/src/wireshark/epan/dissectors/packet-ike.c
Line | Count | Source |
1 | | /* packet-ike.c |
2 | | * Routines for the Internet Security Association and Key Management Protocol |
3 | | * (ISAKMP) (RFC 2408) and the Internet IP Security Domain of Interpretation |
4 | | * for ISAKMP (RFC 2407) |
5 | | * Brad Robel-Forrest <brad.robel-forrest@watchguard.com> |
6 | | * |
7 | | * Added routines for the Internet Key Exchange (IKEv2) Protocol |
8 | | * (RFCs 4306, 5996, 7296) |
9 | | * Shoichi Sakane <sakane@tanu.org> |
10 | | * |
11 | | * Added routines for RFC3947 Negotiation of NAT-Traversal in the IKE |
12 | | * ronnie sahlberg |
13 | | * |
14 | | * 04/2009 Added routines for decryption of IKEv2 Encrypted Payload |
15 | | * Naoyoshi Ueda <piyomaru3141@gmail.com> |
16 | | * |
17 | | * 08/2016 Added decryption using AES-GCM, AES-CCM and AES-CTR |
18 | | * and verification using AES-GCM, AES-CCM |
19 | | * Michal Skalski <mskalski13@gmail.com> |
20 | | * |
21 | | * Wireshark - Network traffic analyzer |
22 | | * By Gerald Combs <gerald@wireshark.org> |
23 | | * Copyright 1998 Gerald Combs |
24 | | * |
25 | | * SPDX-License-Identifier: GPL-2.0-or-later |
26 | | * |
27 | | * References: |
28 | | * IKEv2 https://datatracker.ietf.org/doc/html/rfc7296 |
29 | | * IKEv2 https://tools.ietf.org/html/rfc5996 |
30 | | * IKEv2 https://tools.ietf.org/html/rfc4306 |
31 | | * |
32 | | * http://www.iana.org/assignments/isakmp-registry (last updated 2011-11-07) |
33 | | * http://www.iana.org/assignments/ipsec-registry (last updated 2011-03-14) |
34 | | * http://www.iana.org/assignments/ikev2-parameters (last updated 2026-03-15) |
35 | | */ |
36 | | |
37 | | #include "config.h" |
38 | | |
39 | | #include <epan/packet.h> |
40 | | #include <epan/asn1.h> |
41 | | #include <epan/reassemble.h> |
42 | | #include <epan/prefs.h> |
43 | | #include <epan/expert.h> |
44 | | #include <epan/to_str.h> |
45 | | #include <epan/conversation.h> |
46 | | #include <epan/tfs.h> |
47 | | #include <epan/iana-info.h> |
48 | | #include <wsutil/str_util.h> |
49 | | #include "packet-x509if.h" |
50 | | #include "packet-x509af.h" |
51 | | #include "packet-gsm_a_common.h" |
52 | | #include "packet-ike.h" |
53 | | #include "packet-ber.h" |
54 | | |
55 | | #include <wsutil/wsgcrypt.h> |
56 | | #include <wsutil/array.h> |
57 | | #include <epan/proto_data.h> |
58 | | #include <epan/uat.h> |
59 | | |
60 | | void proto_register_isakmp(void); |
61 | | void proto_reg_handoff_isakmp(void); |
62 | | |
63 | | typedef struct _attribute_common_fields { |
64 | | int all; |
65 | | int format; |
66 | | int type; |
67 | | int length; |
68 | | int value; |
69 | | } attribute_common_fields; |
70 | | |
71 | | static int proto_isakmp; |
72 | | |
73 | | static int hf_isakmp_nat_keepalive; |
74 | | static int hf_isakmp_nat_hash; |
75 | | static int hf_isakmp_nat_original_address_ipv6; |
76 | | static int hf_isakmp_nat_original_address_ipv4; |
77 | | |
78 | | static int hf_isakmp_ispi; |
79 | | static int hf_isakmp_rspi; |
80 | | static int hf_isakmp_typepayload; |
81 | | static int hf_isakmp_nextpayload; |
82 | | static int hf_isakmp_criticalpayload; |
83 | | static int hf_isakmp_reserved2; |
84 | | static int hf_isakmp_reserved7; |
85 | | static int hf_isakmp_reserved; |
86 | | static int hf_isakmp_datapayload; |
87 | | static int hf_isakmp_extradata; |
88 | | static int hf_isakmp_version; |
89 | | static int hf_isakmp_mjver; |
90 | | static int hf_isakmp_mnver; |
91 | | static int hf_isakmp_exchangetype_v1; |
92 | | static int hf_isakmp_exchangetype_v2; |
93 | | static int hf_isakmp_flags; |
94 | | static int hf_isakmp_flag_e; |
95 | | static int hf_isakmp_flag_c; |
96 | | static int hf_isakmp_flag_a; |
97 | | static int hf_isakmp_flag_i; |
98 | | static int hf_isakmp_flag_v; |
99 | | static int hf_isakmp_flag_r; |
100 | | static int hf_isakmp_messageid; |
101 | | static int hf_isakmp_length; |
102 | | static int hf_isakmp_payloadlen; |
103 | | static int hf_isakmp_sa_doi; |
104 | | static int hf_isakmp_sa_situation; |
105 | | static int hf_isakmp_sa_attribute_next_payload; |
106 | | static int hf_isakmp_sa_situation_identity_only; |
107 | | static int hf_isakmp_sa_situation_secrecy; |
108 | | static int hf_isakmp_sa_situation_integrity; |
109 | | static int hf_isakmp_prop_protoid_v1; |
110 | | static int hf_isakmp_prop_protoid_v2; |
111 | | static int hf_isakmp_prop_number; |
112 | | static int hf_isakmp_prop_transforms; |
113 | | static int hf_isakmp_spisize; |
114 | | static int hf_isakmp_spi; |
115 | | static int hf_isakmp_trans_number; |
116 | | static int hf_isakmp_trans_id; |
117 | | static int hf_isakmp_id_type_v1; |
118 | | static int hf_isakmp_id_type_v2; |
119 | | static int hf_isakmp_id_protoid; |
120 | | static int hf_isakmp_id_port; |
121 | | static int hf_isakmp_id_data; |
122 | | static int hf_isakmp_id_data_ipv4_addr; |
123 | | static int hf_isakmp_id_data_fqdn; |
124 | | static int hf_isakmp_id_data_user_fqdn; |
125 | | static int hf_isakmp_id_data_ipv4_subnet; |
126 | | static int hf_isakmp_id_data_ipv4_range_start; |
127 | | static int hf_isakmp_id_data_ipv4_range_end; |
128 | | static int hf_isakmp_id_data_ipv6_addr; |
129 | | static int hf_isakmp_id_data_ipv6_subnet; |
130 | | static int hf_isakmp_id_data_ipv6_range_start; |
131 | | static int hf_isakmp_id_data_ipv6_range_end; |
132 | | static int hf_isakmp_id_data_key_id; |
133 | | static int hf_isakmp_id_data_cert; |
134 | | static int hf_isakmp_cert_encoding_v1; |
135 | | static int hf_isakmp_cert_encoding_v2; |
136 | | static int hf_isakmp_cert_data; |
137 | | static int hf_isakmp_cert_x509_hash; |
138 | | static int hf_isakmp_cert_x509_url; |
139 | | static int hf_isakmp_certreq_type_v1; |
140 | | static int hf_isakmp_certreq_type_v2; |
141 | | static int hf_isakmp_certreq_authority_v1; |
142 | | static int hf_isakmp_certreq_authority_v2; |
143 | | static int hf_isakmp_certreq_authority_sig; |
144 | | static int hf_isakmp_auth_meth; |
145 | | static int hf_isakmp_auth_data; |
146 | | static int hf_isakmp_auth_digital_sig_asn1_len; |
147 | | static int hf_isakmp_auth_digital_sig_asn1_data; |
148 | | static int hf_isakmp_auth_digital_sig_value; |
149 | | static int hf_isakmp_notify_doi; |
150 | | static int hf_isakmp_notify_protoid_v1; |
151 | | static int hf_isakmp_notify_protoid_v2; |
152 | | static int hf_isakmp_notify_msgtype_v1; |
153 | | static int hf_isakmp_notify_msgtype_v2; |
154 | | static int hf_isakmp_notify_data; |
155 | | static int hf_isakmp_notify_data_dpd_are_you_there; |
156 | | static int hf_isakmp_notify_data_dpd_are_you_there_ack; |
157 | | static int hf_isakmp_notify_data_unity_load_balance; |
158 | | static int hf_isakmp_notify_data_fortinet_network_overlay_id; |
159 | | static int hf_isakmp_notify_data_fortinet_forticlient_connect; |
160 | | static int hf_isakmp_notify_data_fortinet_forticlient_connect_item; |
161 | | static int hf_isakmp_notify_data_fortinet_forticlient_connect_type; |
162 | | static int hf_isakmp_notify_data_fortinet_forticlient_connect_value; |
163 | | static int hf_isakmp_notify_data_fortinet_forticlient_connect_ver; |
164 | | static int hf_isakmp_notify_data_fortinet_forticlient_connect_fctver; |
165 | | static int hf_isakmp_notify_data_fortinet_forticlient_connect_uid; |
166 | | static int hf_isakmp_notify_data_fortinet_forticlient_connect_ip; |
167 | | static int hf_isakmp_notify_data_fortinet_forticlient_connect_mac; |
168 | | static int hf_isakmp_notify_data_fortinet_forticlient_connect_host; |
169 | | static int hf_isakmp_notify_data_fortinet_forticlient_connect_user; |
170 | | static int hf_isakmp_notify_data_fortinet_forticlient_connect_osver; |
171 | | static int hf_isakmp_notify_data_fortinet_forticlient_connect_reg_status; |
172 | | static int hf_isakmp_notify_data_fortinet_forticlient_connect_emssn; |
173 | | static int hf_isakmp_notify_data_fortinet_forticlient_connect_emsid; |
174 | | static int hf_isakmp_notify_data_accepted_ke_method; |
175 | | static int hf_isakmp_notify_data_ipcomp_cpi; |
176 | | static int hf_isakmp_notify_data_ipcomp_transform_id; |
177 | | static int hf_isakmp_notify_data_auth_lifetime; |
178 | | static int hf_isakmp_notify_data_redirect_gw_ident_type; |
179 | | static int hf_isakmp_notify_data_redirect_gw_ident_len; |
180 | | static int hf_isakmp_notify_data_redirect_new_resp_gw_ident_ipv4; |
181 | | static int hf_isakmp_notify_data_redirect_new_resp_gw_ident_ipv6; |
182 | | static int hf_isakmp_notify_data_redirect_new_resp_gw_ident_fqdn; |
183 | | static int hf_isakmp_notify_data_redirect_new_resp_gw_ident; |
184 | | static int hf_isakmp_notify_data_redirect_nonce_data; |
185 | | static int hf_isakmp_notify_data_redirect_org_resp_gw_ident_ipv4; |
186 | | static int hf_isakmp_notify_data_redirect_org_resp_gw_ident_ipv6; |
187 | | static int hf_isakmp_notify_data_redirect_org_resp_gw_ident; |
188 | | static int hf_isakmp_notify_data_ticket_lifetime; |
189 | | static int hf_isakmp_notify_data_ticket_data; |
190 | | |
191 | | static attribute_common_fields hf_isakmp_notify_data_rohc_attr; |
192 | | static int hf_isakmp_notify_data_rohc_attr_max_cid; |
193 | | static int hf_isakmp_notify_data_rohc_attr_profile; |
194 | | static int hf_isakmp_notify_data_rohc_attr_integ; |
195 | | static int hf_isakmp_notify_data_rohc_attr_icv_len; |
196 | | static int hf_isakmp_notify_data_rohc_attr_mrru; |
197 | | static int hf_isakmp_notify_data_qcd_token_secret_data; |
198 | | static int hf_isakmp_notify_data_ha_nonce_data; |
199 | | static int hf_isakmp_notify_data_ha_expected_send_req_msg_id; |
200 | | static int hf_isakmp_notify_data_ha_expected_recv_req_msg_id; |
201 | | static int hf_isakmp_notify_data_ha_incoming_ipsec_sa_delta_value; |
202 | | static int hf_isakmp_notify_data_secure_password_methods; |
203 | | static int hf_isakmp_notify_data_signature_hash_algorithms; |
204 | | static int hf_isakmp_delete_doi; |
205 | | static int hf_isakmp_delete_protoid_v1; |
206 | | static int hf_isakmp_delete_protoid_v2; |
207 | | static int hf_isakmp_delete_spi; |
208 | | static int hf_isakmp_vid_bytes; |
209 | | static int hf_isakmp_vid_string; |
210 | | static int hf_isakmp_vid_cp_product; |
211 | | static int hf_isakmp_vid_cp_version; |
212 | | static int hf_isakmp_vid_cp_timestamp; |
213 | | static int hf_isakmp_vid_cp_reserved; |
214 | | static int hf_isakmp_vid_cp_features; |
215 | | static int hf_isakmp_vid_cisco_unity_major; |
216 | | static int hf_isakmp_vid_cisco_unity_minor; |
217 | | static int hf_isakmp_vid_ms_nt5_isakmpoakley; |
218 | | static int hf_isakmp_vid_aruba_via_auth_profile; |
219 | | static int hf_isakmp_vid_fortinet_fortigate_release; |
220 | | static int hf_isakmp_vid_fortinet_fortigate_build; |
221 | | static int hf_isakmp_ts_number_of_ts; |
222 | | static int hf_isakmp_ts_type; |
223 | | static int hf_isakmp_ts_protoid; |
224 | | static int hf_isakmp_ts_selector_length; |
225 | | static int hf_isakmp_ts_start_port; |
226 | | static int hf_isakmp_ts_end_port; |
227 | | static int hf_isakmp_ts_start_addr_ipv4; |
228 | | static int hf_isakmp_ts_end_addr_ipv4; |
229 | | static int hf_isakmp_ts_start_addr_ipv6; |
230 | | static int hf_isakmp_ts_end_addr_ipv6; |
231 | | static int hf_isakmp_ts_start_addr_fc; |
232 | | static int hf_isakmp_ts_end_addr_fc; |
233 | | static int hf_isakmp_ts_start_r_ctl; |
234 | | static int hf_isakmp_ts_end_r_ctl; |
235 | | static int hf_isakmp_ts_start_type; |
236 | | static int hf_isakmp_ts_end_type; |
237 | | static int hf_isakmp_ts_data; |
238 | | static int hf_isakmp_num_spis; |
239 | | static int hf_isakmp_hash; |
240 | | static int hf_isakmp_sig; |
241 | | static int hf_isakmp_nonce; |
242 | | static int hf_isakmp_symmetric_key; |
243 | | |
244 | | static int hf_isakmp_notify_data_3gpp_backoff_timer_len; |
245 | | |
246 | | static int hf_isakmp_notify_data_3gpp_device_identity_len; |
247 | | static int hf_isakmp_notify_data_3gpp_device_identity_type; |
248 | | static int hf_isakmp_notify_data_3gpp_device_identity_imei; |
249 | | static int hf_isakmp_notify_data_3gpp_device_identity_imeisv; |
250 | | |
251 | | static int hf_isakmp_notify_data_3gpp_emergency_call_mcc; |
252 | | static int hf_isakmp_notify_data_3gpp_emergency_call_numbers_len; |
253 | | static int hf_isakmp_notify_data_3gpp_emergency_call_numbers_spare; |
254 | | static int hf_isakmp_notify_data_3gpp_emergency_call_numbers_element_len; |
255 | | static int hf_isakmp_notify_data_3gpp_emergency_call_numbers_flags; |
256 | | |
257 | | static int hf_isakmp_notify_data_3gpp_emergency_call_numbers_flag_b1_police; |
258 | | static int hf_isakmp_notify_data_3gpp_emergency_call_numbers_flag_b2_ambulance; |
259 | | static int hf_isakmp_notify_data_3gpp_emergency_call_numbers_flag_b3_fire_brigade; |
260 | | static int hf_isakmp_notify_data_3gpp_emergency_call_numbers_flag_b4_marine_guard; |
261 | | static int hf_isakmp_notify_data_3gpp_emergency_call_numbers_flag_b5_mountain_rescue; |
262 | | |
263 | | static int hf_iskamp_notify_data_3gpp_emergency_call_number; |
264 | | |
265 | | static attribute_common_fields hf_isakmp_tek_key_attr; |
266 | | |
267 | | static attribute_common_fields hf_isakmp_ipsec_attr; |
268 | | static int hf_isakmp_ipsec_attr_life_type; |
269 | | static int hf_isakmp_ipsec_attr_life_duration_uint32; |
270 | | static int hf_isakmp_ipsec_attr_life_duration_uint64; |
271 | | static int hf_isakmp_ipsec_attr_life_duration_bytes; |
272 | | static int hf_isakmp_ipsec_attr_group_description; |
273 | | static int hf_isakmp_ipsec_attr_encap_mode; |
274 | | static int hf_isakmp_ipsec_attr_auth_algorithm; |
275 | | static int hf_isakmp_ipsec_attr_key_length; |
276 | | static int hf_isakmp_ipsec_attr_key_rounds; |
277 | | static int hf_isakmp_ipsec_attr_cmpr_dict_size; |
278 | | static int hf_isakmp_ipsec_attr_cmpr_algorithm; |
279 | | static int hf_isakmp_ipsec_attr_ecn_tunnel; |
280 | | static int hf_isakmp_ipsec_attr_ext_seq_nbr; |
281 | | static int hf_isakmp_ipsec_attr_auth_key_length; |
282 | | static int hf_isakmp_ipsec_attr_sig_enco_algorithm; |
283 | | static int hf_isakmp_ipsec_attr_addr_preservation; |
284 | | static int hf_isakmp_ipsec_attr_sa_direction; |
285 | | |
286 | | static attribute_common_fields hf_isakmp_resp_lifetime_ipsec_attr; |
287 | | static int hf_isakmp_resp_lifetime_ipsec_attr_life_type; |
288 | | static int hf_isakmp_resp_lifetime_ipsec_attr_life_duration_uint32; |
289 | | static int hf_isakmp_resp_lifetime_ipsec_attr_life_duration_uint64; |
290 | | static int hf_isakmp_resp_lifetime_ipsec_attr_life_duration_bytes; |
291 | | |
292 | | static attribute_common_fields hf_isakmp_ike_attr; |
293 | | static int hf_isakmp_ike_attr_encryption_algorithm; |
294 | | static int hf_isakmp_ike_attr_hash_algorithm; |
295 | | static int hf_isakmp_ike_attr_authentication_method; |
296 | | static int hf_isakmp_ike_attr_authentication_method_china; |
297 | | static int hf_isakmp_ike_attr_group_description; |
298 | | static int hf_isakmp_ike_attr_group_type; |
299 | | static int hf_isakmp_ike_attr_group_prime; |
300 | | static int hf_isakmp_ike_attr_group_generator_one; |
301 | | static int hf_isakmp_ike_attr_group_generator_two; |
302 | | static int hf_isakmp_ike_attr_group_curve_a; |
303 | | static int hf_isakmp_ike_attr_group_curve_b; |
304 | | static int hf_isakmp_ike_attr_life_type; |
305 | | static int hf_isakmp_ike_attr_life_duration_uint32; |
306 | | static int hf_isakmp_ike_attr_life_duration_uint64; |
307 | | static int hf_isakmp_ike_attr_life_duration_bytes; |
308 | | static int hf_isakmp_ike_attr_prf; |
309 | | static int hf_isakmp_ike_attr_key_length; |
310 | | static int hf_isakmp_ike_attr_field_size; |
311 | | static int hf_isakmp_ike_attr_group_order; |
312 | | static int hf_isakmp_ike_attr_block_size; |
313 | | static int hf_isakmp_ike_attr_asymmetric_cryptographic_algorithm_type; |
314 | | |
315 | | static attribute_common_fields hf_isakmp_resp_lifetime_ike_attr; |
316 | | static int hf_isakmp_resp_lifetime_ike_attr_life_type; |
317 | | static int hf_isakmp_resp_lifetime_ike_attr_life_duration_uint32; |
318 | | static int hf_isakmp_resp_lifetime_ike_attr_life_duration_uint64; |
319 | | static int hf_isakmp_resp_lifetime_ike_attr_life_duration_bytes; |
320 | | |
321 | | static int hf_isakmp_trans_type; |
322 | | static int hf_isakmp_trans_encr; |
323 | | static int hf_isakmp_trans_prf; |
324 | | static int hf_isakmp_trans_integ; |
325 | | static int hf_isakmp_trans_ke; |
326 | | static int hf_isakmp_trans_sn; |
327 | | static int hf_isakmp_trans_kwa; |
328 | | static int hf_isakmp_trans_gcauth; |
329 | | static int hf_isakmp_trans_id_v2; |
330 | | |
331 | | static attribute_common_fields hf_isakmp_ike2_attr; |
332 | | static int hf_isakmp_ike2_attr_key_length; |
333 | | |
334 | | static int hf_isakmp_fragments; |
335 | | static int hf_isakmp_fragment; |
336 | | static int hf_isakmp_fragment_overlap; |
337 | | static int hf_isakmp_fragment_overlap_conflicts; |
338 | | static int hf_isakmp_fragment_multiple_tails; |
339 | | static int hf_isakmp_fragment_too_long_fragment; |
340 | | static int hf_isakmp_fragment_error; |
341 | | static int hf_isakmp_fragment_count; |
342 | | static int hf_isakmp_reassembled_in; |
343 | | static int hf_isakmp_reassembled_length; |
344 | | |
345 | | static int hf_isakmp_ike2_fragment_number; |
346 | | static int hf_isakmp_ike2_total_fragments; |
347 | | |
348 | | static int hf_isakmp_cisco_frag_packetid; |
349 | | static int hf_isakmp_cisco_frag_seq; |
350 | | static int hf_isakmp_cisco_frag_last; |
351 | | |
352 | | static int hf_isakmp_key_exch_method; |
353 | | static int hf_isakmp_key_exch_data; |
354 | | static int hf_isakmp_eap_data; |
355 | | |
356 | | static int hf_isakmp_gspm_data; |
357 | | |
358 | | static int hf_isakmp_cfg_type_v1; |
359 | | static int hf_isakmp_cfg_identifier; |
360 | | static int hf_isakmp_cfg_type_v2; |
361 | | |
362 | | static attribute_common_fields hf_isakmp_cfg_attr; |
363 | | static int hf_isakmp_cfg_attr_type_v1; |
364 | | static int hf_isakmp_cfg_attr_type_v2; |
365 | | |
366 | | static int hf_isakmp_cfg_attr_internal_ip4_address; |
367 | | static int hf_isakmp_cfg_attr_internal_ip4_netmask; |
368 | | static int hf_isakmp_cfg_attr_internal_ip4_dns; |
369 | | static int hf_isakmp_cfg_attr_internal_ip4_nbns; |
370 | | static int hf_isakmp_cfg_attr_internal_address_expiry; |
371 | | static int hf_isakmp_cfg_attr_internal_ip4_dhcp; |
372 | | static int hf_isakmp_cfg_attr_application_version; |
373 | | static int hf_isakmp_cfg_attr_internal_ip6_address_ip; |
374 | | static int hf_isakmp_cfg_attr_internal_ip6_address_prefix; |
375 | | static int hf_isakmp_cfg_attr_internal_ip6_netmask; |
376 | | static int hf_isakmp_cfg_attr_internal_ip6_dns; |
377 | | static int hf_isakmp_cfg_attr_internal_ip6_nbns; |
378 | | static int hf_isakmp_cfg_attr_internal_ip6_dhcp; |
379 | | static int hf_isakmp_cfg_attr_internal_ip4_subnet_ip; |
380 | | static int hf_isakmp_cfg_attr_internal_ip4_subnet_netmask; |
381 | | static int hf_isakmp_cfg_attr_supported_attributes; |
382 | | static int hf_isakmp_cfg_attr_internal_ip6_subnet_ip; |
383 | | static int hf_isakmp_cfg_attr_internal_ip6_subnet_prefix; |
384 | | static int hf_isakmp_cfg_attr_internal_ip6_link_interface; |
385 | | static int hf_isakmp_cfg_attr_internal_ip6_link_id; |
386 | | static int hf_isakmp_cfg_attr_internal_ip6_prefix_ip; |
387 | | static int hf_isakmp_cfg_attr_internal_ip6_prefix_length; |
388 | | static int hf_isakmp_cfg_attr_p_cscf_ip4_address; |
389 | | static int hf_isakmp_cfg_attr_p_cscf_ip6_address; |
390 | | static int hf_isakmp_cfg_attr_internal_dns_domain; |
391 | | static int hf_isakmp_cfg_attr_xauth_type; |
392 | | static int hf_isakmp_cfg_attr_xauth_user_name; |
393 | | static int hf_isakmp_cfg_attr_xauth_user_password; |
394 | | static int hf_isakmp_cfg_attr_xauth_passcode; |
395 | | static int hf_isakmp_cfg_attr_xauth_message; |
396 | | static int hf_isakmp_cfg_attr_xauth_challenge; |
397 | | static int hf_isakmp_cfg_attr_xauth_domain; |
398 | | static int hf_isakmp_cfg_attr_xauth_status; |
399 | | static int hf_isakmp_cfg_attr_xauth_next_pin; |
400 | | static int hf_isakmp_cfg_attr_xauth_answer; |
401 | | static int hf_isakmp_cfg_attr_fortinet_auto_negotiate; |
402 | | static int hf_isakmp_cfg_attr_fortinet_keep_alive; |
403 | | static int hf_isakmp_cfg_attr_fortinet_dns_suffix; |
404 | | static int hf_isakmp_cfg_attr_unity_banner; |
405 | | static int hf_isakmp_cfg_attr_unity_save_passwd; |
406 | | static int hf_isakmp_cfg_attr_unity_split_exclude; |
407 | | static int hf_isakmp_cfg_attr_unity_def_domain; |
408 | | |
409 | | static int hf_isakmp_sak_next_payload; |
410 | | static int hf_isakmp_sak_reserved; |
411 | | static int hf_isakmp_sak_payload_len; |
412 | | static int hf_isakmp_sak_protocol; |
413 | | static int hf_isakmp_sak_src_id_type; |
414 | | static int hf_isakmp_sak_src_id_port; |
415 | | static int hf_isakmp_sak_src_id_length; |
416 | | static int hf_isakmp_sak_src_id_data; |
417 | | static int hf_isakmp_sak_dst_id_type; |
418 | | static int hf_isakmp_sak_dst_id_port; |
419 | | static int hf_isakmp_sak_dst_id_length; |
420 | | static int hf_isakmp_sak_dst_id_data; |
421 | | static int hf_isakmp_sak_spi; |
422 | | |
423 | | static int hf_isakmp_sat_next_payload; |
424 | | static int hf_isakmp_sat_reserved; |
425 | | static int hf_isakmp_sat_payload_len; |
426 | | static int hf_isakmp_sat_protocol_id; |
427 | | static int hf_isakmp_sat_protocol; |
428 | | static int hf_isakmp_sat_src_id_type; |
429 | | static int hf_isakmp_sat_src_id_port; |
430 | | static int hf_isakmp_sat_src_id_length; |
431 | | static int hf_isakmp_sat_src_id_data; |
432 | | static int hf_isakmp_sat_dst_id_type; |
433 | | static int hf_isakmp_sat_dst_id_port; |
434 | | static int hf_isakmp_sat_dst_id_length; |
435 | | static int hf_isakmp_sat_dst_id_data; |
436 | | static int hf_isakmp_sat_transform_id; |
437 | | static int hf_isakmp_sat_spi; |
438 | | static int hf_isakmp_sat_payload; |
439 | | |
440 | | static int hf_isakmp_kd_num_key_pkt; |
441 | | static int hf_isakmp_kd_payload; |
442 | | static int hf_isakmp_kdp_type; |
443 | | static int hf_isakmp_kdp_length; |
444 | | static int hf_isakmp_kdp_spi_size; |
445 | | static int hf_isakmp_kdp_spi; |
446 | | |
447 | | static int hf_isakmp_seq_seq; |
448 | | |
449 | | static int hf_isakmp_enc_decrypted_data; |
450 | | static int hf_isakmp_enc_contained_data; |
451 | | static int hf_isakmp_enc_pad_length; |
452 | | static int hf_isakmp_enc_padding; |
453 | | static int hf_isakmp_enc_data; |
454 | | static int hf_isakmp_enc_iv; |
455 | | static int hf_isakmp_enc_icd; |
456 | | |
457 | | static int hf_isakmp_iketcp_magic; |
458 | | static int hf_isakmp_iketcp_length; |
459 | | static int hf_isakmp_iketcp_non_esp_marker; |
460 | | |
461 | | static int ett_isakmp; |
462 | | static int ett_isakmp_version; |
463 | | static int ett_isakmp_flags; |
