR_ENC_MODE_TUNNEL         1
 521 #define   IPSECDOI_ATTR_ENC_MODE_TRNS           2
 522 #define IPSECDOI_ATTR_AUTH                    5 /* B */
 523         /* 0 means not to use authentication. */
 524 #define   IPSECDOI_ATTR_AUTH_HMAC_MD5           1
 525 #define   IPSECDOI_ATTR_AUTH_HMAC_SHA1          2
 526 #define   IPSECDOI_ATTR_AUTH_DES_MAC            3
 527 #define   IPSECDOI_ATTR_AUTH_KPDK               4 /*RFC-1826(Key/Pad/Data/Key)*/
 528         /*
 529          * When negotiating ESP without authentication, the Auth
 530          * Algorithm attribute MUST NOT be included in the proposal.
 531          * When negotiating ESP without confidentiality, the Auth
 532          * Algorithm attribute MUST be included in the proposal and
 533          * the ESP transform ID must be ESP_NULL.
 534         */
 535 #define IPSECDOI_ATTR_KEY_LENGTH              6 /* B */
 536 #define IPSECDOI_ATTR_KEY_ROUNDS              7 /* B */
 537 #define IPSECDOI_ATTR_COMP_DICT_SIZE          8 /* B */
 538 #define IPSECDOI_ATTR_COMP_PRIVALG            9 /* V */
 539
 540 /* 4.6.1 Security Association Payload */
 541 struct ipsecdoi_sa {
 542         struct isakmp_gen h;
 543         uint32_t doi; /* Domain of Interpretation */
 544         uint32_t sit; /* Situation */
 545 };
 546
 547 struct ipsecdoi_secrecy_h {
 548         uint16_t len;
 549         uint16_t reserved;
 550 };
 551
 552 /* 4.6.2.1 Identification Type Values */
 553 struct ipsecdoi_id {
 554         struct isakmp_gen h;
 555         uint8_t  type;          /* ID Type */
 556         uint8_t  proto_id;      /* Protocol ID */
 557         uint16_t port;          /* Port */
 558         /* Identification Data */
 559 };
 560
 561 #define IPSECDOI_ID_IPV4_ADDR                        1
 562 #define IPSECDOI_ID_FQDN                             2
 563 #define IPSECDOI_ID_USER_FQDN                        3
 564 #define IPSECDOI_ID_IPV4_ADDR_SUBNET                 4
 565 #define IPSECDOI_ID_IPV6_ADDR                        5
 566 #define IPSECDOI_ID_IPV6_ADDR_SUBNET                 6
 567 #define IPSECDOI_ID_IPV4_ADDR_RANGE                  7
 568 #define IPSECDOI_ID_IPV6_ADDR_RANGE                  8
 569 #define IPSECDOI_ID_DER_ASN1_DN                      9
 570 #define IPSECDOI_ID_DER_ASN1_GN                      10
 571 #define IPSECDOI_ID_KEY_ID                           11
 572
 573 /* 4.6.3 IPSEC DOI Notify Message Types */
 574 /* Notify Messages - Status Types */
 575 #define IPSECDOI_NTYPE_RESPONDER_LIFETIME                  24576
 576 #define IPSECDOI_NTYPE_REPLAY_STATUS                       24577
 577 #define IPSECDOI_NTYPE_INITIAL_CONTACT                     24578
 578
 579 #define DECLARE_PRINTER(func) static const u_char *ike##func##_print( \
 580                 netdissect_options *ndo, u_char tpay,                 \
 581                 const struct isakmp_gen *ext,                         \
 582                 u_int item_len, \
 583                 const u_char *end_pointer, \
 584                 uint32_t phase,\
 585                 uint32_t doi0, \
 586                 uint32_t proto0, int depth)
 587
 588 DECLARE_PRINTER(v1_sa);
 589 DECLARE_PRINTER(v1_p);
 590 DECLARE_PRINTER(v1_t);
 591 DECLARE_PRINTER(v1_ke);
 592 DECLARE_PRINTER(v1_id);
 593 DECLARE_PRINTER(v1_cert);
 594 DECLARE_PRINTER(v1_cr);
 595 DECLARE_PRINTER(v1_sig);
 596 DECLARE_PRINTER(v1_hash);
 597 DECLARE_PRINTER(v1_nonce);
 598 DECLARE_PRINTER(v1_n);
 599 DECLARE_PRINTER(v1_d);
 600 DECLARE_PRINTER(v1_vid);
 601
 602 DECLARE_PRINTER(v2_sa);
 603 DECLARE_PRINTER(v2_ke);
 604 DECLARE_PRINTER(v2_ID);
 605 DECLARE_PRINTER(v2_cert);
 606 DECLARE_PRINTER(v2_cr);
 607 DECLARE_PRINTER(v2_auth);
 608 DECLARE_PRINTER(v2_nonce);
 609 DECLARE_PRINTER(v2_n);
 610 DECLARE_PRINTER(v2_d);
 611 DECLARE_PRINTER(v2_vid);
 612 DECLARE_PRINTER(v2_TS);
 613 DECLARE_PRINTER(v2_cp);
 614 DECLARE_PRINTER(v2_eap);
 615
 616 static const u_char *ikev2_e_print(netdissect_options *ndo,
 617                                    struct isakmp *base,
 618                                    u_char tpay,
 619                                    const struct isakmp_gen *ext,
 620                                    u_int item_len,
 621                                    const u_char *end_pointer,
 622                                    uint32_t phase,
 623                                    uint32_t doi0,
 624                                    uint32_t proto0, int depth);
 625
 626
 627 static const u_char *ike_sub0_print(netdissect_options *ndo,u_char, const struct isakmp_gen *,
 628         const u_char *, uint32_t, uint32_t, uint32_t, int);
 629 static const u_char *ikev1_sub_print(netdissect_options *ndo,u_char, const struct isakmp_gen *,
 630         const u_char *, uint32_t, uint32_t, uint32_t, int);
 631
 632 static const u_char *ikev2_sub_print(netdissect_options *ndo,
 633                                      struct isakmp *base,
 634                                      u_char np, const struct isakmp_gen *ext,
 635                                      const u_char *ep, uint32_t phase,
 636                                      uint32_t doi, uint32_t proto,
 637                                      int depth);
 638
 639
 640 static char *numstr(int);
 641
 642 static void
 643 ikev1_print(netdissect_options *ndo,
 644             const u_char *bp,  u_int length,
 645             const u_char *bp2, struct isakmp *base);
 646
 647 #define MAXINITIATORS   20
 648 static int ninitiator = 0;
 649 union inaddr_u {
 650         struct in_addr in4;
 651         struct in6_addr in6;
 652 };
 653 static struct {
 654         cookie_t initiator;
 655         u_int version;
 656         union inaddr_u iaddr;
 657         union inaddr_u raddr;
 658 } cookiecache[MAXINITIATORS];
 659
 660 /* protocol id */
 661 static const char *protoidstr[] = {
 662         NULL, "isakmp", "ipsec-ah", "ipsec-esp", "ipcomp",
 663 };
 664
 665 /* isakmp->np */
 666 static const char *npstr[] = {
 667         "none", "sa", "p", "t", "ke", "id", "cert", "cr", "hash", /* 0 - 8 */
 668         "sig", "nonce", "n", "d", "vid",      /* 9 - 13 */
 669         "pay14", "pay15", "pay16", "pay17", "pay18", /* 14- 18 */
 670         "pay19", "pay20", "pay21", "pay22", "pay23", /* 19- 23 */
 671         "pay24", "pay25", "pay26", "pay27", "pay28", /* 24- 28 */
 672         "pay29", "pay30", "pay31", "pay32",          /* 29- 32 */
 673         "v2sa",  "v2ke",  "v2IDi", "v2IDr", "v2cert",/* 33- 37 */
 674         "v2cr",  "v2auth","v2nonce", "v2n",   "v2d",   /* 38- 42 */
 675         "v2vid", "v2TSi", "v2TSr", "v2e",   "v2cp",  /* 43- 47 */
 676         "v2eap",                                     /* 48 */
 677
 678 };
 679
 680 /* isakmp->np */
 681 static const u_char *(*npfunc[])(netdissect_options *ndo, u_char tpay,
 682                                  const struct isakmp_gen *ext,
 683                                  u_int item_len,
 684                                  const u_char *end_pointer,
 685                                  uint32_t phase,
 686                                  uint32_t doi0,
 687                                  uint32_t proto0, int depth) = {
 688         NULL,
 689         ikev1_sa_print,
 690         ikev1_p_print,
 691         ikev1_t_print,
 692         ikev1_ke_print,
 693         ikev1_id_print,
 694         ikev1_cert_print,
 695         ikev1_cr_print,
 696         ikev1_hash_print,
 697         ikev1_sig_print,
 698         ikev1_nonce_print,
 699         ikev1_n_print,
 700         ikev1_d_print,
 701         ikev1_vid_print,                  /* 13 */
 702         NULL, NULL, NULL, NULL, NULL,     /* 14- 18 */
 703         NULL, NULL, NULL, NULL, NULL,     /* 19- 23 */
 704         NULL, NULL, NULL, NULL, NULL,     /* 24- 28 */
 705         NULL, NULL, NULL, NULL,           /* 29- 32 */
 706         ikev2_sa_print,                 /* 33 */
 707         ikev2_ke_print,                 /* 34 */
 708         ikev2_ID_print,                 /* 35 */
 709         ikev2_ID_print,                 /* 36 */
 710         ikev2_cert_print,               /* 37 */
 711         ikev2_cr_print,                 /* 38 */
 712         ikev2_auth_print,               /* 39 */
 713         ikev2_nonce_print,              /* 40 */
 714         ikev2_n_print,                  /* 41 */
 715         ikev2_d_print,                  /* 42 */
 716         ikev2_vid_print,                /* 43 */
 717         ikev2_TS_print,                 /* 44 */
 718         ikev2_TS_print,                 /* 45 */
 719         NULL, /* ikev2_e_print,*/       /* 46 - special */
 720         ikev2_cp_print,                 /* 47 */
 721         ikev2_eap_print,                /* 48 */
 722 };
 723
 724 /* isakmp->etype */
 725 static const char *etypestr[] = {
 726 /* IKEv1 exchange types */
 727         "none", "base", "ident", "auth", "agg", "inf", NULL, NULL,  /* 0-7 */
 728         NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,  /*  8-15 */
 729         NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,  /* 16-23 */
 730         NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,  /* 24-31 */
 731         "oakley-quick", "oakley-newgroup",               /* 32-33 */
 732 /* IKEv2 exchange types */
 733         "ikev2_init", "ikev2_auth", "child_sa", "inf2"   /* 34-37 */
 734 };
 735
 736 #define STR_OR_ID(x, tab) \
 737         (((x) < sizeof(tab)/sizeof(tab[0]) && tab[(x)]) ? tab[(x)] : numstr(x))
 738 #define PROTOIDSTR(x)   STR_OR_ID(x, protoidstr)
 739 #define NPSTR(x)        STR_OR_ID(x, npstr)
 740 #define ETYPESTR(x)     STR_OR_ID(x, etypestr)
 741
 742 #define CHECKLEN(p, np)                                                 \
 743                 if (ep < (const u_char *)(p)) {                         \
 744                         ND_PRINT((ndo," [|%s]", NPSTR(np)));            \
 745                         goto done;                                      \
 746                 }
 747
 748
 749 #define NPFUNC(x) \
 750         (((x) < sizeof(npfunc)/sizeof(npfunc[0]) && npfunc[(x)]) \
 751                 ? npfunc[(x)] : NULL)
 752
 753 static int
 754 iszero(const u_char *p, size_t l)
 755 {
 756         while (l--) {
 757                 if (*p++)
 758                         return 0;
 759         }
 760         return 1;
 761 }
 762
 763 /* find cookie from initiator cache */
 764 static int
 765 cookie_find(cookie_t *in)
 766 {
 767         int i;
 768
 769         for (i = 0; i < MAXINITIATORS; i++) {
 770                 if (memcmp(in, &cookiecache[i].initiator, sizeof(*in)) == 0)
 771                         return i;
 772         }
 773
 774         return -1;
 775 }
 776
 777 /* record initiator */
 778 static void
 779 cookie_record(cookie_t *in, const u_char *bp2)
 780 {
 781         int i;
 782         const struct ip *ip;
 783         const struct ip6_hdr *ip6;
 784
 785         i = cookie_find(in);
 786         if (0 <= i) {
 787                 ninitiator = (i + 1) % MAXINITIATORS;
 788                 return;
 789         }
 790
 791         ip = (const struct ip *)bp2;
 792         switch (IP_V(ip)) {
 793         case 4:
 794                 cookiecache[ninitiator].version = 4;
 795                 UNALIGNED_MEMCPY(&cookiecache[ninitiator].iaddr.in4, &ip->ip_src, sizeof(struct in_addr));
 796                 UNALIGNED_MEMCPY(&cookiecache[ninitiator].raddr.in4, &ip->ip_dst, sizeof(struct in_addr));
 797                 break;
 798         case 6:
 799                 ip6 = (const struct ip6_hdr *)bp2;
 800                 cookiecache[ninitiator].version = 6;
 801                 UNALIGNED_MEMCPY(&cookiecache[ninitiator].iaddr.in6, &ip6->ip6_src, sizeof(struct in6_addr));
 802                 UNALIGNED_MEMCPY(&cookiecache[ninitiator].raddr.in6, &ip6->ip6_dst, sizeof(struct in6_addr));
 803                 break;
 804         default:
 805                 return;
 806         }
 807         UNALIGNED_MEMCPY(&cookiecache[ninitiator].initiator, in, sizeof(*in));
 808         ninitiator = (ninitiator + 1) % MAXINITIATORS;
 809 }
 810
 811 #define cookie_isinitiator(x, y)        cookie_sidecheck((x), (y), 1)
 812 #define cookie_isresponder(x, y)        cookie_sidecheck((x), (y), 0)
 813 static int
 814 cookie_sidecheck(int i, const u_char *bp2, int initiator)
 815 {
 816         const struct ip *ip;
 817         const struct ip6_hdr *ip6;
 818
 819         ip = (const struct ip *)bp2;
 820         switch (IP_V(ip)) {
 821         case 4:
 822                 if (cookiecache[i].version != 4)
 823                         return 0;
 824                 if (initiator) {
 825                         if (UNALIGNED_MEMCMP(&ip->ip_src, &cookiecache[i].iaddr.in4, sizeof(struct in_addr)) == 0)
 826                                 return 1;
 827                 } else {
 828                         if (UNALIGNED_MEMCMP(&ip->ip_src, &cookiecache[i].raddr.in4, sizeof(struct in_addr)) == 0)
 829                                 return 1;
 830                 }
 831                 break;
 832         case 6:
 833                 if (cookiecache[i].version != 6)
 834                         return 0;
 835                 ip6 = (const struct ip6_hdr *)bp2;