464 | | static int ett_isakmp_payload; |
465 | | static int ett_isakmp_payload_digital_signature; |
466 | | static int ett_isakmp_payload_digital_signature_asn1_data; |
467 | | static int ett_isakmp_fragment; |
468 | | static int ett_isakmp_fragments; |
469 | | static int ett_isakmp_sa; |
470 | | static int ett_isakmp_attr; |
471 | | static int ett_isakmp_id; |
472 | | static int ett_isakmp_notify_data; |
473 | | static int ett_isakmp_notify_data_3gpp_emergency_call_numbers_main; |
474 | | static int ett_isakmp_notify_data_3gpp_emergency_call_numbers_element; |
475 | | static int ett_isakmp_notify_fortinet_forticlient_connnect; |
476 | | static int ett_isakmp_ts; |
477 | | static int ett_isakmp_kd; |
478 | | /* For decrypted IKEv2 Encrypted payload*/ |
479 | | static int ett_isakmp_decrypted_data; |
480 | | static int ett_isakmp_decrypted_payloads; |
481 | | |
482 | | static expert_field ei_isakmp_enc_iv; |
483 | | static expert_field ei_isakmp_ikev2_integrity_checksum; |
484 | | static expert_field ei_isakmp_enc_data_length_mult_block_size; |
485 | | static expert_field ei_isakmp_enc_pad_length_big; |
486 | | static expert_field ei_isakmp_attribute_value_empty; |
487 | | static expert_field ei_isakmp_payload_bad_length; |
488 | | static expert_field ei_isakmp_bad_fragment_number; |
489 | | static expert_field ei_isakmp_notify_data_3gpp_unknown_device_identity; |
490 | | static expert_field ei_isakmp_notify_data_nat_payload_sha1_mismatch; |
491 | | |
492 | | static dissector_handle_t eap_handle; |
493 | | static dissector_handle_t esp_handle; |
494 | | static dissector_handle_t isakmp_handle; |
495 | | static dissector_handle_t iketcp_handle; |
496 | | |
497 | | |
498 | | static reassembly_table isakmp_cisco_reassembly_table; |
499 | | static reassembly_table isakmp_ike2_reassembly_table; |
500 | | |
501 | | static const fragment_items isakmp_frag_items = { |
502 | | /* Fragment subtrees */ |
503 | | &ett_isakmp_fragment, |
504 | | &ett_isakmp_fragments, |
505 | | /* Fragment fields */ |
506 | | &hf_isakmp_fragments, |
507 | | &hf_isakmp_fragment, |
508 | | &hf_isakmp_fragment_overlap, |
509 | | &hf_isakmp_fragment_overlap_conflicts, |
510 | | &hf_isakmp_fragment_multiple_tails, |
511 | | &hf_isakmp_fragment_too_long_fragment, |
512 | | &hf_isakmp_fragment_error, |
513 | | &hf_isakmp_fragment_count, |
514 | | /* Reassembled in field */ |
515 | | &hf_isakmp_reassembled_in, |
516 | | /* Reassembled length field */ |
517 | | &hf_isakmp_reassembled_length, |
518 | | /* Reassembled data field */ |
519 | | NULL, |
520 | | /* Tag */ |
521 | | "Message fragments" |
522 | | }; |
523 | | /* IKE port number assigned by IANA */ |
524 | 16 | #define UDP_PORT_ISAKMP 500 |
525 | 16 | #define TCP_PORT_ISAKMP 500 |
526 | | |
527 | | /* |
528 | | * Identifier Type |
529 | | * RFC2407 for IKEv1 |
530 | | * RFC3554 for ID_LIST |
531 | | * RFC4306 for IKEv2 |
532 | | * RFC4595 for ID_FC_NAME |
533 | | * RFC7619 for ID_NULL |
534 | | */ |
535 | 97 | #define IKE_ID_IPV4_ADDR 1 |
536 | 6 | #define IKE_ID_FQDN 2 |
537 | 5 | #define IKE_ID_USER_FQDN 3 |
538 | 11 | #define IKE_ID_IPV4_ADDR_SUBNET 4 |
539 | 199 | #define IKE_ID_IPV6_ADDR 5 |
540 | 34 | #define IKE_ID_IPV6_ADDR_SUBNET 6 |
541 | 20 | #define IKE_ID_IPV4_ADDR_RANGE 7 |
542 | 25 | #define IKE_ID_IPV6_ADDR_RANGE 8 |
543 | 11 | #define IKE_ID_DER_ASN1_DN 9 |
544 | | #define IKE_ID_DER_ASN1_GN 10 |
545 | 5 | #define IKE_ID_KEY_ID 11 |
546 | | #define IKE_ID_LIST 12 |
547 | | #define IKE_ID_FC_NAME 12 |
548 | | #define IKE_ID_NULL 13 |
549 | | #define IKE_ID_RFC822_ADDR 3 |
550 | | /* |
551 | | * Traffic Selector Type |
552 | | * Not in use for IKEv1 |
553 | | */ |
554 | 31 | #define IKEV2_TS_IPV4_ADDR_RANGE 7 |
555 | 25 | #define IKEV2_TS_IPV6_ADDR_RANGE 8 |
556 | 28 | #define IKEV2_TS_FC_ADDR_RANGE 9 /* RFC 4595 */ |
557 | | /* |
558 | | * Configuration Payload Attribute Types |
559 | | * draft-ietf-ipsec-isakmp-mode-cfg-05.txt for IKEv1 |
560 | | * draft-ietf-ipsec-isakmp-xauth-06.txt and draft-beaulieu-ike-xauth-02.txt for XAUTH |
561 | | * RFC4306 for IKEv2 |
562 | | * RFC5739 for INTERNAL_IP6_LINK and INTERNAL_IP6_PREFIX |
563 | | * draft-gundavelli-ipsecme-3gpp-ims-options for P_CSCF_IP4_ADDRESS and P_CSCF_IP6_ADDRESS |
564 | | */ |
565 | 40 | #define INTERNAL_IP4_ADDRESS 1 |
566 | 48 | #define INTERNAL_IP4_NETMASK 2 |
567 | 17 | #define INTERNAL_IP4_DNS 3 |
568 | 81 | #define INTERNAL_IP4_NBNS 4 |
569 | 24 | #define INTERNAL_ADDRESS_EXPIRY 5 |
570 | 20 | #define INTERNAL_IP4_DHCP 6 |
571 | 14 | #define APPLICATION_VERSION 7 |
572 | 28 | #define INTERNAL_IP6_ADDRESS 8 |
573 | 24 | #define INTERNAL_IP6_NETMASK 9 |
574 | 33 | #define INTERNAL_IP6_DNS 10 |
575 | 15 | #define INTERNAL_IP6_NBNS 11 |
576 | 25 | #define INTERNAL_IP6_DHCP 12 |
577 | 24 | #define INTERNAL_IP4_SUBNET 13 |
578 | 17 | #define SUPPORTED_ATTRIBUTES 14 |
579 | 15 | #define INTERNAL_IP6_SUBNET 15 |
580 | | #define MIP6_HOME_PREFIX 16 |
581 | 10 | #define INTERNAL_IP6_LINK 17 |
582 | 6 | #define INTERNAL_IP6_PREFIX 18 |
583 | 21 | #define P_CSCF_IP4_ADDRESS 20 |
584 | 14 | #define P_CSCF_IP6_ADDRESS 21 |
585 | 6 | #define INTERNAL_DNS_DOMAIN 25 |
586 | | /* checkpoint configuration attributes */ |
587 | | #define CHKPT_DEF_DOMAIN 16387 |
588 | | #define CHKPT_MAC_ADDRESS 16388 |
589 | | #define CHKPT_MARCIPAN_REASON_CODE 16389 |
590 | | #define CHKPT_UNKNOWN1 16400 |
591 | | #define CHKPT_UNKNOWN2 16401 |
592 | | #define CHKPT_UNKNOWN3 16402 |
593 | | /* XAUTH configuration attributes */ |
594 | 13 | #define XAUTH_TYPE 16520 |
595 | 7 | #define XAUTH_USER_NAME 16521 |
596 | 4 | #define XAUTH_USER_PASSWORD 16522 |
597 | 1 | #define XAUTH_PASSCODE 16523 |
598 | 2 | #define XAUTH_MESSAGE 16524 |
599 | 6 | #define XAUTH_CHALLENGE 16525 |
600 | 8 | #define XAUTH_DOMAIN 16526 |
601 | 7 | #define XAUTH_STATUS 16527 |
602 | 7 | #define XAUTH_NEXT_PIN 16528 |
603 | 3 | #define XAUTH_ANSWER 16529 |
604 | | /* Fortinet Configuration Attribute */ |
605 | 7 | #define FORTINET_AUTO_NEGOTIATE 21514 |
606 | 8 | #define FORTINET_KEEP_ALIVE 21515 |
607 | 16 | #define FORTINET_DNS_SUFFIX 21516 |
608 | | /* unity (CISCO) configuration attributes */ |
609 | 30 | #define UNITY_BANNER 28672 |
610 | 4 | #define UNITY_SAVE_PASSWD 28673 |
611 | 11 | #define UNITY_DEF_DOMAIN 28674 |
612 | | #define UNITY_SPLIT_DOMAIN 28675 |
613 | | #define UNITY_SPLIT_INCLUDE 28676 |
614 | | #define UNITY_NATT_PORT 28677 |
615 | 5 | #define UNITY_SPLIT_EXCLUDE 28678 |
616 | | #define UNITY_PFS 28679 |
617 | | #define UNITY_FW_TYPE 28680 |
618 | | #define UNITY_BACKUP_SERVERS 28681 |
619 | | #define UNITY_DDNS_HOSTNAME 28682 |
620 | | |
621 | | /* Payload Type |
622 | | * RFC2408 / RFC3547 for IKEv1 |
623 | | * RFC4306 for IKEv2 |
624 | | */ |
625 | 52.4k | #define PLOAD_IKE_NONE 0 |
626 | 4.70k | #define PLOAD_IKE_SA 1 |
627 | 109k | #define PLOAD_IKE_P 2 |
628 | 49.8k | #define PLOAD_IKE_T 3 |
629 | 48 | #define PLOAD_IKE_KE 4 |
630 | 174 | #define PLOAD_IKE_ID 5 |
631 | 9.19k | #define PLOAD_IKE_CERT 6 |
632 | 36 | #define PLOAD_IKE_CR 7 |
633 | 113 | #define PLOAD_IKE_HASH 8 |
634 | 70 | #define PLOAD_IKE_SIG 9 |
635 | 18 | #define PLOAD_IKE_NONCE 10 |
636 | 109 | #define PLOAD_IKE_N 11 |
637 | 27 | #define PLOAD_IKE_D 12 |
638 | 62 | #define PLOAD_IKE_VID 13 |
639 | 25 | #define PLOAD_IKE_A 14 |
640 | 65 | #define PLOAD_IKE_SAK 15 |
641 | 209 | #define PLOAD_IKE_SAT 16 |
642 | 98 | #define PLOAD_IKE_KD 17 |
643 | 34 | #define PLOAD_IKE_SEQ 18 |
644 | | #define PLOAD_IKE_POP 19 |
645 | 121 | #define PLOAD_IKE_NAT_D 20 |
646 | 231 | #define PLOAD_IKE_NAT_OA 21 |
647 | | #define PLOAD_IKE_GAP 22 |
648 | 7.55k | #define PLOAD_IKE2_SA 33 |
649 | 117 | #define PLOAD_IKE2_KE 34 |
650 | 250 | #define PLOAD_IKE2_IDI 35 |
651 | 314 | #define PLOAD_IKE2_IDR 36 |
652 | 9.36k | #define PLOAD_IKE2_CERT 37 |
653 | 109 | #define PLOAD_IKE2_CERTREQ 38 |
654 | 278 | #define PLOAD_IKE2_AUTH 39 |
655 | 223 | #define PLOAD_IKE2_NONCE 40 |
656 | 445 | #define PLOAD_IKE2_N 41 |
657 | 88 | #define PLOAD_IKE2_D 42 |
658 | 206 | #define PLOAD_IKE2_V 43 |
659 | 28 | #define PLOAD_IKE2_TSI 44 |
660 | 991 | #define PLOAD_IKE2_TSR 45 |
661 | 100 | #define PLOAD_IKE2_SK 46 |
662 | 284 | #define PLOAD_IKE2_CP 47 |
663 | 7 | #define PLOAD_IKE2_EAP 48 |
664 | 159 | #define PLOAD_IKE2_GSPM 49 |
665 | | #define PLOAD_IKE2_IDG 50 |
666 | | #define PLOAD_IKE2_GSA 51 |
667 | | #define PLOAD_IKE2_KD 52 |
668 | 190 | #define PLOAD_IKE2_SKF 53 |
669 | | #define PLOAD_IKE2_PS 54 |
670 | 37 | #define PLOAD_IKE_SK 128 |
671 | 137 | #define PLOAD_IKE_NAT_D13 130 |
672 | 319 | #define PLOAD_IKE_NAT_OA14 131 |
673 | 82 | #define PLOAD_IKE_CISCO_FRAG 132 |
674 | | /* |
675 | | * IPSEC Situation Definition (RFC2407) |
676 | | */ |
677 | 16 | #define SIT_IDENTITY_ONLY 0x00000001 |
678 | 16 | #define SIT_SECRECY 0x00000002 |
679 | 16 | #define SIT_INTEGRITY 0x00000004 |
680 | | |
681 | | |
682 | | static const value_string exchange_v1_type[] = { |
683 | | { 0, "NONE" }, |
684 | | { 1, "Base" }, |
685 | | { 2, "Identity Protection (Main Mode)" }, |
686 | | { 3, "Authentication Only" }, |
687 | | { 4, "Aggressive" }, |
688 | | { 5, "Informational" }, |
689 | | { 6, "Transaction (Config Mode)" }, |
690 | | { 32, "Quick Mode" }, |
691 | | { 33, "New Group Mode" }, |
692 | | { 0, NULL }, |
693 | | }; |
694 | | |
695 | | static const value_string exchange_v2_type[] = { |
696 | | { 34, "IKE_SA_INIT" }, |
697 | | { 35, "IKE_AUTH" }, |
698 | | { 36, "CREATE_CHILD_SA" }, |
699 | | { 37, "INFORMATIONAL" }, |
700 | | { 38, "IKE_SESSION_RESUME" }, /* RFC5723 */ |
701 | | { 39, "GSA_AUTH" }, /* RFC9838 */ |
702 | | { 40, "GSA_REGISTRATION" }, /* RFC9838 */ |
703 | | { 41, "GSA_REKEY" }, /* RFC9838 */ |
704 | | { 42, "GSA_INBAND_REKEY" }, /* RFC9838 */ |
705 | | { 43, "IKE_INTERMEDIATE" }, /* [RFC9242] */ |
706 | | { 44, "IKE_FOLLOWUP_KE" }, /* [RFC9370] */ |
707 | | { 0, NULL }, |
708 | | }; |
709 | | |
710 | | static const value_string frag_last_vals[] = { |
711 | | { 0, "More fragments" }, |
712 | | { 1, "Last fragment" }, |
713 | | { 0, NULL }, |
714 | | }; |
715 | | /* Ex vs_proto */ |
716 | | static const value_string protoid_v1_type[] = { |
717 | | { 0, "RESERVED" }, |
718 | | { 1, "ISAKMP" }, |
719 | | { 2, "IPSEC_AH" }, |
720 | | { 3, "IPSEC_ESP" }, |
721 | | { 4, "IPCOMP" }, |
722 | | { 5, "GIGABEAM_RADIO" }, /* RFC4705 */ |
723 | | { 0, NULL }, |
724 | | }; |
725 | | |
726 | | static const value_string protoid_v2_type[] = { |
727 | | { 0, "RESERVED" }, |
728 | | { 1, "IKE" }, |
729 | | { 2, "AH" }, |
730 | | { 3, "ESP" }, |
731 | | { 4, "FC_ESP_HEADER" }, |
732 | | { 5, "FC_CT_AUTHENTICATION" }, |
733 | | { 6, "GIKE_UPDATE" }, /* [RFC9838] */ |
734 | | /* |
735 | | 7-200 UNASSIGNED [RFC7296] |
736 | | 201-255 PRIVATE USE [RFC7296] |
737 | | */ |
738 | | { 0, NULL }, |
739 | | }; |
740 | | |
741 | | static const range_string payload_type[] = { |
742 | | { PLOAD_IKE_NONE,PLOAD_IKE_NONE, "NONE / No Next Payload" }, |
743 | | { PLOAD_IKE_SA,PLOAD_IKE_SA, "Security Association" }, |
744 | | { PLOAD_IKE_P,PLOAD_IKE_P, "Proposal" }, |
745 | | { PLOAD_IKE_T,PLOAD_IKE_T, "Transform" }, |
746 | | { PLOAD_IKE_KE,PLOAD_IKE_KE, "Key Exchange" }, |
747 | | { PLOAD_IKE_ID,PLOAD_IKE_ID, "Identification" }, |
748 | | { PLOAD_IKE_CERT,PLOAD_IKE_CERT, "Certificate" }, |
749 | | { PLOAD_IKE_CR,PLOAD_IKE_CR, "Certificate Request" }, |
750 | | { PLOAD_IKE_HASH,PLOAD_IKE_HASH, "Hash" }, |
751 | | { PLOAD_IKE_SIG,PLOAD_IKE_SIG, "Signature" }, |
752 | | { PLOAD_IKE_NONCE,PLOAD_IKE_NONCE, "Nonce" }, |
753 | | { PLOAD_IKE_N,PLOAD_IKE_N, "Notification" }, |
754 | | { PLOAD_IKE_D,PLOAD_IKE_D, "Delete" }, |
755 | | { PLOAD_IKE_VID,PLOAD_IKE_VID, "Vendor ID" }, |
756 | | { PLOAD_IKE_A,PLOAD_IKE_A, "Attributes" }, /* draft-ietf-ipsec-isakmp-mode-cfg-05.txt */ |
757 | | { PLOAD_IKE_SAK,PLOAD_IKE_SAK, "SA KEK Payload" }, /* Reassigned with RFC3547; formerly: draft-ietf-ipsec-nat-t-ike-04 to 08 */ |
758 | | { PLOAD_IKE_SAT,PLOAD_IKE_SAT, "SA TEK Payload"}, /* Reassigned with RFC3547; formerly: draft-ietf-ipsec-nat-t-ike-05 to 08*/ |
759 | | { PLOAD_IKE_KD,PLOAD_IKE_KD, "Key Download" }, |
760 | | { PLOAD_IKE_SEQ,PLOAD_IKE_SEQ, "Sequence Number" }, |
761 | | { PLOAD_IKE_POP,PLOAD_IKE_POP, "Proof of Possession" }, /* According to RFC6407 deprecated */ |
762 | | { PLOAD_IKE_NAT_D,PLOAD_IKE_NAT_D, "NAT-D (RFC 3947)" }, |
763 | | { PLOAD_IKE_NAT_OA,PLOAD_IKE_NAT_OA, "NAT-OA (RFC 3947)"}, |
764 | | { PLOAD_IKE_GAP,PLOAD_IKE_GAP, "Group Associated Policy"}, |
765 | | { PLOAD_IKE2_SA,PLOAD_IKE2_SA, "Security Association"}, |
766 | | { PLOAD_IKE2_KE,PLOAD_IKE2_KE, "Key Exchange"}, |
767 | | { PLOAD_IKE2_IDI,PLOAD_IKE2_IDI, "Identification - Initiator"}, |
768 | | { PLOAD_IKE2_IDR,PLOAD_IKE2_IDR, "Identification - Responder"}, |
769 | | { PLOAD_IKE2_CERT,PLOAD_IKE2_CERT, "Certificate"}, |
770 | | { PLOAD_IKE2_CERTREQ,PLOAD_IKE2_CERTREQ, "Certificate Request"}, |
771 | | { PLOAD_IKE2_AUTH,PLOAD_IKE2_AUTH, "Authentication"}, |
772 | | { PLOAD_IKE2_NONCE,PLOAD_IKE2_NONCE, "Nonce"}, |
773 | | { PLOAD_IKE2_N,PLOAD_IKE2_N, "Notify"}, |
774 | | { PLOAD_IKE2_D,PLOAD_IKE2_D, "Delete"}, |
775 | | { PLOAD_IKE2_V,PLOAD_IKE2_V, "Vendor ID"}, |
776 | | { PLOAD_IKE2_TSI,PLOAD_IKE2_TSI, "Traffic Selector - Initiator"}, |
777 | | { PLOAD_IKE2_TSR,PLOAD_IKE2_TSR, "Traffic Selector - Responder"}, |
778 | | { PLOAD_IKE2_SK,PLOAD_IKE2_SK, "Encrypted and Authenticated"}, |
779 | | { PLOAD_IKE2_CP,PLOAD_IKE2_CP, "Configuration"}, |
780 | | { PLOAD_IKE2_EAP,PLOAD_IKE2_EAP, "Extensible Authentication"}, |
781 | | { PLOAD_IKE2_GSPM,PLOAD_IKE2_GSPM, "Generic Secure Password Method"}, |
782 | | { PLOAD_IKE2_IDG,PLOAD_IKE2_IDG, "Group Identification"}, |
783 | | { PLOAD_IKE2_GSA,PLOAD_IKE2_GSA, "Group Security Association"}, |
784 | | { PLOAD_IKE2_KD,PLOAD_IKE2_KD, "Key Download"}, |
785 | | { PLOAD_IKE2_SKF,PLOAD_IKE2_SKF, "Encrypted and Authenticated Fragment"}, |
786 | | { PLOAD_IKE2_PS,PLOAD_IKE2_PS, "Puzzle Solution"}, |
787 | | { 55,127, "Unassigned" }, |
788 | | { PLOAD_IKE_SK,PLOAD_IKE_SK, "Symmetric-key"}, |
789 | | { 129,129, "Private Use" }, |
790 | | { PLOAD_IKE_NAT_D13,PLOAD_IKE_NAT_D13, "NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03)"}, |
791 | | { PLOAD_IKE_NAT_OA14,PLOAD_IKE_NAT_OA14, "NAT-OA (draft-ietf-ipsec-nat-t-ike-01 to 03)"}, |
792 | | { PLOAD_IKE_CISCO_FRAG,PLOAD_IKE_CISCO_FRAG, "Cisco-Fragmentation"}, |
793 | | { 133,256, "Private Use" }, |
794 | | { 0,0, NULL }, |
795 | | }; |
796 | | |
797 | | /* |
798 | | * ISAKMP Domain of Interpretation (DOI) |
799 | | * RFC2408 for ISAKMP |
800 | | * RFC2407 for IPSEC |
801 | | * RFC3547 for GDOI |
802 | | */ |
803 | | static const value_string doi_type[] = { |
804 | | { 0, "ISAKMP" }, |
805 | | { 1, "IPSEC" }, |
806 | | { 2, "GDOI" }, |
807 | | { 0, NULL }, |
808 | | }; |
809 | | |
810 | | /* Transform Type */ |
811 | | |
812 | 19 | #define IPSEC_ATTR_LIFE_TYPE 1 |
813 | 91 | #define IPSEC_ATTR_LIFE_DURATION 2 |
814 | 10 | #define IPSEC_ATTR_GROUP_DESC 3 |
815 | 40 | #define IPSEC_ATTR_ENCAP_MODE 4 |
816 | 18 | #define IPSEC_ATTR_AUTH_ALGORITHM 5 |
817 | 23 | #define IPSEC_ATTR_KEY_LENGTH 6 |
818 | 9 | #define IPSEC_ATTR_KEY_ROUNDS 7 |
819 | 4 | #define IPSEC_ATTR_CMPR_DICT_SIZE 8 |
820 | 15 | #define IPSEC_ATTR_CMPR_ALGORITHM 9 |
821 | 7 | #define IPSEC_ATTR_ECN_TUNNEL 10 /* [RFC3168] */ |
822 | 13 | #define IPSEC_ATTR_EXT_SEQ_NBR 11 /* [RFC4304] */ |
823 | 14 | #define IPSEC_ATTR_AUTH_KEY_LENGTH 12 /* [RFC4359] */ |
824 | 7 | #define IPSEC_ATTR_SIG_ENCO_ALGORITHM 13 /* [RFC4359] */ |
825 | 5 | #define IPSEC_ATTR_ADDR_PRESERVATION 14 /* [RFC6407] */ |
826 | 8 | #define IPSEC_ATTR_SA_DIRECTION 15 /* [RFC6407] */ |
827 | | |
828 | | static const range_string ipsec_attr_type[] = { |
829 | | { 1,1, "SA-Life-Type" }, |
830 | | { 2,2, "SA-Life-Duration" }, |
831 | | { 3,3, "Group-Description" }, |
832 | | { 4,4, "Encapsulation-Mode" }, |
833 | | { 5,5, "Authentication-Algorithm" }, |
834 | | { 6,6, "Key-Length" }, |
835 | | { 7,7, "Key-Rounds" }, |
836 | | { 8,8, "Compress-Dictionary-Size" }, |
837 | | { 9,9, "Compress-Private-Algorithm" }, |
838 | | { 10,10, "ECN Tunnel" }, |
839 | | { 11,11, "Extended (64-bit) Sequence Number" }, |
840 | | { 12,12, "Authentication Key Length" }, |
841 | | { 13,13, "Signature Encoding Algorithm" }, |
842 | | { 14,14, "Address Preservation" }, |
843 | | { 15,15, "SA Direction" }, |
844 | | { 16,32000, "Unassigned (Future use)" }, |
845 | | { 32001,32767, "Private use" }, |
846 | | { 0,0, NULL }, |
847 | | }; |
848 | | |
849 | | #define KEY_ATTR_TEK_RSERVED 0 |
850 | | #define KEY_ATTR_TEK_ALGORITHM 1 |
851 | | #define KEY_ATTR_TEK_INTEGRITY 2 |
852 | | #define KEY_ATTR_TEK_SRC_AUTH 3 |
853 | | |
854 | | static const range_string tek_key_attr_type[] = { |
855 | | { 1,1, "TEK_ALGORITHM_KEY" }, |
856 | | { 2,2, "TEK_INTEGRITY_KEY" }, |
857 | | { 3,3, "TEK_SOURCE_AUTH_KEY" }, |
858 | | { 4,137, "Unassigned (Future use)" }, |
859 | | { 128,255, "Private use" }, |
860 | | { 256,32767, "Unassigned (Future use)" }, |
861 | | { 0,0, NULL }, |
862 | | }; |
863 | | |
864 | | /* Transform IKE Type */ |
865 | 11 | #define IKE_ATTR_ENCRYPTION_ALGORITHM 1 |
866 | 22 | #define IKE_ATTR_HASH_ALGORITHM 2 |
867 | 14 | #define IKE_ATTR_AUTHENTICATION_METHOD 3 |
868 | 42 | #define IKE_ATTR_GROUP_DESCRIPTION 4 |
869 | 8 | #define IKE_ATTR_GROUP_TYPE 5 |
870 | 13 | #define IKE_ATTR_GROUP_PRIME 6 |
871 | 6 | #define IKE_ATTR_GROUP_GENERATOR_ONE 7 |
872 | 0 | #define IKE_ATTR_GROUP_GENERATOR_TWO 8 |
873 | 8 | #define IKE_ATTR_GROUP_CURVE_A 9 |
874 | 13 | #define IKE_ATTR_GROUP_CURVE_B 10 |
875 | 12 | #define IKE_ATTR_LIFE_TYPE 11 |
876 | 15 | #define IKE_ATTR_LIFE_DURATION 12 |
877 | 4 | #define IKE_ATTR_PRF 13 |
878 | 10 | #define IKE_ATTR_KEY_LENGTH 14 |
879 | 7 | #define IKE_ATTR_FIELD_SIZE 15 |
880 | 10 | #define IKE_ATTR_GROUP_ORDER 16 |
881 | 4 | #define IKE_ATTR_BLOCK_SIZE 17 |
882 | 5 | #define IKE_ATTR_ACAT 20 |
883 | | |
884 | | |
885 | | |
886 | | static const range_string ike_attr_type[] = { |
887 | | { 1,1, "Encryption-Algorithm" }, |
888 | | { 2,2, "Hash-Algorithm" }, |
889 | | { 3,3, "Authentication-Method" }, |
890 | | { 4,4, "Group-Description" }, |
891 | | { 5,5, "Group-Type" }, |
892 | | { 6,6, "Group-Prime" }, |
893 | | { 7,7, "Group-Generator-One" }, |
894 | | { 8,8, "Group-Generator-Two" }, |
895 | | { 9,9, "Group-Curve-A" }, |
896 | | { 10,10, "Group-Curve-B" }, |
897 | | { 11,11, "Life-Type" }, |
898 | | { 12,12, "Life-Duration" }, |
899 | | { 13,13, "PRF" }, |
900 | | { 14,14, "Key-Length" }, |
901 | | { 15,15, "Field-Size" }, |
902 | | { 16,16, "Group-Order" }, |
903 | | { 17,17, "Block-Size" }, |
904 | | { 18,19, "Unassigned (Future use)" }, |
905 | | { 20,20, "Asymmetric-Cryptographic-Algorithm-Type" }, |
906 | | { 21,16383, "Unassigned (Future use)" }, |
907 | | { 16384,32767, "Private use" }, |
908 | | { 0,0, NULL }, |
909 | | }; |
910 | | |
911 | | #if 0 |
912 | | static const value_string vs_v2_sttr[] = { |
913 | | { 1, "SA-Life-Type" }, |
914 | | { 2, "SA-Life-Duration" }, |
915 | | { 3, "Group-Description" }, |
916 | | { 4, "Encapsulation-Mode" }, |
917 | | { 5, "Authentication-Algorithm" }, |
918 | | { 6, "Key-Length" }, |
919 | | { 7, "Key-Rounds" }, |
920 | | { 8, "Compress-Dictionary-Size" }, |
921 | | { 9, "Compress-Private-Algorithm" }, |
922 | | { 10, "ECN Tunnel" }, |
923 | | { 0, NULL }, |
924 | | }; |
925 | | #endif |
926 | | |
927 | | static const value_string vs_v1_trans_isakmp[] = { |
928 | | { 0, "RESERVED" }, |
929 | | { 1, "KEY_IKE" }, |
930 | | { 0, NULL }, |
931 | | }; |
932 | | |
933 | | static const value_string vs_v1_trans_ah[] = { |
934 | | { 0, "RESERVED" }, |
935 | | { 1, "RESERVED" }, |
936 | | { 2, "MD5" }, |
937 | | { 3, "SHA" }, |
938 | | { 4, "DES" }, |
939 | | { 5, "SHA2-256" }, |
940 | | { 6, "SHA2-384" }, |
941 | | { 7, "SHA2-512" }, |
942 | | { 0, NULL }, |
943 | | }; |
944 | | |
945 | | static const value_string vs_v1_trans_esp[] = { |
946 | | { 0, "RESERVED" }, |
947 | | { 1, "DES-IV64" }, |
948 | | { 2, "DES" }, |
949 | | { 3, "3DES" }, |
950 | | { 4, "RC5" }, |
951 | | { 5, "IDEA" }, |
952 | | { 6, "CAST" }, |
953 | | { 7, "BLOWFISH" }, |
954 | | { 8, "3IDEA" }, |
955 | | { 9, "DES-IV32" }, |
956 | | { 10, "RC4" }, |
957 | | { 11, "NULL" }, |
958 | | { 12, "AES" }, |
959 | | { 0, NULL }, |
960 | | }; |
961 | | |
962 | | static const value_string transform_id_ipcomp[] = { |
963 | | { 0, "RESERVED" }, |
964 | | { 1, "OUI" }, |
965 | | { 2, "DEFLATE" }, |
966 | | { 3, "LZS" }, |
967 | | { 4, "LZJH" }, |
968 | | /* |
969 | | 5-240 UNASSIGNED [RFC7296] |
970 | | 241-255 PRIVATE USE [RFC7296] |
971 | | */ |
972 | | { 0, NULL }, |
973 | | }; |
974 | | static const value_string redirect_gateway_identity_type[] = { |
975 | | { 1, "IPv4 address" }, |
976 | | { 2, "IPv6 address" }, |
977 | | { 3, "FQDN" }, |
978 | | /* |
979 | | 4-240 UNASSIGNED [RFC5685] |
980 | | 241-255 PRIVATE USE [RFC5685] |
981 | | */ |
982 | | { 0, NULL }, |
983 | | }; |
984 | | static const value_string attr_life_type[] = { |
985 | | { 0, "RESERVED" }, |
986 | | { 1, "Seconds" }, |
987 | | { 2, "Kilobytes" }, |
988 | | { 0, NULL }, |
989 | | }; |
990 | | |
991 | | static const value_string ipsec_attr_encap_mode[] = { |
992 | | { 0, "RESERVED" }, |
993 | | { 1, "Tunnel" }, |
994 | | { 2, "Transport" }, |
995 | | { 3, "UDP-Encapsulated-Tunnel" }, /* RFC3947 */ |
996 | | { 4, "UDP-Encapsulated-Transport" }, /* RFC3947 */ |
997 | | { 61440, "Check Point IPSec UDP Encapsulation" }, |
998 | | { 61443, "UDP-Encapsulated-Tunnel (draft)" }, |
999 | | { 61444, "UDP-Encapsulated-Transport (draft)" }, |
1000 | | { 0, NULL }, |
1001 | | }; |
1002 | | |
1003 | | static const value_string ipsec_attr_auth_algo[] = { |
1004 | | { 0, "RESERVED" }, |
1005 | | { 1, "HMAC-MD5" }, |
1006 | | { 2, "HMAC-SHA" }, |
1007 | | { 3, "DES-MAC" }, |
1008 | | { 4, "KPDK" }, |
1009 | | { 5, "HMAC-SHA2-256" }, |
1010 | | { 6, "HMAC-SHA2-384" }, |
1011 | | { 7, "HMAC-SHA2-512" }, |
1012 | | { 8, "HMAC-RIPEMD" }, /* [RFC2857] */ |
1013 | | { 9, "AES-XCBC-MAC" }, /* [RFC3566] */ |
1014 | | { 10, "SIG-RSA" }, /* [RFC4359] */ |
1015 | | { 11, "AES-128-GMAC" }, /* [RFC4543][Errata1821] */ |
1016 | | { 12, "AES-192-GMAC" }, /* [RFC4543][Errata1821] */ |
1017 | | { 13, "AES-256-GMAC" }, /* [RFC4543][Errata1821] */ |
1018 | | |
1019 | | /* |
1020 | | Values 11-61439 are reserved to IANA. Values 61440-65535 are |
1021 | | for private use. |
1022 | | */ |
1023 | | { 0, NULL }, |
1024 | | }; |
1025 | | |
1026 | 0 | #define ENC_DES_CBC 1 |
1027 | | #define ENC_IDEA_CBC 2 |
1028 | | #define ENC_BLOWFISH_CBC 3 |
1029 | | #define ENC_RC5_R16_B64_CBC 4 |
1030 | 0 | #define ENC_3DES_CBC 5 |
1031 | | #define ENC_CAST_CBC 6 |
1032 | 0 | #define ENC_AES_CBC 7 |
1033 | | #define ENC_CAMELLIA_CBC 8 |
1034 | | #define ENC_SM4_CBC_DEPRECATED 127 |
1035 | 28 | #define ENC_SM1_CBC 128 |
1036 | 14 | #define ENC_SM4_CBC 129 |
1037 | | |
1038 | | static const value_string ike_attr_enc_algo[] = { |
1039 | | { 0, "RESERVED" }, |
1040 | | { ENC_DES_CBC, "DES-CBC" }, |
1041 | | { ENC_IDEA_CBC, "IDEA-CBC" }, |
1042 | | { ENC_BLOWFISH_CBC, "BLOWFISH-CBC" }, |
1043 | | { ENC_RC5_R16_B64_CBC, "RC5-R16-B64-CBC" }, |
1044 | | { ENC_3DES_CBC, "3DES-CBC" }, |
1045 | | { ENC_CAST_CBC, "CAST-CBC" }, |
1046 | | { ENC_AES_CBC, "AES-CBC" }, |
1047 | | { ENC_CAMELLIA_CBC, "CAMELLIA-CBC" }, |
1048 | | { ENC_SM4_CBC_DEPRECATED, "SM4-CBC (DEPRECATED)" }, |
1049 | | { ENC_SM1_CBC, "SM1-CBC" }, |
1050 | | { ENC_SM4_CBC, "SM4-CBC" }, |
1051 | | { 0, NULL }, |
1052 | | }; |
1053 | | |
1054 | 0 | #define HMAC_MD5 1 |
1055 | 0 | #define HMAC_SHA 2 |
1056 | | #define HMAC_TIGER 3 |
1057 | 0 | #define HMAC_SHA2_256 4 |
1058 | 0 | #define HMAC_SHA2_384 5 |
1059 | 0 | #define HMAC_SHA2_512 6 |
1060 | 28 | #define HMAC_SM3 20 |
1061 | | |
1062 | | static const value_string ike_attr_hash_algo[] = { |
1063 | | { 0, "RESERVED" }, |
1064 | | { HMAC_MD5, "MD5" }, |
1065 | | { HMAC_SHA, "SHA" }, |
1066 | | { HMAC_TIGER, "TIGER" }, |
1067 | | { HMAC_SHA2_256, "SHA2-256" }, |
1068 | | { HMAC_SHA2_384, "SHA2-384" }, |
1069 | | { HMAC_SHA2_512, "SHA2-512" }, |
1070 | | { HMAC_SM3, "SM3" }, |
1071 | | { 0, NULL }, |
1072 | | }; |
1073 | | |
1074 | | #define ASYMMETRIC_RSA 1 |
1075 | | #define ASYMMETRIC_SM2 2 |
1076 | | |
1077 | | static const value_string ike_attr_asym_algo[] = { |
1078 | | { ASYMMETRIC_RSA, "RSA" }, |
1079 | | { ASYMMETRIC_SM2, "SM2" }, |
1080 | | { 0, NULL }, |
1081 | | }; |
1082 | | |
1083 | | static const value_string ipsec_attr_ecn_tunnel[] = { |
1084 | | { 0, "RESERVED" }, |
1085 | | { 1, "Allowed" }, |
1086 | | { 2, "Forbidden" }, |
1087 | | { 0, NULL }, |
1088 | | }; |
1089 | | |
1090 | | static const value_string ipsec_attr_ext_seq_nbr[] = { |
1091 | | { 0, "RESERVED" }, |
1092 | | { 1, "64-bit Sequence Number" }, |
1093 | | { 0, NULL }, |
1094 | | }; |
1095 | | |
1096 | | #if 0 |
1097 | | static const value_string transform_attr_sig_enco_algo_type[] = { |
1098 | | { 0, "RESERVED" }, |
1099 | | { 1, "RSASSA-PKCS1-v1_5" }, |
1100 | | { 2, "RSASSA-PSS" }, |
1101 | | { 0, NULL }, |
1102 | | }; |
1103 | | #endif |
1104 | | |
1105 | | static const value_string ipsec_attr_addr_preservation[] = { |
1106 | | { 0, "Reserved" }, |
1107 | | { 1, "None" }, |
1108 | | { 2, "Source-Only" }, |
1109 | | { 3, "Destination-Only" }, |
1110 | | { 4, "Source-and-Destination" }, |
1111 | | { 0, NULL }, |
1112 | | }; |
1113 | | |
1114 | | static const value_string ipsec_attr_sa_direction[] = { |
1115 | | { 0, "Reserved" }, |
1116 | | { 1, "Sender-Only" }, |
1117 | | { 2, "Receiver-Only" }, |
1118 | | { 3, "Symmetric" }, |
1119 | | { 0, NULL }, |
1120 | | }; |
1121 | | |
1122 | | static const value_string ike_attr_authmeth[] = { |
1123 | | /* ipsec-registry.xhtml */ |
1124 | | { 0, "RESERVED" }, |
1125 | | { 1, "Pre-shared key" }, |
1126 | | { 2, "DSS signatures" }, |
1127 | | { 3, "RSA signatures" }, |
1128 | | { 4, "Encryption with RSA" }, |
1129 | | { 5, "Revised encryption with RSA" }, |
1130 | | { 6, "Reserved (was Encryption with El-Gamal)" }, |
1131 | | { 7, "Reserved (was Revised encryption with El-Gamal)" }, |
1132 | | { 8, "Reserved (was ECDSA signatures)" }, |
1133 | | { 9, "ECDSA with SHA-256 on the P-256 curve" }, |
1134 | | { 10, "ECDSA with SHA-384 on the P-384 curve" }, |
1135 | | { 11, "ECDSA with SHA-512 on the P-521 curve" }, |
1136 | | /* draft-ietf-ipsec-isakmp-hybrid-auth-05 */ |
1137 | | { 64221, "HybridInitRSA" }, |
1138 | | { 64222, "HybridRespRSA" }, |
1139 | | { 64223, "HybridInitDSS" }, |
1140 | | { 64224, "HybridRespDSS" }, |
1141 | | /* draft-beaulieu-ike-xauth-02 */ |
1142 | | { 65001, "XAUTHInitPreShared" }, |
1143 | | { 65002, "XAUTHRespPreShared" }, |
1144 | | { 65003, "XAUTHInitDSS" }, |
1145 | | { 65004, "XAUTHRespDSS" }, |
1146 | | { 65005, "XAUTHInitRSA" }, |
1147 | | { 65006, "XAUTHRespRSA" }, |
1148 | | { 65007, "XAUTHInitRSAEncryption" }, |
1149 | | { 65008, "XAUTHRespRSAEncryption" }, |
1150 | | { 65009, "XAUTHInitRSARevisedEncryption" }, |
1151 | | { 65010, "XAUTHRespRSARevisedEncryption" }, |
1152 | | { 0, NULL }, |
1153 | | }; |
1154 | | |
1155 | | /* For GM/T 0022 IPSec VPN specification |
1156 | | This specification only define one value for authmeth |
1157 | | */ |
1158 | | static const value_string ike_attr_authmeth_china[] = { |
1159 | | { 10, "Digital Envelope" }, |
1160 | | { 0, NULL }, |
1161 | | }; |
1162 | | |
1163 | | /* This value string is used both by IKEv1 Group Description (Value 4) |
1164 | | * and IKEv2 Transform Type 4, formerly "Diffie-Hellman Group (D-H)", |
1165 | | * renamed by RFC 9370 to "Key Exchange Method (KE)". Unlike other IKE |
1166 | | * registries, the two are compatible. 3-4 are assigned in IKEv1 and |
1167 | | * Reserved in IKEv2. 6-13 were reserved per draft-ipsec-ike-ecc-groups |
1168 | | * but that I-D expired without being adopted and they are deprecated |
1169 | | * in IKEv1 and Unassigned in IKEv2. All entries starting with 31 are |
1170 | | * defined for IKEv2 only. This value string prefers the defined value |
1171 | | * over unassigned values when the two registries differ. That may |
1172 | | * change as RFC 9395 deprecated IKEv1. */ |
1173 | | static const value_string dh_group[] = { |
1174 | | { 0, "UNDEFINED - 0" }, |
1175 | | { 1, "Default 768-bit MODP group" }, /* DEPRECATED [RFC8247] */ |
1176 | | { 2, "Alternate 1024-bit MODP group" }, |
1177 | | { 3, "EC2N group on GP[2^155] group" }, |
1178 | | { 4, "EC2N group on GP[2^185] group" }, |
1179 | | { 5, "1536 bit MODP group" }, |
1180 | | { 6, "EC2N group over GF[2^163]" }, |
1181 | | { 7, "EC2N group over GF[2^163]" }, |
1182 | | { 8, "EC2N group over GF[2^283]" }, |
1183 | | { 9, "EC2N group over GF[2^283]" }, |
1184 | | { 10, "EC2N group over GF[2^409]" }, |
1185 | | { 11, "EC2N group over GF[2^409]" }, |
1186 | | { 12, "EC2N group over GF[2^571]" }, |
1187 | | { 13, "EC2N group over GF[2^571]" }, |
1188 | | { 14, "2048 bit MODP group" }, |
1189 | | { 15, "3072 bit MODP group" }, |
1190 | | { 16, "4096 bit MODP group" }, |
1191 | | { 17, "6144 bit MODP group" }, |
1192 | | { 18, "8192 bit MODP group" }, |
1193 | | { 19, "256-bit random ECP group" }, |
1194 | | { 20, "384-bit random ECP group" }, |
1195 | | { 21, "521-bit random ECP group" }, |
1196 | | { 22, "1024-bit MODP Group with 160-bit Prime Order Subgroup" }, |
1197 | | { 23, "2048-bit MODP Group with 224-bit Prime Order Subgroup" }, |
1198 | | { 24, "2048-bit MODP Group with 256-bit Prime Order Subgroup" }, |
1199 | | { 25, "192-bit Random ECP Group" }, |
1200 | | { 26, "224-bit Random ECP Group" }, |
1201 | | { 27, "224-bit Brainpool ECP group" }, |
1202 | | { 28, "256-bit Brainpool ECP group" }, |
1203 | | { 29, "384-bit Brainpool ECP group" }, |
1204 | | { 30, "512-bit Brainpool ECP group" }, |
1205 | | { 31, "Curve25519" }, |
1206 | | { 32, "Curve448" }, |
1207 | | { 33, "GOST3410_2012_256" }, |
1208 | | { 34, "GOST3410_2012_512" }, |
1209 | | { 35, "ML-KEM-512" }, |
1210 | | { 36, "ML-KEM-768" }, |
1211 | | { 37, "ML-KEM-1024" }, |
1212 | | { 0, NULL } |
1213 | | }; |
1214 | | |
1215 | | static const value_string ike_attr_grp_type[] = { |
1216 | | { 0, "UNDEFINED - 0" }, |
1217 | | { 1, "MODP" }, |
1218 | | { 2, "ECP" }, |
1219 | | { 3, "EC2N" }, |
1220 | | { 0, NULL }, |
1221 | | }; |
1222 | | |
1223 | 3 | #define TF_IKE2_ENCR 1 |
1224 | 1 | #define TF_IKE2_PRF 2 |
1225 | 1 | #define TF_IKE2_INTEG 3 |
1226 | 4 | #define TF_IKE2_KE 4 |
1227 | 24 | #define TF_IKE2_SN 5 |
1228 | | #define TF_IKE2_ADDKE1 6 |
1229 | | #define TF_IKE2_ADDKE2 7 |
1230 | | #define TF_IKE2_ADDKE3 8 |
1231 | | #define TF_IKE2_ADDKE4 9 |
1232 | | #define TF_IKE2_ADDKE5 10 |
1233 | | #define TF_IKE2_ADDKE6 11 |
1234 | | #define TF_IKE2_ADDKE7 12 |
1235 | 1 | #define TF_IKE2_KWA 13 |
1236 | 0 | #define TF_IKE2_GCAUTH 14 |
1237 | | |
1238 | | static const range_string transform_ike2_type[] = { |
1239 | | { 0,0, "RESERVED" }, |
1240 | | { TF_IKE2_ENCR,TF_IKE2_ENCR, "Encryption Algorithm (ENCR)" }, |
1241 | | { TF_IKE2_PRF,TF_IKE2_PRF, "Pseudo-random Function (PRF)"}, |
1242 | | { TF_IKE2_INTEG,TF_IKE2_INTEG, "Integrity Algorithm (INTEG)"}, |
1243 | | { TF_IKE2_KE,TF_IKE2_KE, "Key Exchange Method (KE)"}, |
1244 | | { TF_IKE2_SN,TF_IKE2_SN, "Sequence Numbers (SN)"}, |
1245 | | { TF_IKE2_ADDKE1,TF_IKE2_ADDKE1, "ADDKE1"}, |
1246 | | { TF_IKE2_ADDKE2,TF_IKE2_ADDKE2, "ADDKE2"}, |
1247 | | { TF_IKE2_ADDKE3,TF_IKE2_ADDKE3, "ADDKE3"}, |
1248 | | { TF_IKE2_ADDKE4,TF_IKE2_ADDKE4, "ADDKE4"}, |
1249 | | { TF_IKE2_ADDKE5,TF_IKE2_ADDKE5, "ADDKE5"}, |
1250 | | { TF_IKE2_ADDKE6,TF_IKE2_ADDKE6, "ADDKE6"}, |
1251 | | { TF_IKE2_ADDKE7,TF_IKE2_ADDKE7, "ADDKE7"}, |
1252 | | { TF_IKE2_KWA,TF_IKE2_KWA, "Key Wrap Algorithm (KWA)"}, |
1253 | | { TF_IKE2_GCAUTH,TF_IKE2_GCAUTH, "Group Controller Authentication Method (GCAUTH)"}, |
1254 | | { 13,240, "Reserved to IANA"}, |
1255 | | { 241,255, "Private Use"}, |
1256 | | { 0,0, NULL }, |
1257 | | }; |
1258 | | /* For Transform Type 1 (Encryption Algorithm), defined Transform IDs |
1259 | | * Some algorithms are deprecated in general; others are allowed to |
1260 | | * be negotiated for ESP but MUST NOT be used for IKE itself. */ |
1261 | | static const value_string transform_ike2_encr_type[] = { |
1262 | | { 0, "RESERVED" }, |
1263 | | { 1, "ENCR_DES_IV64" }, /* DEPRECATED [RFC9395] */ |
1264 | | { 2, "ENCR_DES" }, /* DEPRECATED [RFC9395] */ |
1265 | | { 3, "ENCR_3DES" }, |
1266 | | { 4, "ENCR_RC5" }, /* DEPRECATED [RFC9395] */ |
1267 | | { 5, "ENCR_IDEA" }, /* DEPRECATED [RFC9395] */ |
1268 | | { 6, "ENCR_CAST" }, /* DEPRECATED [RFC9395] */ |
1269 | | { 7, "ENCR_BLOWFISH" }, /* DEPRECATED [RFC9395] */ |
1270 | | { 8, "ENCR_3IDEA" }, /* DEPRECATED [RFC9395] */ |
1271 | | { 9, "ENCR_DES_IV32" }, /* DEPRECATED [RFC9395] */ |
1272 | | { 10, "RESERVED" }, |
1273 | | { 11, "ENCR_NULL" }, /* IKE MUST NOT */ |
1274 | | { 12, "ENCR_AES_CBC" }, |
1275 | | { 13, "ENCR_AES_CTR" }, /* [RFC3686] */ |
1276 | | { 14, "ENCR_AES-CCM_8" }, /* [RFC4309] */ |
1277 | | { 15, "ENCR-AES-CCM_12" }, /* [RFC4309] */ |
1278 | | { 16, "ENCR-AES-CCM_16" }, /* [RFC4309] */ |
1279 | | { 17, "UNASSIGNED" }, |
1280 | | { 18, "AES-GCM with a 8 octet ICV" }, /* [RFC4106] */ |
1281 | | { 19, "AES-GCM with a 12 octet ICV" }, /* [RFC4106] */ |
1282 | | { 20, "AES-GCM with a 16 octet ICV" }, /* [RFC4106] */ |
1283 | | { 21, "ENCR_NULL_AUTH_AES_GMAC" }, /* [RFC4543] IKE MUST NOT */ |
1284 | | { 22, "Reserved for IEEE P1619 XTS-AES" }, /* [Ball] */ |
1285 | | { 23, "ENCR_CAMELLIA_CBC" }, /* [RFC5529] */ |
1286 | | { 24, "ENCR_CAMELLIA_CTR" }, /* [RFC5529] */ |
1287 | | { 25, "ENCR_CAMELLIA_CCM with an 8-octet ICV" }, /* [RFC5529] */ |
1288 | | { 26, "ENCR_CAMELLIA_CCM with a 12-octet ICV" }, /* [RFC5529] */ |
1289 | | { 27, "ENCR_CAMELLIA_CCM with a 16-octet ICV" }, /* [RFC5529] */ |
1290 | | { 28, "ENCR_CHACHA20_POLY1305" }, /* [RFC7634] */ |
1291 | | { 29, "ENCR_AES_CCM_8_IIV" }, /* [RFC8750] IKE MUST NOT */ |
1292 | | { 30, "ENCR_AES_GCM_16_IIV" }, /* [RFC8750] IKE MUST NOT */ |
1293 | | { 31, "ENCR_CHACHA20_POLY1305_IIV" }, /* [RFC8750] IKE MUST NOT */ |
1294 | | { 32, "ENCR_KUZNYECHIK_MGM_KTREE" }, /* [RFC9227] */ |
1295 | | { 33, "ENCR_MAGMA_MGM_KTREE" }, /* [RFC9227] */ |
1296 | | { 34, "ENCR_KUZNYECHIK_MGM_MAC_KTREE" }, /* [RFC9227] IKE MUST NOT */ |
1297 | | { 35, "ENCR_MAGMA_MGM_MAC_KTREE" }, /* [RFC9227] IKE MUST NOT */ |
1298 | | /* |
1299 | | * 36-1023 RESERVED TO IANA [RFC4306] |
1300 | | * 1024-65535 PRIVATE USE [RFC4306] |
1301 | | */ |
1302 | | { 0, NULL }, |
1303 | | }; |
1304 | | |
1305 | | /* For Transform Type 2 (Pseudo-random Function), defined Transform IDs */ |
1306 | | static const value_string transform_ike2_prf_type[] = { |
1307 | | { 0, "RESERVED" }, |
1308 | | { 1, "PRF_HMAC_MD5" }, /* DEPRECATED [RFC8247] */ |
1309 | | { 2, "PRF_HMAC_SHA1" }, |
1310 | | { 3, "PRF_HMAC_TIGER" }, /* DEPRECATED [RFC9395] */ |
1311 | | { 4, "PRF_AES128_CBC" }, |
1312 | | { 5, "PRF_HMAC_SHA2_256" }, /* [RFC4868] */ |
1313 | | { 6, "PRF_HMAC_SHA2_384" }, /* [RFC4868] */ |
1314 | | { 7, "PRF_HMAC_SHA2_512" }, /* [RFC4868] */ |
1315 | | { 8, "PRF_AES128_CMAC6" }, /* [RFC4615] */ |
1316 | | { 9, "PRF_HMAC_STREEBOG_512" }, /* [RFC9385] */ |
1317 | | /* |
1318 | | 10-1023 RESERVED TO IANA [RFC4306] |
1319 | | 1024-65535 PRIVATE USE [RFC4306] |
1320 | | */ |
1321 | | { 0, NULL }, |
1322 | | }; |
1323 | | |
1324 | | /* For Transform Type 3 (Integrity Algorithm), defined Transform IDs */ |
1325 | | static const value_string transform_ike2_integ_type[] = { |
1326 | | { 0, "NONE" }, |
1327 | | { 1, "AUTH_HMAC_MD5_96" }, /* DEPRECATED [RFC8247] */ |
1328 | | { 2, "AUTH_HMAC_SHA1_96" }, |
1329 | | { 3, "AUTH_DES_MAC" }, /* DEPRECATED [RFC8247] */ |
1330 | | { 4, "AUTH_KPDK_MD5" }, /* DEPRECATED [RFC8247] */ |
1331 | | { 5, "AUTH_AES_XCBC_96" }, |
1332 | | { 6, "AUTH_HMAC_MD5_128" }, /* [RFC4595] DEPRECATED [RFC9395] */ |
1333 | | { 7, "AUTH_HMAC_SHA1_160" }, /* [RFC4595] DEPRECATED [RFC9395] */ |
1334 | | { 8, "AUTH_AES_CMAC_96" }, /* [RFC4494] */ |
1335 | | { 9, "AUTH_AES_128_GMAC" }, /* [RFC4543] */ |
1336 | | { 10, "AUTH_AES_192_GMAC" }, /* [RFC4543] */ |
1337 | | { 11, "AUTH_AES_256_GMAC" }, /* [RFC4543] */ |
1338 | | { 12, "AUTH_HMAC_SHA2_256_128" }, /* [RFC4868] */ |
1339 | | { 13, "AUTH_HMAC_SHA2_384_192" }, /* [RFC4868] */ |
1340 | | { 14, "AUTH_HMAC_SHA2_512_256" }, /* [RFC4868] */ |
1341 | | /* |
1342 | | 15-1023 RESERVED TO IANA [RFC4306] |
1343 | | 1024-65535 PRIVATE USE [RFC4306] |
1344 | | */ |
1345 | | { 0, NULL }, |
1346 | | }; |
1347 | | /* For Transform Type 5 (Sequence Numbers, formerly known as Extended |
1348 | | * Sequence Numbers, renamed in RFC 9827), defined Transform IDs */ |
1349 | | static const value_string transform_ike2_sn_type[] = { |
1350 | | { 0, "32-bit Sequential Numbers" }, |
1351 | | { 1, "Partially Transmitted 64-bit Sequential Numbers" }, |
1352 | | { 2, "32-bit Unspecified Numbers" }, /* [RFC9827] */ |
1353 | | /* |
1354 | | 3-1023 UNASSIGNED [RFC9827] |
1355 | | 1024-65535 PRIVATE USE [RFC9827] |
1356 | | */ |
1357 | | { 0, NULL }, |
1358 | | }; |
1359 | | /* For Transform Type 13 (Key Wrap Algorithm), defined Transform IDs [RFC 9838] */ |
1360 | | static const value_string transform_ike2_kwa_type[] = { |
1361 | | { 0, "Reserved" }, |
1362 | | { 1, "KW_5649_128" }, |
1363 | | { 2, "KW_5649_192" }, |
1364 | | { 3, "KW_5649_256" }, |
1365 | | { 4, "KW_ARX" }, |
1366 | | /* |
1367 | | 5-1023 UNASSIGNED |
1368 | | 1024-65535 PRIVATE USE |
1369 | | */ |
1370 | | { 0, NULL }, |
1371 | | }; |
1372 | | /* For Transform Type 14 (Group Controller Authentication Method), |
1373 | | * defined Transform IDs [RFC 9838] */ |
1374 | | static const value_string transform_ike2_gcauth_type[] = { |
1375 | | { 0, "Reserved" }, |
1376 | | { 1, "Implicit" }, |
1377 | | { 2, "Digital Signature" }, |
1378 | | /* |
1379 | | 3-1023 UNASSIGNED |
1380 | | 1024-65535 PRIVATE USE |
1381 | | */ |
1382 | | { 0, NULL }, |
1383 | | }; |
1384 | | /* Transform IKE2 Type */ |
1385 | 5 | #define IKE2_ATTR_KEY_LENGTH 14 |
1386 | | |
1387 | | static const range_string transform_ike2_attr_type[] = { |
1388 | | { 0,13, "Reserved" }, |
1389 | | { 14,14, "Key Length" }, |
1390 | | { 15,17, "Reserved" }, |
1391 | | { 18,18, "Signature Algorithm Identifier" }, |
1392 | | { 19,16383, "Unassigned (Future use)" }, |
1393 | | { 16384,32767, "Private use" }, |
1394 | | { 0,0, NULL }, |
1395 | | }; |
1396 | | |
1397 | | static const range_string cert_v1_type[] = { |
1398 | | { 0,0, "NONE" }, |
1399 | | { 1,1, "PKCS #7 wrapped X.509 certificate" }, |
1400 | | { 2,2, "PGP Certificate" }, |
1401 | | { 3,3, "DNS Signed Key" }, |
1402 | | { 4,4, "X.509 Certificate - Signature" }, |
1403 | | { 5,5, "X.509 Certificate - Key Exchange" }, |
1404 | | { 6,6, "Kerberos Tokens" }, |
1405 | | { 7,7, "Certificate Revocation List (CRL)" }, |
1406 | | { 8,8, "Authority Revocation List (ARL)" }, |
1407 | | { 9,9, "SPKI Certificate" }, |
1408 | | { 10,10, "X.509 Certificate - Attribute" }, |
1409 | | { 11,255, "RESERVED" }, |
1410 | | { 0,0, NULL }, |
1411 | | }; |
1412 | | |
1413 | | static const range_string cert_v2_type[] = { |
1414 | | { 0,0, "RESERVED" }, |
1415 | | { 1,1, "PKCS #7 wrapped X.509 certificate" }, |
1416 | | { 2,2, "PGP Certificate" }, |
1417 | | { 3,3, "DNS Signed Key" }, |
1418 | | { 4,4, "X.509 Certificate - Signature" }, |
1419 | | { 5,5, "*undefined by any document*" }, |
1420 | | { 6,6, "Kerberos Tokens" }, |
1421 | | { 7,7, "Certificate Revocation List (CRL)" }, |
1422 | | { 8,8, "Authority Revocation List (ARL)" }, |
1423 | | { 9,9, "SPKI Certificate" }, |
1424 | | { 10,10, "X.509 Certificate - Attribute" }, |
1425 | | { 11,11, "Raw RSA Key (DEPRECATED)" }, |
1426 | | { 12,12, "Hash and URL of X.509 certificate" }, |
1427 | | { 13,13, "Hash and URL of X.509 bundle" }, |
1428 | | { 14,14, "OCSP Content" }, /* [RFC4806] */ |
1429 | | { 15,15, "Raw Public Key" }, /* [RFC7670] */ |
1430 | | { 16,200, "RESERVED to IANA" }, |
1431 | | { 201,255, "PRIVATE USE" }, |
1432 | | { 0,0, NULL }, |
1433 | | }; |
1434 | | |
1435 | 278 | #define AUTH_METH_DIGITAL_SIGNATURE 14 |
1436 | | |
1437 | | static const range_string authmeth_v2_type[] = { |
1438 | | { 0,0, "RESERVED TO IANA" }, |
1439 | | { 1,1, "RSA Digital Signature" }, |
1440 | | { 2,2, "Shared Key Message Integrity Code" }, |
1441 | | { 3,3, "DSS Digital Signature" }, |
1442 | | { 4,8, "RESERVED TO IANA" }, |
1443 | | { 9,9, "ECDSA with SHA-256 on the P-256 curve" }, /* RFC4754 */ |
1444 | | { 10,10, "ECDSA with SHA-384 on the P-384 curve" }, /* RFC4754 */ |
1445 | | { 11,11, "ECDSA with SHA-512 on the P-521 curve" }, /* RFC4754 */ |
1446 | | { 12,12, "Generic Secure Password Authentication Method" }, /* RFC6467 */ |
1447 | | { 13,13, "NULL Authentication" }, /* RFC7619 */ |
1448 | | { 14,14, "Digital Signature" }, /* RFC7427 */ |
1449 | | { 15,200, "RESERVED TO IANA" }, |
1450 | | { 201,255, "PRIVATE USE" }, |
1451 | | { 0,0, NULL }, |
1452 | | }; |
1453 | | |
1454 | | static const range_string notifmsg_v1_type[] = { |
1455 | | { 0,0, "<UNKNOWN>" }, |
1456 | | { 1,1, "INVALID-PAYLOAD-TYPE" }, |
1457 | | { 2,2, "DOI-NOT-SUPPORTED" }, |
1458 | | { 3,3, "SITUATION-NOT-SUPPORTED" }, |
1459 | | { 4,4, "INVALID-COOKIE" }, |
1460 | | { 5,5, "INVALID-MAJOR-VERSION" }, |
1461 | | { 6,6, "INVALID-MINOR-VERSION" }, |
1462 | | { 7,7, "INVALID-EXCHANGE-TYPE" }, |
1463 | | { 8,8, "INVALID-FLAGS" }, |
1464 | | { 9,9, "INVALID-MESSAGE-ID" }, |
1465 | | { 10,10, "INVALID-PROTOCOL-ID" }, |
1466 | | { 11,11, "INVALID-SPI" }, |
1467 | | { 12,12, "INVALID-TRANSFORM-ID" }, |
1468 | | { 13,13, "ATTRIBUTES-NOT-SUPPORTED" }, |
1469 | | { 14,14, "NO-PROPOSAL-CHOSEN" }, |
1470 | | { 15,15, "BAD-PROPOSAL-SYNTAX" }, |
1471 | | { 16,16, "PAYLOAD-MALFORMED" }, |
1472 | | { 17,17, "INVALID-KEY-INFORMATION" }, |
1473 | | { 18,18, "INVALID-ID-INFORMATION" }, |
1474 | | { 19,19, "INVALID-CERT-ENCODING" }, |
1475 | | { 20,20, "INVALID-CERTIFICATE" }, |
1476 | | { 21,21, "CERT-TYPE-UNSUPPORTED" }, |
1477 | | { 22,22, "INVALID-CERT-AUTHORITY" }, |
1478 | | { 23,23, "INVALID-HASH-INFORMATION" }, |
1479 | | { 24,24, "AUTHENTICATION-FAILED" }, |
1480 | | { 25,25, "INVALID-SIGNATURE" }, |
1481 | | { 26,26, "ADDRESS-NOTIFICATION" }, |
1482 | | { 27,27, "NOTIFY-SA-LIFETIME" }, |
1483 | | { 28,28, "CERTIFICATE-UNAVAILABLE" }, |
1484 | | { 29,29, "UNSUPPORTED-EXCHANGE-TYPE" }, |
1485 | | { 30,30, "UNEQUAL-PAYLOAD-LENGTHS" }, |
1486 | | { 31,8191, "RESERVED (Future Use)" }, |
1487 | | { 8192,16383, "Private Use" }, |
1488 | | { 16384,16384,"CONNECTED" }, |
1489 | | { 16385,24575,"RESERVED (Future Use)" }, |
1490 | | { 24576,24576,"RESPONDER-LIFETIME" }, |
1491 | | { 24577,24577,"REPLAY-STATUS" }, |
1492 | | { 24578,24578,"INITIAL-CONTACT" }, |
1493 | | { 24579,32767,"DOI-specific codes" }, |
1494 | | { 32768,36135,"Private Use" }, |
1495 | | { 36136,36136,"R-U-THERE" }, |
1496 | | { 36137,36137,"R-U-THERE-ACK" }, |
1497 | | { 36138,40500,"Private Use" }, |
1498 | | { 40501,40501,"UNITY-LOAD-BALANCE" }, |
1499 | | { 40502,40502,"UNITY-UNKNOWN" }, |
1500 | | { 40503,40503,"UNITY-GROUP-HASH" }, |
1501 | | { 40503,40959,"Private Use" }, |
1502 | | { 40960,65535,"RESERVED (Future Use)" }, |
1503 | | { 0,0, NULL }, |
1504 | | }; |
1505 | | |
1506 | | static const range_string notifmsg_v2_type[] = { |
1507 | | { 0,0, "RESERVED" }, |
1508 | | { 1,1, "UNSUPPORTED_CRITICAL_PAYLOAD" }, |
1509 | | { 2,3, "RESERVED" }, |
1510 | | { 4,4, "INVALID_IKE_SPI" }, |
1511 | | { 5,5, "INVALID_MAJOR_VERSION" }, |
1512 | | { 6,6, "RESERVED" }, |
1513 | | { 7,7, "INVALID_SYNTAX" }, |
1514 | | { 8,8, "RESERVED" }, |
1515 | | { 9,9, "INVALID_MESSAGE_ID" }, |
1516 | | { 10,10, "RESERVED" }, |
1517 | | { 11,11, "INVALID_SPI" }, |
1518 | | { 12,13, "RESERVED" }, |
1519 | | { 14,14, "NO_PROPOSAL_CHOSEN" }, |
1520 | | { 15,16, "RESERVED" }, |
1521 | | { 17,17, "INVALID_KE_PAYLOAD" }, |
1522 | | { 18,23, "RESERVED" }, |
1523 | | { 24,24, "AUTHENTICATION_FAILED" }, |
1524 | | { 25,33, "RESERVED" }, |
1525 | | { 34,34, "SINGLE_PAIR_REQUIRED" }, |
1526 | | { 35,35, "NO_ADDITIONAL_SAS" }, |
1527 | | { 36,36, "INTERNAL_ADDRESS_FAILURE" }, |
1528 | | { 37,37, "FAILED_CP_REQUIRED" }, |
1529 | | { 38,38, "TS_UNACCEPTABLE" }, |
1530 | | { 39,39, "INVALID_SELECTORS" }, |
1531 | | { 40,40, "UNACCEPTABLE_ADDRESSES" }, /* RFC4555 */ |
1532 | | { 41,41, "UNEXPECTED_NAT_DETECTED" }, /* RFC4555 */ |
1533 | | { 42,42, "USE_ASSIGNED_HoA" }, /* RFC5026 */ |
1534 | | { 43,43, "TEMPORARY_FAILURE" }, /* RFC5996 */ |
1535 | | { 44,44, "CHILD_SA_NOT_FOUND" }, /* RFC5996 */ |
1536 | | { 45,45, "INVALID_GROUP_ID" }, /* RFC9838 */ |
1537 | | { 46,46, "AUTHORIZATION_FAILED"}, /* RFC9838 */ |
1538 | | { 47,47, "STATE_NOT_FOUND" }, /* RFC9370 */ |
1539 | | { 48,48, "TS_MAX_QUEUE" }, /* RFC9611 */ |
1540 | | { 49,49, "REGISTRATION_FAILED"}, /* RFC9838 */ |
1541 | | { 50,8191, "RESERVED TO IANA - Error types" }, |
1542 | | { 8192,16383, "Private Use - Errors" }, |
1543 | | { 16384,16384, "INITIAL_CONTACT" }, |
1544 | | { 16385,16385, "SET_WINDOW_SIZE" }, |
1545 | | { 16386,16386, "ADDITIONAL_TS_POSSIBLE" }, |
1546 | | { 16387,16387, "IPCOMP_SUPPORTED" }, |
1547 | | { 16388,16388, "NAT_DETECTION_SOURCE_IP" }, |
1548 | | { 16389,16389, "NAT_DETECTION_DESTINATION_IP" }, |
1549 | | { 16390,16390, "COOKIE" }, |
1550 | | { 16391,16391, "USE_TRANSPORT_MODE" }, |
1551 | | { 16392,16392, "HTTP_CERT_LOOKUP_SUPPORTED" }, |
1552 | | { 16393,16393, "REKEY_SA" }, |
1553 | | { 16394,16394, "ESP_TFC_PADDING_NOT_SUPPORTED" }, |
1554 | | { 16395,16395, "NON_FIRST_FRAGMENTS_ALSO" }, |
1555 | | { 16396,16396, "MOBIKE_SUPPORTED" }, /* RFC4555 */ |
1556 | | { 16397,16397, "ADDITIONAL_IP4_ADDRESS" }, /* RFC4555 */ |
1557 | | { 16398,16398, "ADDITIONAL_IP6_ADDRESS" }, /* RFC4555 */ |
1558 | | { 16399,16399, "NO_ADDITIONAL_ADDRESSES" }, /* RFC4555 */ |