 836                 if (initiator) {
 837                         if (UNALIGNED_MEMCMP(&ip6->ip6_src, &cookiecache[i].iaddr.in6, sizeof(struct in6_addr)) == 0)
 838                                 return 1;
 839                 } else {
 840                         if (UNALIGNED_MEMCMP(&ip6->ip6_src, &cookiecache[i].raddr.in6, sizeof(struct in6_addr)) == 0)
 841                                 return 1;
 842                 }
 843                 break;
 844         default:
 845                 break;
 846         }
 847
 848         return 0;
 849 }
 850
 851 static void
 852 hexprint(netdissect_options *ndo, const uint8_t *loc, size_t len)
 853 {
 854         const uint8_t *p;
 855         size_t i;
 856
 857         p = loc;
 858         for (i = 0; i < len; i++)
 859                 ND_PRINT((ndo,"%02x", p[i] & 0xff));
 860 }
 861
 862 static int
 863 rawprint(netdissect_options *ndo, const uint8_t *loc, size_t len)
 864 {
 865         ND_TCHECK2(*loc, len);
 866
 867         hexprint(ndo, loc, len);
 868         return 1;
 869 trunc:
 870         return 0;
 871 }
 872
 873
 874 /*
 875  * returns false if we run out of data buffer
 876  */
 877 static int ike_show_somedata(netdissect_options *ndo,
 878                              const u_char *cp, const u_char *ep)
 879 {
 880         /* there is too much data, just show some of it */
 881         const u_char *end = ep - 20;
 882         int  elen = 20;
 883         int   len = ep - cp;
 884         if(len > 10) {
 885                 len = 10;
 886         }
 887
 888         /* really shouldn't happen because of above */
 889         if(end < cp + len) {
 890                 end = cp+len;
 891                 elen = ep - end;
 892         }
 893
 894         ND_PRINT((ndo," data=("));
 895         if(!rawprint(ndo, (const uint8_t *)(cp), len)) goto trunc;
 896         ND_PRINT((ndo, "..."));
 897         if(elen) {
 898                 if(!rawprint(ndo, (const uint8_t *)(end), elen)) goto trunc;
 899         }
 900         ND_PRINT((ndo,")"));
 901         return 1;
 902
 903 trunc:
 904         return 0;
 905 }
 906
 907 struct attrmap {
 908         const char *type;
 909         u_int nvalue;
 910         const char *value[30];  /*XXX*/
 911 };
 912
 913 static const u_char *
 914 ikev1_attrmap_print(netdissect_options *ndo,
 915                     const u_char *p, const u_char *ep2,
 916                     const struct attrmap *map, size_t nmap)
 917 {
 918         int totlen;
 919         uint32_t t, v;
 920
 921         ND_TCHECK(p[0]);
 922         if (p[0] & 0x80)
 923                 totlen = 4;
 924         else {
 925                 ND_TCHECK_16BITS(&p[2]);
 926                 totlen = 4 + EXTRACT_16BITS(&p[2]);
 927         }
 928         if (ep2 < p + totlen) {
 929                 ND_PRINT((ndo,"[|attr]"));
 930                 return ep2 + 1;
 931         }
 932
 933         ND_TCHECK_16BITS(&p[0]);
 934         ND_PRINT((ndo,"("));
 935         t = EXTRACT_16BITS(&p[0]) & 0x7fff;
 936         if (map && t < nmap && map[t].type)
 937                 ND_PRINT((ndo,"type=%s ", map[t].type));
 938         else
 939                 ND_PRINT((ndo,"type=#%d ", t));
 940         if (p[0] & 0x80) {
 941                 ND_PRINT((ndo,"value="));
 942                 ND_TCHECK_16BITS(&p[2]);
 943                 v = EXTRACT_16BITS(&p[2]);
 944                 if (map && t < nmap && v < map[t].nvalue && map[t].value[v])
 945                         ND_PRINT((ndo,"%s", map[t].value[v]));
 946                 else {
 947                         if (!rawprint(ndo, (const uint8_t *)&p[2], 2)) {
 948                                 ND_PRINT((ndo,")"));
 949                                 goto trunc;
 950                         }
 951                 }
 952         } else {
 953                 ND_PRINT((ndo,"len=%d value=", totlen - 4));
 954                 if (!rawprint(ndo, (const uint8_t *)&p[4], totlen - 4)) {
 955                         ND_PRINT((ndo,")"));
 956                         goto trunc;
 957                 }
 958         }
 959         ND_PRINT((ndo,")"));
 960         return p + totlen;
 961
 962 trunc:
 963         return NULL;
 964 }
 965
 966 static const u_char *
 967 ikev1_attr_print(netdissect_options *ndo, const u_char *p, const u_char *ep2)
 968 {
 969         int totlen;
 970         uint32_t t;
 971
 972         ND_TCHECK(p[0]);
 973         if (p[0] & 0x80)
 974                 totlen = 4;
 975         else {
 976                 ND_TCHECK_16BITS(&p[2]);
 977                 totlen = 4 + EXTRACT_16BITS(&p[2]);
 978         }
 979         if (ep2 < p + totlen) {
 980                 ND_PRINT((ndo,"[|attr]"));
 981                 return ep2 + 1;
 982         }
 983
 984         ND_TCHECK_16BITS(&p[0]);
 985         ND_PRINT((ndo,"("));
 986         t = EXTRACT_16BITS(&p[0]) & 0x7fff;
 987         ND_PRINT((ndo,"type=#%d ", t));
 988         if (p[0] & 0x80) {
 989                 ND_PRINT((ndo,"value="));
 990                 t = p[2];
 991                 if (!rawprint(ndo, (const uint8_t *)&p[2], 2)) {
 992                         ND_PRINT((ndo,")"));
 993                         goto trunc;
 994                 }
 995         } else {
 996                 ND_PRINT((ndo,"len=%d value=", totlen - 4));
 997                 if (!rawprint(ndo, (const uint8_t *)&p[4], totlen - 4)) {
 998                         ND_PRINT((ndo,")"));
 999                         goto trunc;
1000                 }
1001         }
1002         ND_PRINT((ndo,")"));
1003         return p + totlen;
1004
1005 trunc:
1006         return NULL;
1007 }
1008
1009 static const u_char *
1010 ikev1_sa_print(netdissect_options *ndo, u_char tpay _U_,
1011                const struct isakmp_gen *ext,
1012                 u_int item_len _U_,
1013                 const u_char *ep, uint32_t phase, uint32_t doi0 _U_,
1014                 uint32_t proto0, int depth)
1015 {
1016         const struct ikev1_pl_sa *p;
1017         struct ikev1_pl_sa sa;
1018         uint32_t doi, sit, ident;
1019         const u_char *cp, *np;
1020         int t;
1021
1022         ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_SA)));
1023
1024         p = (const struct ikev1_pl_sa *)ext;
1025         ND_TCHECK(*p);
1026         UNALIGNED_MEMCPY(&sa, ext, sizeof(sa));
1027         doi = ntohl(sa.doi);
1028         sit = ntohl(sa.sit);
1029         if (doi != 1) {
1030                 ND_PRINT((ndo," doi=%d", doi));
1031                 ND_PRINT((ndo," situation=%u", (uint32_t)ntohl(sa.sit)));
1032                 return (const u_char *)(p + 1);
1033         }
1034
1035         ND_PRINT((ndo," doi=ipsec"));
1036         ND_PRINT((ndo," situation="));
1037         t = 0;
1038         if (sit & 0x01) {
1039                 ND_PRINT((ndo,"identity"));
1040                 t++;
1041         }
1042         if (sit & 0x02) {
1043                 ND_PRINT((ndo,"%ssecrecy", t ? "+" : ""));
1044                 t++;
1045         }
1046         if (sit & 0x04)
1047                 ND_PRINT((ndo,"%sintegrity", t ? "+" : ""));
1048
1049         np = (const u_char *)ext + sizeof(sa);
1050         if (sit != 0x01) {
1051                 ND_TCHECK2(*(ext + 1), sizeof(ident));
1052                 UNALIGNED_MEMCPY(&ident, ext + 1, sizeof(ident));
1053                 ND_PRINT((ndo," ident=%u", (uint32_t)ntohl(ident)));
1054                 np += sizeof(ident);
1055         }
1056
1057         ext = (const struct isakmp_gen *)np;
1058         ND_TCHECK(*ext);
1059
1060         cp = ikev1_sub_print(ndo, ISAKMP_NPTYPE_P, ext, ep, phase, doi, proto0,
1061                 depth);
1062
1063         return cp;
1064 trunc:
1065         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_SA)));
1066         return NULL;
1067 }
1068
1069 static const u_char *
1070 ikev1_p_print(netdissect_options *ndo, u_char tpay _U_,
1071               const struct isakmp_gen *ext, u_int item_len _U_,
1072                const u_char *ep, uint32_t phase, uint32_t doi0,
1073                uint32_t proto0 _U_, int depth)
1074 {
1075         const struct ikev1_pl_p *p;
1076         struct ikev1_pl_p prop;
1077         const u_char *cp;
1078
1079         ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_P)));
1080
1081         p = (const struct ikev1_pl_p *)ext;
1082         ND_TCHECK(*p);
1083         UNALIGNED_MEMCPY(&prop, ext, sizeof(prop));
1084         ND_PRINT((ndo," #%d protoid=%s transform=%d",
1085                   prop.p_no, PROTOIDSTR(prop.prot_id), prop.num_t));
1086         if (prop.spi_size) {
1087                 ND_PRINT((ndo," spi="));
1088                 if (!rawprint(ndo, (const uint8_t *)(p + 1), prop.spi_size))
1089                         goto trunc;
1090         }
1091
1092         ext = (const struct isakmp_gen *)((const u_char *)(p + 1) + prop.spi_size);
1093         ND_TCHECK(*ext);
1094
1095         cp = ikev1_sub_print(ndo, ISAKMP_NPTYPE_T, ext, ep, phase, doi0,
1096                              prop.prot_id, depth);
1097
1098         return cp;
1099 trunc:
1100         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_P)));
1101         return NULL;
1102 }
1103
1104 static const char *ikev1_p_map[] = {
1105         NULL, "ike",
1106 };
1107
1108 static const char *ikev2_t_type_map[]={
1109         NULL, "encr", "prf", "integ", "dh", "esn"
1110 };
1111
1112 static const char *ah_p_map[] = {
1113         NULL, "(reserved)", "md5", "sha", "1des",
1114         "sha2-256", "sha2-384", "sha2-512",
1115 };
1116
1117 static const char *prf_p_map[] = {
1118         NULL, "hmac-md5", "hmac-sha", "hmac-tiger",
1119         "aes128_xcbc"
1120 };
1121
1122 static const char *integ_p_map[] = {
1123         NULL, "hmac-md5", "hmac-sha", "dec-mac",
1124         "kpdk-md5", "aes-xcbc"
1125 };
1126
1127 static const char *esn_p_map[] = {
1128         "no-esn", "esn"
1129 };
1130
1131 static const char *dh_p_map[] = {
1132         NULL, "modp768",
1133         "modp1024",    /* group 2 */
1134         "EC2N 2^155",  /* group 3 */
1135         "EC2N 2^185",  /* group 4 */
1136         "modp1536",    /* group 5 */
1137         "iana-grp06", "iana-grp07", /* reserved */
1138         "iana-grp08", "iana-grp09",
1139         "iana-grp10", "iana-grp11",
1140         "iana-grp12", "iana-grp13",
1141         "modp2048",    /* group 14 */
1142         "modp3072",    /* group 15 */
1143         "modp4096",    /* group 16 */
1144         "modp6144",    /* group 17 */
1145         "modp8192",    /* group 18 */
1146 };
1147
1148 static const char *esp_p_map[] = {
1149         NULL, "1des-iv64", "1des", "3des", "rc5", "idea", "cast",
1150         "blowfish", "3idea", "1des-iv32", "rc4", "null", "aes"
1151 };
1152
1153 static const char *ipcomp_p_map[] = {
1154         NULL, "oui", "deflate", "lzs",
1155 };
1156
1157 static const struct attrmap ipsec_t_map[] = {
1158         { NULL, 0, { NULL } },
1159         { "lifetype", 3, { NULL, "sec", "kb", }, },
1160         { "life", 0, { NULL } },
1161         { "group desc", 18,     { NULL, "modp768",
1162                                   "modp1024",    /* group 2 */
1163                                   "EC2N 2^155",  /* group 3 */
1164                                   "EC2N 2^185",  /* group 4 */
1165                                   "modp1536",    /* group 5 */
1166                                   "iana-grp06", "iana-grp07", /* reserved */
1167                                   "iana-grp08", "iana-grp09",
1168                                   "iana-grp10", "iana-grp11",
1169                                   "iana-grp12", "iana-grp13",
1170                                   "modp2048",    /* group 14 */
1171                                   "modp3072",    /* group 15 */
1172                                   "modp4096",    /* group 16 */
1173                                   "modp6144",    /* group 17 */
1174                                   "modp8192",    /* group 18 */
1175                 }, },
1176         { "enc mode", 3, { NULL, "tunnel", "transport", }, },
1177         { "auth", 5, { NULL, "hmac-md5", "hmac-sha1", "1des-mac", "keyed", }, },
1178         { "keylen", 0, { NULL } },
1179         { "rounds", 0, { NULL } },
1180         { "dictsize", 0, { NULL } },
1181         { "privalg", 0, { NULL } },
1182 };
1183
1184 static const struct attrmap encr_t_map[] = {
1185         { NULL, 0, { NULL } },  { NULL, 0, { NULL } },  /* 0, 1 */
1186         { NULL, 0, { NULL } },  { NULL, 0, { NULL } },  /* 2, 3 */
1187         { NULL, 0, { NULL } },  { NULL, 0, { NULL } },  /* 4, 5 */
1188         { NULL, 0, { NULL } },  { NULL, 0, { NULL } },  /* 6, 7 */
1189         { NULL, 0, { NULL } },  { NULL, 0, { NULL } },  /* 8, 9 */
1190         { NULL, 0, { NULL } },  { NULL, 0, { NULL } },  /* 10,11*/
1191         { NULL, 0, { NULL } },  { NULL, 0, { NULL } },  /* 12,13*/
1192         { "keylen", 14, { NULL }},
1193 };
1194
1195 static const struct attrmap oakley_t_map[] = {
1196         { NULL, 0, { NULL } },
1197         { "enc", 8,     { NULL, "1des", "idea", "blowfish", "rc5",
1198                           "3des", "cast", "aes", }, },
1199         { "hash", 7,    { NULL, "md5", "sha1", "tiger",