1559 | | { 16400,16400, "UPDATE_SA_ADDRESSES" }, /* RFC4555 */ |
1560 | | { 16401,16401, "COOKIE2" }, /* RFC4555 */ |
1561 | | { 16402,16402, "NO_NATS_ALLOWED" }, /* RFC4555 */ |
1562 | | { 16403,16403, "AUTH_LIFETIME" }, /* RFC4478 */ |
1563 | | { 16404,16404, "MULTIPLE_AUTH_SUPPORTED" }, /* RFC4739 */ |
1564 | | { 16405,16405, "ANOTHER_AUTH_FOLLOWS" }, /* RFC4739 */ |
1565 | | { 16406,16406, "REDIRECT_SUPPORTED" }, /* RFC5685 */ |
1566 | | { 16407,16407, "REDIRECT" }, /* RFC5685 */ |
1567 | | { 16408,16408, "REDIRECTED_FROM" }, /* RFC5685 */ |
1568 | | { 16409,16409, "TICKET_LT_OPAQUE" }, /* RFC5723 */ |
1569 | | { 16410,16410, "TICKET_REQUEST" }, /* RFC5723 */ |
1570 | | { 16411,16411, "TICKET_ACK" }, /* RFC5723 */ |
1571 | | { 16412,16412, "TICKET_NACK" }, /* RFC5723 */ |
1572 | | { 16413,16413, "TICKET_OPAQUE" }, /* RFC5723 */ |
1573 | | { 16414,16414, "LINK_ID" }, /* RFC5739 */ |
1574 | | { 16415,16415, "USE_WESP_MODE" }, /* RFC5840 */ |
1575 | | { 16416,16416, "ROHC_SUPPORTED" }, /* RFC5857 */ |
1576 | | { 16417,16417, "EAP_ONLY_AUTHENTICATION" }, /* RFC5998 */ |
1577 | | { 16418,16418, "CHILDLESS_IKEV2_SUPPORTED" }, /* RFC6023 */ |
1578 | | { 16419,16419, "QUICK_CRASH_DETECTION" }, /* RFC6290 */ |
1579 | | { 16420,16420, "IKEV2_MESSAGE_ID_SYNC_SUPPORTED" }, /* RFC6311 */ |
1580 | | { 16421,16421, "IPSEC_REPLAY_COUNTER_SYNC_SUPPORTED" },/* RFC6311 */ |
1581 | | { 16422,16422, "IKEV2_MESSAGE_ID_SYNC" }, /* RFC6311 */ |
1582 | | { 16423,16423, "IPSEC_REPLAY_COUNTER_SYNC" }, /* RFC6311 */ |
1583 | | { 16424,16424, "SECURE_PASSWORD_METHODS" }, /* RFC6467 */ |
1584 | | { 16425,16425, "PSK_PERSIST" }, /* RFC6631 */ |
1585 | | { 16426,16426, "PSK_CONFIRM" }, /* RFC6631 */ |
1586 | | { 16427,16427, "ERX_SUPPORTED" }, /* RFC6867 */ |
1587 | | { 16428,16428, "IFOM_CAPABILITY" }, /* [Frederic_Firmin][3GPP TS 24.303 v10.6.0 annex B.2] */ |
1588 | | { 16429,16429, "SENDER_REQUEST_ID" }, /* [draft-yeung-g-ikev2] */ |
1589 | | { 16430,16430, "IKEV2_FRAGMENTATION_SUPPORTED" }, /* RFC7383 */ |
1590 | | { 16431,16431, "SIGNATURE_HASH_ALGORITHMS" }, /* RFC7427 */ |
1591 | | { 16432,16432, "CLONE_IKE_SA_SUPPORTED" }, /* [RFC7791] */ |
1592 | | { 16433,16433, "CLONE_IKE_SA" }, /* [RFC7791] */ |
1593 | | { 16434,16434, "PUZZLE" }, /* [RFC8019] */ |
1594 | | { 16435,16435, "USE_PPK" }, /* [RFC8784] */ |
1595 | | { 16436,16436, "PPK_IDENTITY" }, /* [RFC8784] */ |
1596 | | { 16437,16437, "NO_PPK_AUTH" }, |
1597 | | { 16438,16438, "INTERMEDIATE_EXCHANGE_SUPPORTED" }, /* RFC9242 */ |
1598 | | { 16439,16439, "IP4_ALLOWED" }, /* RFC8983 */ |
1599 | | { 16440,16440, "IP4_ALLOWED" }, /* RFC8983 */ |
1600 | | { 16441,16441, "ADDITIONAL_KEY_EXCHANGE" }, /* RFC9370 */ |
1601 | | { 16442,16442, "USE_AGGFRAG" }, /* RFC9347 */ |
1602 | | { 16443,16443, "SUPPORTED_AUTH_METHODS" }, /* RFC9593 */ |
1603 | | { 16444,16444, "SA_RESOURCE_INFO" }, /* RFC9611 */ |
1604 | | { 16445,16445, "USE_PPK_INIT" }, /* RFC9867 */ |
1605 | | { 16446,16446, "PPK_IDENTITY_KEY" }, /* RFC9867 */ |
1606 | | { 16447,40959, "RESERVED TO IANA - STATUS TYPES" }, |
1607 | | { 40960,65535, "Private Use - STATUS TYPES" }, |
1608 | | { 0,0, NULL }, |
1609 | | }; |
1610 | | |
1611 | | /* 3GPP private error and status types in Notify messages |
1612 | | * 3GPP TS 24.302 V16.0.0 (2019-03) |
1613 | | * 3GPP TS 24.502 V15.3.0 (2019-03) |
1614 | | * Note currently all private data types wil be decoded as 3GPP if that's not good enough a preference must be used |
1615 | | */ |
1616 | | static const range_string notifmsg_v2_3gpp_type[] = { |
1617 | | /* PRIVATE ERROR TYPES */ |
1618 | | { 8192,8192, "PDN_CONNECTION_REJECTION" }, /* TS 24.302 */ |
1619 | | { 8193,8193, "MAX_CONNECTION_REACHED" }, /* TS 24.302 */ |
1620 | | { 8194,8240, "Private Use - Errors" }, |
1621 | | { 8241,8241, "SEMANTIC_ERROR_IN_THE_TFT_OPERATION" }, /* TS 24.302 */ |
1622 | | { 8242,8242, "SYNTACTICAL_ERROR_IN_THE_TFT_OPERATION" }, /* TS 24.302 */ |
1623 | | { 8243,8243, "Private Use - Errors" }, |
1624 | | { 8244,8244, "SEMANTIC_ERRORS_IN_PACKET_FILTERS" }, /* TS 24.302 */ |
1625 | | { 8245,8245, "SYNTACTICAL_ERRORS_IN_PACKET_FILTERS" }, /* TS 24.302 */ |
1626 | | { 8246,8999, "Private Use - Errors" }, |
1627 | | { 9000,9000, "NON_3GPP_ACCESS_TO_EPC_NOT_ALLOWED" }, /* TS 24.302 */ |
1628 | | { 9001,9001, "USER_UNKNOWN" }, /* TS 24.302 */ |
1629 | | { 9002,9002, "NO_APN_SUBSCRIPTION" }, |
1630 | | { 9003,9003, "AUTHORIZATION_REJECTED" }, /* TS 24.302 */ |
1631 | | { 9004,9005, "Private Use - Errors" }, |
1632 | | { 9006,9006, "ILLEGAL_ME" }, /* TS 24.302 */ |
1633 | | { 9007,10499, "Private Use - Errors" }, |
1634 | | { 10500,10500, "NETWORK_FAILURE" }, /* TS 24.302 */ |
1635 | | { 10501,11000, "Private Use - Errors" }, |
1636 | | { 11001,11001, "RAT_TYPE_NOT_ALLOWED" }, /* TS 24.302 */ |
1637 | | { 11002,11004, "Private Use - Errors" }, |
1638 | | { 11005,11005, "IMEI_NOT_ACCEPTED" }, /* TS 24.302 */ |
1639 | | { 11006,11010, "Private Use - Errors" }, |
1640 | | { 11011,11011, "PLMN_NOT_ALLOWED" }, /* TS 24.302 */ |
1641 | | { 11012,11054, "Private Use - Errors" }, |
1642 | | { 11055,11055, "UNAUTHENTICATED_EMERGENCY_NOT_SUPPORTED" }, /* TS 24.302 */ |
1643 | | { 11056,15499, "Private Use - Errors" }, |
1644 | | { 15500,15500, "CONGESTION" }, /* TS 24.502 */ |
1645 | | { 15501,16383, "Private Use - Errors" }, |
1646 | | /* PRIVATE STATUS TYPES */ |
1647 | | { 40960,40960, "Private Use - STATUS TYPES" }, |
1648 | | { 40961,40961, "REACTIVATION_REQUESTED_CAUSE" }, /* TS 24.302 */ |
1649 | | { 40962,41040, "Private Use - STATUS TYPES" }, |
1650 | | { 41041,41041, "BACKOFF_TIMER" }, /* TS 24.302 */ |
1651 | | { 41042,41049, "Private Use - STATUS TYPES" }, |
1652 | | { 41050,41050, "PDN_TYPE_IPv4_ONLY_ALLOWED" }, /* TS 24.302 */ |
1653 | | { 41051,41051, "PDN_TYPE_IPv6_ONLY_ALLOWED" }, /* TS 24.302 */ |
1654 | | { 41052,41100, "Private Use - STATUS TYPES" }, |
1655 | | { 41101,41101, "DEVICE_IDENTITY" }, /* TS 24.302 */ |
1656 | | { 41102,41111, "Private Use - STATUS TYPES" }, |
1657 | | { 41112,41112, "EMERGENCY_SUPPORT" }, /* TS 24.302 */ |
1658 | | { 41113,41133, "Private Use - STATUS TYPES" }, |
1659 | | { 41134,41134, "EMERGENCY_CALL_NUMBERS" }, /* TS 24.302 */ |
1660 | | { 41135,41287, "Private Use - STATUS TYPES" }, |
1661 | | { 41288,41288, "NBIFOM_GENERIC_CONTAINER" }, /* TS 24.302 */ |
1662 | | { 41289,41303, "Private Use - STATUS TYPES" }, |
1663 | | { 41304,41304, "P-CSCF_RESELECTION_SUPPORT" }, /* TS 24.302 */ |
1664 | | { 41305,41500, "Private Use - STATUS TYPES" }, |
1665 | | { 41501,41501, "PTI" }, /* TS 24.302 */ |
1666 | | { 41502,42010, "Private Use - STATUS TYPES" }, |
1667 | | { 42011,42011, "P-IKEV2_MULTIPLE_BEARER_PDN_CONNECTIVITY" }, /* TS 24.302 */ |
1668 | | { 42012,42013, "Private Use - STATUS TYPES" }, |
1669 | | { 42014,42014, "P-EPS_QOS" }, /* TS 24.302 */ |
1670 | | { 42015,42015, "P-EXTENDED_EPS_QOS" }, /* TS 24.302 */ |
1671 | | { 42016,42016, "Private Use - STATUS TYPES" }, |
1672 | | { 42017,42017, "P-TFT" }, /* TS 24.302 */ |
1673 | | { 42018,42019, "Private Use - STATUS TYPES" }, |
1674 | | { 42020,42020, "P-MODIFIED_BEARER" }, /* TS 24.302 */ |
1675 | | { 42021,42093, "Private Use - STATUS TYPES" }, |
1676 | | { 42094,42094, "P-APN_AMBR" }, /* TS 24.302 */ |
1677 | | { 42095,42095, "P-EXTENDED_APN_AMBR" }, /* TS 24.302 */ |
1678 | | { 42096,51014, "Private Use - STATUS TYPES" }, |
1679 | | { 51015,51015, "P-N1_MODE_CAPABILITY" }, /* TS 24.302 */ |
1680 | | { 51016,51114, "Private Use - STATUS TYPES" }, |
1681 | | { 51115,51115, "P-N1_MODE_INFORMATION" }, /* TS 24.302 */ |
1682 | | { 51116,55500, "Private Use - STATUS TYPES" }, |
1683 | | { 55501,55501, "5G_QOS_INFO" }, /* TS 24.502 */ |
1684 | | { 55502,55502, "NAS_IP4_ADDRESS" }, /* TS 24.502 */ |
1685 | | { 55503,55503, "NAS_IP6_ADDRESS" }, /* TS 24.502 */ |
1686 | | { 55504,55504, "UP_IP4_ADDRESS" }, /* TS 24.502 */ |
1687 | | { 55505,55505, "UP_IP6_ADDRESS" }, /* TS 24.502 */ |
1688 | | { 55506,55506, "NAS_TCP_PORT" }, /* TS 24.502 */ |
1689 | | { 55507,55507, "N3GPP_BACKOFF_TIMER" }, /* TS 24.502 */ |
1690 | | { 55508,61471, "Private Use - STATUS TYPES" }, |
1691 | | { 61472,61472, "Auto-Discovery Sender (Fortinet)" }, |
1692 | | { 61473,61473, "Auto-Discovery Receiver (Fortinet)" }, |
1693 | | { 61474,61519, "Private Use - STATUS TYPES" }, |
1694 | | { 61520,61520, "Network Overlay ID (Fortinet)" }, |
1695 | | { 61521,61695, "Private Use - STATUS TYPES" }, |
1696 | | { 61696,61696, "FORTICLIENT_CONNECT" }, |
1697 | | { 61697,65535, "Private Use - STATUS TYPES" }, |
1698 | | { 0,0, NULL }, |
1699 | | }; |
1700 | | |
1701 | | static const range_string vs_v1_cfgtype[] = { |
1702 | | { 0,0, "Reserved" }, |
1703 | | { 1,1, "ISAKMP_CFG_REQUEST" }, |
1704 | | { 2,2, "ISAKMP_CFG_REPLY" }, |
1705 | | { 3,3, "ISAKMP_CFG_SET" }, |
1706 | | { 4,4, "ISAKMP_CFG_ACK" }, |
1707 | | { 5,127, "Future use" }, |
1708 | | { 128,256, "Private Use" }, |
1709 | | { 0,0, NULL }, |
1710 | | }; |
1711 | | |
1712 | | |
1713 | | static const range_string vs_v2_cfgtype[] = { |
1714 | | { 0,0, "RESERVED" }, |
1715 | | { 1,1, "CFG_REQUEST" }, |
1716 | | { 2,2, "CFG_REPLY" }, |
1717 | | { 3,3, "CFG_SET" }, |
1718 | | { 4,4, "CFG_ACK" }, |
1719 | | { 5,127, "Unassigned" }, |
1720 | | { 128,256, "Reserved for Private Use" }, |
1721 | | { 0,0, NULL }, |
1722 | | }; |
1723 | | |
1724 | | static const range_string vs_v1_cfgattr[] = { |
1725 | | { 0,0, "RESERVED" }, |
1726 | | { 1,1, "INTERNAL_IP4_ADDRESS" }, |
1727 | | { 2,2, "INTERNAL_IP4_NETMASK" }, |
1728 | | { 3,3, "INTERNAL_IP4_DNS" }, |
1729 | | { 4,4, "INTERNAL_IP4_NBNS" }, |
1730 | | { 5,5, "INTERNAL_ADDRESS_EXPIRY" }, |
1731 | | { 6,6, "INTERNAL_IP4_DHCP" }, |
1732 | | { 7,7, "APPLICATION_VERSION" }, |
1733 | | { 8,8, "INTERNAL_IP6_ADDRESS" }, |
1734 | | { 9,9, "INTERNAL_IP6_NETMASK" }, |
1735 | | { 10,10, "INTERNAL_IP6_DNS" }, |
1736 | | { 11,11, "INTERNAL_IP6_NBNS" }, |
1737 | | { 12,12, "INTERNAL_IP6_DHCP" }, |
1738 | | { 13,13, "INTERNAL_IP4_SUBNET" }, |
1739 | | { 14,14, "SUPPORTED_ATTRIBUTES" }, |
1740 | | { 15,15, "INTERNAL_IP6_SUBNET" }, |
1741 | | { 16,16383, "FUTURE USE"}, |
1742 | | { 16384,16386, "PRIVATE USE"}, |
1743 | | { 16387,16387, "CHKPT_DEF_DOMAIN" }, |
1744 | | { 16388,16388, "CHKPT_MAC_ADDRESS" }, |
1745 | | { 16389,16389, "CHKPT_MARCIPAN_REASON_CODE" }, |
1746 | | { 16400,16400, "CHKPT_UNKNOWN1" }, |
1747 | | { 16401,16401, "CHKPT_UNKNOWN2" }, |
1748 | | { 16402,16402, "CHKPT_UNKNOWN3" }, |
1749 | | { 16403,16519, "PRIVATE USE"}, |
1750 | | { 16520,16520, "XAUTH_TYPE" }, |
1751 | | { 16521,16521, "XAUTH_USER_NAME" }, |
1752 | | { 16522,16522, "XAUTH_USER_PASSWORD" }, |
1753 | | { 16523,16523, "XAUTH_PASSCODE" }, |
1754 | | { 16524,16524, "XAUTH_MESSAGE" }, |
1755 | | { 16525,16525, "XAUTH_CHALLENGE" }, |
1756 | | { 16526,16526, "XAUTH_DOMAIN" }, |
1757 | | { 16527,16527, "XAUTH_STATUS" }, |
1758 | | { 16528,16528, "XAUTH_NEXT_PIN" }, |
1759 | | { 16529,16529, "XAUTH_ANSWER" }, |
1760 | | { 16530,28671, "PRIVATE USE"}, |
1761 | | { 28672,28672, "UNITY_BANNER" }, |
1762 | | { 28673,28673, "UNITY_SAVE_PASSWD" }, |
1763 | | { 28674,28674, "UNITY_DEF_DOMAIN" }, |
1764 | | { 28675,28675, "UNITY_SPLIT_DOMAIN" }, |
1765 | | { 28676,28676, "UNITY_SPLIT_INCLUDE" }, |
1766 | | { 28677,28677, "UNITY_NATT_PORT" }, |
1767 | | { 28678,28678, "UNITY_SPLIT_EXCLUDE" }, |
1768 | | { 28679,28679, "UNITY_PFS" }, |
1769 | | { 28680,28680, "UNITY_FW_TYPE" }, |
1770 | | { 28681,28681, "UNITY_BACKUP_SERVERS" }, |
1771 | | { 28682,28682, "UNITY_DDNS_HOSTNAME" }, |
1772 | | { 28683,32767, "PRIVATE USE"}, |
1773 | | { 0,0, NULL }, |
1774 | | }; |
1775 | | |
1776 | | static const range_string vs_v2_cfgattr[] = { |
1777 | | { 0,0, "RESERVED" }, |
1778 | | { 1,1, "INTERNAL_IP4_ADDRESS" }, |
1779 | | { 2,2, "INTERNAL_IP4_NETMASK" }, |
1780 | | { 3,3, "INTERNAL_IP4_DNS" }, |
1781 | | { 4,4, "INTERNAL_IP4_NBNS" }, |
1782 | | { 5,5, "INTERNAL_ADDRESS_EXPIRY" }, /* OBSO [RFC5996] */ |
1783 | | { 6,6, "INTERNAL_IP4_DHCP" }, |
1784 | | { 7,7, "APPLICATION_VERSION" }, |
1785 | | { 8,8, "INTERNAL_IP6_ADDRESS" }, |
1786 | | { 9,9, "RESERVED" }, |
1787 | | { 10,10, "INTERNAL_IP6_DNS" }, |
1788 | | { 11,11, "INTERNAL_IP6_NBNS" }, /* OBSO [RFC5996] */ |
1789 | | { 12,12, "INTERNAL_IP6_DHCP" }, |
1790 | | { 13,13, "INTERNAL_IP4_SUBNET" }, |
1791 | | { 14,14, "SUPPORTED_ATTRIBUTES" }, |
1792 | | { 15,15, "INTERNAL_IP6_SUBNET" }, |
1793 | | { 16,16, "MIP6_HOME_PREFIX" }, |
1794 | | { 17,17, "INTERNAL_IP6_LINK" }, |
1795 | | { 18,18, "INTERNAL_IP6_PREFIX" }, |
1796 | | { 19,19, "HOME_AGENT_ADDRESS" }, /* 3GPP TS 24.302 http://www.3gpp.org/ftp/Specs/html-info/24302.htm */ |
1797 | | { 20,20, "P_CSCF_IP4_ADDRESS" }, /* 3GPP IMS Option for IKEv2 [RFC7651] */ |
1798 | | { 21,21, "P_CSCF_IP6_ADDRESS" }, /* [RFC7651] */ |
1799 | | { 22,22, "FTT_KAT" }, /* 3GPP TS 24.302 12.6.0 */ |
1800 | | { 23,23, "EXTERNAL_SOURCE_IP4_NAT_INFO" }, /* 3GPP TS 29.139 */ |
1801 | | { 24,24, "TIMEOUT_PERIOD_FOR_LIVENESS_CHECK" }, /* 3GPP TS 24.302 13.4.0 */ |
1802 | | { 25,25, "INTERNAL_DNS_DOMAIN" }, /* [RFC8598] */ |
1803 | | { 26,26, "INTERNAL_DNSSEC_TA" }, /* [RFC8598] */ |
1804 | | { 27,27, "ENCDNS_IP4" }, /* [RFC8464] */ |
1805 | | { 28,28, "ENCDNS_IP6" }, /* [RFC8464] */ |
1806 | | { 29,29, "ENCDNS_DIGEST_INFO" }, /* [RFC8464] */ |
1807 | | { 30,16383, "Unassigned"}, |
1808 | | { 16384,21513, "Reserved for Private Use"}, |
1809 | | { 21514,21514, "FORTINET_AUTO_NEGOTIATE" }, |
1810 | | { 21515,21515, "FORTINET_KEEP_ALIVE" }, |
1811 | | { 21516,21516, "FORTINET_DNS_SUFFIX" }, |
1812 | | { 21517,28671, "Reserved for Private Use"}, |
1813 | | { 28672,28672, "UNITY_BANNER" }, /* Fortinet use UNITY for IKEv2 too...*/ |
1814 | | { 28673,28673, "UNITY_SAVE_PASSWD" }, /* Fortinet use UNITY for IKEv2 too...*/ |
1815 | | { 28674,28677, "Reserved for Private Use"}, |
1816 | | { 28678,28678, "UNITY_SPLIT_EXCLUDE" }, /* Fortinet use UNITY for IKEv2 too...*/ |
1817 | | { 28679,32767, "Reserved for Private Use"}, |
1818 | | { 0,0, NULL }, |
1819 | | }; |
1820 | | |
1821 | | static const range_string cfgattr_xauth_type[] = { |
1822 | | { 0,0, "Generic" }, |
1823 | | { 1,1, "RADIUS-CHAP" }, |
1824 | | { 2,2, "OTP" }, |
1825 | | { 3,3, "S/KEY" }, |
1826 | | { 4,32767, "Future use" }, |
1827 | | { 32768,65535, "Private use" }, |
1828 | | { 0,0, NULL }, |
1829 | | }; |
1830 | | |
1831 | | |
1832 | | static const value_string cfgattr_xauth_status[] = { |
1833 | | { 0, "Fail" }, |
1834 | | { 1, "Success" }, |
1835 | | { 0, NULL }, |
1836 | | }; |
1837 | | |
1838 | | static const value_string cp_product[] = { |
1839 | | { 1, "Firewall-1" }, |
1840 | | { 2, "SecuRemote/SecureClient" }, |
1841 | | { 0, NULL }, |
1842 | | }; |
1843 | | |
1844 | | static const value_string cp_version[] = { |
1845 | | { 2,"4.1" }, |
1846 | | { 3,"4.1 SP-1" }, |
1847 | | { 4002,"4.1 (SP-2 or above)" }, |
1848 | | { 5000,"NG" }, |
1849 | | { 5001,"NG Feature Pack 1" }, |
1850 | | { 5002,"NG Feature Pack 2" }, |
1851 | | { 5003,"NG Feature Pack 3" }, |
1852 | | { 5004,"NG with Application Intelligence" }, |
1853 | | { 5005,"NG with Application Intelligence R55" }, |
1854 | | { 5006,"NG with Application Intelligence R56" }, |
1855 | | { 0, NULL }, |
1856 | | }; |
1857 | | static const range_string traffic_selector_type[] = { |
1858 | | { 0,6, "Reserved" }, |
1859 | | { 7,7, "TS_IPV4_ADDR_RANGE" }, |
1860 | | { 8,8, "TS_IPV6_ADDR_RANGE" }, |
1861 | | { 9,9, "TS_FC_ADDR_RANGE" }, |
1862 | | { 10,10, "TS_SECLABEL" }, /* [RFC9478] */ |
1863 | | { 11,240, "Unassigned" }, |
1864 | | { 241,255, "Reserved for Private use" }, /* [RFC7296] */ |
1865 | | { 0,0, NULL }, |
1866 | | }; |
1867 | | static const value_string ms_nt5_isakmpoakley_type[] = { |
1868 | | { 2, "Windows 2000" }, |
1869 | | { 3, "Windows XP SP1" }, |
1870 | | { 4, "Windows 2003 and Windows XP SP2" }, |
1871 | | { 5, "Windows Vista" }, |
1872 | | { 0, NULL } |
1873 | | }; |
1874 | | static const range_string vs_v1_id_type[] = { |
1875 | | { 0,0, "RESERVED" }, |
1876 | | { IKE_ID_IPV4_ADDR,IKE_ID_IPV4_ADDR, "IPV4_ADDR" }, |
1877 | | { IKE_ID_FQDN,IKE_ID_FQDN, "FQDN" }, |
1878 | | { IKE_ID_USER_FQDN,IKE_ID_USER_FQDN, "USER_FQDN" }, |
1879 | | { IKE_ID_IPV4_ADDR_SUBNET,IKE_ID_IPV4_ADDR_SUBNET, "IPV4_ADDR_SUBNET" }, |
1880 | | { IKE_ID_IPV6_ADDR,IKE_ID_IPV6_ADDR, "IPV6_ADDR" }, |
1881 | | { IKE_ID_IPV6_ADDR_SUBNET,IKE_ID_IPV6_ADDR_SUBNET, "IPV6_ADDR_SUBNET" }, |
1882 | | { IKE_ID_IPV4_ADDR_RANGE,IKE_ID_IPV4_ADDR_RANGE, "IPV4_ADDR_RANGE" }, |
1883 | | { IKE_ID_IPV6_ADDR_RANGE,IKE_ID_IPV6_ADDR_RANGE, "IPV6_ADDR_RANGE" }, |
1884 | | { IKE_ID_DER_ASN1_DN,IKE_ID_DER_ASN1_DN, "DER_ASN1_DN" }, |
1885 | | { IKE_ID_DER_ASN1_GN,IKE_ID_DER_ASN1_GN, "DER_ASN1_GN" }, |
1886 | | { IKE_ID_KEY_ID,IKE_ID_KEY_ID, "KEY_ID" }, |
1887 | | { IKE_ID_LIST,IKE_ID_LIST, "KEY_LIST" }, |
1888 | | { 13,248, "Future use" }, |
1889 | | { 249,255, "Private Use" }, |
1890 | | { 0,0, NULL }, |
1891 | | }; |
1892 | | static const range_string vs_v2_id_type[] = { |
1893 | | { 0,0, "RESERVED" }, |
1894 | | { IKE_ID_IPV4_ADDR,IKE_ID_IPV4_ADDR, "IPV4_ADDR" }, |
1895 | | { IKE_ID_FQDN,IKE_ID_FQDN, "FQDN" }, |
1896 | | { IKE_ID_RFC822_ADDR,IKE_ID_RFC822_ADDR, "ID_RFC822_ADDR" }, |
1897 | | { 4,4, "Unassigned" }, |
1898 | | { IKE_ID_IPV6_ADDR,IKE_ID_IPV6_ADDR, "IPV6_ADDR" }, |
1899 | | { 6,8, "Unassigned" }, |
1900 | | { IKE_ID_DER_ASN1_DN,IKE_ID_DER_ASN1_DN, "DER_ASN1_DN" }, |
1901 | | { IKE_ID_DER_ASN1_GN,IKE_ID_DER_ASN1_GN, "DER_ASN1_GN" }, |
1902 | | { IKE_ID_KEY_ID,IKE_ID_KEY_ID, "KEY_ID" }, |
1903 | | { IKE_ID_FC_NAME,IKE_ID_FC_NAME, "KEY_LIST" }, |
1904 | | { IKE_ID_NULL,IKE_ID_NULL, "NULL" }, |
1905 | | { 14,200, "Future use" }, |
1906 | | { 201,255, "Private Use" }, |
1907 | | { 0,0, NULL }, |
1908 | | }; |
1909 | 233k | #define COOKIE_SIZE 8 |
1910 | | |
1911 | | typedef struct isakmp_hdr { |
1912 | | uint8_t next_payload; |
1913 | | uint8_t version; |
1914 | | uint8_t exch_type; |
1915 | | uint8_t flags; |
1916 | 774 | #define E_FLAG 0x01 |
1917 | 16 | #define C_FLAG 0x02 |
1918 | 16 | #define A_FLAG 0x04 |
1919 | 19.5k | #define I_FLAG 0x08 |
1920 | 9.76k | #define V_FLAG 0x10 |
1921 | 30.4k | #define R_FLAG 0x20 |
1922 | | uint32_t message_id; |
1923 | | uint32_t length; |
1924 | | } isakmp_hdr_t; |
1925 | | |
1926 | | static const true_false_string attribute_format = { |
1927 | | "Type/Value (TV)", |
1928 | | "Type/Length/Value (TLV)" |
1929 | | }; |
1930 | | static const true_false_string flag_e = { |
1931 | | "Encrypted", |
1932 | | "Not encrypted" |
1933 | | }; |
1934 | | static const true_false_string flag_c = { |
1935 | | "Commit", |
1936 | | "No commit" |
1937 | | }; |
1938 | | static const true_false_string flag_a = { |
1939 | | "Authentication", |
1940 | | "No authentication" |
1941 | | }; |
1942 | | static const true_false_string flag_i = { |
1943 | | "Initiator", |
1944 | | "Responder" |
1945 | | }; |
1946 | | static const true_false_string flag_v = { |
1947 | | "A higher version enabled", |
1948 | | "No higher version" |
1949 | | }; |
1950 | | |
1951 | | |
1952 | | /* ROHC Attribute Type RFC5857 */ |
1953 | | |
1954 | 2 | #define ROHC_MAX_CID 1 |
1955 | 0 | #define ROHC_PROFILE 2 |
1956 | 1 | #define ROHC_INTEG 3 |
1957 | 38 | #define ROHC_ICV_LEN 4 |
1958 | 1 | #define ROHC_MRRU 5 |
1959 | | |
1960 | | static const range_string rohc_attr_type[] = { |
1961 | | { 1,1, "Maximum Context Identifier (MAX_CID)" }, |
1962 | | { 2,2, "ROHC Profile (ROHC_PROFILE)" }, |
1963 | | { 3,3, "ROHC Integrity Algorithm (ROHC_INTEG)" }, |
1964 | | { 4,4, "ROHC ICV Length in bytes (ROHC_ICV_LEN)" }, |
1965 | | { 5,5, "Maximum Reconstructed Reception Unit (MRRU)" }, |
1966 | | { 6,16383, "Unassigned (Future use)" }, |
1967 | | { 16384,32767, "Private use" }, |
1968 | | { 0,0, NULL }, |
1969 | | }; |
1970 | | |
1971 | | #if 0 |
1972 | | static const range_string secure_password_methods[] = { |
1973 | | { 0,0, "Reserved" }, /* [RFC6467] */ |
1974 | | { 1,1, "PACE" }, /* [RFC6631] */ |
1975 | | { 2,2, "AugPAKE" }, /* [RFC6628] */ |
1976 | | { 3,3, "Secure PSK Authentication" },/* [RFC6617] */ |
1977 | | { 4,1023, "Unassigned" }, |
1978 | | { 1024,65535, "Reserved for Private Use" }, |
1979 | | {0,0, NULL }, |
1980 | | }; |
1981 | | #endif |
1982 | | |
1983 | | static const range_string signature_hash_algorithms[] = { |
1984 | | { 0,0, "Reserved" }, |
1985 | | { 1,1, "SHA1" }, |
1986 | | { 2,2, "SHA2-256" }, |
1987 | | { 3,3, "SHA2-384" }, |
1988 | | { 4,4, "SHA2-512" }, |
1989 | | { 5,5, "Identity" }, /* [RFC8420] */ |
1990 | | { 6,6, "STREEBOG_256" }, /* [RFC9385] */ |
1991 | | { 7,7, "STREEBOG_512" }, /* [RFC9385] */ |
1992 | | { 8,1023, "Unassigned" }, |
1993 | | { 1024,65535, "Reserved for Private Use" }, |
1994 | | {0,0, NULL }, |
1995 | | }; |
1996 | | |
1997 | | #if 0 |
1998 | | /* Used in the PPK_IDENTITY notification */ |
1999 | | static const range_string post_quantum_preshared_key_id_types[] = { |
2000 | | { 0,0, "Reserved" }, /* [RFC8784] */ |
2001 | | { 1,1, "PPK_ID_OPAQUE" }, /* [RFC8784] */ |
2002 | | { 2,2, "PPK_ID_FIXED" }, /* [RFC8784] */ |
2003 | | { 3,127, "Unassigned" }, |
2004 | | { 128,255, "Reserved for Private Use" }, |
2005 | | {0,0, NULL }, |
2006 | | }; |
2007 | | |
2008 | | /* Used in the Group Security Association payload (51) */ |
2009 | | static const range_string group_sa_attributes[] = { |
2010 | | { 0,0, "Reserved" }, /* [RFC9838] */ |
2011 | | { 1,1, "GSA_KEY_LIFETIME" }, /* [RFC9838] */ |
2012 | | { 2,2, "GSA_INITIAL_MESSAGE_ID" }, /* [RFC9838] */ |
2013 | | { 3,3, "GSA_NEXT_SPI" }, /* [RFC9838] */ |
2014 | | { 4,16383, "Unassigned" }, |
2015 | | { 16384,32767, "Reserved for Private Use" }, |
2016 | | {0,0, NULL }, |
2017 | | }; |
2018 | | |
2019 | | static const range_string group_wide_policy_attributes[] = { |
2020 | | { 0,0, "Reserved" }, /* [RFC9838] */ |
2021 | | { 1,1, "GWP_ATD" }, /* [RFC9838] */ |
2022 | | { 2,2, "GWP_DTD" }, /* [RFC9838] */ |
2023 | | { 3,3, "GWP_SENDER_ID_BITS" }, /* [RFC9838] */ |
2024 | | { 4,16383, "Unassigned" }, |
2025 | | { 16384,32767, "Reserved for Private Use" }, |
2026 | | {0,0, NULL }, |
2027 | | }; |
2028 | | |
2029 | | /* Used in the Key Download payload (52) */ |
2030 | | static const range_string group_key_bag_attributes[] = { |
2031 | | { 0,0, "Reserved" }, /* [RFC9838] */ |
2032 | | { 1,1, "SA_KEY" }, /* [RFC9838] */ |
2033 | | { 2,16383, "Unassigned" }, |
2034 | | { 16384,32767, "Reserved for Private Use" }, |
2035 | | {0,0, NULL }, |
2036 | | }; |
2037 | | |
2038 | | static const range_string member_key_bag_attributes[] = { |
2039 | | { 0,0, "Reserved" }, /* [RFC9838] */ |
2040 | | { 1,1, "WRAP_KEY" }, /* [RFC9838] */ |
2041 | | { 2,2, "AUTH_KEY" }, /* [RFC9838] */ |
2042 | | { 3,3, "GM_SENDER_ID" }, /* [RFC9838] */ |
2043 | | { 4,16383, "Unassigned" }, |
2044 | | { 16384,32767, "Reserved for Private Use" }, |
2045 | | {0,0, NULL }, |
2046 | | }; |
2047 | | #endif |
2048 | | |