1200                           "sha2-256", "sha2-384", "sha2-512", }, },
1201         { "auth", 6,    { NULL, "preshared", "dss", "rsa sig", "rsa enc",
1202                           "rsa enc revised", }, },
1203         { "group desc", 18,     { NULL, "modp768",
1204                                   "modp1024",    /* group 2 */
1205                                   "EC2N 2^155",  /* group 3 */
1206                                   "EC2N 2^185",  /* group 4 */
1207                                   "modp1536",    /* group 5 */
1208                                   "iana-grp06", "iana-grp07", /* reserved */
1209                                   "iana-grp08", "iana-grp09",
1210                                   "iana-grp10", "iana-grp11",
1211                                   "iana-grp12", "iana-grp13",
1212                                   "modp2048",    /* group 14 */
1213                                   "modp3072",    /* group 15 */
1214                                   "modp4096",    /* group 16 */
1215                                   "modp6144",    /* group 17 */
1216                                   "modp8192",    /* group 18 */
1217                 }, },
1218         { "group type", 4,      { NULL, "MODP", "ECP", "EC2N", }, },
1219         { "group prime", 0, { NULL } },
1220         { "group gen1", 0, { NULL } },
1221         { "group gen2", 0, { NULL } },
1222         { "group curve A", 0, { NULL } },
1223         { "group curve B", 0, { NULL } },
1224         { "lifetype", 3,        { NULL, "sec", "kb", }, },
1225         { "lifeduration", 0, { NULL } },
1226         { "prf", 0, { NULL } },
1227         { "keylen", 0, { NULL } },
1228         { "field", 0, { NULL } },
1229         { "order", 0, { NULL } },
1230 };
1231
1232 static const u_char *
1233 ikev1_t_print(netdissect_options *ndo, u_char tpay _U_,
1234               const struct isakmp_gen *ext, u_int item_len,
1235               const u_char *ep, uint32_t phase _U_, uint32_t doi _U_,
1236               uint32_t proto, int depth _U_)
1237 {
1238         const struct ikev1_pl_t *p;
1239         struct ikev1_pl_t t;
1240         const u_char *cp;
1241         const char *idstr;
1242         const struct attrmap *map;
1243         size_t nmap;
1244         const u_char *ep2;
1245
1246         ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_T)));
1247
1248         p = (const struct ikev1_pl_t *)ext;
1249         ND_TCHECK(*p);
1250         UNALIGNED_MEMCPY(&t, ext, sizeof(t));
1251
1252         switch (proto) {
1253         case 1:
1254                 idstr = STR_OR_ID(t.t_id, ikev1_p_map);
1255                 map = oakley_t_map;
1256                 nmap = sizeof(oakley_t_map)/sizeof(oakley_t_map[0]);
1257                 break;
1258         case 2:
1259                 idstr = STR_OR_ID(t.t_id, ah_p_map);
1260                 map = ipsec_t_map;
1261                 nmap = sizeof(ipsec_t_map)/sizeof(ipsec_t_map[0]);
1262                 break;
1263         case 3:
1264                 idstr = STR_OR_ID(t.t_id, esp_p_map);
1265                 map = ipsec_t_map;
1266                 nmap = sizeof(ipsec_t_map)/sizeof(ipsec_t_map[0]);
1267                 break;
1268         case 4:
1269                 idstr = STR_OR_ID(t.t_id, ipcomp_p_map);
1270                 map = ipsec_t_map;
1271                 nmap = sizeof(ipsec_t_map)/sizeof(ipsec_t_map[0]);
1272                 break;
1273         default:
1274                 idstr = NULL;
1275                 map = NULL;
1276                 nmap = 0;
1277                 break;
1278         }
1279
1280         if (idstr)
1281                 ND_PRINT((ndo," #%d id=%s ", t.t_no, idstr));
1282         else
1283                 ND_PRINT((ndo," #%d id=%d ", t.t_no, t.t_id));
1284         cp = (const u_char *)(p + 1);
1285         ep2 = (const u_char *)p + item_len;
1286         while (cp < ep && cp < ep2) {
1287                 if (map && nmap)
1288                         cp = ikev1_attrmap_print(ndo, cp, ep2, map, nmap);
1289                 else
1290                         cp = ikev1_attr_print(ndo, cp, ep2);
1291                 if (cp == NULL)
1292                         goto trunc;
1293         }
1294         if (ep < ep2)
1295                 ND_PRINT((ndo,"..."));
1296         return cp;
1297 trunc:
1298         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_T)));
1299         return NULL;
1300 }
1301
1302 static const u_char *
1303 ikev1_ke_print(netdissect_options *ndo, u_char tpay _U_,
1304                const struct isakmp_gen *ext, u_int item_len _U_,
1305                const u_char *ep _U_, uint32_t phase _U_, uint32_t doi _U_,
1306                uint32_t proto _U_, int depth _U_)
1307 {
1308         struct isakmp_gen e;
1309
1310         ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_KE)));
1311
1312         ND_TCHECK(*ext);
1313         UNALIGNED_MEMCPY(&e, ext, sizeof(e));
1314         ND_PRINT((ndo," key len=%d", ntohs(e.len) - 4));
1315         if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1316                 /* Print the entire payload in hex */
1317                 ND_PRINT((ndo," "));
1318                 if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4))
1319                         goto trunc;
1320         }
1321         return (const u_char *)ext + ntohs(e.len);
1322 trunc:
1323         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_KE)));
1324         return NULL;
1325 }
1326
1327 static const u_char *
1328 ikev1_id_print(netdissect_options *ndo, u_char tpay _U_,
1329                const struct isakmp_gen *ext, u_int item_len,
1330                const u_char *ep _U_, uint32_t phase, uint32_t doi _U_,
1331                uint32_t proto _U_, int depth _U_)
1332 {
1333 #define USE_IPSECDOI_IN_PHASE1  1
1334         const struct ikev1_pl_id *p;
1335         struct ikev1_pl_id id;
1336         static const char *idtypestr[] = {
1337                 "IPv4", "IPv4net", "IPv6", "IPv6net",
1338         };
1339         static const char *ipsecidtypestr[] = {
1340                 NULL, "IPv4", "FQDN", "user FQDN", "IPv4net", "IPv6",
1341                 "IPv6net", "IPv4range", "IPv6range", "ASN1 DN", "ASN1 GN",
1342                 "keyid",
1343         };
1344         int len;
1345         const u_char *data;
1346
1347         ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_ID)));
1348
1349         p = (const struct ikev1_pl_id *)ext;
1350         ND_TCHECK(*p);
1351         UNALIGNED_MEMCPY(&id, ext, sizeof(id));
1352         if (sizeof(*p) < item_len) {
1353                 data = (const u_char *)(p + 1);
1354                 len = item_len - sizeof(*p);
1355         } else {
1356                 data = NULL;
1357                 len = 0;
1358         }
1359
1360 #if 0 /*debug*/
1361         ND_PRINT((ndo," [phase=%d doi=%d proto=%d]", phase, doi, proto));
1362 #endif
1363         switch (phase) {
1364 #ifndef USE_IPSECDOI_IN_PHASE1
1365         case 1:
1366 #endif
1367         default:
1368                 ND_PRINT((ndo," idtype=%s", STR_OR_ID(id.d.id_type, idtypestr)));
1369                 ND_PRINT((ndo," doi_data=%u",
1370                           (uint32_t)(ntohl(id.d.doi_data) & 0xffffff)));
1371                 break;
1372
1373 #ifdef USE_IPSECDOI_IN_PHASE1
1374         case 1:
1375 #endif
1376         case 2:
1377             {
1378                 const struct ipsecdoi_id *doi_p;
1379                 struct ipsecdoi_id doi_id;
1380                 const char *p_name;
1381
1382                 doi_p = (const struct ipsecdoi_id *)ext;
1383                 ND_TCHECK(*doi_p);
1384                 UNALIGNED_MEMCPY(&doi_id, ext, sizeof(doi_id));
1385                 ND_PRINT((ndo," idtype=%s", STR_OR_ID(doi_id.type, ipsecidtypestr)));
1386                 /* A protocol ID of 0 DOES NOT mean IPPROTO_IP! */
1387                 if (!ndo->ndo_nflag && doi_id.proto_id && (p_name = netdb_protoname(doi_id.proto_id)) != NULL)
1388                         ND_PRINT((ndo," protoid=%s", p_name));
1389                 else
1390                         ND_PRINT((ndo," protoid=%u", doi_id.proto_id));
1391                 ND_PRINT((ndo," port=%d", ntohs(doi_id.port)));
1392                 if (!len)
1393                         break;
1394                 if (data == NULL)
1395                         goto trunc;
1396                 ND_TCHECK2(*data, len);
1397                 switch (doi_id.type) {
1398                 case IPSECDOI_ID_IPV4_ADDR:
1399                         if (len < 4)
1400                                 ND_PRINT((ndo," len=%d [bad: < 4]", len));
1401                         else
1402                                 ND_PRINT((ndo," len=%d %s", len, ipaddr_string(ndo, data)));
1403                         len = 0;
1404                         break;
1405                 case IPSECDOI_ID_FQDN:
1406                 case IPSECDOI_ID_USER_FQDN:
1407                     {
1408                         int i;
1409                         ND_PRINT((ndo," len=%d ", len));
1410                         for (i = 0; i < len; i++)
1411                                 safeputchar(ndo, data[i]);
1412                         len = 0;
1413                         break;
1414                     }
1415                 case IPSECDOI_ID_IPV4_ADDR_SUBNET:
1416                     {
1417                         const u_char *mask;
1418                         if (len < 8)
1419                                 ND_PRINT((ndo," len=%d [bad: < 8]", len));
1420                         else {
1421                                 mask = data + sizeof(struct in_addr);
1422                                 ND_PRINT((ndo," len=%d %s/%u.%u.%u.%u", len,
1423                                           ipaddr_string(ndo, data),
1424                                           mask[0], mask[1], mask[2], mask[3]));
1425                         }
1426                         len = 0;
1427                         break;
1428                     }
1429                 case IPSECDOI_ID_IPV6_ADDR:
1430                         if (len < 16)
1431                                 ND_PRINT((ndo," len=%d [bad: < 16]", len));
1432                         else
1433                                 ND_PRINT((ndo," len=%d %s", len, ip6addr_string(ndo, data)));
1434                         len = 0;
1435                         break;
1436                 case IPSECDOI_ID_IPV6_ADDR_SUBNET:
1437                     {
1438                         const u_char *mask;
1439                         if (len < 32)
1440                                 ND_PRINT((ndo," len=%d [bad: < 32]", len));
1441                         else {
1442                                 mask = (const u_char *)(data + sizeof(struct in6_addr));
1443                                 /*XXX*/
1444                                 ND_PRINT((ndo," len=%d %s/0x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x", len,
1445                                           ip6addr_string(ndo, data),
1446                                           mask[0], mask[1], mask[2], mask[3],
1447                                           mask[4], mask[5], mask[6], mask[7],
1448                                           mask[8], mask[9], mask[10], mask[11],
1449                                           mask[12], mask[13], mask[14], mask[15]));
1450                         }
1451                         len = 0;
1452                         break;
1453                     }
1454                 case IPSECDOI_ID_IPV4_ADDR_RANGE:
1455                         if (len < 8)
1456                                 ND_PRINT((ndo," len=%d [bad: < 8]", len));
1457                         else {
1458                                 ND_PRINT((ndo," len=%d %s-%s", len,
1459                                           ipaddr_string(ndo, data),
1460                                           ipaddr_string(ndo, data + sizeof(struct in_addr))));
1461                         }
1462                         len = 0;
1463                         break;
1464                 case IPSECDOI_ID_IPV6_ADDR_RANGE:
1465                         if (len < 32)
1466                                 ND_PRINT((ndo," len=%d [bad: < 32]", len));
1467                         else {
1468                                 ND_PRINT((ndo," len=%d %s-%s", len,
1469                                           ip6addr_string(ndo, data),
1470                                           ip6addr_string(ndo, data + sizeof(struct in6_addr))));
1471                         }
1472                         len = 0;
1473                         break;
1474                 case IPSECDOI_ID_DER_ASN1_DN:
1475                 case IPSECDOI_ID_DER_ASN1_GN:
1476                 case IPSECDOI_ID_KEY_ID:
1477                         break;
1478                 }
1479                 break;
1480             }
1481         }
1482         if (data && len) {
1483                 ND_PRINT((ndo," len=%d", len));
1484                 if (2 < ndo->ndo_vflag) {
1485                         ND_PRINT((ndo," "));
1486                         if (!rawprint(ndo, (const uint8_t *)data, len))
1487                                 goto trunc;