2049 | | static const range_string sat_protocol_ids[] = { |
2050 | | { 0,0, "Reserved" }, |
2051 | | { 1,1, "GDOI_PROTO_IPSEC_ESP" }, |
2052 | | { 2,2, "GDOI_PROTO_IPSEC_AH" }, |
2053 | | { 3,127, "Unassigned" }, |
2054 | | { 128, 255, "Private Use" }, |
2055 | | { 0,0, NULL }, |
2056 | | }; |
2057 | | |
2058 | | static const range_string key_download_types[] = { |
2059 | | { 0,0, "Reserved" }, |
2060 | | { 1,1, "TEK" }, |
2061 | | { 2,2, "KEK" }, |
2062 | | { 3,3, "LKH" }, |
2063 | | { 4,4, "SID" }, |
2064 | | { 5,127, "Unassigned" }, |
2065 | | { 128, 255, "Private Use" }, |
2066 | | { 0,0, NULL }, |
2067 | | }; |
2068 | | |
2069 | | static const value_string device_identity_types[] = { |
2070 | | { 0x01, "IMEI" }, |
2071 | | { 0x02, "IMEISV" }, |
2072 | | { 0, NULL }, |
2073 | | }; |
2074 | | |
2075 | 66.3k | #define ISAKMP_HDR_SIZE ((int)sizeof(struct isakmp_hdr) + (2 * COOKIE_SIZE)) |
2076 | | |
2077 | | |
2078 | 0 | #define MAX_KEY_SIZE 256 |
2079 | | #define MAX_DIGEST_SIZE 64 |
2080 | | #define MAX_OAKLEY_KEY_LEN 32 |
2081 | | |
2082 | 20 | #define PINFO_CBC_IV 1 |
2083 | | |
2084 | 20 | #define DECR_PARAMS_INIT 0 |
2085 | 20 | #define DECR_PARAMS_READY 1 |
2086 | 18 | #define DECR_PARAMS_FAIL 2 |
2087 | | |
2088 | | typedef struct _ikev1_uat_data_key { |
2089 | | unsigned char *icookie; |
2090 | | unsigned icookie_len; |
2091 | | unsigned char *key; |
2092 | | unsigned key_len; |
2093 | | } ikev1_uat_data_key_t; |
2094 | | |
2095 | | typedef struct decrypt_data { |
2096 | | bool is_psk; |
2097 | | address initiator; |
2098 | | unsigned ike_encr_alg; |
2099 | | unsigned ike_encr_keylen; |
2100 | | unsigned ike_hash_alg; |
2101 | | int cipher_algo; |
2102 | | size_t cipher_keylen; |
2103 | | size_t cipher_blklen; |
2104 | | int digest_algo; |
2105 | | unsigned digest_len; |
2106 | | unsigned group; |
2107 | | char *gi; |
2108 | | unsigned gi_len; |
2109 | | char *gr; |
2110 | | unsigned gr_len; |
2111 | | unsigned char secret[MAX_KEY_SIZE]; |
2112 | | unsigned secret_len; |
2113 | | GHashTable *iv_hash; |
2114 | | unsigned state; |
2115 | | } decrypt_data_t; |
2116 | | |
2117 | | /* IKEv1: Lookup from Initiator-SPI -> decrypt_data_t* */ |
2118 | | static GHashTable *isakmp_hash; |
2119 | | |
2120 | | static ikev1_uat_data_key_t* ikev1_uat_data; |
2121 | | static uat_t * ikev1_uat; |
2122 | | static unsigned num_ikev1_uat_data; |
2123 | | |
2124 | | /* Specifications of encryption algorithms for IKEv2 decryption */ |
2125 | | typedef struct _ikev2_encr_alg_spec { |
2126 | | unsigned number; |
2127 | | /* Length of encryption key */ |
2128 | | unsigned key_len; |
2129 | | /* Block size of the cipher */ |
2130 | | unsigned block_len; |
2131 | | /* Length of initialization vector */ |
2132 | | unsigned iv_len; |
2133 | | /* Encryption algorithm ID to be passed to gcry_cipher_open() */ |
2134 | | int gcry_alg; |
2135 | | /* Cipher mode to be passed to gcry_cipher_open() */ |
2136 | | int gcry_mode; |
2137 | | |
2138 | | /* Salt length used in AEAD (GCM/CCM) mode. Salt value is last salt_len bytes of encr_key. |
2139 | | * IV for decryption is the result of concatenating salt value and iv_len bytes of iv. |
2140 | | * For non-AED ciphers salt_len 0 */ |
2141 | | unsigned salt_len; |
2142 | | /* Authenticated Encryption TAG length (ICV) - length of data taken from end of encrypted output |
2143 | | * used for integrity checksum, computed during decryption (for AEAD ciphers)*/ |
2144 | | unsigned icv_len; |
2145 | | |
2146 | | } ikev2_encr_alg_spec_t; |
2147 | | |
2148 | 0 | #define IKEV2_ENCR_NULL 1 |
2149 | | #define IKEV2_ENCR_3DES 2 |
2150 | | #define IKEV2_ENCR_AES_CBC_128 3 |
2151 | | #define IKEV2_ENCR_AES_CBC_192 4 |
2152 | | #define IKEV2_ENCR_AES_CBC_256 5 |
2153 | | |
2154 | | #define IKEV2_ENCR_AES_CTR_128 6 |
2155 | | #define IKEV2_ENCR_AES_CTR_192 7 |
2156 | | #define IKEV2_ENCR_AES_CTR_256 8 |
2157 | | |
2158 | | /* AEAD algorithms. Require gcrypt_version >= 1.6.0 if integrity verification shall be performed */ |
2159 | 0 | #define IKEV2_ENCR_AES_GCM_128_16 101 |
2160 | | #define IKEV2_ENCR_AES_GCM_192_16 102 |
2161 | | #define IKEV2_ENCR_AES_GCM_256_16 103 |
2162 | | |
2163 | | #define IKEV2_ENCR_AES_GCM_128_8 104 |
2164 | | #define IKEV2_ENCR_AES_GCM_192_8 105 |
2165 | | #define IKEV2_ENCR_AES_GCM_256_8 106 |
2166 | | |
2167 | | #define IKEV2_ENCR_AES_GCM_128_12 107 |
2168 | | #define IKEV2_ENCR_AES_GCM_192_12 108 |
2169 | 0 | #define IKEV2_ENCR_AES_GCM_256_12 109 |
2170 | | |
2171 | 0 | #define IKEV2_ENCR_AES_CCM_128_16 111 |
2172 | | #define IKEV2_ENCR_AES_CCM_192_16 112 |
2173 | | #define IKEV2_ENCR_AES_CCM_256_16 113 |
2174 | | |
2175 | | #define IKEV2_ENCR_AES_CCM_128_8 114 |
2176 | | #define IKEV2_ENCR_AES_CCM_192_8 115 |
2177 | | #define IKEV2_ENCR_AES_CCM_256_8 116 |
2178 | | |
2179 | | #define IKEV2_ENCR_AES_CCM_128_12 117 |
2180 | | #define IKEV2_ENCR_AES_CCM_192_12 118 |
2181 | 0 | #define IKEV2_ENCR_AES_CCM_256_12 119 |
2182 | | |
2183 | | |
2184 | | static const ikev2_encr_alg_spec_t ikev2_encr_algs[] = { |
2185 | | {IKEV2_ENCR_NULL, 0, 1, 0, GCRY_CIPHER_NONE, GCRY_CIPHER_MODE_NONE, 0, 0}, |
2186 | | {IKEV2_ENCR_3DES, 24, 8, 8, GCRY_CIPHER_3DES, GCRY_CIPHER_MODE_CBC, 0, 0}, |
2187 | | {IKEV2_ENCR_AES_CBC_128, 16, 16, 16, GCRY_CIPHER_AES128, GCRY_CIPHER_MODE_CBC, 0, 0}, |
2188 | | {IKEV2_ENCR_AES_CBC_192, 24, 16, 16, GCRY_CIPHER_AES192, GCRY_CIPHER_MODE_CBC, 0, 0}, |
2189 | | {IKEV2_ENCR_AES_CBC_256, 32, 16, 16, GCRY_CIPHER_AES256, GCRY_CIPHER_MODE_CBC, 0, 0}, |
2190 | | |
2191 | | {IKEV2_ENCR_AES_CTR_128, 20, 1, 8, GCRY_CIPHER_AES128, GCRY_CIPHER_MODE_CTR, 4, 0}, |
2192 | | {IKEV2_ENCR_AES_CTR_192, 28, 1, 8, GCRY_CIPHER_AES192, GCRY_CIPHER_MODE_CTR, 4, 0}, |
2193 | | {IKEV2_ENCR_AES_CTR_256, 36, 1, 8, GCRY_CIPHER_AES256, GCRY_CIPHER_MODE_CTR, 4, 0}, |
2194 | | |
2195 | | /* GCM algorithms: key length: aes-length + 4 bytes of IV (salt), iv - 8 bytes */ |
2196 | | {IKEV2_ENCR_AES_GCM_128_16, 20, 1, 8, GCRY_CIPHER_AES128, GCRY_CIPHER_MODE_GCM, 4, 16}, |
2197 | | {IKEV2_ENCR_AES_GCM_192_16, 28, 1, 8, GCRY_CIPHER_AES192, GCRY_CIPHER_MODE_GCM, 4, 16}, |
2198 | | {IKEV2_ENCR_AES_GCM_256_16, 36, 1, 8, GCRY_CIPHER_AES256, GCRY_CIPHER_MODE_GCM, 4, 16}, |
2199 | | |
2200 | | {IKEV2_ENCR_AES_GCM_128_8, 20, 1, 8, GCRY_CIPHER_AES128, GCRY_CIPHER_MODE_GCM, 4, 8}, |
2201 | | {IKEV2_ENCR_AES_GCM_192_8, 28, 1, 8, GCRY_CIPHER_AES192, GCRY_CIPHER_MODE_GCM, 4, 8}, |
2202 | | {IKEV2_ENCR_AES_GCM_256_8, 36, 1, 8, GCRY_CIPHER_AES256, GCRY_CIPHER_MODE_GCM, 4, 8}, |
2203 | | |
2204 | | {IKEV2_ENCR_AES_GCM_128_12, 20, 1, 8, GCRY_CIPHER_AES128, GCRY_CIPHER_MODE_GCM, 4, 12}, |
2205 | | {IKEV2_ENCR_AES_GCM_192_12, 28, 1, 8, GCRY_CIPHER_AES192, GCRY_CIPHER_MODE_GCM, 4, 12}, |
2206 | | {IKEV2_ENCR_AES_GCM_256_12, 36, 1, 8, GCRY_CIPHER_AES256, GCRY_CIPHER_MODE_GCM, 4, 12}, |
2207 | | |
2208 | | /* CCM algorithms: key length: aes-length + 3 bytes of salt, iv - 8 bytes */ |
2209 | | {IKEV2_ENCR_AES_CCM_128_16, 19, 1, 8, GCRY_CIPHER_AES128, GCRY_CIPHER_MODE_CCM, 3, 16}, |
2210 | | {IKEV2_ENCR_AES_CCM_192_16, 27, 1, 8, GCRY_CIPHER_AES192, GCRY_CIPHER_MODE_CCM, 3, 16}, |
2211 | | {IKEV2_ENCR_AES_CCM_256_16, 35, 1, 8, GCRY_CIPHER_AES256, GCRY_CIPHER_MODE_CCM, 3, 16}, |
2212 | | |
2213 | | {IKEV2_ENCR_AES_CCM_128_8, 19, 1, 8, GCRY_CIPHER_AES128, GCRY_CIPHER_MODE_CCM, 3, 8}, |
2214 | | {IKEV2_ENCR_AES_CCM_192_8, 27, 1, 8, GCRY_CIPHER_AES192, GCRY_CIPHER_MODE_CCM, 3, 8}, |
2215 | | {IKEV2_ENCR_AES_CCM_256_8, 35, 1, 8, GCRY_CIPHER_AES256, GCRY_CIPHER_MODE_CCM, 3, 8}, |
2216 | | |
2217 | | {IKEV2_ENCR_AES_CCM_128_12, 19, 1, 8, GCRY_CIPHER_AES128, GCRY_CIPHER_MODE_CCM, 3, 12}, |
2218 | | {IKEV2_ENCR_AES_CCM_192_12, 27, 1, 8, GCRY_CIPHER_AES192, GCRY_CIPHER_MODE_CCM, 3, 12}, |
2219 | | {IKEV2_ENCR_AES_CCM_256_12, 35, 1, 8, GCRY_CIPHER_AES256, GCRY_CIPHER_MODE_CCM, 3, 12}, |
2220 | | |
2221 | | {0, 0, 0, 0, 0, 0, 0, 0} |
2222 | | }; |
2223 | | |
2224 | | /* |
2225 | | * Specifications of authentication algorithms for |
2226 | | * decryption and/or ICD (Integrity Checksum Data) checking of IKEv2 |
2227 | | */ |
2228 | | typedef struct _ikev2_auth_alg_spec { |
2229 | | unsigned number; |
2230 | | /* Output length of the hash algorithm */ |
2231 | | unsigned output_len; |
2232 | | /* Length of the hash key */ |
2233 | | unsigned key_len; |
2234 | | /* Actual ICD length after truncation */ |
2235 | | unsigned trunc_len; |
2236 | | /* Hash algorithm ID to be passed to gcry_md_open() */ |
2237 | | int gcry_alg; |
2238 | | /* Flags to be passed to gcry_md_open() */ |
2239 | | unsigned gcry_flag; |
2240 | | } ikev2_auth_alg_spec_t; |
2241 | | |
2242 | 0 | #define IKEV2_AUTH_NONE 1 |
2243 | | #define IKEV2_AUTH_HMAC_MD5_96 2 |
2244 | | #define IKEV2_AUTH_HMAC_SHA1_96 3 |
2245 | | #define IKEV2_AUTH_HMAC_SHA2_256_96 4 |
2246 | | #define IKEV2_AUTH_HMAC_SHA2_256_128 5 |
2247 | | #define IKEV2_AUTH_HMAC_SHA2_384_192 6 |
2248 | | #define IKEV2_AUTH_HMAC_SHA2_512_256 7 |
2249 | | #define IKEV2_AUTH_ANY_96BITS 8 |
2250 | | #define IKEV2_AUTH_ANY_128BITS 9 |
2251 | | #define IKEV2_AUTH_ANY_160BITS 10 |
2252 | | #define IKEV2_AUTH_ANY_192BITS 11 |
2253 | | #define IKEV2_AUTH_ANY_256BITS 12 |
2254 | | #define IKEV2_AUTH_ANY_64BITS 13 |
2255 | | #define IKEV2_AUTH_HMAC_MD5_128 14 |
2256 | | #define IKEV2_AUTH_HMAC_SHA1_160 15 |
2257 | | |
2258 | | static const ikev2_auth_alg_spec_t ikev2_auth_algs[] = { |
2259 | | /*{number, output_len, key_len, trunc_len, gcry_alg, gcry_flag}*/ |
2260 | | {IKEV2_AUTH_NONE, 0, 0, 0, GCRY_MD_NONE, 0}, |
2261 | | {IKEV2_AUTH_HMAC_MD5_96, 16, 16, 12, GCRY_MD_MD5, GCRY_MD_FLAG_HMAC}, |
2262 | | {IKEV2_AUTH_HMAC_SHA1_96, 20, 20, 12, GCRY_MD_SHA1, GCRY_MD_FLAG_HMAC}, |
2263 | | {IKEV2_AUTH_HMAC_MD5_128, 16, 16, 16, GCRY_MD_MD5, GCRY_MD_FLAG_HMAC}, |
2264 | | {IKEV2_AUTH_HMAC_SHA1_160, 20, 20, 20, GCRY_MD_SHA1, GCRY_MD_FLAG_HMAC}, |
2265 | | {IKEV2_AUTH_HMAC_SHA2_256_96, 32, 32, 12, GCRY_MD_SHA256, GCRY_MD_FLAG_HMAC}, |
2266 | | {IKEV2_AUTH_HMAC_SHA2_256_128, 32, 32, 16, GCRY_MD_SHA256, GCRY_MD_FLAG_HMAC}, |
2267 | | {IKEV2_AUTH_HMAC_SHA2_384_192, 48, 48, 24, GCRY_MD_SHA384, GCRY_MD_FLAG_HMAC}, |
2268 | | {IKEV2_AUTH_HMAC_SHA2_512_256, 64, 64, 32, GCRY_MD_SHA512, GCRY_MD_FLAG_HMAC}, |
2269 | | {IKEV2_AUTH_ANY_96BITS, 0, 0, 12, 0, 0}, |
2270 | | {IKEV2_AUTH_ANY_128BITS, 0, 0, 16, 0, 0}, |
2271 | | {IKEV2_AUTH_ANY_160BITS, 0, 0, 20, 0, 0}, |
2272 | | {IKEV2_AUTH_ANY_192BITS, 0, 0, 24, 0, 0}, |
2273 | | {IKEV2_AUTH_ANY_256BITS, 0, 0, 32, 0, 0}, |
2274 | | {IKEV2_AUTH_ANY_64BITS, 0, 0, 8, 0, 0}, |
2275 | | |
2276 | | {0, 0, 0, 0, 0, 0} |
2277 | | }; |
2278 | | |
2279 | | typedef struct _ikev2_decrypt_data { |
2280 | | unsigned char *encr_key; |
2281 | | unsigned char *auth_key; |
2282 | | const ikev2_encr_alg_spec_t *encr_spec; |
2283 | | const ikev2_auth_alg_spec_t *auth_spec; |
2284 | | } ikev2_decrypt_data_t; |
2285 | | |
2286 | | typedef struct _ikev2_uat_data_key { |
2287 | | unsigned char *spii; |
2288 | | unsigned spii_len; |
2289 | | unsigned char *spir; |
2290 | | unsigned spir_len; |
2291 | | } ikev2_uat_data_key_t; |
2292 | | |
2293 | | typedef struct _ikev2_uat_data { |
2294 | | ikev2_uat_data_key_t key; |
2295 | | unsigned encr_alg; |
2296 | | unsigned auth_alg; |
2297 | | unsigned char *sk_ei; |
2298 | | unsigned sk_ei_len; |
2299 | | unsigned char *sk_er; |
2300 | | unsigned sk_er_len; |
2301 | | unsigned char *sk_ai; |
2302 | | unsigned sk_ai_len; |
2303 | | unsigned char *sk_ar; |
2304 | | unsigned sk_ar_len; |
2305 | | const ikev2_encr_alg_spec_t *encr_spec; |
2306 | | const ikev2_auth_alg_spec_t *auth_spec; |
2307 | | } ikev2_uat_data_t; |
2308 | | |
2309 | | static ikev2_uat_data_t* ikev2_uat_data; |
2310 | | static unsigned num_ikev2_uat_data; |
2311 | | static uat_t* ikev2_uat; |
2312 | | |
2313 | | /* IKEv2: (I-SPI, R-SPI) -> ikev2_uat_data_t* */ |
2314 | | static GHashTable *ikev2_key_hash; |
2315 | | |
2316 | | #define IKEV2_ENCR_3DES_STR "3DES [RFC2451]" |
2317 | | static const value_string vs_ikev2_encr_algs[] = { |
2318 | | {IKEV2_ENCR_3DES, IKEV2_ENCR_3DES_STR}, |
2319 | | {IKEV2_ENCR_AES_CBC_128, "AES-CBC-128 [RFC3602]"}, |
2320 | | {IKEV2_ENCR_AES_CBC_192, "AES-CBC-192 [RFC3602]"}, |
2321 | | {IKEV2_ENCR_AES_CBC_256, "AES-CBC-256 [RFC3602]"}, |
2322 | | {IKEV2_ENCR_NULL, "NULL [RFC2410]"}, |
2323 | | |
2324 | | {IKEV2_ENCR_AES_CTR_128, "AES-CTR-128 [RFC5930]"}, |
2325 | | {IKEV2_ENCR_AES_CTR_192, "AES-CTR-192 [RFC5930]"}, |
2326 | | {IKEV2_ENCR_AES_CTR_256, "AES-CTR-256 [RFC5930]"}, |
2327 | | |
2328 | | {IKEV2_ENCR_AES_GCM_128_16, "AES-GCM-128 with 16 octet ICV [RFC5282]"}, |
2329 | | {IKEV2_ENCR_AES_GCM_192_16, "AES-GCM-192 with 16 octet ICV [RFC5282]"}, |
2330 | | {IKEV2_ENCR_AES_GCM_256_16, "AES-GCM-256 with 16 octet ICV [RFC5282]"}, |
2331 | | |
2332 | | {IKEV2_ENCR_AES_GCM_128_8, "AES-GCM-128 with 8 octet ICV [RFC5282]"}, |
2333 | | {IKEV2_ENCR_AES_GCM_192_8, "AES-GCM-192 with 8 octet ICV [RFC5282]"}, |
2334 | | {IKEV2_ENCR_AES_GCM_256_8, "AES-GCM-256 with 8 octet ICV [RFC5282]"}, |
2335 | | |
2336 | | {IKEV2_ENCR_AES_GCM_128_12, "AES-GCM-128 with 12 octet ICV [RFC5282]"}, |
2337 | | {IKEV2_ENCR_AES_GCM_192_12, "AES-GCM-192 with 12 octet ICV [RFC5282]"}, |
2338 | | {IKEV2_ENCR_AES_GCM_256_12, "AES-GCM-256 with 12 octet ICV [RFC5282]"}, |
2339 | | |
2340 | | {IKEV2_ENCR_AES_CCM_128_16, "AES-CCM-128 with 16 octet ICV [RFC5282]"}, |
2341 | | {IKEV2_ENCR_AES_CCM_192_16, "AES-CCM-192 with 16 octet ICV [RFC5282]"}, |
2342 | | {IKEV2_ENCR_AES_CCM_256_16, "AES-CCM-256 with 16 octet ICV [RFC5282]"}, |
2343 | | |
2344 | | {IKEV2_ENCR_AES_CCM_128_8, "AES-CCM-128 with 8 octet ICV [RFC5282]"}, |
2345 | | {IKEV2_ENCR_AES_CCM_192_8, "AES-CCM-192 with 8 octet ICV [RFC5282]"}, |
2346 | | {IKEV2_ENCR_AES_CCM_256_8, "AES-CCM-256 with 8 octet ICV [RFC5282]"}, |
2347 | | |
2348 | | {IKEV2_ENCR_AES_CCM_128_12, "AES-CCM-128 with 12 octet ICV [RFC5282]"}, |
2349 | | {IKEV2_ENCR_AES_CCM_192_12, "AES-CCM-192 with 12 octet ICV [RFC5282]"}, |
2350 | | {IKEV2_ENCR_AES_CCM_256_12, "AES-CCM-256 with 12 octet ICV [RFC5282]"}, |
2351 | | |
2352 | | {0, NULL} |
2353 | | }; |
2354 | | |
2355 | | #define IKEV2_AUTH_HMAC_SHA1_96_STR "HMAC_SHA1_96 [RFC2404]" |
2356 | | static const value_string vs_ikev2_auth_algs[] = { |
2357 | | {IKEV2_AUTH_HMAC_MD5_96, "HMAC_MD5_96 [RFC2403]"}, |
2358 | | {IKEV2_AUTH_HMAC_SHA1_96, IKEV2_AUTH_HMAC_SHA1_96_STR}, |
2359 | | {IKEV2_AUTH_HMAC_MD5_128, "HMAC_MD5_128 [RFC4595]"}, |
2360 | | {IKEV2_AUTH_HMAC_SHA1_160, "HMAC_SHA1_160 [RFC4595]"}, |
2361 | | {IKEV2_AUTH_HMAC_SHA2_256_96, "HMAC_SHA2_256_96 [draft-ietf-ipsec-ciph-sha-256-00]"}, |
2362 | | {IKEV2_AUTH_HMAC_SHA2_256_128, "HMAC_SHA2_256_128 [RFC4868]"}, |
2363 | | {IKEV2_AUTH_HMAC_SHA2_384_192, "HMAC_SHA2_384_192 [RFC4868]"}, |
2364 | | {IKEV2_AUTH_HMAC_SHA2_512_256, "HMAC_SHA2_512_256 [RFC4868]"}, |
2365 | | {IKEV2_AUTH_NONE, "NONE [RFC4306]"}, |
2366 | | {IKEV2_AUTH_ANY_64BITS, "ANY 64-bits of Authentication [No Checking]"}, |
2367 | | {IKEV2_AUTH_ANY_96BITS, "ANY 96-bits of Authentication [No Checking]"}, |
2368 | | {IKEV2_AUTH_ANY_128BITS, "ANY 128-bits of Authentication [No Checking]"}, |
2369 | | {IKEV2_AUTH_ANY_160BITS, "ANY 160-bits of Authentication [No Checking]"}, |
2370 | | {IKEV2_AUTH_ANY_192BITS, "ANY 192-bits of Authentication [No Checking]"}, |
2371 | | {IKEV2_AUTH_ANY_256BITS, "ANY 256-bits of Authentication [No Checking]"}, |
2372 | | {0, NULL} |
2373 | | }; |
2374 | | |
2375 | 0 | static const ikev2_encr_alg_spec_t* ikev2_decrypt_find_encr_spec(unsigned num) { |
2376 | 0 | const ikev2_encr_alg_spec_t *e; |
2377 | |
|
2378 | 0 | for (e = ikev2_encr_algs; e->number != 0; e++) { |
2379 | 0 | if (e->number == num) { |
2380 | 0 | return e; |
2381 | 0 | } |
2382 | 0 | } |
2383 | 0 | return NULL; |
2384 | 0 | } |
2385 | | |
2386 | 0 | static const ikev2_auth_alg_spec_t* ikev2_decrypt_find_auth_spec(unsigned num) { |
2387 | 0 | const ikev2_auth_alg_spec_t *a; |
2388 | |
|
2389 | 0 | for (a = ikev2_auth_algs; a->number != 0; a++) { |
2390 | 0 | if (a->number == num) { |
2391 | 0 | return a; |
2392 | 0 | } |
2393 | 0 | } |
2394 | 0 | return NULL; |
2395 | 0 | } |
2396 | | |
2397 | 9 | static int ikev1_find_gcry_cipher_algo(unsigned ike_cipher, unsigned ike_keylen) { |
2398 | 9 | switch(ike_cipher) { |
2399 | 0 | case ENC_3DES_CBC: |
2400 | 0 | return GCRY_CIPHER_3DES; |
2401 | | |
2402 | 0 | case ENC_DES_CBC: |
2403 | 0 | return GCRY_CIPHER_DES; |
2404 | | |
2405 | 0 | case ENC_AES_CBC: |
2406 | 0 | switch (ike_keylen) { |
2407 | 0 | case 128: |
2408 | 0 | return GCRY_CIPHER_AES128; |
2409 | 0 | case 192: |
2410 | 0 | return GCRY_CIPHER_AES192; |
2411 | 0 | case 256: |
2412 | 0 | return GCRY_CIPHER_AES256; |
2413 | 0 | } |
2414 | 0 | return GCRY_CIPHER_NONE; |
2415 | 9 | } |
2416 | 9 | return GCRY_CIPHER_NONE; |
2417 | 9 | } |
2418 | | |
2419 | 9 | static int ikev1_find_gcry_md_algo(unsigned ike_hash) { |
2420 | 9 | switch(ike_hash) { |
2421 | 0 | case HMAC_MD5: |
2422 | 0 | return GCRY_MD_MD5; |
2423 | 0 | case HMAC_SHA: |
2424 | 0 | return GCRY_MD_SHA1; |
2425 | 0 | case HMAC_SHA2_256: |
2426 | 0 | return GCRY_MD_SHA256; |
2427 | 0 | case HMAC_SHA2_384: |
2428 | 0 | return GCRY_MD_SHA384; |
2429 | 0 | case HMAC_SHA2_512: |
2430 | 0 | return GCRY_MD_SHA512; |
2431 | 9 | } |
2432 | 9 | return GCRY_MD_NONE; |
2433 | 9 | } |
2434 | | |
2435 | | static void * |
2436 | | generate_iv(const void *b1, size_t b1_len, |
2437 | | const void *b2, size_t b2_len, |
2438 | 0 | int md_algo, size_t iv_len) { |
2439 | |
|
2440 | 0 | gcry_md_hd_t md_ctx; |
2441 | 0 | void *iv; |
2442 | |
|
2443 | 0 | if (gcry_md_open(&md_ctx, md_algo, 0) != GPG_ERR_NO_ERROR) |
2444 | 0 | return NULL; |
2445 | | |
2446 | 0 | gcry_md_write(md_ctx, b1, b1_len); |
2447 | 0 | gcry_md_write(md_ctx, b2, b2_len); |
2448 | |
|
2449 | 0 | iv = wmem_alloc(wmem_file_scope(), iv_len); |
2450 | 0 | memcpy(iv, gcry_md_read(md_ctx, md_algo), iv_len); |
2451 | 0 | gcry_md_close(md_ctx); |
2452 | |
|
2453 | 0 | return iv; |
2454 | 0 | } |
2455 | | |
2456 | | /* Get the IV previously stored for the current message ID, |
2457 | | * or create a new IV if the message ID was not seen before. |
2458 | | * The caller owns the result and does not need to copy it. |
2459 | | * This function may return NULL. |
2460 | | */ |
2461 | | static void * |
2462 | 0 | get_iv(uint32_t message_id, decrypt_data_t *decr) { |
2463 | 0 | void *iv, *iv1; |
2464 | 0 | size_t cipher_blklen; |
2465 | 0 | void *msgid_key; |
2466 | 0 | uint32_t msgid_net; |
2467 | 0 | bool found; |
2468 | |
|
2469 | 0 | cipher_blklen = decr->cipher_blklen; |
2470 | | |
2471 | | /* Get the current IV for the given message ID, |
2472 | | * and remove it from the hash table without destroying it. */ |
2473 | 0 | msgid_key = GINT_TO_POINTER(message_id); |
2474 | 0 | found = g_hash_table_lookup_extended(decr->iv_hash, msgid_key, NULL, &iv); |
2475 | 0 | if (found) { |
2476 | 0 | g_hash_table_steal(decr->iv_hash, msgid_key); |
2477 | 0 | return iv; |
2478 | 0 | } |
2479 | | |
2480 | | /* No IV for this message ID was found; a new phase has started. |
2481 | | * Generate the first IV for it from its message ID and the current |
2482 | | * phase 1 IV. The phase 1 IV always exists in the hash table |
2483 | | * and is not NULL. |
2484 | | */ |
2485 | 0 | iv1 = g_hash_table_lookup(decr->iv_hash, GINT_TO_POINTER(0)); |
2486 | 0 | msgid_net = g_htonl(message_id); |
2487 | 0 | iv = generate_iv(iv1, cipher_blklen, |
2488 | 0 | &msgid_net, sizeof(msgid_net), |
2489 | 0 | decr->digest_algo, cipher_blklen); |
2490 | 0 | return iv; |
2491 | 0 | } |
2492 | | |
2493 | | /* Fill in the next IV from the final ciphertext block. */ |
2494 | | static void |
2495 | 0 | set_next_iv(const uint8_t *buf, unsigned buf_len, uint32_t message_id, decrypt_data_t *decr) { |
2496 | 0 | void *iv; |
2497 | 0 | size_t cipher_blklen; |
2498 | 0 | void *msgid_key; |
2499 | |
|
2500 | 0 | cipher_blklen = decr->cipher_blklen; |
2501 | |
|
2502 | 0 | if (buf_len < cipher_blklen) { |
2503 | 0 | iv = NULL; |
2504 | 0 | } else { |
2505 | 0 | iv = wmem_alloc(wmem_file_scope(), cipher_blklen); |
2506 | 0 | memcpy(iv, buf + buf_len - cipher_blklen, cipher_blklen); |
2507 | 0 | } |
2508 | |
|
2509 | 0 | msgid_key = GINT_TO_POINTER(message_id); |
2510 | 0 | g_hash_table_insert(decr->iv_hash, msgid_key, iv); |
2511 | 0 | } |
2512 | | |
2513 | | static void |
2514 | 0 | update_ivs(packet_info *pinfo, const uint8_t *buf, unsigned buf_len, uint32_t message_id, decrypt_data_t *decr) { |
2515 | 0 | void *iv; |
2516 | | |
2517 | | /* Get the current IV and store it as per-packet data. */ |
2518 | 0 | iv = get_iv(message_id, decr); |
2519 | 0 | p_add_proto_data(wmem_file_scope(), pinfo, proto_isakmp, PINFO_CBC_IV, iv); |
2520 | |
|
2521 | 0 | set_next_iv(buf, buf_len, message_id, decr); |
2522 | 0 | } |
2523 | | |
2524 | | static bool |
2525 | 9 | prepare_decrypt_params(decrypt_data_t *decr) { |
2526 | 9 | decr->cipher_algo = ikev1_find_gcry_cipher_algo(decr->ike_encr_alg, |
2527 | 9 | decr->ike_encr_keylen); |
2528 | 9 | decr->digest_algo = ikev1_find_gcry_md_algo(decr->ike_hash_alg); |
2529 | | |
2530 | 9 | if (decr->cipher_algo == GCRY_CIPHER_NONE || |
2531 | 0 | decr->digest_algo == GCRY_MD_NONE) |
2532 | 9 | return false; |
2533 | | |
2534 | 0 | decr->cipher_keylen = gcry_cipher_get_algo_keylen(decr->cipher_algo); |
2535 | 0 | decr->cipher_blklen = gcry_cipher_get_algo_blklen(decr->cipher_algo); |
2536 | 0 | decr->digest_len = gcry_md_get_algo_dlen(decr->digest_algo); |
2537 | |
|
2538 | 0 | if (decr->secret_len < decr->cipher_keylen || |
2539 | 0 | decr->digest_len < decr->cipher_blklen) |
2540 | 0 | return false; |
2541 | | |
2542 | 0 | if (decr->gi_len == 0 || decr->gr_len == 0) |
2543 | 0 | return false; |
2544 | | |
2545 | 0 | return true; |
2546 | 0 | } |
2547 | | |
2548 | | /* Generate phase 1 IV from DH values |
2549 | | * and store it into the IV hash table. */ |
2550 | | static bool |
2551 | 0 | prepare_phase1_iv(decrypt_data_t *decr) { |
2552 | 0 | void *iv; |
2553 | |
|
2554 | 0 | iv = generate_iv(decr->gi, decr->gi_len, |
2555 | 0 | decr->gr, decr->gr_len, |
2556 | 0 | decr->digest_algo, decr->cipher_blklen); |
2557 | 0 | if (!iv) |
2558 | 0 | return false; |
2559 | | |
2560 | 0 | g_hash_table_insert(decr->iv_hash, GINT_TO_POINTER(0), iv); |
2561 | 0 | return true; |
2562 | 0 | } |
2563 | | |
2564 | | static bool |
2565 | 20 | prepare_decrypt(decrypt_data_t *decr) { |
2566 | 20 | bool result; |
2567 | | |
2568 | 20 | if (!decr) |
2569 | 0 | return false; |
2570 | | |
2571 | 20 | if (decr->state == DECR_PARAMS_INIT) { |
2572 | | /* Short-circuit evaluation is intended. */ |
2573 | 9 | result = prepare_decrypt_params(decr) && |
2574 | 0 | prepare_phase1_iv(decr); |
2575 | 9 | decr->state = result ? DECR_PARAMS_READY : DECR_PARAMS_FAIL; |
2576 | 9 | } |
2577 | | |
2578 | 20 | return (decr->state == DECR_PARAMS_READY); |
2579 | 20 | } |
2580 | | |
2581 | | static decrypt_data_t * |
2582 | 183 | create_decrypt_data(void) { |
2583 | 183 | decrypt_data_t *decr; |
2584 | | |
2585 | 183 | decr = (decrypt_data_t *)g_slice_alloc(sizeof(decrypt_data_t)); |
2586 | 183 | memset(decr, 0, sizeof(decrypt_data_t)); |
2587 | 183 | decr->iv_hash = g_hash_table_new(NULL, NULL); |
2588 | 183 | clear_address(&decr->initiator); |
2589 | | |
2590 | 183 | return decr; |
2591 | 183 | } |
2592 | | |
2593 | | static tvbuff_t * |
2594 | 20 | decrypt_payload(tvbuff_t *tvb, packet_info *pinfo, const uint8_t *buf, unsigned buf_len, decrypt_data_t *decr) { |
2595 | 20 | uint8_t *decrypted_data; |
2596 | 20 | gcry_cipher_hd_t decr_ctx; |
2597 | 20 | tvbuff_t *encr_tvb; |
2598 | 20 | void *iv; |
2599 | 20 | bool error; |
2600 | | |
2601 | 20 | if (buf_len < decr->cipher_blklen) |
2602 | 0 | return NULL; |
2603 | | |
2604 | 20 | iv = p_get_proto_data(wmem_file_scope(), pinfo, proto_isakmp, PINFO_CBC_IV); |
2605 | 20 | if (!iv) |
2606 | 20 | return NULL; |
2607 | | |
2608 | 0 | if (gcry_cipher_open(&decr_ctx, decr->cipher_algo, GCRY_CIPHER_MODE_CBC, 0) != GPG_ERR_NO_ERROR) |
2609 | 0 | return NULL; |
2610 | | |
2611 | 0 | decrypted_data = (uint8_t *)wmem_alloc(pinfo->pool, buf_len); |
2612 | | |
2613 | | /* Short-circuit evaluation is intended. */ |
2614 | 0 | error = gcry_cipher_setiv(decr_ctx, iv, decr->cipher_blklen) || |
2615 | 0 | gcry_cipher_setkey(decr_ctx, decr->secret, decr->secret_len) || |
2616 | 0 | gcry_cipher_decrypt(decr_ctx, decrypted_data, buf_len, buf, buf_len); |
2617 | |
|
2618 | 0 | gcry_cipher_close(decr_ctx); |
2619 | 0 | if (error) |
2620 | 0 | return NULL; |
2621 | | |
2622 | 0 | encr_tvb = tvb_new_child_real_data(tvb, decrypted_data, buf_len, buf_len); |
2623 | | |
2624 | | /* Add the decrypted data to the data source list. */ |
2625 | 0 | add_new_data_source(pinfo, encr_tvb, "Decrypted IKE"); |
2626 | |
|
2627 | 0 | return encr_tvb; |
2628 | 0 | } |
2629 | | |
2630 | | static proto_tree *dissect_payload_header(tvbuff_t *, packet_info *, unsigned offset, unsigned length, int, uint8_t, |
2631 | | uint8_t *, uint16_t *, proto_tree *); |
2632 | | |
2633 | | static void dissect_sa(tvbuff_t *, unsigned offset, unsigned length, proto_tree *, int, packet_info *, bool, void*); |
2634 | | static void dissect_proposal(tvbuff_t *, packet_info *, unsigned offset, unsigned length, proto_tree *, int, void*); |
2635 | | static void dissect_transform(tvbuff_t *, packet_info *, unsigned offset, unsigned length, proto_tree *, int, int, void*); |
2636 | | static void dissect_key_exch(tvbuff_t *, unsigned offset, unsigned length, proto_tree *, int, packet_info *, void*); |
2637 | | static void dissect_id_type(tvbuff_t *, unsigned offset, unsigned length, uint8_t, proto_tree *, proto_item *, packet_info *); |
2638 | | static void dissect_id(tvbuff_t *, unsigned offset, unsigned length, proto_tree *, int, packet_info *); |
2639 | | static void dissect_cert(tvbuff_t *, unsigned offset, unsigned length, proto_tree *, int, packet_info *); |
2640 | | static void dissect_certreq(tvbuff_t *, unsigned offset, unsigned length, proto_tree *, int, packet_info *); |
2641 | | static void dissect_auth(tvbuff_t *, packet_info *, unsigned offset, unsigned length, proto_tree *); |
2642 | | static void dissect_hash(tvbuff_t *, unsigned offset, unsigned length, proto_tree *); |
2643 | | static void dissect_sig(tvbuff_t *, unsigned offset, unsigned length, proto_tree *); |
2644 | | static void dissect_nonce(tvbuff_t *, unsigned offset, unsigned length, proto_tree *); |
2645 | | static void dissect_notif(tvbuff_t *, packet_info *, unsigned offset, unsigned length, proto_tree *, int); |
2646 | | static void dissect_delete(tvbuff_t *, unsigned offset, unsigned length, proto_tree *, int); |
2647 | | static int dissect_vid(tvbuff_t *, packet_info*, unsigned offset, unsigned length, proto_tree *); |
2648 | | static void dissect_config(tvbuff_t *, packet_info *, unsigned offset, unsigned length, proto_tree *, int, bool); |
2649 | | static void dissect_sa_kek(tvbuff_t *, packet_info *, unsigned offset, unsigned length, proto_tree *); |
2650 | | static void dissect_sa_tek(tvbuff_t *, packet_info *, unsigned offset, unsigned length, proto_tree *); |
2651 | | static void dissect_key_download(tvbuff_t *, packet_info *, unsigned offset, unsigned length, proto_tree *, int); |
2652 | | static void dissect_sequence(tvbuff_t *, packet_info *, unsigned offset, unsigned length, proto_tree *); |
2653 | | static void dissect_nat_discovery(tvbuff_t *, unsigned offset, unsigned length, proto_tree * ); |
2654 | | static void dissect_nat_original_address(tvbuff_t *, unsigned offset, unsigned length, proto_tree *, int ); |
2655 | | static void dissect_ts_payload(tvbuff_t *, packet_info*, unsigned offset, unsigned length, proto_tree *); |
2656 | | static tvbuff_t * dissect_enc(tvbuff_t *, unsigned offset, unsigned length, proto_tree *, packet_info *, uint8_t, bool, void*, bool); |
2657 | | static void dissect_eap(tvbuff_t *, unsigned offset, unsigned length, proto_tree *, packet_info *); |
2658 | | static void dissect_gspm(tvbuff_t *, unsigned offset, unsigned length, proto_tree *); |
2659 | | static void dissect_symmetric_key(tvbuff_t *, unsigned offset, unsigned length, proto_tree *); |
2660 | | static void dissect_cisco_fragmentation(tvbuff_t *, unsigned offset, unsigned length, proto_tree *, packet_info *); |
2661 | | |
2662 | | /* State of current fragmentation within a conversation */ |
2663 | | typedef struct ikev2_fragmentation_state_t { |
2664 | | uint32_t message_id; |
2665 | | uint8_t next_payload; |
2666 | | } ikev2_fragmentation_state_t; |
2667 | | |
2668 | | /* frame_number -> next_payload. The key will be the frame that completes the original message */ |
2669 | | static GHashTable *defrag_next_payload_hash; |
2670 | | |
2671 | | static void dissect_ikev2_fragmentation(tvbuff_t *, unsigned offset, proto_tree *, packet_info *, uint32_t message_id, uint8_t next_payload, |
2672 | | bool is_request, void* decr_info); |
2673 | | |
2674 | | static const uint8_t VID_SSH_IPSEC_EXPRESS_1_1_0[] = { /* Ssh Communications Security IPSEC Express version 1.1.0 */ |
2675 | | 0xfB, 0xF4, 0x76, 0x14, 0x98, 0x40, 0x31, 0xFA, |
2676 | | 0x8E, 0x3B, 0xB6, 0x19, 0x80, 0x89, 0xB2, 0x23 |
2677 | | }; |
2678 | | |
2679 | | static const uint8_t VID_SSH_IPSEC_EXPRESS_1_1_1[] = { /* Ssh Communications Security IPSEC Express version 1.1.1 */ |
2680 | | 0x19, 0x52, 0xDC, 0x91, 0xAC, 0x20, 0xF6, 0x46, |
2681 | | 0xFB, 0x01, 0xCF, 0x42, 0xA3, 0x3A, 0xEE, 0x30 |
2682 | | }; |
2683 | | |
2684 | | static const uint8_t VID_SSH_IPSEC_EXPRESS_1_1_2[] = { /* Ssh Communications Security IPSEC Express version 1.1.2 */ |
2685 | | 0xE8, 0xBF, 0xFA, 0x64, 0x3E, 0x5C, 0x8F, 0x2C, |
2686 | | 0xD1, 0x0F, 0xDA, 0x73, 0x70, 0xB6, 0xEB, 0xE5 |
2687 | | }; |
2688 | | |
2689 | | static const uint8_t VID_SSH_IPSEC_EXPRESS_1_2_1[] = { /* Ssh Communications Security IPSEC Express version 1.2.1 */ |
2690 | | 0xC1, 0x11, 0x1B, 0x2D, 0xEE, 0x8C, 0xBC, 0x3D, |
2691 | | 0x62, 0x05, 0x73, 0xEC, 0x57, 0xAA, 0xB9, 0xCB |
2692 | | }; |
2693 | | |
2694 | | static const uint8_t VID_SSH_IPSEC_EXPRESS_1_2_2[] = { /* Ssh Communications Security IPSEC Express version 1.2.2 */ |
2695 | | 0x09, 0xEC, 0x27, 0xBF, 0xBC, 0x09, 0xC7, 0x58, |
2696 | | 0x23, 0xCF, 0xEC, 0xBF, 0xFE, 0x56, 0x5A, 0x2E |
2697 | | }; |
2698 | | |
2699 | | static const uint8_t VID_SSH_IPSEC_EXPRESS_2_0_0[] = { /* SSH Communications Security IPSEC Express version 2.0.0 */ |
2700 | | 0x7F, 0x21, 0xA5, 0x96, 0xE4, 0xE3, 0x18, 0xF0, |
2701 | | 0xB2, 0xF4, 0x94, 0x4C, 0x23, 0x84, 0xCB, 0x84 |
2702 | | }; |
2703 | | |
2704 | | static const uint8_t VID_SSH_IPSEC_EXPRESS_2_1_0[] = { /* SSH Communications Security IPSEC Express version 2.1.0 */ |
2705 | | 0x28, 0x36, 0xD1, 0xFD, 0x28, 0x07, 0xBC, 0x9E, |
2706 | | 0x5A, 0xE3, 0x07, 0x86, 0x32, 0x04, 0x51, 0xEC |
2707 | | }; |
2708 | | |
2709 | | static const uint8_t VID_SSH_IPSEC_EXPRESS_2_1_1[] = { /* SSH Communications Security IPSEC Express version 2.1.1 */ |
2710 | | 0xA6, 0x8D, 0xE7, 0x56, 0xA9, 0xC5, 0x22, 0x9B, |
2711 | | 0xAE, 0x66, 0x49, 0x80, 0x40, 0x95, 0x1A, 0xD5 |
2712 | | }; |
2713 | | |
2714 | | static const uint8_t VID_SSH_IPSEC_EXPRESS_2_1_2[] = { /* SSH Communications Security IPSEC Express version 2.1.2 */ |
2715 | | 0x3F, 0x23, 0x72, 0x86, 0x7E, 0x23, 0x7C, 0x1C, |
2716 | | 0xD8, 0x25, 0x0A, 0x75, 0x55, 0x9C, 0xAE, 0x20 |
2717 | | }; |
2718 | | |
2719 | | static const uint8_t VID_SSH_IPSEC_EXPRESS_3_0_0[] = { /* SSH Communications Security IPSEC Express version 3.0.0 */ |
2720 | | 0x0E, 0x58, 0xD5, 0x77, 0x4D, 0xF6, 0x02, 0x00, |
2721 | | 0x7D, 0x0B, 0x02, 0x44, 0x36, 0x60, 0xF7, 0xEB |
2722 | | }; |
2723 | | |
2724 | | static const uint8_t VID_SSH_IPSEC_EXPRESS_3_0_1[] = { /* SSH Communications Security IPSEC Express version 3.0.1 */ |
2725 | | 0xF5, 0xCE, 0x31, 0xEB, 0xC2, 0x10, 0xF4, 0x43, |
2726 | | 0x50, 0xCF, 0x71, 0x26, 0x5B, 0x57, 0x38, 0x0F |
2727 | | }; |
2728 | | |
2729 | | static const uint8_t VID_SSH_IPSEC_EXPRESS_4_0_0[] = { /* SSH Communications Security IPSEC Express version 4.0.0 */ |
2730 | | 0xF6, 0x42, 0x60, 0xAF, 0x2E, 0x27, 0x42, 0xDA, |
2731 | | 0xDD, 0xD5, 0x69, 0x87, 0x06, 0x8A, 0x99, 0xA0 |
2732 | | }; |
2733 | | |
2734 | | static const uint8_t VID_SSH_IPSEC_EXPRESS_4_0_1[] = { /* SSH Communications Security IPSEC Express version 4.0.1 */ |
2735 | | 0x7A, 0x54, 0xD3, 0xBD, 0xB3, 0xB1, 0xE6, 0xD9, |
2736 | | 0x23, 0x89, 0x20, 0x64, 0xBE, 0x2D, 0x98, 0x1C |
2737 | | }; |
2738 | | |
2739 | | static const uint8_t VID_SSH_IPSEC_EXPRESS_4_1_0[] = { /* SSH Communications Security IPSEC Express version 4.1.0 */ |
2740 | | 0x9A, 0xA1, 0xF3, 0xB4, 0x34, 0x72, 0xA4, 0x5D, |
2741 | | 0x5F, 0x50, 0x6A, 0xEB, 0x26, 0x0C, 0xF2, 0x14 |
2742 | | }; |
2743 | | |
2744 | | static const uint8_t VID_SSH_IPSEC_EXPRESS_4_1_1[] = { /* SSH Communications Security IPSEC Express version 4.1.1 */ |
2745 | | 0x89, 0xF7, 0xB7, 0x60, 0xD8, 0x6B, 0x01, 0x2A, |
2746 | | 0xCF, 0x26, 0x33, 0x82, 0x39, 0x4D, 0x96, 0x2F |
2747 | | }; |
2748 | | |
2749 | | static const uint8_t VID_SSH_IPSEC_EXPRESS_4_2_0[] = { /* SSH Communications Security IPSEC Express version 4.2.0 */ |
2750 | | 0x68, 0x80, 0xC7, 0xD0, 0x26, 0x09, 0x91, 0x14, |
2751 | | 0xE4, 0x86, 0xC5, 0x54, 0x30, 0xE7, 0xAB, 0xEE |
2752 | | }; |
2753 | | |
2754 | | static const uint8_t VID_SSH_IPSEC_EXPRESS_5_0[] = { /* SSH Communications Security IPSEC Express version 5.0 */ |
2755 | | 0xB0, 0x37, 0xA2, 0x1A, 0xCE, 0xCC, 0xB5, 0x57, |
2756 | | 0x0F, 0x60, 0x25, 0x46, 0xF9, 0x7B, 0xDE, 0x8C |
2757 | | }; |
2758 | | |
2759 | | static const uint8_t VID_SSH_IPSEC_EXPRESS_5_0_0[] = { /* SSH Communications Security IPSEC Express version 5.0.0 */ |
2760 | | 0x2B, 0x2D, 0xAD, 0x97, 0xC4, 0xD1, 0x40, 0x93, |
2761 | | 0x00, 0x53, 0x28, 0x7F, 0x99, 0x68, 0x50, 0xB0 |
2762 | | }; |
2763 | | |
2764 | | static const uint8_t VID_SSH_IPSEC_EXPRESS_5_1_0[] = { /* SSH Communications Security IPSEC Express version 5.1.0 */ |
2765 | | 0x45, 0xE1, 0x7F, 0x3A, 0xBE, 0x93, 0x94, 0x4C, |
2766 | | 0xB2, 0x02, 0x91, 0x0C, 0x59, 0xEF, 0x80, 0x6B |
2767 | | }; |
2768 | | |
2769 | | static const uint8_t VID_SSH_IPSEC_EXPRESS_5_1_1[] = { /* SSH Communications Security IPSEC Express version 5.1.1 */ |
2770 | | 0x59, 0x25, 0x85, 0x9F, 0x73, 0x77, 0xED, 0x78, |
2771 | | 0x16, 0xD2, 0xFB, 0x81, 0xC0, 0x1F, 0xA5, 0x51 |
2772 | | }; |
2773 | | |
2774 | | static const uint8_t VID_SSH_SENTINEL[] = { /* SSH Sentinel */ |
2775 | | 0x05, 0x41, 0x82, 0xA0, 0x7C, 0x7A, 0xE2, 0x06, |
2776 | | 0xF9, 0xD2, 0xCF, 0x9D, 0x24, 0x32, 0xC4, 0x82 |
2777 | | }; |
2778 | | |
2779 | | static const uint8_t VID_SSH_SENTINEL_1_1[] = { /* SSH Sentinel 1.1 */ |
2780 | | 0xB9, 0x16, 0x23, 0xE6, 0x93, 0xCA, 0x18, 0xA5, |
2781 | | 0x4C, 0x6A, 0x27, 0x78, 0x55, 0x23, 0x05, 0xE8 |
2782 | | }; |
2783 | | |
2784 | | static const uint8_t VID_SSH_SENTINEL_1_2[] = { /* SSH Sentinel 1.2 */ |
2785 | | 0x54, 0x30, 0x88, 0x8D, 0xE0, 0x1A, 0x31, 0xA6, |
2786 | | 0xFA, 0x8F, 0x60, 0x22, 0x4E, 0x44, 0x99, 0x58 |
2787 | | }; |
2788 | | |
2789 | | static const uint8_t VID_SSH_SENTINEL_1_3[] = { /* SSH Sentinel 1.3 */ |
2790 | | 0x7E, 0xE5, 0xCB, 0x85, 0xF7, 0x1C, 0xE2, 0x59, |
2791 | | 0xC9, 0x4A, 0x5C, 0x73, 0x1E, 0xE4, 0xE7, 0x52 |
2792 | | }; |
2793 | | |
2794 | | static const uint8_t VID_SSH_SENTINEL_1_4[] = { /* SSH Sentinel 1.4 */ |
2795 | | 0x63, 0xD9, 0xA1, 0xA7, 0x00, 0x94, 0x91, 0xB5, |
2796 | | 0xA0, 0xA6, 0xFD, 0xEB, 0x2A, 0x82, 0x84, 0xF0 |
2797 | | }; |
2798 | | |
2799 | | static const uint8_t VID_SSH_SENTINEL_1_4_1[] = { /* SSH Sentinel 1.4.1 */ |
2800 | | 0xEB, 0x4B, 0x0D, 0x96, 0x27, 0x6B, 0x4E, 0x22, |
2801 | | 0x0A, 0xD1, 0x62, 0x21, 0xA7, 0xB2, 0xA5, 0xE6 |
2802 | | }; |
2803 | | |
2804 | | static const uint8_t VID_SSH_QUICKSEC_0_9_0[] = { /* SSH Communications Security QuickSec 0.9.0 */ |
2805 | | 0x37, 0xEB, 0xA0, 0xC4, 0x13, 0x61, 0x84, 0xE7, |
2806 | | 0xDA, 0xF8, 0x56, 0x2A, 0x77, 0x06, 0x0B, 0x4A |
2807 | | }; |
2808 | | |
2809 | | static const uint8_t VID_SSH_QUICKSEC_1_1_0[] = { /* SSH Communications Security QuickSec 1.1.0 */ |
2810 | | 0x5D, 0x72, 0x92, 0x5E, 0x55, 0x94, 0x8A, 0x96, |
2811 | | 0x61, 0xA7, 0xFC, 0x48, 0xFD, 0xEC, 0x7F, 0xF9 |
2812 | | }; |
2813 | | |
2814 | | static const uint8_t VID_SSH_QUICKSEC_1_1_1[] = { /* SSH Communications Security QuickSec 1.1.1 */ |
2815 | | 0x77, 0x7F, 0xBF, 0x4C, 0x5A, 0xF6, 0xD1, 0xCD, |
2816 | | 0xD4, 0xB8, 0x95, 0xA0, 0x5B, 0xF8, 0x25, 0x94 |
2817 | | }; |
2818 | | |
2819 | | static const uint8_t VID_SSH_QUICKSEC_1_1_2[] = { /* SSH Communications Security QuickSec 1.1.2 */ |
2820 | | 0x2C, 0xDF, 0x08, 0xE7, 0x12, 0xED, 0xE8, 0xA5, |
2821 | | 0x97, 0x87, 0x61, 0x26, 0x7C, 0xD1, 0x9B, 0x91 |
2822 | | }; |
2823 | | |
2824 | | static const uint8_t VID_SSH_QUICKSEC_1_1_3[] = { /* SSH Communications Security QuickSec 1.1.3 */ |
2825 | | 0x59, 0xE4, 0x54, 0xA8, 0xC2, 0xCF, 0x02, 0xA3, |
2826 | | 0x49, 0x59, 0x12, 0x1F, 0x18, 0x90, 0xBC, 0x87 |
2827 | | }; |
2828 | | |
2829 | | static const uint8_t VID_draft_huttunen_ipsec_esp_in_udp_00[] = { /* draft-huttunen-ipsec-esp-in-udp-00.txt */ |
2830 | | 0x6A, 0x74, 0x34, 0xC1, 0x9D, 0x7E, 0x36, 0x34, |
2831 | | 0x80, 0x90, 0xA0, 0x23, 0x34, 0xC9, 0xC8, 0x05 |
2832 | | }; |
2833 | | |
2834 | | static const uint8_t VID_draft_huttunen_ipsec_esp_in_udp_01[] = { /* draft-huttunen-ipsec-esp-in-udp-01.txt */ |
2835 | | 0x50, 0x76, 0x0F, 0x62, 0x4C, 0x63, 0xE5, 0xC5, |
2836 | | 0x3E, 0xEA, 0x38, 0x6C, 0x68, 0x5C, 0xA0, 0x83 |
2837 | | }; |
2838 | | |
2839 | | static const uint8_t VID_draft_stenberg_ipsec_nat_traversal_01[] = { /* draft-stenberg-ipsec-nat-traversal-01 */ |
2840 | | 0x27, 0xBA, 0xB5, 0xDC, 0x01, 0xEA, 0x07, 0x60, |
2841 | | 0xEA, 0x4E, 0x31, 0x90, 0xAC, 0x27, 0xC0, 0xD0 |
2842 | | }; |
2843 | | |
2844 | | static const uint8_t VID_draft_stenberg_ipsec_nat_traversal_02[]= { /* draft-stenberg-ipsec-nat-traversal-02 */ |
2845 | | 0x61, 0x05, 0xC4, 0x22, 0xE7, 0x68, 0x47, 0xE4, |
2846 | | 0x3F, 0x96, 0x84, 0x80, 0x12, 0x92, 0xAE, 0xCD |
2847 | | }; |
2848 | | |
2849 | | static const uint8_t VID_draft_ietf_ipsec_nat_t_ike[]= { /* draft-ietf-ipsec-nat-t-ike */ |
2850 | | 0x4D, 0xF3, 0x79, 0x28, 0xE9, 0xFC, 0x4F, 0xD1, |
2851 | | 0xB3, 0x26, 0x21, 0x70, 0xD5, 0x15, 0xC6, 0x62 |
2852 | | }; |
2853 | | |
2854 | | static const uint8_t VID_draft_ietf_ipsec_nat_t_ike_00[]= { /* draft-ietf-ipsec-nat-t-ike-00 */ |
2855 | | 0x44, 0x85, 0x15, 0x2D, 0x18, 0xB6, 0xBB, 0xCD, |
2856 | | 0x0B, 0xE8, 0xA8, 0x46, 0x95, 0x79, 0xDD, 0xCC |
2857 | | }; |
2858 | | |
2859 | | static const uint8_t VID_draft_ietf_ipsec_nat_t_ike_01[]= { /* "draft-ietf-ipsec-nat-t-ike-01" */ |
2860 | | 0x16, 0xF6, 0xCA, 0x16, 0xE4, 0xA4, 0x06, 0x6D, |
2861 | | 0x83, 0x82, 0x1A, 0x0F, 0x0A, 0xEA, 0xA8, 0x62 |
2862 | | }; |
2863 | | |
2864 | | static const uint8_t VID_draft_ietf_ipsec_nat_t_ike_02[]= { /* draft-ietf-ipsec-nat-t-ike-02 */ |
2865 | | 0xCD, 0x60, 0x46, 0x43, 0x35, 0xDF, 0x21, 0xF8, |
2866 | | 0x7C, 0xFD, 0xB2, 0xFC, 0x68, 0xB6, 0xA4, 0x48 |
2867 | | }; |
2868 | | |
2869 | | static const uint8_t VID_draft_ietf_ipsec_nat_t_ike_02n[]= { /* draft-ietf-ipsec-nat-t-ike-02\n */ |
2870 | | 0x90, 0xCB, 0x80, 0x91, 0x3E, 0xBB, 0x69, 0x6E, |
2871 | | 0x08, 0x63, 0x81, 0xB5, 0xEC, 0x42, 0x7B, 0x1F |
2872 | | }; |
2873 | | |
2874 | | static const uint8_t VID_draft_ietf_ipsec_nat_t_ike_03[] = { /* draft-ietf-ipsec-nat-t-ike-03 */ |
2875 | | 0x7D, 0x94, 0x19, 0xA6, 0x53, 0x10, 0xCA, 0x6F, |
2876 | | 0x2C, 0x17, 0x9D, 0x92, 0x15, 0x52, 0x9d, 0x56 |
2877 | | }; |
2878 | | |
2879 | | static const uint8_t VID_draft_ietf_ipsec_nat_t_ike_04[] = { /* draft-ietf-ipsec-nat-t-ike-04 */ |
2880 | | 0x99, 0x09, 0xb6, 0x4e, 0xed, 0x93, 0x7c, 0x65, |
2881 | | 0x73, 0xde, 0x52, 0xac, 0xe9, 0x52, 0xfa, 0x6b |
2882 | | }; |
2883 | | static const uint8_t VID_draft_ietf_ipsec_nat_t_ike_05[] = { /* draft-ietf-ipsec-nat-t-ike-05 */ |
2884 | | 0x80, 0xd0, 0xbb, 0x3d, 0xef, 0x54, 0x56, 0x5e, |
2885 | | 0xe8, 0x46, 0x45, 0xd4, 0xc8, 0x5c, 0xe3, 0xee |
2886 | | }; |
2887 | | static const uint8_t VID_draft_ietf_ipsec_nat_t_ike_06[] = { /* draft-ietf-ipsec-nat-t-ike-06 */ |
2888 | | 0x4d, 0x1e, 0x0e, 0x13, 0x6d, 0xea, 0xfa, 0x34, |
2889 | | 0xc4, 0xf3, 0xea, 0x9f, 0x02, 0xec, 0x72, 0x85 |
2890 | | }; |
2891 | | static const uint8_t VID_draft_ietf_ipsec_nat_t_ike_07[] = { /* draft-ietf-ipsec-nat-t-ike-07 */ |
2892 | | 0x43, 0x9b, 0x59, 0xf8, 0xba, 0x67, 0x6c, 0x4c, |
2893 | | 0x77, 0x37, 0xae, 0x22, 0xea, 0xb8, 0xf5, 0x82 |
2894 | | }; |
2895 | | static const uint8_t VID_draft_ietf_ipsec_nat_t_ike_08[] = { /* draft-ietf-ipsec-nat-t-ike-08 */ |
2896 | | 0x8f, 0x8d, 0x83, 0x82, 0x6d, 0x24, 0x6b, 0x6f, |
2897 | | 0xc7, 0xa8, 0xa6, 0xa4, 0x28, 0xc1, 0x1d, 0xe8 |
2898 | | }; |
2899 | | static const uint8_t VID_draft_ietf_ipsec_nat_t_ike_09[] = { /* draft-ietf-ipsec-nat-t-ike-09 */ |
2900 | | 0x42, 0xea, 0x5b, 0x6f, 0x89, 0x8d, 0x97, 0x73, |
2901 | | 0xa5, 0x75, 0xdf, 0x26, 0xe7, 0xdd, 0x19, 0xe1 |
2902 | | }; |
2903 | | static const uint8_t VID_testing_nat_t_rfc[] = { /* Testing NAT-T RFC */ |
2904 | | 0xc4, 0x0f, 0xee, 0x00, 0xd5, 0xd3, 0x9d, 0xdb, |
2905 | | 0x1f, 0xc7, 0x62, 0xe0, 0x9b, 0x7c, 0xfe, 0xa7 |
2906 | | }; |
2907 | | |
2908 | | static const uint8_t VID_rfc3947_nat_t[] = { /* RFC 3947 Negotiation of NAT-Traversal in the IKE */ |
2909 | | 0x4a, 0x13, 0x1c, 0x81, 0x07, 0x03, 0x58, 0x45, |
2910 | | 0x5c, 0x57, 0x28, 0xf2, 0x0e, 0x95, 0x45, 0x2f |
2911 | | }; |
2912 | | static const uint8_t VID_draft_beaulieu_ike_xauth_02[]= { /* draft-beaulieu-ike-xauth-02.txt 02 or 06 ??*/ |
2913 | | 0x09, 0x00, 0x26, 0x89, 0xDF, 0xD6, 0xB7, 0x12, |
2914 | | 0x80, 0xA2, 0x24, 0xDE, 0xC3, 0x3B, 0x81, 0xE5 |
2915 | | }; |
2916 | | |
2917 | | static const uint8_t VID_xauth[]= { /* XAUTH (truncated MD5 hash of "draft-ietf-ipsra-isakmp-xauth-06.txt") */ |
2918 | | 0x09, 0x00, 0x26, 0x89, 0xDF, 0xD6, 0xB7, 0x12 |
2919 | | }; |
2920 | | |
2921 | | static const uint8_t VID_rfc3706_dpd[]= { /* RFC 3706 */ |
2922 | | 0xAF, 0xCA, 0xD7, 0x13, 0x68, 0xA1, 0xF1, 0xC9, |
2923 | | 0x6B, 0x86, 0x96, 0xFC, 0x77, 0x57, 0x01, 0x00 |
2924 | | }; |
2925 | | static const uint8_t VID_draft_ietf_ipsec_antireplay_00[]= { /* draft-ietf-ipsec-antireplay-00.txt */ |
2926 | | 0x32, 0x5D, 0xF2, 0x9A, 0x23, 0x19, 0xF2, 0xDD |
2927 | | }; |
2928 | | |
2929 | | static const uint8_t VID_draft_ietf_ipsec_heartbeats_00[]= { /* draft-ietf-ipsec-heartbeats-00.txt */ |
2930 | | 0x8D, 0xB7, 0xA4, 0x18, 0x11, 0x22, 0x16, 0x60 |
2931 | | }; |
2932 | | static const uint8_t VID_IKE_CHALLENGE_RESPONSE_1[]= { /* IKE Challenge/Response for Authenticated Cryptographic Keys */ |
2933 | | 0xBA, 0x29, 0x04, 0x99, 0xC2, 0x4E, 0x84, 0xE5, |
2934 | | 0x3A, 0x1D, 0x83, 0xA0, 0x5E, 0x5F, 0x00, 0xC9 |
2935 | | }; |
2936 | | |
2937 | | static const uint8_t VID_IKE_CHALLENGE_RESPONSE_2[]= { /* IKE Challenge/Response for Authenticated Cryptographic Keys */ |
2938 | | 0x0D, 0x33, 0x61, 0x1A, 0x5D, 0x52, 0x1B, 0x5E, |
2939 | | 0x3C, 0x9C, 0x03, 0xD2, 0xFC, 0x10, 0x7E, 0x12 |
2940 | | }; |
2941 | | |
2942 | | static const uint8_t VID_IKE_CHALLENGE_RESPONSE_REV_1[]= { /* IKE Challenge/Response for Authenticated Cryptographic Keys (Revised) */ |
2943 | | |
2944 | | 0xAD, 0x32, 0x51, 0x04, 0x2C, 0xDC, 0x46, 0x52, |
2945 | | 0xC9, 0xE0, 0x73, 0x4C, 0xE5, 0xDE, 0x4C, 0x7D |
2946 | | }; |
2947 | | |
2948 | | static const uint8_t VID_IKE_CHALLENGE_RESPONSE_REV_2[]= { /* IKE Challenge/Response for Authenticated Cryptographic Keys (Revised) */ |
2949 | | 0x01, 0x3F, 0x11, 0x82, 0x3F, 0x96, 0x6F, 0xA9, |
2950 | | 0x19, 0x00, 0xF0, 0x24, 0xBA, 0x66, 0xA8, 0x6B |
2951 | | }; |
2952 | | |
2953 | | static const uint8_t VID_CISCO_FRAG2[]= { /* Cisco Fragmentation - md5("FRAGMENTATION") */ |
2954 | | 0x40, 0x48, 0xB7, 0xD5, 0x6E, 0xBC, 0xE8, 0x85, |
2955 | | 0x25, 0xE7, 0xDE, 0x7F, 0x00, 0xD6, 0xC2, 0xD3 |
2956 | | }; |
2957 | | |
2958 | | static const uint8_t VID_MS_VID_INITIAL_CONTACT[]= { /* Microsoft Vid-Initial-Contact */ |
2959 | | 0x26, 0x24, 0x4d, 0x38, 0xed, 0xdb, 0x61, 0xb3, |
2960 | | 0x17, 0x2a, 0x36, 0xe3, 0xd0, 0xcf, 0xb8, 0x19 |
2961 | | }; |
2962 | | |
2963 | | static const uint8_t VID_GSS_API_1[]= { /* A GSS-API Authentication Method for IKE */ |
2964 | | 0xB4, 0x6D, 0x89, 0x14, 0xF3, 0xAA, 0xA3, 0xF2, |
2965 | | 0xFE, 0xDE, 0xB7, 0xC7, 0xDB, 0x29, 0x43, 0xCA |
2966 | | }; |
2967 | | |
2968 | | static const uint8_t VID_GSS_API_2[]= { /* A GSS-API Authentication Method for IKE */ |
2969 | | 0xAD, 0x2C, 0x0D, 0xD0, 0xB9, 0xC3, 0x20, 0x83, |
2970 | | 0xCC, 0xBA, 0x25, 0xB8, 0x86, 0x1E, 0xC4, 0x55 |
2971 | | }; |
2972 | | |
2973 | | static const uint8_t VID_GSSAPI[]= { /* GSSAPI */ |
2974 | | 0x62, 0x1B, 0x04, 0xBB, 0x09, 0x88, 0x2A, 0xC1, |
2975 | | 0xE1, 0x59, 0x35, 0xFE, 0xFA, 0x24, 0xAE, 0xEE |
2976 | | }; |
2977 | | |
2978 | | static const uint8_t VID_MS_NT5_ISAKMPOAKLEY[]= { /* MS NT5 ISAKMPOAKLEY */ |
2979 | | 0x1E, 0x2B, 0x51, 0x69, 0x05, 0x99, 0x1C, 0x7D, |
2980 | | 0x7C, 0x96, 0xFC, 0xBF, 0xB5, 0x87, 0xE4, 0x61 |
2981 | | }; |
2982 | | |
2983 | | static const uint8_t VID_CISCO_UNITY[]= { /* CISCO-UNITY */ |
2984 | | 0x12, 0xF5, 0xF2, 0x8C, 0x45, 0x71, 0x68, 0xA9, |
2985 | | 0x70, 0x2D, 0x9F, 0xE2, 0x74, 0xCC |
2986 | | }; |
2987 | | |
2988 | | |
2989 | | static const uint8_t VID_CISCO_CONCENTRATOR[]= { /* CISCO-CONCENTRATOR */ |
2990 | | 0x1F, 0x07, 0xF7, 0x0E, 0xAA, 0x65, 0x14, 0xD3, |
2991 | | 0xB0, 0xFA, 0x96, 0x54, 0x2A, 0x50, 0x01, 0x00 |
2992 | | }; |
2993 | | static const uint8_t VID_CISCO_FRAG[] = { /* Cisco Fragmentation */ |
2994 | | 0x40, 0x48, 0xB7, 0xD5, 0x6E, 0xBC, 0xE8, 0x85, |
2995 | | 0x25, 0xE7, 0xDE, 0x7F, 0x00, 0xD6, 0xC2, 0xD3, |
2996 | | 0x80, 0x00, 0x00, 0x00 |
2997 | | }; |
2998 | | |
2999 | | static const uint8_t VID_CISCO_FLEXVPN_SUPPORTED[] = { /* FLEXVPN-SUPPORTED */ |
3000 | | 0x46, 0x4c, 0x45, 0x58, 0x56, 0x50, 0x4e, 0x2d, |