1488                 }
1489         }
1490         return (const u_char *)ext + item_len;
1491 trunc:
1492         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_ID)));
1493         return NULL;
1494 }
1495
1496 static const u_char *
1497 ikev1_cert_print(netdissect_options *ndo, u_char tpay _U_,
1498                  const struct isakmp_gen *ext, u_int item_len,
1499                  const u_char *ep _U_, uint32_t phase _U_,
1500                  uint32_t doi0 _U_,
1501                  uint32_t proto0 _U_, int depth _U_)
1502 {
1503         const struct ikev1_pl_cert *p;
1504         struct ikev1_pl_cert cert;
1505         static const char *certstr[] = {
1506                 "none", "pkcs7", "pgp", "dns",
1507                 "x509sign", "x509ke", "kerberos", "crl",
1508                 "arl", "spki", "x509attr",
1509         };
1510
1511         ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_CERT)));
1512
1513         p = (const struct ikev1_pl_cert *)ext;
1514         ND_TCHECK(*p);
1515         UNALIGNED_MEMCPY(&cert, ext, sizeof(cert));
1516         ND_PRINT((ndo," len=%d", item_len - 4));
1517         ND_PRINT((ndo," type=%s", STR_OR_ID((cert.encode), certstr)));
1518         if (2 < ndo->ndo_vflag && 4 < item_len) {
1519                 /* Print the entire payload in hex */
1520                 ND_PRINT((ndo," "));
1521                 if (!rawprint(ndo, (const uint8_t *)(ext + 1), item_len - 4))
1522                         goto trunc;
1523         }
1524         return (const u_char *)ext + item_len;
1525 trunc:
1526         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_CERT)));
1527         return NULL;
1528 }
1529
1530 static const u_char *
1531 ikev1_cr_print(netdissect_options *ndo, u_char tpay _U_,
1532                const struct isakmp_gen *ext, u_int item_len,
1533                const u_char *ep _U_, uint32_t phase _U_, uint32_t doi0 _U_,
1534                uint32_t proto0 _U_, int depth _U_)
1535 {
1536         const struct ikev1_pl_cert *p;
1537         struct ikev1_pl_cert cert;
1538         static const char *certstr[] = {
1539                 "none", "pkcs7", "pgp", "dns",
1540                 "x509sign", "x509ke", "kerberos", "crl",
1541                 "arl", "spki", "x509attr",
1542         };
1543
1544         ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_CR)));
1545
1546         p = (const struct ikev1_pl_cert *)ext;
1547         ND_TCHECK(*p);
1548         UNALIGNED_MEMCPY(&cert, ext, sizeof(cert));
1549         ND_PRINT((ndo," len=%d", item_len - 4));
1550         ND_PRINT((ndo," type=%s", STR_OR_ID((cert.encode), certstr)));
1551         if (2 < ndo->ndo_vflag && 4 < item_len) {
1552                 /* Print the entire payload in hex */
1553                 ND_PRINT((ndo," "));
1554                 if (!rawprint(ndo, (const uint8_t *)(ext + 1), item_len - 4))
1555                         goto trunc;
1556         }
1557         return (const u_char *)ext + item_len;
1558 trunc:
1559         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_CR)));
1560         return NULL;
1561 }
1562
1563 static const u_char *
1564 ikev1_hash_print(netdissect_options *ndo, u_char tpay _U_,
1565                  const struct isakmp_gen *ext, u_int item_len _U_,
1566                  const u_char *ep _U_, uint32_t phase _U_, uint32_t doi _U_,
1567                  uint32_t proto _U_, int depth _U_)
1568 {
1569         struct isakmp_gen e;
1570
1571         ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_HASH)));
1572
1573         ND_TCHECK(*ext);
1574         UNALIGNED_MEMCPY(&e, ext, sizeof(e));
1575         ND_PRINT((ndo," len=%d", ntohs(e.len) - 4));
1576         if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1577                 /* Print the entire payload in hex */
1578                 ND_PRINT((ndo," "));
1579                 if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4))
1580                         goto trunc;
1581         }
1582         return (const u_char *)ext + ntohs(e.len);
1583 trunc:
1584         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_HASH)));
1585         return NULL;
1586 }
1587
1588 static const u_char *
1589 ikev1_sig_print(netdissect_options *ndo, u_char tpay _U_,
1590                 const struct isakmp_gen *ext, u_int item_len _U_,
1591                 const u_char *ep _U_, uint32_t phase _U_, uint32_t doi _U_,
1592                 uint32_t proto _U_, int depth _U_)
1593 {
1594         struct isakmp_gen e;
1595
1596         ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_SIG)));
1597
1598         ND_TCHECK(*ext);
1599         UNALIGNED_MEMCPY(&e, ext, sizeof(e));
1600         ND_PRINT((ndo," len=%d", ntohs(e.len) - 4));
1601         if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1602                 /* Print the entire payload in hex */
1603                 ND_PRINT((ndo," "));
1604                 if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4))
1605                         goto trunc;
1606         }
1607         return (const u_char *)ext + ntohs(e.len);
1608 trunc:
1609         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_SIG)));
1610         return NULL;
1611 }
1612
1613 static const u_char *
1614 ikev1_nonce_print(netdissect_options *ndo, u_char tpay _U_,
1615                   const struct isakmp_gen *ext,
1616                   u_int item_len _U_,
1617                   const u_char *ep,
1618                   uint32_t phase _U_, uint32_t doi _U_,
1619                   uint32_t proto _U_, int depth _U_)
1620 {
1621         struct isakmp_gen e;
1622
1623         ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_NONCE)));
1624
1625         ND_TCHECK(*ext);
1626         UNALIGNED_MEMCPY(&e, ext, sizeof(e));
1627         /*
1628          * Our caller has ensured that the length is >= 4.
1629          */
1630         ND_PRINT((ndo," n len=%u", ntohs(e.len) - 4));
1631         if (ntohs(e.len) > 4) {
1632                 if (ndo->ndo_vflag > 2) {
1633                         ND_PRINT((ndo, " "));
1634                         if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4))
1635                                 goto trunc;
1636                 } else if (ndo->ndo_vflag > 1) {
1637                         ND_PRINT((ndo, " "));
1638                         if (!ike_show_somedata(ndo, (const u_char *)(ext + 1), ep))
1639                                 goto trunc;
1640                 }
1641         }
1642         return (const u_char *)ext + ntohs(e.len);
1643 trunc:
1644         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_NONCE)));
1645         return NULL;
1646 }
1647
1648 static const u_char *
1649 ikev1_n_print(netdissect_options *ndo, u_char tpay _U_,
1650               const struct isakmp_gen *ext, u_int item_len,
1651               const u_char *ep, uint32_t phase _U_, uint32_t doi0 _U_,
1652               uint32_t proto0 _U_, int depth _U_)
1653 {
1654         const struct ikev1_pl_n *p;
1655         struct ikev1_pl_n n;
1656         const u_char *cp;
1657         const u_char *ep2;
1658         uint32_t doi;
1659         uint32_t proto;
1660         static const char *notify_error_str[] = {
1661                 NULL,                           "INVALID-PAYLOAD-TYPE",
1662                 "DOI-NOT-SUPPORTED",            "SITUATION-NOT-SUPPORTED",
1663                 "INVALID-COOKIE",               "INVALID-MAJOR-VERSION",
1664                 "INVALID-MINOR-VERSION",        "INVALID-EXCHANGE-TYPE",
1665                 "INVALID-FLAGS",                "INVALID-MESSAGE-ID",
1666                 "INVALID-PROTOCOL-ID",          "INVALID-SPI",
1667                 "INVALID-TRANSFORM-ID",         "ATTRIBUTES-NOT-SUPPORTED",
1668                 "NO-PROPOSAL-CHOSEN",           "BAD-PROPOSAL-SYNTAX",
1669                 "PAYLOAD-MALFORMED",            "INVALID-KEY-INFORMATION",
1670                 "INVALID-ID-INFORMATION",       "INVALID-CERT-ENCODING",
1671                 "INVALID-CERTIFICATE",          "CERT-TYPE-UNSUPPORTED",
1672                 "INVALID-CERT-AUTHORITY",       "INVALID-HASH-INFORMATION",
1673                 "AUTHENTICATION-FAILED",        "INVALID-SIGNATURE",
1674                 "ADDRESS-NOTIFICATION",         "NOTIFY-SA-LIFETIME",
1675                 "CERTIFICATE-UNAVAILABLE",      "UNSUPPORTED-EXCHANGE-TYPE",
1676                 "UNEQUAL-PAYLOAD-LENGTHS",
1677         };
1678         static const char *ipsec_notify_error_str[] = {
1679                 "RESERVED",
1680         };
1681         static const char *notify_status_str[] = {
1682                 "CONNECTED",
1683         };
1684         static const char *ipsec_notify_status_str[] = {
1685                 "RESPONDER-LIFETIME",           "REPLAY-STATUS",
1686                 "INITIAL-CONTACT",
1687         };
1688 /* NOTE: these macro must be called with x in proper range */
1689
1690 /* 0 - 8191 */
1691 #define NOTIFY_ERROR_STR(x) \
1692         STR_OR_ID((x), notify_error_str)
1693
1694 /* 8192 - 16383 */
1695 #define IPSEC_NOTIFY_ERROR_STR(x) \
1696         STR_OR_ID((u_int)((x) - 8192), ipsec_notify_error_str)
1697
1698 /* 16384 - 24575 */
1699 #define NOTIFY_STATUS_STR(x) \
1700         STR_OR_ID((u_int)((x) - 16384), notify_status_str)
1701
1702 /* 24576 - 32767 */
1703 #define IPSEC_NOTIFY_STATUS_STR(x) \
1704         STR_OR_ID((u_int)((x) - 24576), ipsec_notify_status_str)
1705
1706         ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_N)));
1707
1708         p = (const struct ikev1_pl_n *)ext;
1709         ND_TCHECK(*p);
1710         UNALIGNED_MEMCPY(&n, ext, sizeof(n));
1711         doi = ntohl(n.doi);
1712         proto = n.prot_id;
1713         if (doi != 1) {
1714                 ND_PRINT((ndo," doi=%d", doi));
1715                 ND_PRINT((ndo," proto=%d", proto));
1716                 if (ntohs(n.type) < 8192)
1717                         ND_PRINT((ndo," type=%s", NOTIFY_ERROR_STR(ntohs(n.type))));
1718                 else if (ntohs(n.type) < 16384)
1719                         ND_PRINT((ndo," type=%s", numstr(ntohs(n.type))));
1720                 else if (ntohs(n.type) < 24576)
1721                         ND_PRINT((ndo," type=%s", NOTIFY_STATUS_STR(ntohs(n.type))));
1722                 else
1723                         ND_PRINT((ndo," type=%s", numstr(ntohs(n.type))));
1724                 if (n.spi_size) {
1725                         ND_PRINT((ndo," spi="));
1726                         if (!rawprint(ndo, (const uint8_t *)(p + 1), n.spi_size))
1727                                 goto trunc;
1728                 }
1729                 return (const u_char *)(p + 1) + n.spi_size;
1730         }
1731
1732         ND_PRINT((ndo," doi=ipsec"));
1733         ND_PRINT((ndo," proto=%s", PROTOIDSTR(proto)));
1734         if (ntohs(n.type) < 8192)
1735                 ND_PRINT((ndo," type=%s", NOTIFY_ERROR_STR(ntohs(n.type))));
1736         else if (ntohs(n.type) < 16384)
1737                 ND_PRINT((ndo," type=%s", IPSEC_NOTIFY_ERROR_STR(ntohs(n.type))));
1738         else if (ntohs(n.type) < 24576)
1739                 ND_PRINT((ndo," type=%s", NOTIFY_STATUS_STR(ntohs(n.type))));
1740         else if (ntohs(n.type) < 32768)
1741                 ND_PRINT((ndo," type=%s", IPSEC_NOTIFY_STATUS_STR(ntohs(n.type))));
1742         else
1743                 ND_PRINT((ndo," type=%s", numstr(ntohs(n.type))));
1744         if (n.spi_size) {
1745                 ND_PRINT((ndo," spi="));
1746                 if (!rawprint(ndo, (const uint8_t *)(p + 1), n.spi_size))
1747                         goto trunc;
1748         }
1749
1750         cp = (const u_char *)(p + 1) + n.spi_size;
1751         ep2 = (const u_char *)p + item_len;
1752
1753         if (cp < ep) {
1754                 switch (ntohs(n.type)) {
1755                 case IPSECDOI_NTYPE_RESPONDER_LIFETIME:
1756                     {
1757                         const struct attrmap *map = oakley_t_map;
1758                         size_t nmap = sizeof(oakley_t_map)/sizeof(oakley_t_map[0]);
1759                         ND_PRINT((ndo," attrs=("));
1760                         while (cp < ep && cp < ep2) {
1761                                 cp = ikev1_attrmap_print(ndo, cp, ep2, map, nmap);
1762                                 if (cp == NULL) {
1763                                         ND_PRINT((ndo,")"));
1764                                         goto trunc;
1765                                 }
1766                         }
1767                         ND_PRINT((ndo,")"));
1768                         break;
1769                     }
1770                 case IPSECDOI_NTYPE_REPLAY_STATUS:
1771                         ND_PRINT((ndo," status=("));
1772                         ND_TCHECK_32BITS(cp);
1773                         ND_PRINT((ndo,"replay detection %sabled",
1774                                   EXTRACT_32BITS(cp) ? "en" : "dis"));
1775                         ND_PRINT((ndo,")"));
1776                         break;
1777                 default:
1778                         /*
1779                          * XXX - fill in more types here; see, for example,
1780                          * draft-ietf-ipsec-notifymsg-04.