3001 | | 0x53, 0x55, 0x50, 0x50, 0x4f, 0x52, 0x54, 0x45, |
3002 | | 0x44 |
3003 | | }; |
3004 | | |
3005 | | static const uint8_t VID_CISCO_DELETE_REASON[] = { /* CISCO-DELETE-REASON */ |
3006 | | 0x43, 0x49, 0x53, 0x43, 0x4f, 0x2d, 0x44, 0x45, |
3007 | | 0x4c, 0x45, 0x54, 0x45, 0x2d, 0x52, 0x45, 0x41, |
3008 | | 0x53, 0x4f, 0x4e |
3009 | | }; |
3010 | | |
3011 | | static const uint8_t VID_CISCO_DYNAMIC_ROUTE[] = { /* CISCO-DYNAMIC-ROUTE */ |
3012 | | 0x43, 0x49, 0x53, 0x43, 0x4f, 0x2d, 0x44, 0x59, |
3013 | | 0x4e, 0x41, 0x4d, 0x49, 0x43, 0x2d, 0x52, 0x4f, |
3014 | | 0x55, 0x54, 0x45 |
3015 | | }; |
3016 | | |
3017 | | static const uint8_t VID_CISCO_VPN_REV_02[] = { /* CISCO-VPN-REV-02 */ |
3018 | | 0x43, 0x49, 0x53, 0x43, 0x4f, 0x56, 0x50, 0x4e, |
3019 | | 0x2d, 0x52, 0x45, 0x56, 0x2d, 0x30, 0x32 |
3020 | | }; |
3021 | | |
3022 | | /* CISCO(COPYRIGHT)&Copyright (c) 2009 Cisco Systems, Inc. */ |
3023 | | static const uint8_t VID_CISCO_COPYRIGHT[] = { /* Cisco Copyright */ |
3024 | | 0x43, 0x49, 0x53, 0x43, 0x4f, 0x28, 0x43, 0x4f, |
3025 | | 0x50, 0x59, 0x52, 0x49, 0x47, 0x48, 0x54, 0x29, |
3026 | | 0x26, 0x43, 0x6f, 0x70, 0x79, 0x72, 0x69, 0x67, |
3027 | | 0x68, 0x74, 0x20, 0x28, 0x63, 0x29, 0x20, 0x32, |
3028 | | 0x30, 0x30, 0x39, 0x20, 0x43, 0x69, 0x73, 0x63, |
3029 | | 0x6f, 0x20, 0x53, 0x79, 0x73, 0x74, 0x65, 0x6d, |
3030 | | 0x73, 0x2c, 0x20, 0x49, 0x6e, 0x63, 0x2e |
3031 | | }; |
3032 | | |
3033 | | static const uint8_t VID_CISCO_GRE_MODE[] = { /* CISCO-GRE-MODE */ |
3034 | | 0x43, 0x49, 0x53, 0x43, 0x4f, 0x2d, 0x47, 0x52, |
3035 | | 0x45, 0x2d, 0x4d, 0x4f, 0x44, 0x45 |
3036 | | }; |
3037 | | |
3038 | | static const uint8_t VID_CP_01_R65[] = { /* CryptoPro/GOST 0.1 / Check Point R65 */ |
3039 | | 0xF4, 0xED, 0x19, 0xE0, 0xC1, 0x14, 0xEB, 0x51, |
3040 | | 0x6F, 0xAA, 0xAC, 0x0E, 0xE3, 0x7D, 0xAF, 0x28, |
3041 | | 0x7, 0xB4, 0x38, 0x1F |
3042 | | }; |
3043 | | |
3044 | | static const uint8_t VID_CP_10_R71[] = { /* CryptoPro/GOST 1.0 / Check Point R71 */ |
3045 | | 0x03, 0x10, 0x17, 0xE0, 0x7F, 0x7A, 0x82, 0xE3, |
3046 | | 0xAA, 0x69, 0x50, 0xC9, 0x99, 0x99, 0x01, 0x00 |
3047 | | }; |
3048 | | |
3049 | | static const uint8_t VID_CP_11[] = { /* CryptoPro/GOST 1.1 */ |
3050 | | 0x03, 0x10, 0x17, 0xE0, 0x7F, 0x7A, 0x82, 0xE3, |
3051 | | 0xAA, 0x69, 0x50, 0xC9, 0x99, 0x99, 0x01, 0x01 |
3052 | | }; |
3053 | | |
3054 | | static const uint8_t VID_CYBERGUARD[] = { /* CyberGuard */ |
3055 | | 0x9A, 0xA1, 0xF3, 0xB4, 0x34, 0x72, 0xA4, 0x5D, |
3056 | | 0x5F, 0x50, 0x6A, 0xEB, 0x26, 0xC0, 0xF2, 0x14 |
3057 | | }; |
3058 | | |
3059 | | static const uint8_t VID_SHREWSOFT[] = { /* Shrew Soft */ |
3060 | | 0xf1, 0x4b, 0x94, 0xb7, 0xbf, 0xf1, 0xfe, 0xf0, |
3061 | | 0x27, 0x73, 0xb8, 0xc4, 0x9f, 0xed, 0xed, 0x26 |
3062 | | }; |
3063 | | static const uint8_t VID_STRONGSWAN[] = { /* strongSwan */ |
3064 | | 0x88, 0x2f, 0xe5, 0x6d, 0x6f, 0xd2, 0x0d, 0xbc, |
3065 | | 0x22, 0x51, 0x61, 0x3b, 0x2e, 0xbe, 0x5b, 0xeb |
3066 | | }; |
3067 | | static const uint8_t VID_KAME_RACOON[] = { /* KAME/racoon */ |
3068 | | 0x70, 0x03, 0xcb, 0xc1, 0x09, 0x7d, 0xbe, 0x9c, |
3069 | | 0x26, 0x00, 0xba, 0x69, 0x83, 0xbc, 0x8b, 0x35 |
3070 | | }; |
3071 | | |
3072 | | static const uint8_t VID_IPSEC_TOOLS[] = { /* IPsec-Tools */ |
3073 | | 0x20, 0xa3, 0x62, 0x2c, 0x1c, 0xea, 0x7c, 0xe3, |
3074 | | 0x7b, 0xee, 0x3c, 0xa4, 0x84, 0x42, 0x52, 0x76 |
3075 | | }; |
3076 | | |
3077 | | static const uint8_t VID_NETSCREEN_1[] = { /* Netscreen-1 */ |
3078 | | 0x29, 0x9e, 0xe8, 0x28, 0x9f, 0x40, 0xa8, 0x97, |
3079 | | 0x3b, 0xc7, 0x86, 0x87, 0xe2, 0xe7, 0x22, 0x6b, |
3080 | | 0x53, 0x2c, 0x3b, 0x76 |
3081 | | }; |
3082 | | |
3083 | | static const uint8_t VID_NETSCREEN_2[] = { /* Netscreen-2 */ |
3084 | | 0x3a, 0x15, 0xe1, 0xf3, 0xcf, 0x2a, 0x63, 0x58, |
3085 | | 0x2e, 0x3a, 0xc8, 0x2d, 0x1c, 0x64, 0xcb, 0xe3, |
3086 | | 0xb6, 0xd7, 0x79, 0xe7 |
3087 | | }; |
3088 | | |
3089 | | static const uint8_t VID_NETSCREEN_3[] = { /* Netscreen-3 */ |
3090 | | 0x47, 0xd2, 0xb1, 0x26, 0xbf, 0xcd, 0x83, 0x48, |
3091 | | 0x97, 0x60, 0xe2, 0xcf, 0x8c, 0x5d, 0x4d, 0x5a, |
3092 | | 0x03, 0x49, 0x7c, 0x15 |
3093 | | }; |
3094 | | |
3095 | | static const uint8_t VID_NETSCREEN_4[] = { /* Netscreen-4 */ |
3096 | | 0x4a, 0x43, 0x40, 0xb5, 0x43, 0xe0, 0x2b, 0x84, |
3097 | | 0xc8, 0x8a, 0x8b, 0x96, 0xa8, 0xaf, 0x9e, 0xbe, |
3098 | | 0x77, 0xd9, 0xac, 0xcc |
3099 | | }; |
3100 | | |
3101 | | static const uint8_t VID_NETSCREEN_5[] = { /* Netscreen-5 */ |
3102 | | 0x64, 0x40, 0x5f, 0x46, 0xf0, 0x3b, 0x76, 0x60, |
3103 | | 0xa2, 0x3b, 0xe1, 0x16, 0xa1, 0x97, 0x50, 0x58, |
3104 | | 0xe6, 0x9e, 0x83, 0x87 |
3105 | | }; |
3106 | | |
3107 | | static const uint8_t VID_NETSCREEN_6[] = { /* Netscreen-6 */ |
3108 | | 0x69, 0x93, 0x69, 0x22, 0x87, 0x41, 0xc6, 0xd4, |
3109 | | 0xca, 0x09, 0x4c, 0x93, 0xe2, 0x42, 0xc9, 0xde, |
3110 | | 0x19, 0xe7, 0xb7, 0xc6 |
3111 | | }; |
3112 | | |
3113 | | static const uint8_t VID_NETSCREEN_7[] = { /* Netscreen-7 */ |
3114 | | 0x8c, 0x0d, 0xc6, 0xcf, 0x62, 0xa0, 0xef, 0x1b, |
3115 | | 0x5c, 0x6e, 0xab, 0xd1, 0xb6, 0x7b, 0xa6, 0x98, |
3116 | | 0x66, 0xad, 0xf1, 0x6a |
3117 | | }; |
3118 | | |
3119 | | static const uint8_t VID_NETSCREEN_8[] = { /* Netscreen-8 */ |
3120 | | 0x92, 0xd2, 0x7a, 0x9e, 0xcb, 0x31, 0xd9, 0x92, |
3121 | | 0x46, 0x98, 0x6d, 0x34, 0x53, 0xd0, 0xc3, 0xd5, |
3122 | | 0x7a, 0x22, 0x2a, 0x61 |
3123 | | }; |
3124 | | |
3125 | | static const uint8_t VID_NETSCREEN_9[] = { /* Netscreen-9 */ |
3126 | | 0x9b, 0x09, 0x6d, 0x9a, 0xc3, 0x27, 0x5a, 0x7d, |
3127 | | 0x6f, 0xe8, 0xb9, 0x1c, 0x58, 0x31, 0x11, 0xb0, |
3128 | | 0x9e, 0xfe, 0xd1, 0xa0 |
3129 | | }; |
3130 | | |
3131 | | static const uint8_t VID_NETSCREEN_10[] = { /* Netscreen-10 */ |
3132 | | 0xbf, 0x03, 0x74, 0x61, 0x08, 0xd7, 0x46, 0xc9, |
3133 | | 0x04, 0xf1, 0xf3, 0x54, 0x7d, 0xe2, 0x4f, 0x78, |
3134 | | 0x47, 0x9f, 0xed, 0x12 |
3135 | | }; |
3136 | | |
3137 | | static const uint8_t VID_NETSCREEN_11[] = { /* Netscreen-11 */ |
3138 | | 0xc2, 0xe8, 0x05, 0x00, 0xf4, 0xcc, 0x5f, 0xbf, |
3139 | | 0x5d, 0xaa, 0xee, 0xd3, 0xbb, 0x59, 0xab, 0xae, |
3140 | | 0xee, 0x56, 0xc6, 0x52 |
3141 | | }; |
3142 | | |
3143 | | static const uint8_t VID_NETSCREEN_12[] = { /* Netscreen-12 */ |
3144 | | 0xc8, 0x66, 0x0a, 0x62, 0xb0, 0x3b, 0x1b, 0x61, |
3145 | | 0x30, 0xbf, 0x78, 0x16, 0x08, 0xd3, 0x2a, 0x6a, |
3146 | | 0x8d, 0x0f, 0xb8, 0x9f |
3147 | | }; |
3148 | | |
3149 | | static const uint8_t VID_NETSCREEN_13[] = { /* Netscreen-13 */ |
3150 | | 0xf8, 0x85, 0xda, 0x40, 0xb1, 0xe7, 0xa9, 0xab, |
3151 | | 0xd1, 0x76, 0x55, 0xec, 0x5b, 0xbe, 0xc0, 0xf2, |
3152 | | 0x1f, 0x0e, 0xd5, 0x2e |
3153 | | }; |
3154 | | |
3155 | | static const uint8_t VID_NETSCREEN_14[] = { /* Netscreen-14 */ |
3156 | | 0x2a, 0x2b, 0xca, 0xc1, 0x9b, 0x8e, 0x91, 0xb4, |
3157 | | 0x26, 0x10, 0x78, 0x07, 0xe0, 0x2e, 0x72, 0x49, |
3158 | | 0x56, 0x9d, 0x6f, 0xd3 |
3159 | | }; |
3160 | | static const uint8_t VID_NETSCREEN_15[] = { /* Netscreen-15 */ |
3161 | | 0x16, 0x6f, 0x93, 0x2d, 0x55, 0xeb, 0x64, 0xd8, |
3162 | | 0xe4, 0xdf, 0x4f, 0xd3, 0x7e, 0x23, 0x13, 0xf0, |
3163 | | 0xd0, 0xfd, 0x84, 0x51 |
3164 | | }; |
3165 | | |
3166 | | static const uint8_t VID_NETSCREEN_16[] = { /* Netscreen-16 */ |
3167 | | 0xa3, 0x5b, 0xfd, 0x05, 0xca, 0x1a, 0xc0, 0xb3, |
3168 | | 0xd2, 0xf2, 0x4e, 0x9e, 0x82, 0xbf, 0xcb, 0xff, |
3169 | | 0x9c, 0x9e, 0x52, 0xb5 |
3170 | | }; |
3171 | | |
3172 | | static const uint8_t VID_ZYWALL[] = { /* ZYWALL */ |
3173 | | 0x62, 0x50, 0x27, 0x74, 0x9d, 0x5a, 0xb9, 0x7f, |
3174 | | 0x56, 0x16, 0xc1, 0x60, 0x27, 0x65, 0xcf, 0x48, |
3175 | | 0x0a, 0x3b, 0x7d, 0x0b |
3176 | | }; |
3177 | | |
3178 | | static const uint8_t VID_SIDEWINDER[] = { /* SIDEWINDER */ |
3179 | | 0x84, 0x04, 0xad, 0xf9, 0xcd, 0xa0, 0x57, 0x60, |
3180 | | 0xb2, 0xca, 0x29, 0x2e, 0x4b, 0xff, 0x53, 0x7b |
3181 | | }; |
3182 | | |
3183 | | static const uint8_t VID_SONICWALL[] = { /* SonicWALL */ |
3184 | | 0x40, 0x4B, 0xF4, 0x39, 0x52, 0x2C, 0xA3, 0xF6 |
3185 | | }; |
3186 | | |
3187 | | static const uint8_t VID_HEARTBEAT_NOTIFY[] = { /* Heartbeat Notify */ |
3188 | | 0x48 ,0x65, 0x61, 0x72, 0x74, 0x42, 0x65, 0x61, |
3189 | | 0x74, 0x5f, 0x4e, 0x6f, 0x74, 0x69, 0x66, 0x79 |
3190 | | }; |
3191 | | |
3192 | | static const uint8_t VID_DWR[] = { /* DWR: Delete with reason */ |
3193 | | 0x2D, 0x79, 0x22, 0xC6, 0xB3, 0x01, 0xD9, 0xB0, |
3194 | | 0xE1, 0x34, 0x27, 0x39, 0xE9, 0xCF, 0xBB, 0xD5 |
3195 | | }; |
3196 | | |
3197 | | static const uint8_t VID_ARUBA_RAP[] = { /* Remote AP (Aruba Networks) */ |
3198 | | 0xca, 0x3e, 0x2b, 0x85, 0x4b, 0xa8, 0x03, 0x00, |
3199 | | 0x17, 0xdc, 0x10, 0x23, 0xa4, 0xfd, 0xe2, 0x04, |
3200 | | 0x1f, 0x9f, 0x74, 0x63 |
3201 | | }; |
3202 | | |
3203 | | static const uint8_t VID_ARUBA_CONTROLLER[] = { /* Controller (Aruba Networks) */ |
3204 | | 0x3c, 0x8e, 0x70, 0xbd, 0xf9, 0xc7, 0xd7, 0x4a, |
3205 | | 0xdd, 0x53, 0xe4, 0x10, 0x09, 0x15, 0xdc, 0x2e, |
3206 | | 0x4b, 0xb5, 0x12, 0x74 |
3207 | | }; |
3208 | | |
3209 | | static const uint8_t VID_ARUBA_VIA_CLIENT[] = { /* VIA Client (Aruba Networks) */ |
3210 | | 0x88, 0xf0, 0xe3, 0x14, 0x9b, 0x3f, 0xa4, 0x8b, |
3211 | | 0x05, 0xaa, 0x7f, 0x68, 0x5f, 0x0b, 0x76, 0x6b, |
3212 | | 0xe1, 0x86, 0xcc, 0xb8 |
3213 | | }; |
3214 | | |
3215 | | static const uint8_t VID_ARUBA_VIA_AUTH_PROFILE[] = { /* VIA Auth Profile (Aruba Networks) */ |
3216 | | 0x56, 0x49, 0x41, 0x20, 0x41, 0x75, 0x74, 0x68, |
3217 | | 0x20, 0x50, 0x72, 0x6f, 0x66, 0x69, 0x6c, 0x65, |
3218 | | 0x20, 0x3a, 0x20 |
3219 | | }; |
3220 | | |
3221 | | /* |
3222 | | * MS-IKEE Internet Key Exchange Protocol Extensions (v20080212).pdf |
3223 | | * Windows Vista and Windows Server 2008 |
3224 | | */ |
3225 | | static const uint8_t VID_MS_IKEE_20080212_CGA1[] = { /* IKE CGA Version 1 */ |
3226 | | 0xe3, 0xa5, 0x96, 0x6a, 0x76, 0x37, 0x9f, 0xe7, |
3227 | | 0x07, 0x22, 0x82, 0x31, 0xe5, 0xce, 0x86, 0x52 |
3228 | | }; |
3229 | | |
3230 | | static const uint8_t VID_MS_IKEE_20080212_MS_NDC[] = { /* MS-Negotiation Discovery Capable */ |
3231 | | 0xfb, 0x1d, 0xe3, 0xcd, 0xf3, 0x41, 0xb7, 0xea, |
3232 | | 0x16, 0xb7, 0xe5, 0xbe, 0x08, 0x55, 0xf1, 0x20 |
3233 | | }; |
3234 | | |
3235 | | static const uint8_t VID_FORTINET_FORTIGATE[] = { /* Fortigate (Fortinet) */ |
3236 | | 0x82, 0x99, 0x03, 0x17, 0x57, 0xA3, 0x60, 0x82, |
3237 | | 0xC6, 0xA6, 0x21, 0xDE |
3238 | | }; |
3239 | | |
3240 | | static const uint8_t VID_FORTINET_FORTICLIENT_CONNECT[] = { /* Forticlient Connect license (Fortinet) */ |
3241 | | 0x4C, 0x53, 0x42, 0x7B, 0x6D, 0x46, 0x5D, 0x1B, |
3242 | | 0x33, 0x7B, 0xB7, 0x55, 0xA3, 0x7A, 0x7F, 0xEF |
3243 | | }; |
3244 | | |
3245 | | static const uint8_t VID_FORTINET_ENDPOINT_CONTROL[] = { /* Endpoint Control (Fortinet) */ |
3246 | | 0xB4, 0xF0, 0x1C, 0xA9, 0x51, 0xE9, 0xDA, 0x8D, |
3247 | | 0x0B, 0xAF, 0xBB, 0xD3, 0x4A, 0xD3, 0x04, 0x4E |
3248 | | }; |
3249 | | |
3250 | | static const uint8_t VID_FORTINET_AUTODISCOVERY_RECEIVER[] = { /* Auto-Discovery Receiver (Fortinet) */ |
3251 | | 0xCA, 0x4A, 0x4C, 0xBB, 0x12, 0xEA, 0xB6, 0xC5, |
3252 | | 0x8C, 0x57, 0x06, 0x7C, 0x2E, 0x65, 0x37, 0x86 |
3253 | | }; |
3254 | | |
3255 | | static const uint8_t VID_FORTINET_AUTODISCOVERY_SENDER[] = { /* Auto-Discovery Sender (Fortinet) */ |
3256 | | 0x9B, 0x15, 0xE6, 0x5A, 0x87, 0x1A, 0xFF, 0x34, |
3257 | | 0x26, 0x66, 0x62, 0x3B, 0xA5, 0x02, 0x2E, 0x60 |
3258 | | }; |
3259 | | |
3260 | | static const uint8_t VID_FORTINET_EXCHANGE_INTERFACE_IP[] = { /* Exchange Interface IP (Fortinet) */ |
3261 | | 0xA5, 0x8F, 0xEC, 0x50, 0x36, 0xF5, 0x7B, 0x21, |
3262 | | 0xE8, 0xB4, 0x99, 0xE3, 0x36, 0xC7, 0x6E, 0xE6 |
3263 | | }; |
3264 | | |
3265 | | static const uint8_t VID_FORTINET_FORTICLIENT_EAP_EXTENSION[] = { /* Forticlient EAP Extension (Fortinet) */ |
3266 | | 0xC1, 0xDC, 0x43, 0x50, 0x47, 0x6B, 0x98, 0xA4, |
3267 | | 0x29, 0xB9, 0x17, 0x81, 0x91, 0x4C, 0xA4, 0x3E |
3268 | | }; |
3269 | | |
3270 | | static const bytes_string vendor_id[] = { |
3271 | | { VID_SSH_IPSEC_EXPRESS_1_1_0, sizeof(VID_SSH_IPSEC_EXPRESS_1_1_0), "Ssh Communications Security IPSEC Express version 1.1.0" }, |
3272 | | { VID_SSH_IPSEC_EXPRESS_1_1_1, sizeof(VID_SSH_IPSEC_EXPRESS_1_1_1), "Ssh Communications Security IPSEC Express version 1.1.1" }, |
3273 | | { VID_SSH_IPSEC_EXPRESS_1_1_2, sizeof(VID_SSH_IPSEC_EXPRESS_1_1_2), "Ssh Communications Security IPSEC Express version 1.1.2" }, |
3274 | | { VID_SSH_IPSEC_EXPRESS_1_2_1, sizeof(VID_SSH_IPSEC_EXPRESS_1_2_1), "Ssh Communications Security IPSEC Express version 1.2.1" }, |
3275 | | { VID_SSH_IPSEC_EXPRESS_1_2_2, sizeof(VID_SSH_IPSEC_EXPRESS_1_2_2), "Ssh Communications Security IPSEC Express version 1.2.2" }, |
3276 | | { VID_SSH_IPSEC_EXPRESS_2_0_0, sizeof(VID_SSH_IPSEC_EXPRESS_2_0_0), "SSH Communications Security IPSEC Express version 2.0.0" }, |
3277 | | { VID_SSH_IPSEC_EXPRESS_2_1_0, sizeof(VID_SSH_IPSEC_EXPRESS_2_1_0), "SSH Communications Security IPSEC Express version 2.1.0" }, |
3278 | | { VID_SSH_IPSEC_EXPRESS_2_1_1, sizeof(VID_SSH_IPSEC_EXPRESS_2_1_1), "SSH Communications Security IPSEC Express version 2.1.1" }, |
3279 | | { VID_SSH_IPSEC_EXPRESS_2_1_2, sizeof(VID_SSH_IPSEC_EXPRESS_2_1_2), "SSH Communications Security IPSEC Express version 2.1.2" }, |
3280 | | { VID_SSH_IPSEC_EXPRESS_3_0_0, sizeof(VID_SSH_IPSEC_EXPRESS_3_0_0), "SSH Communications Security IPSEC Express version 3.0.0" }, |
3281 | | { VID_SSH_IPSEC_EXPRESS_3_0_1, sizeof(VID_SSH_IPSEC_EXPRESS_3_0_1), "SSH Communications Security IPSEC Express version 3.0.1" }, |
3282 | | { VID_SSH_IPSEC_EXPRESS_4_0_0, sizeof(VID_SSH_IPSEC_EXPRESS_4_0_0), "SSH Communications Security IPSEC Express version 4.0.0" }, |
3283 | | { VID_SSH_IPSEC_EXPRESS_4_0_1, sizeof(VID_SSH_IPSEC_EXPRESS_4_0_1), "SSH Communications Security IPSEC Express version 4.0.1" }, |
3284 | | { VID_SSH_IPSEC_EXPRESS_4_1_0, sizeof(VID_SSH_IPSEC_EXPRESS_4_1_0), "SSH Communications Security IPSEC Express version 4.1.0" }, |
3285 | | { VID_SSH_IPSEC_EXPRESS_4_1_1, sizeof(VID_SSH_IPSEC_EXPRESS_4_1_1), "SSH Communications Security IPSEC Express version 4.1.1" }, |
3286 | | { VID_SSH_IPSEC_EXPRESS_4_2_0, sizeof(VID_SSH_IPSEC_EXPRESS_4_2_0), "SSH Communications Security IPSEC Express version 4.2.0" }, |
3287 | | { VID_SSH_IPSEC_EXPRESS_5_0, sizeof(VID_SSH_IPSEC_EXPRESS_5_0), "SSH Communications Security IPSEC Express version 5.0" }, |
3288 | | { VID_SSH_IPSEC_EXPRESS_5_0_0, sizeof(VID_SSH_IPSEC_EXPRESS_5_0_0), "SSH Communications Security IPSEC Express version 5.0.0" }, |
3289 | | { VID_SSH_IPSEC_EXPRESS_5_1_0, sizeof(VID_SSH_IPSEC_EXPRESS_5_1_0), "SSH Communications Security IPSEC Express version 5.1.0" }, |
3290 | | { VID_SSH_IPSEC_EXPRESS_5_1_1, sizeof(VID_SSH_IPSEC_EXPRESS_5_1_1), "SSH Communications Security IPSEC Express version 5.1.1" }, |
3291 | | { VID_SSH_SENTINEL, sizeof(VID_SSH_SENTINEL), "SSH Sentinel" }, |
3292 | | { VID_SSH_SENTINEL_1_1, sizeof(VID_SSH_SENTINEL_1_1), "SSH Sentinel 1.1" }, |
3293 | | { VID_SSH_SENTINEL_1_2, sizeof(VID_SSH_SENTINEL_1_2), "SSH Sentinel 1.2" }, |
3294 | | { VID_SSH_SENTINEL_1_3, sizeof(VID_SSH_SENTINEL_1_3), "SSH Sentinel 1.3" }, |
3295 | | { VID_SSH_SENTINEL_1_4, sizeof(VID_SSH_SENTINEL_1_4), "SSH Sentinel 1.4" }, |
3296 | | { VID_SSH_SENTINEL_1_4_1, sizeof(VID_SSH_SENTINEL_1_4_1), "SSH Sentinel 1.4.1" }, |
3297 | | { VID_SSH_QUICKSEC_0_9_0, sizeof(VID_SSH_QUICKSEC_0_9_0), "SSH Communications Security QuickSec 0.9.0" }, |
3298 | | { VID_SSH_QUICKSEC_1_1_0, sizeof(VID_SSH_QUICKSEC_1_1_0), "SSH Communications Security QuickSec 1.1.0" }, |
3299 | | { VID_SSH_QUICKSEC_1_1_1, sizeof(VID_SSH_QUICKSEC_1_1_1), "SSH Communications Security QuickSec 1.1.1" }, |
3300 | | { VID_SSH_QUICKSEC_1_1_2, sizeof(VID_SSH_QUICKSEC_1_1_2), "SSH Communications Security QuickSec 1.1.2" }, |
3301 | | { VID_SSH_QUICKSEC_1_1_3, sizeof(VID_SSH_QUICKSEC_1_1_3), "SSH Communications Security QuickSec 1.1.3" }, |
3302 | | { VID_draft_huttunen_ipsec_esp_in_udp_00, sizeof(VID_draft_huttunen_ipsec_esp_in_udp_00), "draft-huttunen-ipsec-esp-in-udp-00.txt" }, |
3303 | | { VID_draft_huttunen_ipsec_esp_in_udp_01, sizeof(VID_draft_huttunen_ipsec_esp_in_udp_01), "draft-huttunen-ipsec-esp-in-udp-01.txt (ESPThruNAT)" }, |
3304 | | { VID_draft_stenberg_ipsec_nat_traversal_01, sizeof(VID_draft_stenberg_ipsec_nat_traversal_01), "draft-stenberg-ipsec-nat-traversal-01" }, |
3305 | | { VID_draft_stenberg_ipsec_nat_traversal_02, sizeof(VID_draft_stenberg_ipsec_nat_traversal_02), "draft-stenberg-ipsec-nat-traversal-02" }, |
3306 | | { VID_draft_ietf_ipsec_nat_t_ike, sizeof(VID_draft_ietf_ipsec_nat_t_ike), "draft-ietf-ipsec-nat-t-ike" }, |
3307 | | { VID_draft_ietf_ipsec_nat_t_ike_00, sizeof(VID_draft_ietf_ipsec_nat_t_ike_00), "draft-ietf-ipsec-nat-t-ike-00" }, |
3308 | | { VID_draft_ietf_ipsec_nat_t_ike_01, sizeof(VID_draft_ietf_ipsec_nat_t_ike_01), "draft-ietf-ipsec-nat-t-ike-01" }, |
3309 | | { VID_draft_ietf_ipsec_nat_t_ike_02, sizeof(VID_draft_ietf_ipsec_nat_t_ike_02), "draft-ietf-ipsec-nat-t-ike-02" }, |
3310 | | { VID_draft_ietf_ipsec_nat_t_ike_02n, sizeof(VID_draft_ietf_ipsec_nat_t_ike_02n), "draft-ietf-ipsec-nat-t-ike-02\\n" }, |
3311 | | { VID_draft_ietf_ipsec_nat_t_ike_03, sizeof(VID_draft_ietf_ipsec_nat_t_ike_03), "draft-ietf-ipsec-nat-t-ike-03" }, |
3312 | | { VID_draft_ietf_ipsec_nat_t_ike_04, sizeof(VID_draft_ietf_ipsec_nat_t_ike_04), "draft-ietf-ipsec-nat-t-ike-04" }, |
3313 | | { VID_draft_ietf_ipsec_nat_t_ike_05, sizeof(VID_draft_ietf_ipsec_nat_t_ike_05), "draft-ietf-ipsec-nat-t-ike-05" }, |
3314 | | { VID_draft_ietf_ipsec_nat_t_ike_06, sizeof(VID_draft_ietf_ipsec_nat_t_ike_06), "draft-ietf-ipsec-nat-t-ike-06" }, |
3315 | | { VID_draft_ietf_ipsec_nat_t_ike_07, sizeof(VID_draft_ietf_ipsec_nat_t_ike_07), "draft-ietf-ipsec-nat-t-ike-07" }, |
3316 | | { VID_draft_ietf_ipsec_nat_t_ike_08, sizeof(VID_draft_ietf_ipsec_nat_t_ike_08), "draft-ietf-ipsec-nat-t-ike-08" }, |
3317 | | { VID_draft_ietf_ipsec_nat_t_ike_09, sizeof(VID_draft_ietf_ipsec_nat_t_ike_09), "draft-ietf-ipsec-nat-t-ike-09" }, |
3318 | | { VID_testing_nat_t_rfc, sizeof(VID_testing_nat_t_rfc), "Testing NAT-T RFC" }, |
3319 | | { VID_rfc3947_nat_t, sizeof(VID_rfc3947_nat_t), "RFC 3947 Negotiation of NAT-Traversal in the IKE" }, |
3320 | | { VID_draft_beaulieu_ike_xauth_02, sizeof(VID_draft_beaulieu_ike_xauth_02), "draft-beaulieu-ike-xauth-02.txt" }, |
3321 | | { VID_xauth, sizeof(VID_xauth), "XAUTH" }, |
3322 | | { VID_rfc3706_dpd, sizeof(VID_rfc3706_dpd), "RFC 3706 DPD (Dead Peer Detection)" }, |
3323 | | { VID_draft_ietf_ipsec_antireplay_00, sizeof(VID_draft_ietf_ipsec_antireplay_00), "draft-ietf-ipsec-antireplay-00.txt" }, |
3324 | | { VID_draft_ietf_ipsec_heartbeats_00, sizeof(VID_draft_ietf_ipsec_heartbeats_00), "draft-ietf-ipsec-heartbeats-00.txt" }, |
3325 | | { VID_IKE_CHALLENGE_RESPONSE_1, sizeof(VID_IKE_CHALLENGE_RESPONSE_1), "IKE Challenge/Response for Authenticated Cryptographic Keys" }, |
3326 | | { VID_IKE_CHALLENGE_RESPONSE_2, sizeof(VID_IKE_CHALLENGE_RESPONSE_2), "IKE Challenge/Response for Authenticated Cryptographic Keys" }, |
3327 | | { VID_IKE_CHALLENGE_RESPONSE_REV_1, sizeof(VID_IKE_CHALLENGE_RESPONSE_REV_1), "IKE Challenge/Response for Authenticated Cryptographic Keys (Revised)" }, |
3328 | | { VID_IKE_CHALLENGE_RESPONSE_REV_2, sizeof(VID_IKE_CHALLENGE_RESPONSE_REV_2), "IKE Challenge/Response for Authenticated Cryptographic Keys (Revised)" }, |
3329 | | { VID_CISCO_FRAG2, sizeof(VID_CISCO_FRAG2), "Cisco Fragmentation" }, |
3330 | | { VID_CISCO_FLEXVPN_SUPPORTED, sizeof(VID_CISCO_FLEXVPN_SUPPORTED), "Cisco FlexVPN Supported" }, |
3331 | | { VID_CISCO_DELETE_REASON, sizeof(VID_CISCO_DELETE_REASON), "Cisco Delete Reason Supported"}, |
3332 | | { VID_CISCO_DYNAMIC_ROUTE, sizeof(VID_CISCO_DYNAMIC_ROUTE), "Cisco Dynamic Route Supported"}, |
3333 | | { VID_CISCO_VPN_REV_02, sizeof(VID_CISCO_VPN_REV_02), "Cisco VPN Revision 2"}, |
3334 | | { VID_CISCO_COPYRIGHT, sizeof(VID_CISCO_COPYRIGHT), "Cisco Copyright"}, |
3335 | | { VID_CISCO_GRE_MODE, sizeof(VID_CISCO_GRE_MODE), "Cisco GRE Mode Supported"}, |
3336 | | { VID_MS_VID_INITIAL_CONTACT, sizeof(VID_MS_VID_INITIAL_CONTACT), "Microsoft Vid-Initial-Contact" }, |
3337 | | { VID_GSS_API_1, sizeof(VID_GSS_API_1), "A GSS-API Authentication Method for IKE" }, |
3338 | | { VID_GSS_API_2, sizeof(VID_GSS_API_2), "A GSS-API Authentication Method for IKE" }, |
3339 | | { VID_GSSAPI, sizeof(VID_GSSAPI), "GSSAPI" }, |
3340 | | { VID_MS_NT5_ISAKMPOAKLEY, sizeof(VID_MS_NT5_ISAKMPOAKLEY), "MS NT5 ISAKMPOAKLEY" }, |
3341 | | { VID_CISCO_UNITY, sizeof(VID_CISCO_UNITY), "CISCO-UNITY" }, |
3342 | | { VID_CISCO_CONCENTRATOR, sizeof(VID_CISCO_CONCENTRATOR), "CISCO-CONCENTRATOR" }, |
3343 | | { VID_CISCO_FRAG, sizeof(VID_CISCO_FRAG), "Cisco Fragmentation" }, |
3344 | | { VID_CP_01_R65, sizeof(VID_CP_01_R65), "CryptoPro/GOST 0.1 / Check Point R65" }, |
3345 | | { VID_CP_10_R71, sizeof(VID_CP_10_R71), "CryptoPro/GOST 1.0 / Check Point R71" }, |
3346 | | { VID_CP_11, sizeof(VID_CP_11), "CryptoPro/GOST 1.1" }, |
3347 | | { VID_CYBERGUARD, sizeof(VID_CYBERGUARD), "CyberGuard" }, |
3348 | | { VID_SHREWSOFT, sizeof(VID_SHREWSOFT), "Shrew Soft" }, |
3349 | | { VID_STRONGSWAN, sizeof(VID_STRONGSWAN), "strongSwan" }, |
3350 | | { VID_KAME_RACOON, sizeof(VID_KAME_RACOON), "KAME/racoon" }, |
3351 | | { VID_IPSEC_TOOLS, sizeof(VID_IPSEC_TOOLS), "IPSec-Tools" }, |
3352 | | { VID_NETSCREEN_1, sizeof(VID_NETSCREEN_1), "Netscreen-1" }, |
3353 | | { VID_NETSCREEN_2, sizeof(VID_NETSCREEN_2), "Netscreen-2" }, |
3354 | | { VID_NETSCREEN_3, sizeof(VID_NETSCREEN_3), "Netscreen-3" }, |
3355 | | { VID_NETSCREEN_4, sizeof(VID_NETSCREEN_4), "Netscreen-4" }, |
3356 | | { VID_NETSCREEN_5, sizeof(VID_NETSCREEN_5), "Netscreen-5" }, |
3357 | | { VID_NETSCREEN_6, sizeof(VID_NETSCREEN_6), "Netscreen-6" }, |
3358 | | { VID_NETSCREEN_7, sizeof(VID_NETSCREEN_7), "Netscreen-7" }, |
3359 | | { VID_NETSCREEN_8, sizeof(VID_NETSCREEN_8), "Netscreen-8" }, |
3360 | | { VID_NETSCREEN_9, sizeof(VID_NETSCREEN_9), "Netscreen-9" }, |
3361 | | { VID_NETSCREEN_10, sizeof(VID_NETSCREEN_10), "Netscreen-10" }, |
3362 | | { VID_NETSCREEN_11, sizeof(VID_NETSCREEN_11), "Netscreen-11" }, |
3363 | | { VID_NETSCREEN_12, sizeof(VID_NETSCREEN_12), "Netscreen-12" }, |
3364 | | { VID_NETSCREEN_13, sizeof(VID_NETSCREEN_13), "Netscreen-13" }, |
3365 | | { VID_NETSCREEN_14, sizeof(VID_NETSCREEN_14), "Netscreen-14" }, |
3366 | | { VID_NETSCREEN_15, sizeof(VID_NETSCREEN_15), "Netscreen-15" }, |
3367 | | { VID_NETSCREEN_16, sizeof(VID_NETSCREEN_16), "Netscreen-16" }, |
3368 | | { VID_ZYWALL, sizeof(VID_ZYWALL), "ZYWALL" }, |
3369 | | { VID_SIDEWINDER, sizeof(VID_SIDEWINDER), "SIDEWINDER" }, |
3370 | | { VID_SONICWALL, sizeof(VID_SONICWALL), "SonicWALL" }, |
3371 | | { VID_HEARTBEAT_NOTIFY, sizeof(VID_HEARTBEAT_NOTIFY), "Heartbeat Notify" }, |
3372 | | { VID_DWR, sizeof(VID_DWR), "DWR: Delete with reason" }, |
3373 | | { VID_ARUBA_RAP, sizeof(VID_ARUBA_RAP), "Remote AP (Aruba Networks)" }, |