1781                          */
1782                         if (ndo->ndo_vflag > 3) {
1783                                 ND_PRINT((ndo," data=("));
1784                                 if (!rawprint(ndo, (const uint8_t *)(cp), ep - cp))
1785                                         goto trunc;
1786                                 ND_PRINT((ndo,")"));
1787                         } else {
1788                                 if (!ike_show_somedata(ndo, cp, ep))
1789                                         goto trunc;
1790                         }
1791                         break;
1792                 }
1793         }
1794         return (const u_char *)ext + item_len;
1795 trunc:
1796         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_N)));
1797         return NULL;
1798 }
1799
1800 static const u_char *
1801 ikev1_d_print(netdissect_options *ndo, u_char tpay _U_,
1802               const struct isakmp_gen *ext, u_int item_len _U_,
1803               const u_char *ep _U_, uint32_t phase _U_, uint32_t doi0 _U_,
1804               uint32_t proto0 _U_, int depth _U_)
1805 {
1806         const struct ikev1_pl_d *p;
1807         struct ikev1_pl_d d;
1808         const uint8_t *q;
1809         uint32_t doi;
1810         uint32_t proto;
1811         int i;
1812
1813         ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_D)));
1814
1815         p = (const struct ikev1_pl_d *)ext;
1816         ND_TCHECK(*p);
1817         UNALIGNED_MEMCPY(&d, ext, sizeof(d));
1818         doi = ntohl(d.doi);
1819         proto = d.prot_id;
1820         if (doi != 1) {
1821                 ND_PRINT((ndo," doi=%u", doi));
1822                 ND_PRINT((ndo," proto=%u", proto));
1823         } else {
1824                 ND_PRINT((ndo," doi=ipsec"));
1825                 ND_PRINT((ndo," proto=%s", PROTOIDSTR(proto)));
1826         }
1827         ND_PRINT((ndo," spilen=%u", d.spi_size));
1828         ND_PRINT((ndo," nspi=%u", ntohs(d.num_spi)));
1829         ND_PRINT((ndo," spi="));
1830         q = (const uint8_t *)(p + 1);
1831         for (i = 0; i < ntohs(d.num_spi); i++) {
1832                 if (i != 0)
1833                         ND_PRINT((ndo,","));
1834                 if (!rawprint(ndo, (const uint8_t *)q, d.spi_size))
1835                         goto trunc;
1836                 q += d.spi_size;
1837         }
1838         return q;
1839 trunc:
1840         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_D)));
1841         return NULL;
1842 }
1843
1844 static const u_char *
1845 ikev1_vid_print(netdissect_options *ndo, u_char tpay _U_,
1846                 const struct isakmp_gen *ext,
1847                 u_int item_len _U_, const u_char *ep _U_,
1848                 uint32_t phase _U_, uint32_t doi _U_,
1849                 uint32_t proto _U_, int depth _U_)
1850 {
1851         struct isakmp_gen e;
1852
1853         ND_PRINT((ndo,"%s:", NPSTR(ISAKMP_NPTYPE_VID)));
1854
1855         ND_TCHECK(*ext);
1856         UNALIGNED_MEMCPY(&e, ext, sizeof(e));
1857         ND_PRINT((ndo," len=%d", ntohs(e.len) - 4));
1858         if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1859                 /* Print the entire payload in hex */
1860                 ND_PRINT((ndo," "));
1861                 if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4))
1862                         goto trunc;
1863         }
1864         return (const u_char *)ext + ntohs(e.len);
1865 trunc:
1866         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_VID)));
1867         return NULL;
1868 }
1869
1870 /************************************************************/
1871 /*                                                          */
1872 /*              IKE v2 - rfc4306 - dissector                */
1873 /*                                                          */
1874 /************************************************************/
1875
1876 static void
1877 ikev2_pay_print(netdissect_options *ndo, const char *payname, int critical)
1878 {
1879         ND_PRINT((ndo,"%s%s:", payname, critical&0x80 ? "[C]" : ""));
1880 }
1881
1882 static const u_char *
1883 ikev2_gen_print(netdissect_options *ndo, u_char tpay,
1884                 const struct isakmp_gen *ext)
1885 {
1886         struct isakmp_gen e;
1887
1888         ND_TCHECK(*ext);
1889         UNALIGNED_MEMCPY(&e, ext, sizeof(e));
1890         ikev2_pay_print(ndo, NPSTR(tpay), e.critical);
1891
1892         ND_PRINT((ndo," len=%d", ntohs(e.len) - 4));
1893         if (2 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
1894                 /* Print the entire payload in hex */
1895                 ND_PRINT((ndo," "));
1896                 if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4))
1897                         goto trunc;
1898         }
1899         return (const u_char *)ext + ntohs(e.len);
1900 trunc:
1901         ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
1902         return NULL;
1903 }
1904
1905 static const u_char *
1906 ikev2_t_print(netdissect_options *ndo, int tcount,
1907               const struct isakmp_gen *ext, u_int item_len,
1908               const u_char *ep)
1909 {
1910         const struct ikev2_t *p;
1911         struct ikev2_t t;
1912         uint16_t  t_id;
1913         const u_char *cp;
1914         const char *idstr;
1915         const struct attrmap *map;
1916         size_t nmap;
1917         const u_char *ep2;
1918
1919         p = (const struct ikev2_t *)ext;
1920         ND_TCHECK(*p);
1921         UNALIGNED_MEMCPY(&t, ext, sizeof(t));
1922         ikev2_pay_print(ndo, NPSTR(ISAKMP_NPTYPE_T), t.h.critical);
1923
1924         t_id = ntohs(t.t_id);
1925
1926         map = NULL;
1927         nmap = 0;
1928
1929         switch (t.t_type) {
1930         case IV2_T_ENCR:
1931                 idstr = STR_OR_ID(t_id, esp_p_map);
1932                 map = encr_t_map;
1933                 nmap = sizeof(encr_t_map)/sizeof(encr_t_map[0]);
1934                 break;
1935
1936         case IV2_T_PRF:
1937                 idstr = STR_OR_ID(t_id, prf_p_map);
1938                 break;
1939
1940         case IV2_T_INTEG:
1941                 idstr = STR_OR_ID(t_id, integ_p_map);
1942                 break;
1943
1944         case IV2_T_DH:
1945                 idstr = STR_OR_ID(t_id, dh_p_map);
1946                 break;
1947
1948         case IV2_T_ESN:
1949                 idstr = STR_OR_ID(t_id, esn_p_map);
1950                 break;
1951
1952         default:
1953                 idstr = NULL;
1954                 break;
1955         }
1956
1957         if (idstr)
1958                 ND_PRINT((ndo," #%u type=%s id=%s ", tcount,
1959                           STR_OR_ID(t.t_type, ikev2_t_type_map),
1960                           idstr));
1961         else
1962                 ND_PRINT((ndo," #%u type=%s id=%u ", tcount,
1963                           STR_OR_ID(t.t_type, ikev2_t_type_map),
1964                           t.t_id));
1965         cp = (const u_char *)(p + 1);
1966         ep2 = (const u_char *)p + item_len;
1967         while (cp < ep && cp < ep2) {
1968                 if (map && nmap) {
1969                         cp = ikev1_attrmap_print(ndo, cp, ep2, map, nmap);
1970                 } else
1971                         cp = ikev1_attr_print(ndo, cp, ep2);
1972                 if (cp == NULL)
1973                         goto trunc;
1974         }
1975         if (ep < ep2)
1976                 ND_PRINT((ndo,"..."));
1977         return cp;
1978 trunc:
1979         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_T)));
1980         return NULL;
1981 }
1982
1983 static const u_char *
1984 ikev2_p_print(netdissect_options *ndo, u_char tpay _U_, int pcount _U_,
1985               const struct isakmp_gen *ext, u_int oprop_length,
1986               const u_char *ep, int depth)
1987 {
1988         const struct ikev2_p *p;
1989         struct ikev2_p prop;
1990         u_int prop_length;
1991         const u_char *cp;
1992         int i;
1993         int tcount;
1994         u_char np;
1995         struct isakmp_gen e;
1996         u_int item_len;
1997
1998         p = (const struct ikev2_p *)ext;
1999         ND_TCHECK(*p);
2000         UNALIGNED_MEMCPY(&prop, ext, sizeof(prop));
2001
2002         ikev2_pay_print(ndo, NPSTR(ISAKMP_NPTYPE_P), prop.h.critical);
2003
2004         /*
2005          * ikev2_sa_print() guarantees that this is >= 4.
2006          */
2007         prop_length = oprop_length - 4;
2008         ND_PRINT((ndo," #%u protoid=%s transform=%d len=%u",
2009                   prop.p_no,  PROTOIDSTR(prop.prot_id),
2010                   prop.num_t, oprop_length));
2011         cp = (const u_char *)(p + 1);
2012
2013         if (prop.spi_size) {
2014                 if (prop_length < prop.spi_size)
2015                         goto toolong;
2016                 ND_PRINT((ndo," spi="));
2017                 if (!rawprint(ndo, (const uint8_t *)cp, prop.spi_size))
2018                         goto trunc;
2019                 cp += prop.spi_size;
2020                 prop_length -= prop.spi_size;
2021         }
2022
2023         /*
2024          * Print the transforms.
2025          */
2026         tcount = 0;
2027         for (np = ISAKMP_NPTYPE_T; np != 0; np = e.np) {
2028                 tcount++;
2029                 ext = (const struct isakmp_gen *)cp;
2030                 if (prop_length < sizeof(*ext))
2031                         goto toolong;
2032                 ND_TCHECK(*ext);
2033                 UNALIGNED_MEMCPY(&e, ext, sizeof(e));
2034
2035                 /*
2036                  * Since we can't have a payload length of less than 4 bytes,
2037                  * we need to bail out here if the generic header is nonsensical
2038                  * or truncated, otherwise we could loop forever processing
2039                  * zero-length items or otherwise misdissect the packet.
2040                  */
2041                 item_len = ntohs(e.len);
2042                 if (item_len <= 4)
2043                         goto trunc;
2044
2045                 if (prop_length < item_len)
2046                         goto toolong;
2047                 ND_TCHECK2(*cp, item_len);
2048
2049                 depth++;
2050                 ND_PRINT((ndo,"\n"));
2051                 for (i = 0; i < depth; i++)
2052                         ND_PRINT((ndo,"    "));
2053                 ND_PRINT((ndo,"("));
2054                 if (np == ISAKMP_NPTYPE_T) {
2055                         cp = ikev2_t_print(ndo, tcount, ext, item_len, ep);
2056                         if (cp == NULL) {
2057                                 /* error, already reported */
2058                                 return NULL;
2059                         }
2060                 } else {
2061                         ND_PRINT((ndo, "%s", NPSTR(np)));
2062                         cp += item_len;
2063                 }
2064                 ND_PRINT((ndo,")"));
2065                 depth--;
2066                 prop_length -= item_len;
2067         }
2068         return cp;
2069 toolong:
2070         /*
2071          * Skip the rest of the proposal.
2072          */
2073         cp += prop_length;
2074         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_P)));
2075         return cp;
2076 trunc:
2077         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_P)));
2078         return NULL;
2079 }
2080
2081 static const u_char *
2082 ikev2_sa_print(netdissect_options *ndo, u_char tpay,
2083                 const struct isakmp_gen *ext1,
2084                 u_int osa_length, const u_char *ep,
2085                 uint32_t phase _U_, uint32_t doi _U_,
2086                 uint32_t proto _U_, int depth)
2087 {
2088         const struct isakmp_gen *ext;
2089         struct isakmp_gen e;
2090         u_int sa_length;
2091         const u_char *cp;
2092         int i;
2093         int pcount;
2094         u_char np;
2095         u_int item_len;
2096
2097         ND_TCHECK(*ext1);
2098         UNALIGNED_MEMCPY(&e, ext1, sizeof(e));
2099         ikev2_pay_print(ndo, "sa", e.critical);
2100
2101         /*
2102          * ikev2_sub0_print() guarantees that this is >= 4.
2103          */
2104         osa_length= ntohs(e.len);
2105         sa_length = osa_length - 4;
2106         ND_PRINT((ndo," len=%d", sa_length));
2107
2108         /*
2109          * Print the payloads.
2110          */
2111         cp = (const u_char *)(ext1 + 1);
2112         pcount = 0;
2113         for (np = ISAKMP_NPTYPE_P; np != 0; np = e.np) {
2114                 pcount++;
2115                 ext = (const struct isakmp_gen *)cp;
2116                 if (sa_length < sizeof(*ext))
2117                         goto toolong;
2118                 ND_TCHECK(*ext);
2119                 UNALIGNED_MEMCPY(&e, ext, sizeof(e));
2120
2121                 /*
2122                  * Since we can't have a payload length of less than 4 bytes,
2123                  * we need to bail out here if the generic header is nonsensical
2124                  * or truncated, otherwise we could loop forever processing
2125                  * zero-length items or otherwise misdissect the packet.
2126                  */
2127                 item_len = ntohs(e.len);
2128                 if (item_len <= 4)
2129                         goto trunc;
2130
2131                 if (sa_length < item_len)
2132                         goto toolong;
2133                 ND_TCHECK2(*cp, item_len);
2134
2135                 depth++;
2136                 ND_PRINT((ndo,"\n"));
2137                 for (i = 0; i < depth; i++)
2138                         ND_PRINT((ndo,"    "));
2139                 ND_PRINT((ndo,"("));
2140                 if (np == ISAKMP_NPTYPE_P) {
2141                         cp = ikev2_p_print(ndo, np, pcount, ext, item_len,
2142                                            ep, depth);
2143                         if (cp == NULL) {
2144                                 /* error, already reported */
2145                                 return NULL;
2146                         }
2147                 } else {
2148                         ND_PRINT((ndo, "%s", NPSTR(np)));
2149                         cp += item_len;
2150                 }
2151                 ND_PRINT((ndo,")"));
2152                 depth--;
2153                 sa_length -= item_len;
2154         }
2155         return cp;
2156 toolong:
2157         /*
2158          * Skip the rest of the SA.
2159          */
2160         cp += sa_length;
2161         ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
2162         return cp;
2163 trunc:
2164         ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
2165         return NULL;
2166 }
2167
2168 static const u_char *
2169 ikev2_ke_print(netdissect_options *ndo, u_char tpay,
2170                 const struct isakmp_gen *ext,
2171                 u_int item_len _U_, const u_char *ep _U_,
2172                 uint32_t phase _U_, uint32_t doi _U_,
2173                 uint32_t proto _U_, int depth _U_)
2174 {
2175         struct ikev2_ke ke;
2176         const struct ikev2_ke *k;
2177
2178         k = (const struct ikev2_ke *)ext;
2179         ND_TCHECK(*k);
2180         UNALIGNED_MEMCPY(&ke, ext, sizeof(ke));
2181         ikev2_pay_print(ndo, NPSTR(tpay), ke.h.critical);
2182
2183         ND_PRINT((ndo," len=%u group=%s", ntohs(ke.h.len) - 8,
2184                   STR_OR_ID(ntohs(ke.ke_group), dh_p_map)));
2185
2186         if (2 < ndo->ndo_vflag && 8 < ntohs(ke.h.len)) {
2187                 ND_PRINT((ndo," "));
2188                 if (!rawprint(ndo, (const uint8_t *)(k + 1), ntohs(ke.h.len) - 8))
2189                         goto trunc;
2190         }
2191         return (const u_char *)ext + ntohs(ke.h.len);
2192 trunc:
2193         ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
2194         return NULL;
2195 }
2196
2197 static const u_char *
2198 ikev2_ID_print(netdissect_options *ndo, u_char tpay,
2199                 const struct isakmp_gen *ext,
2200                 u_int item_len _U_, const u_char *ep _U_,
2201                 uint32_t phase _U_, uint32_t doi _U_,
2202                 uint32_t proto _U_, int depth _U_)
2203 {
2204         const struct ikev2_id *idp;
2205         struct ikev2_id id;
2206         int id_len, idtype_len, i;
2207         unsigned int dumpascii, dumphex;
2208         const unsigned char *typedata;
2209
2210         idp = (const struct ikev2_id *)ext;
2211         ND_TCHECK(*idp);
2212         UNALIGNED_MEMCPY(&id, ext, sizeof(id));
2213         ikev2_pay_print(ndo, NPSTR(tpay), id.h.critical);
2214
2215         id_len = ntohs(id.h.len);
2216
2217         ND_PRINT((ndo," len=%d", id_len - 4));
2218         if (2 < ndo->ndo_vflag && 4 < id_len) {
2219                 /* Print the entire payload in hex */
2220                 ND_PRINT((ndo," "));
2221                 if (!rawprint(ndo, (const uint8_t *)(ext + 1), id_len - 4))
2222                         goto trunc;
2223         }
2224
2225         idtype_len =id_len - sizeof(struct ikev2_id);
2226         dumpascii = 0;
2227         dumphex   = 0;
2228         typedata  = (const unsigned char *)(ext)+sizeof(struct ikev2_id);
2229
2230         switch(id.type) {
2231         case ID_IPV4_ADDR:
2232                 ND_PRINT((ndo, " ipv4:"));
2233                 dumphex=1;
2234                 break;
2235         case ID_FQDN:
2236                 ND_PRINT((ndo, " fqdn:"));
2237                 dumpascii=1;
2238                 break;
2239         case ID_RFC822_ADDR:
2240                 ND_PRINT((ndo, " rfc822:"));
2241                 dumpascii=1;
2242                 break;
2243         case ID_IPV6_ADDR:
2244                 ND_PRINT((ndo, " ipv6:"));
2245                 dumphex=1;
2246                 break;
2247         case ID_DER_ASN1_DN:
2248                 ND_PRINT((ndo, " dn:"));
2249                 dumphex=1;
2250                 break;
2251         case ID_DER_ASN1_GN:
2252                 ND_PRINT((ndo, " gn:"));
2253                 dumphex=1;
2254                 break;
2255         case ID_KEY_ID:
2256                 ND_PRINT((ndo, " keyid:"));
2257                 dumphex=1;
2258                 break;
2259         }
2260
2261         if(dumpascii) {
2262                 ND_TCHECK2(*typedata, idtype_len);
2263                 for(i=0; i<idtype_len; i++) {
2264                         if(ND_ISPRINT(typedata[i])) {
2265                                 ND_PRINT((ndo, "%c", typedata[i]));
2266                         } else {
2267                                 ND_PRINT((ndo, "."));
2268                         }
2269                 }
2270         }
2271         if(dumphex) {
2272                 if (!rawprint(ndo, (const uint8_t *)typedata, idtype_len))
2273                         goto trunc;
2274         }
2275
2276         return (const u_char *)ext + id_len;
2277 trunc:
2278         ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
2279         return NULL;
2280 }
2281
2282 static const u_char *
2283 ikev2_cert_print(netdissect_options *ndo, u_char tpay,
2284                 const struct isakmp_gen *ext,
2285                 u_int item_len _U_, const u_char *ep _U_,
2286                 uint32_t phase _U_, uint32_t doi _U_,
2287                 uint32_t proto _U_, int depth _U_)
2288 {
2289         return ikev2_gen_print(ndo, tpay, ext);
2290 }
2291
2292 static const u_char *
2293 ikev2_cr_print(netdissect_options *ndo, u_char tpay,
2294                 const struct isakmp_gen *ext,
2295                 u_int item_len _U_, const u_char *ep _U_,
2296                 uint32_t phase _U_, uint32_t doi _U_,
2297                 uint32_t proto _U_, int depth _U_)
2298 {
2299         return ikev2_gen_print(ndo, tpay, ext);
2300 }
2301
2302 static const u_char *
2303 ikev2_auth_print(netdissect_options *ndo, u_char tpay,
2304                 const struct isakmp_gen *ext,
2305                 u_int item_len _U_, const u_char *ep,
2306                 uint32_t phase _U_, uint32_t doi _U_,
2307                 uint32_t proto _U_, int depth _U_)
2308 {
2309         struct ikev2_auth a;
2310         const char *v2_auth[]={ "invalid", "rsasig",
2311                                 "shared-secret", "dsssig" };
2312         const u_char *authdata = (const u_char*)ext + sizeof(a);
2313         unsigned int len;
2314
2315         ND_TCHECK2(*ext, sizeof(a));
2316         UNALIGNED_MEMCPY(&a, ext, sizeof(a));
2317         ikev2_pay_print(ndo, NPSTR(tpay), a.h.critical);
2318         len = ntohs(a.h.len);
2319
2320         /*
2321          * Our caller has ensured that the length is >= 4.
2322          */
2323         ND_PRINT((ndo," len=%u method=%s", len-4,
2324                   STR_OR_ID(a.auth_method, v2_auth)));
2325         if (len > 4) {
2326                 if (ndo->ndo_vflag > 1) {
2327                         ND_PRINT((ndo, " authdata=("));
2328                         if (!rawprint(ndo, (const uint8_t *)authdata, len - sizeof(a)))
2329                                 goto trunc;
2330                         ND_PRINT((ndo, ") "));
2331                 } else if (ndo->ndo_vflag) {
2332                         if (!ike_show_somedata(ndo, authdata, ep))
2333                                 goto trunc;
2334                 }
2335         }
2336
2337         return (const u_char *)ext + len;
2338 trunc:
2339         ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
2340         return NULL;
2341 }
2342
2343 static const u_char *
2344 ikev2_nonce_print(netdissect_options *ndo, u_char tpay,
2345                 const struct isakmp_gen *ext,
2346                 u_int item_len _U_, const u_char *ep,
2347                 uint32_t phase _U_, uint32_t doi _U_,
2348                 uint32_t proto _U_, int depth _U_)
2349 {
2350         struct isakmp_gen e;
2351
2352         ND_TCHECK(*ext);
2353         UNALIGNED_MEMCPY(&e, ext, sizeof(e));
2354         ikev2_pay_print(ndo, "nonce", e.critical);
2355
2356         ND_PRINT((ndo," len=%d", ntohs(e.len) - 4));
2357         if (1 < ndo->ndo_vflag && 4 < ntohs(e.len)) {
2358                 ND_PRINT((ndo," nonce=("));
2359                 if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4))
2360                         goto trunc;
2361                 ND_PRINT((ndo,") "));
2362         } else if(ndo->ndo_vflag && 4 < ntohs(e.len)) {
2363                 if(!ike_show_somedata(ndo, (const u_char *)(ext+1), ep)) goto trunc;
2364         }
2365
2366         return (const u_char *)ext + ntohs(e.len);
2367 trunc:
2368         ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
2369         return NULL;
2370 }
2371
2372 /* notify payloads */
2373 static const u_char *
2374 ikev2_n_print(netdissect_options *ndo, u_char tpay _U_,
2375                 const struct isakmp_gen *ext,
2376                 u_int item_len, const u_char *ep,
2377                 uint32_t phase _U_, uint32_t doi _U_,
2378                 uint32_t proto _U_, int depth _U_)
2379 {
2380         const struct ikev2_n *p;
2381         struct ikev2_n n;
2382         const u_char *cp;
2383         u_char showspi, showsomedata;
2384         const char *notify_name;
2385         uint32_t type;
2386
2387         p = (const struct ikev2_n *)ext;
2388         ND_TCHECK(*p);
2389         UNALIGNED_MEMCPY(&n, ext, sizeof(n));
2390         ikev2_pay_print(ndo, NPSTR(ISAKMP_NPTYPE_N), n.h.critical);
2391
2392         showspi = 1;
2393         showsomedata=0;
2394         notify_name=NULL;
2395
2396         ND_PRINT((ndo," prot_id=%s", PROTOIDSTR(n.prot_id)));
2397
2398         type = ntohs(n.type);
2399
2400         /* notify space is annoying sparse */
2401         switch(type) {
2402         case IV2_NOTIFY_UNSUPPORTED_CRITICAL_PAYLOAD:
2403                 notify_name = "unsupported_critical_payload";
2404                 showspi = 0;
2405                 break;
2406
2407         case IV2_NOTIFY_INVALID_IKE_SPI:
2408                 notify_name = "invalid_ike_spi";
2409                 showspi = 1;
2410                 break;
2411
2412         case IV2_NOTIFY_INVALID_MAJOR_VERSION:
2413                 notify_name = "invalid_major_version";
2414                 showspi = 0;
2415                 break;
2416
2417         case IV2_NOTIFY_INVALID_SYNTAX:
2418                 notify_name = "invalid_syntax";
2419                 showspi = 1;
2420                 break;
2421
2422         case IV2_NOTIFY_INVALID_MESSAGE_ID:
2423                 notify_name = "invalid_message_id";
2424                 showspi = 1;
2425                 break;
2426
2427         case IV2_NOTIFY_INVALID_SPI:
2428                 notify_name = "invalid_spi";
2429                 showspi = 1;
2430                 break;
2431
2432         case IV2_NOTIFY_NO_PROPOSAL_CHOSEN:
2433                 notify_name = "no_protocol_chosen";
2434                 showspi = 1;
2435                 break;
2436
2437         case IV2_NOTIFY_INVALID_KE_PAYLOAD:
2438                 notify_name = "invalid_ke_payload";
2439                 showspi = 1;
2440                 break;
2441
2442         case IV2_NOTIFY_AUTHENTICATION_FAILED:
2443                 notify_name = "authentication_failed";
2444                 showspi = 1;
2445                 break;
2446
2447         case IV2_NOTIFY_SINGLE_PAIR_REQUIRED:
2448                 notify_name = "single_pair_required";
2449                 showspi = 1;
2450                 break;
2451
2452         case IV2_NOTIFY_NO_ADDITIONAL_SAS:
2453                 notify_name = "no_additional_sas";
2454                 showspi = 0;
2455                 break;
2456
2457         case IV2_NOTIFY_INTERNAL_ADDRESS_FAILURE:
2458                 notify_name = "internal_address_failure";
2459                 showspi = 0;
2460                 break;
2461
2462         case IV2_NOTIFY_FAILED_CP_REQUIRED:
2463                 notify_name = "failed:cp_required";
2464                 showspi = 0;
2465                 break;
2466
2467         case IV2_NOTIFY_INVALID_SELECTORS:
2468                 notify_name = "invalid_selectors";
2469                 showspi = 0;
2470                 break;
2471
2472         case IV2_NOTIFY_INITIAL_CONTACT:
2473                 notify_name = "initial_contact";
2474                 showspi = 0;
2475                 break;
2476
2477         case IV2_NOTIFY_SET_WINDOW_SIZE:
2478                 notify_name = "set_window_size";
2479                 showspi = 0;
2480                 break;
2481
2482         case IV2_NOTIFY_ADDITIONAL_TS_POSSIBLE:
2483                 notify_name = "additional_ts_possible";
2484                 showspi = 0;
2485                 break;
2486
2487         case IV2_NOTIFY_IPCOMP_SUPPORTED:
2488                 notify_name = "ipcomp_supported";
2489                 showspi = 0;
2490                 break;
2491
2492         case IV2_NOTIFY_NAT_DETECTION_SOURCE_IP:
2493                 notify_name = "nat_detection_source_ip";
2494                 showspi = 1;
2495                 break;
2496
2497         case IV2_NOTIFY_NAT_DETECTION_DESTINATION_IP:
2498                 notify_name = "nat_detection_destination_ip";
2499                 showspi = 1;
2500                 break;
2501
2502         case IV2_NOTIFY_COOKIE:
2503                 notify_name = "cookie";
2504                 showspi = 1;
2505                 showsomedata= 1;
2506                 break;
2507
2508         case IV2_NOTIFY_USE_TRANSPORT_MODE:
2509                 notify_name = "use_transport_mode";
2510                 showspi = 0;
2511                 break;
2512
2513         case IV2_NOTIFY_HTTP_CERT_LOOKUP_SUPPORTED:
2514                 notify_name = "http_cert_lookup_supported";
2515                 showspi = 0;
2516                 break;
2517
2518         case IV2_NOTIFY_REKEY_SA:
2519                 notify_name = "rekey_sa";
2520                 showspi = 1;
2521                 break;
2522
2523         case IV2_NOTIFY_ESP_TFC_PADDING_NOT_SUPPORTED:
2524                 notify_name = "tfc_padding_not_supported";
2525                 showspi = 0;
2526                 break;
2527
2528         case IV2_NOTIFY_NON_FIRST_FRAGMENTS_ALSO:
2529                 notify_name = "non_first_fragment_also";
2530                 showspi = 0;
2531                 break;
2532
2533         default:
2534                 if (type < 8192) {
2535                         notify_name="error";
2536                 } else if(type < 16384) {
2537                         notify_name="private-error";
2538                 } else if(type < 40960) {
2539                         notify_name="status";
2540                 } else {
2541                         notify_name="private-status";
2542                 }
2543         }
2544
2545         if(notify_name) {
2546                 ND_PRINT((ndo," type=%u(%s)", type, notify_name));
2547         }
2548
2549
2550         if (showspi && n.spi_size) {
2551                 ND_PRINT((ndo," spi="));
2552                 if (!rawprint(ndo, (const uint8_t *)(p + 1), n.spi_size))
2553                         goto trunc;
2554         }
2555
2556         cp = (const u_char *)(p + 1) + n.spi_size;
2557
2558         if (cp < ep) {
2559                 if (ndo->ndo_vflag > 3 || (showsomedata && ep-cp < 30)) {
2560                         ND_PRINT((ndo," data=("));
2561                         if (!rawprint(ndo, (const uint8_t *)(cp), ep - cp))
2562                                 goto trunc;
2563
2564                         ND_PRINT((ndo,")"));
2565                 } else if (showsomedata) {
2566                         if (!ike_show_somedata(ndo, cp, ep))
2567                                 goto trunc;
2568                 }
2569         }
2570
2571         return (const u_char *)ext + item_len;
2572 trunc:
2573         ND_PRINT((ndo," [|%s]", NPSTR(ISAKMP_NPTYPE_N)));
2574         return NULL;
2575 }
2576
2577 static const u_char *
2578 ikev2_d_print(netdissect_options *ndo, u_char tpay,
2579                 const struct isakmp_gen *ext,
2580                 u_int item_len _U_, const u_char *ep _U_,
2581                 uint32_t phase _U_, uint32_t doi _U_,
2582                 uint32_t proto _U_, int depth _U_)
2583 {
2584         return ikev2_gen_print(ndo, tpay, ext);
2585 }
2586
2587 static const u_char *
2588 ikev2_vid_print(netdissect_options *ndo, u_char tpay,
2589                 const struct isakmp_gen *ext,
2590                 u_int item_len _U_, const u_char *ep _U_,
2591                 uint32_t phase _U_, uint32_t doi _U_,
2592                 uint32_t proto _U_, int depth _U_)
2593 {
2594         struct isakmp_gen e;
2595         const u_char *vid;
2596         int i, len;
2597
2598         ND_TCHECK(*ext);
2599         UNALIGNED_MEMCPY(&e, ext, sizeof(e));
2600         ikev2_pay_print(ndo, NPSTR(tpay), e.critical);
2601         ND_PRINT((ndo," len=%d vid=", ntohs(e.len) - 4));
2602
2603         vid = (const u_char *)(ext+1);
2604         len = ntohs(e.len) - 4;
2605         ND_TCHECK2(*vid, len);
2606         for(i=0; i<len; i++) {
2607                 if(ND_ISPRINT(vid[i])) ND_PRINT((ndo, "%c", vid[i]));
2608                 else ND_PRINT((ndo, "."));
2609         }
2610         if (2 < ndo->ndo_vflag && 4 < len) {
2611                 /* Print the entire payload in hex */
2612                 ND_PRINT((ndo," "));
2613                 if (!rawprint(ndo, (const uint8_t *)(ext + 1), ntohs(e.len) - 4))
2614                         goto trunc;
2615         }
2616         return (const u_char *)ext + ntohs(e.len);
2617 trunc:
2618         ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
2619         return NULL;
2620 }
2621
2622 static const u_char *
2623 ikev2_TS_print(netdissect_options *ndo, u_char tpay,
2624                 const struct isakmp_gen *ext,
2625                 u_int item_len _U_, const u_char *ep _U_,
2626                 uint32_t phase _U_, uint32_t doi _U_,
2627                 uint32_t proto _U_, int depth _U_)
2628 {
2629         return ikev2_gen_print(ndo, tpay, ext);
2630 }
2631
2632 static const u_char *
2633 ikev2_e_print(netdissect_options *ndo,
2634 #ifndef HAVE_LIBCRYPTO
2635               _U_
2636 #endif
2637               struct isakmp *base,
2638               u_char tpay,
2639               const struct isakmp_gen *ext,
2640               u_int item_len _U_, const u_char *ep _U_,
2641 #ifndef HAVE_LIBCRYPTO
2642               _U_
2643 #endif
2644               uint32_t phase,
2645 #ifndef HAVE_LIBCRYPTO
2646               _U_
2647 #endif
2648               uint32_t doi,
2649 #ifndef HAVE_LIBCRYPTO
2650               _U_
2651 #endif
2652               uint32_t proto,
2653 #ifndef HAVE_LIBCRYPTO
2654               _U_
2655 #endif
2656               int depth)
2657 {
2658         struct isakmp_gen e;
2659         const u_char *dat;
2660         volatile int dlen;
2661
2662         ND_TCHECK(*ext);
2663         UNALIGNED_MEMCPY(&e, ext, sizeof(e));
2664         ikev2_pay_print(ndo, NPSTR(tpay), e.critical);
2665
2666         dlen = ntohs(e.len)-4;
2667
2668         ND_PRINT((ndo," len=%d", dlen));
2669         if (2 < ndo->ndo_vflag && 4 < dlen) {
2670                 ND_PRINT((ndo," "));
2671                 if (!rawprint(ndo, (const uint8_t *)(ext + 1), dlen))
2672                         goto trunc;
2673         }
2674
2675         dat = (const u_char *)(ext+1);
2676         ND_TCHECK2(*dat, dlen);
2677
2678 #ifdef HAVE_LIBCRYPTO
2679         /* try to decypt it! */
2680         if(esp_print_decrypt_buffer_by_ikev2(ndo,
2681                                              base->flags & ISAKMP_FLAG_I,
2682                                              base->i_ck, base->r_ck,
2683                                              dat, dat+dlen)) {
2684
2685                 ext = (const struct isakmp_gen *)ndo->ndo_packetp;
2686
2687                 /* got it decrypted, print stuff inside. */
2688                 ikev2_sub_print(ndo, base, e.np, ext, ndo->ndo_snapend,
2689                                 phase, doi, proto, depth+1);
2690         }
2691 #endif
2692
2693
2694         /* always return NULL, because E must be at end, and NP refers
2695          * to what was inside.
2696          */
2697         return NULL;
2698 trunc:
2699         ND_PRINT((ndo," [|%s]", NPSTR(tpay)));
2700         return NULL;
2701 }
2702
2703 static const u_char *
2704 ikev2_cp_print(netdissect_options *ndo, u_char tpay,
2705                 const struct isakmp_gen *ext,
2706                 u_int item_len _U_, const u_char *ep _U_,
2707                 uint32_t phase _U_, uint32_t doi _U_,
2708                 uint32_t proto _U_, int depth _U_)
2709 {
2710         return ikev2_gen_print(ndo, tpay, ext);
2711 }
2712
2713 static const u_char *
2714 ikev2_eap_print(netdissect_options *ndo, u_char tpay,
2715                 const struct isakmp_gen *ext,
2716                 u_int item_len _U_, const u_char *ep _U_,
2717                 uint32_t phase _U_, uint32_t doi _U_,
2718                 uint32_t proto _U_, int depth _U_)
2719 {
2720         return ikev2_gen_print(ndo, tpay, ext);
2721 }
2722
2723 static const u_char *
2724 ike_sub0_print(netdissect_options *ndo,
2725                  u_char np, const struct isakmp_gen *ext, const u_char *ep,
2726
2727                uint32_t phase, uint32_t doi, uint32_t proto, int depth)
2728 {
2729         const u_char *cp;
2730         struct isakmp_gen e;
2731         u_int item_len;
2732
2733         cp = (const u_char *)ext;
2734         ND_TCHECK(*ext);
2735         UNALIGNED_MEMCPY(&e, ext, sizeof(e));
2736
2737         /*
2738          * Since we can't have a payload length of less than 4 bytes,
2739          * we need to bail out here if the generic header is nonsensical
2740          * or truncated, otherwise we could loop forever processing
2741          * zero-length items or otherwise misdissect the packet.
2742          */
2743         item_len = ntohs(e.len);
2744         if (item_len <= 4)
2745                 return NULL;
2746
2747         if (NPFUNC(np)) {
2748                 /*
2749                  * XXX - what if item_len is too short, or too long,
2750                  * for this payload type?
2751                  */
2752                 cp = (*npfunc[np])(ndo, np, ext, item_len, ep, phase, doi, proto, depth);
2753         } else {
2754                 ND_PRINT((ndo,"%s", NPSTR(np)));
2755                 cp += item_len;
2756         }
2757
2758         return cp;
2759 trunc:
2760         ND_PRINT((ndo," [|isakmp]"));
2761         return NULL;
2762 }
2763
2764 static const u_char *
2765 ikev1_sub_print(netdissect_options *ndo,
2766                 u_char np, const struct isakmp_gen *ext, const u_char *ep,
2767                 uint32_t phase, uint32_t doi, uint32_t proto, int depth)
2768 {
2769         const u_char *cp;
2770         int i;
2771         struct isakmp_gen e;
2772
2773         cp = (const u_char *)ext;
2774
2775         while (np) {
2776                 ND_TCHECK(*ext);
2777                 UNALIGNED_MEMCPY(&e, ext, sizeof(e));
2778
2779                 ND_TCHECK2(*ext, ntohs(e.len));
2780
2781                 depth++;
2782                 ND_PRINT((ndo,"\n"));
2783                 for (i = 0; i < depth; i++)
2784                         ND_PRINT((ndo,"    "));
2785                 ND_PRINT((ndo,"("));
2786                 cp = ike_sub0_print(ndo, np, ext, ep, phase, doi, proto, depth);
2787                 ND_PRINT((ndo,")"));
2788                 depth--;
2789
2790                 if (cp == NULL) {
2791                         /* Zero-length subitem */
2792                         return NULL;
2793                 }
2794
2795                 np = e.np;
2796                 ext = (const struct isakmp_gen *)cp;
2797         }
2798         return cp;
2799 trunc:
2800         ND_PRINT((ndo," [|%s]", NPSTR(np)));
2801         return NULL;
2802 }
2803
2804 static char *
2805 numstr(int x)
2806 {
2807         static char buf[20];
2808         snprintf(buf, sizeof(buf), "#%d", x);
2809         return buf;
2810 }
2811
2812 static void
2813 ikev1_print(netdissect_options *ndo,
2814             const u_char *bp,  u_int length,
2815             const u_char *bp2, struct isakmp *base)
2816 {
2817         const struct isakmp *p;
2818         const u_char *ep;
2819         u_char np;
2820         int i;
2821         int phase;
2822
2823         p = (const struct isakmp *)bp;
2824         ep = ndo->ndo_snapend;
2825
2826         phase = (EXTRACT_32BITS(base->msgid) == 0) ? 1 : 2;
2827         if (phase == 1)
2828                 ND_PRINT((ndo," phase %d", phase));
2829         else
2830                 ND_PRINT((ndo," phase %d/others", phase));
2831
2832         i = cookie_find(&base->i_ck);
2833         if (i < 0) {
2834                 if (iszero((const u_char *)&base->r_ck, sizeof(base->r_ck))) {
2835                         /* the first packet */
2836                         ND_PRINT((ndo," I"));
2837                         if (bp2)
2838                                 cookie_record(&base->i_ck, bp2);
2839                 } else
2840                         ND_PRINT((ndo," ?"));
2841         } else {
2842                 if (bp2 && cookie_isinitiator(i, bp2))
2843                         ND_PRINT((ndo," I"));
2844                 else if (bp2 && cookie_isresponder(i, bp2))
2845                         ND_PRINT((ndo," R"));
2846                 else
2847                         ND_PRINT((ndo," ?"));
2848         }
2849
2850         ND_PRINT((ndo," %s", ETYPESTR(base->etype)));
2851         if (base->flags) {
2852                 ND_PRINT((ndo,"[%s%s]", base->flags & ISAKMP_FLAG_E ? "E" : "",
2853                           base->flags & ISAKMP_FLAG_C ? "C" : ""));
2854         }
2855
2856         if (ndo->ndo_vflag) {
2857                 const struct isakmp_gen *ext;
2858
2859                 ND_PRINT((ndo,":"));
2860
2861                 /* regardless of phase... */
2862                 if (base->flags & ISAKMP_FLAG_E) {
2863                         /*
2864                          * encrypted, nothing we can do right now.
2865                          * we hope to decrypt the packet in the future...
2866                          */
2867                         ND_PRINT((ndo," [encrypted %s]", NPSTR(base->np)));
2868                         goto done;
2869                 }
2870
2871                 CHECKLEN(p + 1, base->np);
2872                 np = base->np;
2873                 ext = (const struct isakmp_gen *)(p + 1);
2874                 ikev1_sub_print(ndo, np, ext, ep, phase, 0, 0, 0);
2875         }
2876
2877 done:
2878         if (ndo->ndo_vflag) {
2879                 if (ntohl(base->len) != length) {
2880                         ND_PRINT((ndo," (len mismatch: isakmp %u/ip %u)",
2881                                   (uint32_t)ntohl(base->len), length));
2882                 }
2883         }
2884 }
2885
2886 static const u_char *
2887 ikev2_sub0_print(netdissect_options *ndo, struct isakmp *base,
2888                  u_char np,
2889                  const struct isakmp_gen *ext, const u_char *ep,
2890                  uint32_t phase, uint32_t doi, uint32_t proto, int depth)
2891 {
2892         const u_char *cp;
2893         struct isakmp_gen e;
2894         u_int item_len;
2895
2896         cp = (const u_char *)ext;
2897         ND_TCHECK(*ext);
2898         UNALIGNED_MEMCPY(&e, ext, sizeof(e));
2899
2900         /*
2901          * Since we can't have a payload length of less than 4 bytes,
2902          * we need to bail out here if the generic header is nonsensical
2903          * or truncated, otherwise we could loop forever processing
2904          * zero-length items or otherwise misdissect the packet.
2905          */
2906         item_len = ntohs(e.len);
2907         if (item_len <= 4)
2908                 return NULL;
2909
2910         if (np == ISAKMP_NPTYPE_v2E) {
2911                 cp = ikev2_e_print(ndo, base, np, ext, item_len,
2912                                    ep, phase, doi, proto, depth);
2913         } else if (NPFUNC(np)) {
2914                 /*
2915                  * XXX - what if item_len is too short, or too long,
2916                  * for this payload type?
2917                  */
2918                 cp = (*npfunc[np])(ndo, np, ext, item_len,
2919                                    ep, phase, doi, proto, depth);
2920         } else {
2921                 ND_PRINT((ndo,"%s", NPSTR(np)));
2922                 cp += item_len;
2923         }
2924
2925         return cp;
2926 trunc:
2927         ND_PRINT((ndo," [|isakmp]"));
2928         return NULL;
2929 }
2930
2931 static const u_char *
2932 ikev2_sub_print(netdissect_options *ndo,
2933                 struct isakmp *base,
2934                 u_char np, const struct isakmp_gen *ext, const u_char *ep,
2935                 uint32_t phase, uint32_t doi, uint32_t proto, int depth)
2936 {
2937         const u_char *cp;
2938         int i;
2939         struct isakmp_gen e;
2940
2941         cp = (const u_char *)ext;
2942         while (np) {
2943                 ND_TCHECK(*ext);
2944                 UNALIGNED_MEMCPY(&e, ext, sizeof(e));
2945
2946                 ND_TCHECK2(*ext, ntohs(e.len));
2947
2948                 depth++;
2949                 ND_PRINT((ndo,"\n"));
2950                 for (i = 0; i < depth; i++)
2951                         ND_PRINT((ndo,"    "));
2952                 ND_PRINT((ndo,"("));
2953                 cp = ikev2_sub0_print(ndo, base, np,
2954                                       ext, ep, phase, doi, proto, depth);
2955                 ND_PRINT((ndo,")"));
2956                 depth--;
2957
2958                 if (cp == NULL) {
2959                         /* Zero-length subitem */
2960                         return NULL;
2961                 }
2962
2963                 np = e.np;
2964                 ext = (const struct isakmp_gen *)cp;
2965         }
2966         return cp;
2967 trunc:
2968         ND_PRINT((ndo," [|%s]", NPSTR(np)));
2969         return NULL;
2970 }
2971
2972 static void
2973 ikev2_print(netdissect_options *ndo,
2974             const u_char *bp,  u_int length,
2975             const u_char *bp2 _U_, struct isakmp *base)
2976 {
2977         const struct isakmp *p;
2978         const u_char *ep;
2979         u_char np;
2980         int phase;
2981
2982         p = (const struct isakmp *)bp;
2983         ep = ndo->ndo_snapend;
2984
2985         phase = (EXTRACT_32BITS(base->msgid) == 0) ? 1 : 2;
2986         if (phase == 1)
2987                 ND_PRINT((ndo, " parent_sa"));
2988         else
2989                 ND_PRINT((ndo, " child_sa "));
2990
2991         ND_PRINT((ndo, " %s", ETYPESTR(base->etype)));
2992         if (base->flags) {
2993                 ND_PRINT((ndo, "[%s%s%s]",
2994                           base->flags & ISAKMP_FLAG_I ? "I" : "",
2995                           base->flags & ISAKMP_FLAG_V ? "V" : "",
2996                           base->flags & ISAKMP_FLAG_R ? "R" : ""));
2997         }
2998
2999         if (ndo->ndo_vflag) {
3000                 const struct isakmp_gen *ext;
3001
3002                 ND_PRINT((ndo, ":"));
3003
3004                 /* regardless of phase... */
3005                 if (base->flags & ISAKMP_FLAG_E) {
3006                         /*
3007                          * encrypted, nothing we can do right now.
3008                          * we hope to decrypt the packet in the future...
3009                          */
3010                         ND_PRINT((ndo, " [encrypted %s]", NPSTR(base->np)));
3011                         goto done;
3012                 }
3013
3014                 CHECKLEN(p + 1, base->np)
3015
3016                 np = base->np;
3017                 ext = (const struct isakmp_gen *)(p + 1);
3018                 ikev2_sub_print(ndo, base, np, ext, ep, phase, 0, 0, 0);
3019         }
3020
3021 done:
3022         if (ndo->ndo_vflag) {
3023                 if (ntohl(base->len) != length) {
3024                         ND_PRINT((ndo, " (len mismatch: isakmp %u/ip %u)",
3025                                   (uint32_t)ntohl(base->len), length));
3026                 }
3027         }
3028 }
3029
3030 void
3031 isakmp_print(netdissect_options *ndo,
3032              const u_char *bp, u_int length,
3033              const u_char *bp2)
3034 {
3035         const struct isakmp *p;
3036         struct isakmp base;
3037         const u_char *ep;
3038         int major, minor;
3039
3040 #ifdef HAVE_LIBCRYPTO
3041         /* initialize SAs */
3042         if (ndo->ndo_sa_list_head == NULL) {
3043                 if (ndo->ndo_espsecret)
3044                         esp_print_decodesecret(ndo);
3045         }
3046 #endif
3047
3048         p = (const struct isakmp *)bp;
3049         ep = ndo->ndo_snapend;
3050
3051         if ((const struct isakmp *)ep < p + 1) {
3052                 ND_PRINT((ndo,"[|isakmp]"));
3053                 return;
3054         }
3055
3056         UNALIGNED_MEMCPY(&base, p, sizeof(base));
3057
3058         ND_PRINT((ndo,"isakmp"));
3059         major = (base.vers & ISAKMP_VERS_MAJOR)
3060                 >> ISAKMP_VERS_MAJOR_SHIFT;
3061         minor = (base.vers & ISAKMP_VERS_MINOR)
3062                 >> ISAKMP_VERS_MINOR_SHIFT;
3063
3064         if (ndo->ndo_vflag) {
3065                 ND_PRINT((ndo," %d.%d", major, minor));
3066         }
3067
3068         if (ndo->ndo_vflag) {
3069                 ND_PRINT((ndo," msgid "));
3070                 hexprint(ndo, (const uint8_t *)&base.msgid, sizeof(base.msgid));
3071         }
3072
3073         if (1 < ndo->ndo_vflag) {
3074                 ND_PRINT((ndo," cookie "));
3075                 hexprint(ndo, (const uint8_t *)&base.i_ck, sizeof(base.i_ck));
3076                 ND_PRINT((ndo,"->"));
3077                 hexprint(ndo, (const uint8_t *)&base.r_ck, sizeof(base.r_ck));
3078         }
3079         ND_PRINT((ndo,":"));
3080
3081         switch(major) {
3082         case IKEv1_MAJOR_VERSION:
3083                 ikev1_print(ndo, bp, length, bp2, &base);
3084                 break;
3085
3086         case IKEv2_MAJOR_VERSION:
3087                 ikev2_print(ndo, bp, length, bp2, &base);
3088                 break;
3089         }
3090 }
3091
3092 void
3093 isakmp_rfc3948_print(netdissect_options *ndo,
3094                      const u_char *bp, u_int length,
3095                      const u_char *bp2)
3096 {
3097         ND_TCHECK(bp[0]);
3098         if(length == 1 && bp[0]==0xff) {
3099                 ND_PRINT((ndo, "isakmp-nat-keep-alive"));
3100                 return;
3101         }
3102
3103         if(length < 4) {
3104                 goto trunc;
3105         }
3106         ND_TCHECK(bp[3]);
3107
3108         /*
3109          * see if this is an IKE packet
3110          */
3111         if(bp[0]==0 && bp[1]==0 && bp[2]==0 && bp[3]==0) {
3112                 ND_PRINT((ndo, "NONESP-encap: "));
3113                 isakmp_print(ndo, bp+4, length-4, bp2);
3114                 return;
3115         }
3116
3117         /* must be an ESP packet */
3118         {
3119                 int nh, enh, padlen;
3120                 int advance;
3121
3122                 ND_PRINT((ndo, "UDP-encap: "));
3123
3124                 advance = esp_print(ndo, bp, length, bp2, &enh, &padlen);
3125                 if(advance <= 0)
3126                         return;
3127
3128                 bp += advance;
3129                 length -= advance + padlen;
3130                 nh = enh & 0xff;
3131
3132                 ip_print_inner(ndo, bp, length, nh, bp2);
3133                 return;
3134         }
3135
3136 trunc:
3137         ND_PRINT((ndo,"[|isakmp]"));
3138         return;
3139 }
3140
3141 /*
3142  * Local Variables:
3143  * c-style: whitesmith
3144  * c-basic-offset: 8
3145  * End:
3146  */