3374 | | { VID_ARUBA_CONTROLLER, sizeof(VID_ARUBA_CONTROLLER), "Controller (Aruba Networks)" }, |
3375 | | { VID_ARUBA_VIA_CLIENT, sizeof(VID_ARUBA_VIA_CLIENT), "VIA Client (Aruba Networks)" }, |
3376 | | { VID_ARUBA_VIA_AUTH_PROFILE, sizeof(VID_ARUBA_VIA_AUTH_PROFILE), "VIA Auth Profile (Aruba Networks)" }, |
3377 | | { VID_MS_IKEE_20080212_CGA1, sizeof(VID_MS_IKEE_20080212_CGA1), "IKE CGA Version 1" }, |
3378 | | { VID_MS_IKEE_20080212_MS_NDC, sizeof(VID_MS_IKEE_20080212_MS_NDC), "MS-Negotiation Discovery Capable" }, |
3379 | | { VID_FORTINET_FORTIGATE, sizeof(VID_FORTINET_FORTIGATE), "Fortigate (Fortinet)" }, |
3380 | | { VID_FORTINET_FORTICLIENT_CONNECT, sizeof(VID_FORTINET_FORTICLIENT_CONNECT), "Forticlient connect license (Fortinet)" }, |
3381 | | { VID_FORTINET_ENDPOINT_CONTROL, sizeof(VID_FORTINET_ENDPOINT_CONTROL), "Endpoint Control (Fortinet)" }, |
3382 | | { VID_FORTINET_AUTODISCOVERY_RECEIVER, sizeof(VID_FORTINET_AUTODISCOVERY_RECEIVER), "Auto-Discovery Receiver (Fortinet)" }, |
3383 | | { VID_FORTINET_AUTODISCOVERY_SENDER, sizeof(VID_FORTINET_AUTODISCOVERY_SENDER), "Auto-Discovery Sender (Fortinet)" }, |
3384 | | { VID_FORTINET_EXCHANGE_INTERFACE_IP, sizeof(VID_FORTINET_EXCHANGE_INTERFACE_IP), "Exchange Interface IP (Fortinet)" }, |
3385 | | { VID_FORTINET_FORTICLIENT_EAP_EXTENSION, sizeof(VID_FORTINET_FORTICLIENT_EAP_EXTENSION), "Forticlient EAP Extension (Fortinet)" }, |
3386 | | { 0, 0, NULL } |
3387 | | }; |
3388 | | |
3389 | | |
3390 | | |
3391 | | static void |
3392 | | // NOLINTNEXTLINE(misc-no-recursion) |
3393 | | dissect_payloads(tvbuff_t *tvb, proto_tree *tree, |
3394 | | int isakmp_version, uint8_t initial_payload, unsigned offset, unsigned length, |
3395 | | packet_info *pinfo, uint32_t message_id, bool is_request, void* decr_data) |
3396 | 18.3k | { |
3397 | 18.3k | uint8_t payload, next_payload; |
3398 | 18.3k | uint16_t payload_length; |
3399 | 18.3k | proto_tree * ntree; |
3400 | | |
3401 | 61.0k | for (payload = initial_payload; length > 0; payload = next_payload) { |
3402 | 52.4k | if (payload == PLOAD_IKE_NONE) { |
3403 | | /* |
3404 | | * What? There's more stuff in this chunk of data, but the |
3405 | | * previous payload had a "next payload" type of None? |
3406 | | */ |
3407 | 364 | proto_tree_add_item(tree, hf_isakmp_extradata, tvb, offset, length, ENC_NA); |
3408 | 364 | break; |
3409 | 364 | } |
3410 | | |
3411 | 52.0k | ntree = dissect_payload_header(tvb, pinfo, offset, length, isakmp_version, payload, &next_payload, &payload_length, tree); |
3412 | 52.0k | if (payload_length >= 4) { /* XXX = > 4? */ |
3413 | 40.0k | increment_dissection_depth(pinfo); |
3414 | 40.0k | tvb_ensure_bytes_exist(tvb, offset + 4, payload_length - 4); |
3415 | 40.0k | switch(payload){ |
3416 | 4.70k | case PLOAD_IKE_SA: |
3417 | 7.55k | case PLOAD_IKE2_SA: |
3418 | 7.55k | dissect_sa(tvb, offset + 4, payload_length - 4, ntree, isakmp_version, pinfo, is_request, decr_data); |
3419 | 7.55k | break; |
3420 | 257 | case PLOAD_IKE_P: |
3421 | 257 | dissect_proposal(tvb, pinfo, offset + 4, payload_length - 4, ntree, isakmp_version, decr_data ); |
3422 | 257 | break; |
3423 | 48 | case PLOAD_IKE_KE: |
3424 | 117 | case PLOAD_IKE2_KE: |
3425 | 117 | dissect_key_exch(tvb, offset + 4, payload_length - 4, ntree, isakmp_version, pinfo, decr_data ); |
3426 | 117 | break; |
3427 | 174 | case PLOAD_IKE_ID: |
3428 | 250 | case PLOAD_IKE2_IDI: |
3429 | 314 | case PLOAD_IKE2_IDR: |
3430 | 314 | dissect_id(tvb, offset + 4, payload_length - 4, ntree, isakmp_version, pinfo ); |
3431 | 314 | break; |
3432 | 9.19k | case PLOAD_IKE_CERT: |
3433 | 9.36k | case PLOAD_IKE2_CERT: |
3434 | 9.36k | dissect_cert(tvb, offset + 4, payload_length - 4, ntree, isakmp_version, pinfo ); |
3435 | 9.36k | break; |
3436 | 36 | case PLOAD_IKE_CR: |
3437 | 109 | case PLOAD_IKE2_CERTREQ: |
3438 | 109 | dissect_certreq(tvb, offset + 4, payload_length - 4, ntree, isakmp_version, pinfo ); |
3439 | 109 | break; |
3440 | 113 | case PLOAD_IKE_HASH: |
3441 | 113 | dissect_hash(tvb, offset + 4, payload_length - 4, ntree); |
3442 | 113 | break; |
3443 | 70 | case PLOAD_IKE_SIG: |
3444 | 70 | dissect_sig(tvb, offset + 4, payload_length - 4, ntree); |
3445 | 70 | break; |
3446 | 18 | case PLOAD_IKE_NONCE: |
3447 | 223 | case PLOAD_IKE2_NONCE: |
3448 | 223 | dissect_nonce(tvb, offset + 4, payload_length - 4, ntree); |
3449 | 223 | break; |
3450 | 109 | case PLOAD_IKE_N: |
3451 | 445 | case PLOAD_IKE2_N: |
3452 | 445 | dissect_notif(tvb, pinfo, offset + 4, payload_length - 4, ntree, isakmp_version); |
3453 | 445 | break; |
3454 | 27 | case PLOAD_IKE_D: |
3455 | 88 | case PLOAD_IKE2_D: |
3456 | 88 | dissect_delete(tvb, offset + 4, payload_length - 4, ntree, isakmp_version); |
3457 | 88 | break; |
3458 | 62 | case PLOAD_IKE_VID: |
3459 | 206 | case PLOAD_IKE2_V: |
3460 | 206 | dissect_vid(tvb, pinfo, offset + 4, payload_length - 4, ntree); |
3461 | 206 | break; |
3462 | 25 | case PLOAD_IKE_A: |
3463 | 284 | case PLOAD_IKE2_CP: |
3464 | 284 | dissect_config(tvb, pinfo, offset + 4, payload_length - 4, ntree, isakmp_version, is_request); |
3465 | 284 | break; |
3466 | 61 | case PLOAD_IKE_SAK: |
3467 | 61 | dissect_sa_kek(tvb, pinfo, offset + 4, payload_length - 4, ntree); |
3468 | 61 | break; |
3469 | 38 | case PLOAD_IKE_SAT: |
3470 | 38 | dissect_sa_tek(tvb, pinfo, offset + 4, payload_length - 4, ntree); |
3471 | 38 | break; |
3472 | 98 | case PLOAD_IKE_KD: |
3473 | 98 | dissect_key_download(tvb, pinfo, offset + 4, payload_length - 4, ntree, isakmp_version); |
3474 | 98 | break; |
3475 | 34 | case PLOAD_IKE_SEQ: |
3476 | 34 | dissect_sequence(tvb, pinfo, offset + 4, payload_length - 4, ntree); |
3477 | 34 | break; |
3478 | 278 | case PLOAD_IKE2_AUTH: |
3479 | 278 | dissect_auth(tvb, pinfo, offset + 4, payload_length - 4, ntree); |
3480 | 278 | break; |
3481 | 28 | case PLOAD_IKE2_TSI: |
3482 | 991 | case PLOAD_IKE2_TSR: |
3483 | 991 | dissect_ts_payload(tvb, pinfo, offset + 4, payload_length - 4, ntree); |
3484 | 991 | break; |
3485 | 100 | case PLOAD_IKE2_SK: |
3486 | 100 | if(isakmp_version == 2) |
3487 | 85 | dissect_enc(tvb, offset + 4, payload_length - 4, ntree, pinfo, next_payload, is_request, decr_data, true); |
3488 | 100 | break; |
3489 | 7 | case PLOAD_IKE2_EAP: |
3490 | 7 | dissect_eap(tvb, offset + 4, payload_length - 4, ntree, pinfo ); |
3491 | 7 | break; |
3492 | 159 | case PLOAD_IKE2_GSPM: |
3493 | 159 | dissect_gspm(tvb, offset + 4, payload_length - 4, ntree); |
3494 | 159 | break; |
3495 | 121 | case PLOAD_IKE_NAT_D: |
3496 | 137 | case PLOAD_IKE_NAT_D13: |
3497 | 137 | dissect_nat_discovery(tvb, offset + 4, payload_length - 4, ntree ); |
3498 | 137 | break; |
3499 | 231 | case PLOAD_IKE_NAT_OA: |
3500 | 319 | case PLOAD_IKE_NAT_OA14: |
3501 | 319 | dissect_nat_original_address(tvb, offset + 4, payload_length - 4, ntree, isakmp_version ); |
3502 | 319 | break; |
3503 | 82 | case PLOAD_IKE_CISCO_FRAG: |
3504 | 82 | dissect_cisco_fragmentation(tvb, offset + 4, payload_length - 4, ntree, pinfo ); |
3505 | 82 | break; |
3506 | 190 | case PLOAD_IKE2_SKF: |
3507 | 190 | if (isakmp_version == 2) { |
3508 | | /* N.B. not passing in length as must be the last payload in the message */ |
3509 | 172 | dissect_ikev2_fragmentation(tvb, offset + 4, ntree, pinfo, message_id, next_payload, is_request, decr_data ); |
3510 | 172 | } |
3511 | 190 | break; |
3512 | 37 | case PLOAD_IKE_SK: |
3513 | 37 | dissect_symmetric_key(tvb, offset + 4, payload_length - 4, ntree); |
3514 | 37 | break; |
3515 | 18.2k | default: |
3516 | 18.2k | proto_tree_add_item(ntree, hf_isakmp_datapayload, tvb, offset + 4, payload_length-4, ENC_NA); |
3517 | 18.2k | break; |
3518 | 40.0k | } |
3519 | 30.5k | increment_dissection_depth(pinfo); |
3520 | 30.5k | } |
3521 | 12.0k | else if (payload_length > length) { |
3522 | 0 | proto_tree_add_expert_format(ntree, pinfo, &ei_isakmp_payload_bad_length, tvb, 0, 0, |
3523 | 0 | "Payload (bogus, length is %u, greater than remaining length %d", |
3524 | 0 | payload_length, length); |
3525 | 0 | return; |
3526 | 0 | } |
3527 | 12.0k | else { |
3528 | 12.0k | proto_tree_add_expert_format(ntree, pinfo, &ei_isakmp_payload_bad_length, tvb, 0, 0, |
3529 | 12.0k | "Payload (bogus, length is %u, must be at least 4)", |
3530 | 12.0k | payload_length); |
3531 | 12.0k | payload_length = 4; |
3532 | 12.0k | } |
3533 | | |
3534 | 42.6k | offset += payload_length; |
3535 | 42.6k | if (length > payload_length) { |
3536 | 41.4k | length -= payload_length; |
3537 | 41.4k | } else { |
3538 | 1.19k | length = 0; |
3539 | 1.19k | } |
3540 | 42.6k | } |
3541 | 18.3k | } |
3542 | | |
3543 | | void |
3544 | | isakmp_dissect_payloads(tvbuff_t *tvb, proto_tree *tree, int isakmp_version, |
3545 | | uint8_t initial_payload, unsigned offset, unsigned length, |
3546 | | packet_info *pinfo) |
3547 | 25 | { |
3548 | 25 | dissect_payloads(tvb, tree, isakmp_version, initial_payload, offset, length, |
3549 | 25 | pinfo, 0, false, NULL); |
3550 | 25 | } |
3551 | | |
3552 | | static int |
3553 | | // NOLINTNEXTLINE(misc-no-recursion) |
3554 | | dissect_isakmp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_) |
3555 | 11.1k | { |
3556 | 11.1k | int offset = 0, len; |
3557 | 11.1k | isakmp_hdr_t hdr; |
3558 | 11.1k | proto_item *ti, *vers_item, *ti_root; |
3559 | 11.1k | proto_tree *isakmp_tree = NULL, *vers_tree; |
3560 | 11.1k | int isakmp_version; |
3561 | 11.1k | void* decr_data = NULL; |
3562 | 11.1k | uint8_t flags; |
3563 | 11.1k | uint8_t i_cookie[COOKIE_SIZE], *ic_key; |
3564 | 11.1k | decrypt_data_t *decr = NULL; |
3565 | 11.1k | tvbuff_t *decr_tvb; |
3566 | 11.1k | proto_tree *decr_tree; |
3567 | 11.1k | address null_addr; |
3568 | | |
3569 | 11.1k | col_set_str(pinfo->cinfo, COL_PROTOCOL, "IKE"); |
3570 | 11.1k | col_clear(pinfo->cinfo, COL_INFO); |
3571 | | |
3572 | | /* Some simple heuristics to catch non-isakmp packets */ |
3573 | 11.1k | if (tvb_reported_length(tvb)== 1 && tvb_get_uint8(tvb, offset) !=0xff) |
3574 | 21 | return 0; |
3575 | 11.1k | else if (tvb_reported_length(tvb) < ISAKMP_HDR_SIZE) |
3576 | 83 | return 0; |
3577 | 11.0k | else if (tvb_get_ntohl(tvb, ISAKMP_HDR_SIZE-4) < ISAKMP_HDR_SIZE) |
3578 | 19 | return 0; |
3579 | | |
3580 | 11.0k | ti_root = proto_tree_add_item(tree, proto_isakmp, tvb, offset, -1, ENC_NA); |
3581 | 11.0k | isakmp_tree = proto_item_add_subtree(ti_root, ett_isakmp); |
3582 | | |
3583 | | /* RFC3948 2.3 NAT Keepalive packet: |
3584 | | * 1 byte payload with the value 0xff. |
3585 | | */ |
3586 | 11.0k | if ( (tvb_reported_length(tvb)== 1) && (tvb_get_uint8(tvb, offset) == 0xff) ){ |
3587 | 0 | col_set_str(pinfo->cinfo, COL_INFO, "NAT Keepalive"); |
3588 | 0 | proto_tree_add_item(isakmp_tree, hf_isakmp_nat_keepalive, tvb, offset, 1, ENC_NA); |
3589 | 0 | return 1; |
3590 | 0 | } |
3591 | | |
3592 | 11.0k | hdr.length = tvb_get_ntohl(tvb, offset + ISAKMP_HDR_SIZE - 4); |
3593 | 11.0k | hdr.exch_type = tvb_get_uint8(tvb, COOKIE_SIZE + COOKIE_SIZE + 1 + 1); |
3594 | 11.0k | hdr.version = tvb_get_uint8(tvb, COOKIE_SIZE + COOKIE_SIZE + 1); |
3595 | 11.0k | isakmp_version = hi_nibble(hdr.version); /* save the version */ |
3596 | 11.0k | hdr.flags = tvb_get_uint8(tvb, COOKIE_SIZE + COOKIE_SIZE + 1 + 1 + 1); |
3597 | | |
3598 | 11.0k | if (isakmp_version == 1) { |
3599 | 764 | clear_address(&null_addr); |
3600 | | |
3601 | 764 | tvb_memcpy(tvb, i_cookie, offset, COOKIE_SIZE); |
3602 | 764 | decr = (decrypt_data_t*) g_hash_table_lookup(isakmp_hash, i_cookie); |
3603 | | |
3604 | 764 | if (! decr) { |
3605 | 183 | ic_key = (uint8_t *)g_slice_alloc(COOKIE_SIZE); |
3606 | 183 | memcpy(ic_key, i_cookie, COOKIE_SIZE); |
3607 | 183 | decr = create_decrypt_data(); |
3608 | 183 | g_hash_table_insert(isakmp_hash, ic_key, decr); |
3609 | 183 | } |
3610 | | |
3611 | 764 | if (addresses_equal(&decr->initiator, &null_addr)) { |
3612 | | /* XXX - We assume that we're seeing the second packet in an exchange here. |
3613 | | * Is there a way to verify this? */ |
3614 | 764 | copy_address_wmem(wmem_file_scope(), &decr->initiator, &pinfo->src); |
3615 | 764 | } |
3616 | | |
3617 | 764 | decr_data = decr; |
3618 | 10.2k | } else if (isakmp_version == 2) { |
3619 | 9.74k | ikev2_uat_data_key_t hash_key; |
3620 | 9.74k | ikev2_uat_data_t *ike_sa_data; |
3621 | 9.74k | ikev2_decrypt_data_t *ikev2_dec_data; |
3622 | 9.74k | unsigned char spii[COOKIE_SIZE], spir[COOKIE_SIZE]; |
3623 | | |
3624 | 9.74k | tvb_memcpy(tvb, spii, offset, COOKIE_SIZE); |
3625 | 9.74k | tvb_memcpy(tvb, spir, offset + COOKIE_SIZE, COOKIE_SIZE); |
3626 | 9.74k | hash_key.spii = spii; |
3627 | 9.74k | hash_key.spir = spir; |
3628 | 9.74k | hash_key.spii_len = COOKIE_SIZE; |
3629 | 9.74k | hash_key.spir_len = COOKIE_SIZE; |
3630 | | |
3631 | 9.74k | ike_sa_data = (ikev2_uat_data_t *)g_hash_table_lookup(ikev2_key_hash, &hash_key); |
3632 | 9.74k | if (ike_sa_data) { |
3633 | 0 | uint8_t initiator_flag; |
3634 | 0 | initiator_flag = hdr.flags & I_FLAG; |
3635 | 0 | ikev2_dec_data = wmem_new(pinfo->pool, ikev2_decrypt_data_t); |
3636 | 0 | ikev2_dec_data->encr_key = initiator_flag ? ike_sa_data->sk_ei : ike_sa_data->sk_er; |
3637 | 0 | ikev2_dec_data->auth_key = initiator_flag ? ike_sa_data->sk_ai : ike_sa_data->sk_ar; |
3638 | 0 | ikev2_dec_data->encr_spec = ike_sa_data->encr_spec; |
3639 | 0 | ikev2_dec_data->auth_spec = ike_sa_data->auth_spec; |
3640 | |
|
3641 | 0 | decr_data = ikev2_dec_data; |
3642 | 0 | } |
3643 | 9.74k | } |
3644 | | |
3645 | 11.0k | { |
3646 | 11.0k | proto_tree_add_item(isakmp_tree, hf_isakmp_ispi, tvb, offset, COOKIE_SIZE, ENC_NA); |
3647 | 11.0k | offset += COOKIE_SIZE; |
3648 | | |
3649 | 11.0k | proto_tree_add_item(isakmp_tree, hf_isakmp_rspi, tvb, offset, COOKIE_SIZE, ENC_NA); |
3650 | 11.0k | offset += COOKIE_SIZE; |
3651 | | |
3652 | 11.0k | hdr.next_payload = tvb_get_uint8(tvb, offset); |
3653 | 11.0k | proto_tree_add_item(isakmp_tree, hf_isakmp_nextpayload, tvb, offset, 1, ENC_BIG_ENDIAN); |
3654 | | |
3655 | 11.0k | offset += 1; |
3656 | | |
3657 | 11.0k | vers_item = proto_tree_add_uint_format_value(isakmp_tree, hf_isakmp_version, tvb, offset, |
3658 | 11.0k | 1, hdr.version, "%u.%u", |
3659 | 11.0k | hi_nibble(hdr.version), lo_nibble(hdr.version)); |
3660 | 11.0k | vers_tree = proto_item_add_subtree(vers_item, ett_isakmp_version); |
3661 | 11.0k | proto_tree_add_item(vers_tree, hf_isakmp_mjver, tvb, offset, 1, ENC_BIG_ENDIAN); |
3662 | 11.0k | proto_tree_add_item(vers_tree, hf_isakmp_mnver, tvb, offset, 1, ENC_BIG_ENDIAN); |
3663 | 11.0k | offset += 1; |
3664 | | |
3665 | 11.0k | if(isakmp_version == 1) { |
3666 | 764 | proto_tree_add_item(isakmp_tree, hf_isakmp_exchangetype_v1, tvb, offset, 1, ENC_BIG_ENDIAN); |
3667 | 764 | col_add_str(pinfo->cinfo, COL_INFO,val_to_str(pinfo->pool, hdr.exch_type, exchange_v1_type, "Unknown %d")); |
3668 | 10.2k | } else if (isakmp_version == 2){ |
3669 | 9.74k | proto_tree_add_item(isakmp_tree, hf_isakmp_exchangetype_v2, tvb, offset, 1, ENC_BIG_ENDIAN); |
3670 | 9.74k | col_add_str(pinfo->cinfo, COL_INFO,val_to_str(pinfo->pool, hdr.exch_type, exchange_v2_type, "Unknown %d")); |
3671 | 9.74k | } |
3672 | 11.0k | offset += 1; |
3673 | | |
3674 | 11.0k | { |
3675 | 11.0k | proto_item * fti; |
3676 | 11.0k | proto_tree * ftree; |
3677 | | |
3678 | 11.0k | fti = proto_tree_add_item(isakmp_tree, hf_isakmp_flags, tvb, offset, 1, ENC_BIG_ENDIAN); |
3679 | 11.0k | ftree = proto_item_add_subtree(fti, ett_isakmp_flags); |
3680 | 11.0k | flags = tvb_get_uint8(tvb, offset); |
3681 | | |
3682 | 11.0k | if (isakmp_version == 1) { |
3683 | 764 | proto_tree_add_item(ftree, hf_isakmp_flag_e, tvb, offset, 1, ENC_BIG_ENDIAN); |
3684 | | |
3685 | 764 | proto_tree_add_item(ftree, hf_isakmp_flag_c, tvb, offset, 1, ENC_BIG_ENDIAN); |
3686 | | |
3687 | 764 | proto_tree_add_item(ftree, hf_isakmp_flag_a, tvb, offset, 1, ENC_BIG_ENDIAN); |
3688 | | |
3689 | 10.2k | } else if (isakmp_version == 2) { |
3690 | 9.74k | proto_tree_add_item(ftree, hf_isakmp_flag_i, tvb, offset, 1, ENC_BIG_ENDIAN); |
3691 | 9.74k | proto_tree_add_item(ftree, hf_isakmp_flag_v, tvb, offset, 1, ENC_BIG_ENDIAN); |
3692 | 9.74k | proto_tree_add_item(ftree, hf_isakmp_flag_r, tvb, offset, 1, ENC_BIG_ENDIAN); |
3693 | | |
3694 | 9.74k | proto_item_append_text(fti, " (%s, %s, %s)", |
3695 | 9.74k | tfs_get_string(flags & I_FLAG, &flag_i), |
3696 | 9.74k | tfs_get_string(flags & V_FLAG, &flag_v), |
3697 | 9.74k | tfs_get_string(flags & R_FLAG, &tfs_response_request)); |
3698 | 9.74k | } |
3699 | 11.0k | offset += 1; |
3700 | 11.0k | } |
3701 | | |
3702 | 11.0k | hdr.message_id = tvb_get_ntohl(tvb, offset); |
3703 | 11.0k | proto_tree_add_item(isakmp_tree, hf_isakmp_messageid, tvb, offset, 4, ENC_BIG_ENDIAN); |
3704 | 11.0k | offset += 4; |
3705 | | |
3706 | | /* Add some summary to the Info column */ |
3707 | 11.0k | if (isakmp_version == 2) { |
3708 | 9.74k | col_append_fstr(pinfo->cinfo, COL_INFO, " MID=%02u %s %s", |
3709 | 9.74k | hdr.message_id, |
3710 | 9.74k | tfs_get_string(flags & I_FLAG, &flag_i), |
3711 | 9.74k | tfs_get_string(flags & R_FLAG, &tfs_response_request)); |
3712 | 9.74k | } |
3713 | | |
3714 | 11.0k | if (hdr.length < ISAKMP_HDR_SIZE) { |
3715 | 0 | proto_tree_add_uint_format_value(isakmp_tree, hf_isakmp_length, tvb, offset, 4, |
3716 | 0 | hdr.length, "(bogus, length is %u, should be at least %lu)", |
3717 | 0 | hdr.length, (unsigned long)ISAKMP_HDR_SIZE); |
3718 | 0 | return tvb_captured_length(tvb); |
3719 | 0 | } |
3720 | | |
3721 | 11.0k | len = hdr.length - ISAKMP_HDR_SIZE; |
3722 | | |
3723 | 11.0k | if (len < 0) { |
3724 | 86 | proto_tree_add_uint_format_value(isakmp_tree, hf_isakmp_length, tvb, offset, 4, |
3725 | 86 | hdr.length, "(bogus, length is %u, which is too large)", |
3726 | 86 | hdr.length); |
3727 | 86 | return tvb_captured_length(tvb); |
3728 | 86 | } |
3729 | 10.9k | tvb_ensure_bytes_exist(tvb, offset, len); |
3730 | 10.9k | proto_tree_add_item(isakmp_tree, hf_isakmp_length, tvb, offset, 4, ENC_BIG_ENDIAN); |
3731 | 10.9k | offset += 4; |
3732 | | |
3733 | 10.9k | if (isakmp_version == 1 && (hdr.flags & E_FLAG)) { |
3734 | | /* Encrypted flag set (v1 only), so decrypt before dissecting payloads */ |
3735 | 34 | if (len) { |
3736 | 20 | ti = proto_tree_add_item(isakmp_tree, hf_isakmp_enc_data, tvb, offset, len, ENC_NA); |
3737 | 20 | proto_item_append_text(ti, " (%d byte%s)", len, plurality(len, "", "s")); |
3738 | | |
3739 | | /* Collect initialization vectors during first pass. */ |
3740 | 20 | if (!PINFO_FD_VISITED(pinfo)) |
3741 | 20 | if (prepare_decrypt(decr)) |
3742 | 0 | update_ivs(pinfo, tvb_get_ptr(tvb, offset, len), len, hdr.message_id, decr); |
3743 | 20 | decr_tvb = decrypt_payload(tvb, pinfo, tvb_get_ptr(tvb, offset, len), len, decr); |
3744 | 20 | if (decr_tvb) { |
3745 | 0 | decr_tree = proto_item_add_subtree(ti, ett_isakmp); |
3746 | 0 | dissect_payloads(decr_tvb, decr_tree, isakmp_version, |
3747 | 0 | hdr.next_payload, 0, tvb_reported_length(decr_tvb), pinfo, hdr.message_id, !(flags & R_FLAG), decr_data); |
3748 | 0 | } |
3749 | 20 | } |
3750 | 10.9k | } else { |
3751 | 10.9k | dissect_payloads(tvb, isakmp_tree, isakmp_version, hdr.next_payload, |
3752 | 10.9k | offset, len, pinfo, hdr.message_id, !(flags & R_FLAG), decr_data); |
3753 | 10.9k | } |
3754 | | |
3755 | 10.9k | offset += len; |
3756 | 10.9k | } |
3757 | | |
3758 | 0 | proto_item_set_end(ti_root, tvb, offset); |
3759 | | |
3760 | 10.9k | return offset; |
3761 | 11.0k | } |
3762 | | |
3763 | | |
3764 | | static proto_tree * |
3765 | | dissect_payload_header(tvbuff_t *tvb, packet_info *pinfo, unsigned offset, unsigned length, |
3766 | | int isakmp_version, uint8_t payload, uint8_t *next_payload_p, |
3767 | | uint16_t *payload_length_p, proto_tree *tree) |
3768 | 52.8k | { |
3769 | 52.8k | uint8_t next_payload; |
3770 | 52.8k | uint16_t payload_length; |
3771 | 52.8k | proto_item * ti; |
3772 | 52.8k | proto_tree * ntree; |
3773 | | |
3774 | 52.8k | if (length < 4) { |
3775 | 99 | proto_tree_add_expert_format(tree, pinfo, &ei_isakmp_payload_bad_length, tvb, offset, length, |
3776 | 99 | "Not enough room in payload for all transforms"); |
3777 | 99 | *next_payload_p = 0; |
3778 | 99 | *payload_length_p = 0; |
3779 | 99 | return NULL; |
3780 | 99 | } |
3781 | 52.7k | next_payload = tvb_get_uint8(tvb, offset); |
3782 | 52.7k | payload_length = tvb_get_ntohs(tvb, offset + 2); |
3783 | | |
3784 | 52.7k | ti = proto_tree_add_uint(tree, hf_isakmp_typepayload, tvb, offset, payload_length, payload); |
3785 | | |
3786 | 52.7k | ntree = proto_item_add_subtree(ti, ett_isakmp_payload); |
3787 | | |
3788 | 52.7k | proto_tree_add_item(ntree, hf_isakmp_nextpayload, tvb, offset, 1, ENC_BIG_ENDIAN); |
3789 | | |
3790 | | /* The critical flag only applies to IKEv2 payloads but not proposals and transforms. */ |
3791 | 52.7k | if (isakmp_version == 1 || payload == PLOAD_IKE_P || payload == PLOAD_IKE_T) { |
3792 | 3.99k | proto_tree_add_item(ntree, hf_isakmp_reserved, tvb, offset + 1, 1, ENC_NA); |
3793 | 48.7k | } else if (isakmp_version == 2) { |
3794 | 46.7k | proto_tree_add_item(ntree, hf_isakmp_criticalpayload, tvb, offset+1, 1, ENC_BIG_ENDIAN); |
3795 | 46.7k | proto_tree_add_item(ntree, hf_isakmp_reserved7, tvb, offset + 1, 1, ENC_BIG_ENDIAN); |
3796 | 46.7k | } |
3797 | 52.7k | proto_tree_add_item(ntree, hf_isakmp_payloadlen, tvb, offset + 2, 2, ENC_BIG_ENDIAN); |
3798 | | |
3799 | 52.7k | *next_payload_p = next_payload; |
3800 | 52.7k | *payload_length_p = payload_length; |
3801 | 52.7k | return ntree; |
3802 | 52.8k | } |
3803 | | |
3804 | | static void |
3805 | | // NOLINTNEXTLINE(misc-no-recursion) |
3806 | | dissect_sa(tvbuff_t *tvb, unsigned offset, unsigned length, proto_tree *tree, int isakmp_version, packet_info *pinfo, bool is_request, void* decr_data) |
3807 | 7.55k | { |
3808 | 7.55k | uint32_t doi; |
3809 | 7.55k | uint16_t saattr; |
3810 | 7.55k | proto_item *sti; |
3811 | 7.55k | proto_tree *stree; |
3812 | 7.55k | proto_tree *currtree; |
3813 | | |
3814 | | /* make a copy of current tree working position which we will use while dissecting other payloads*/ |
3815 | 7.55k | currtree = tree; |
3816 | 7.55k | if (isakmp_version == 1) { |
3817 | 48 | proto_tree_add_item_ret_uint(tree, hf_isakmp_sa_doi, tvb, offset, 4, ENC_BIG_ENDIAN, &doi); |
3818 | | |
3819 | 48 | offset += 4; |
3820 | 48 | length -= 4; |
3821 | | |
3822 | 48 | switch(doi) { |
3823 | 11 | case 1: { |
3824 | | /* IPSEC */ |
3825 | 11 | if (length < 4) { |
3826 | 4 | proto_tree_add_bytes_format_value(tree, hf_isakmp_sa_situation, tvb, offset, length, |
3827 | 4 | NULL, |
3828 | 4 | "%s (length is %u, should be >= 4)", |
3829 | 4 | tvb_bytes_to_str(pinfo->pool, tvb, offset, length), length); |
3830 | 4 | return; |
3831 | 4 | } |
3832 | 7 | sti = proto_tree_add_item(tree, hf_isakmp_sa_situation, tvb, offset, 4, ENC_NA); |
3833 | 7 | stree = proto_item_add_subtree(sti, ett_isakmp_sa); |
3834 | | |
3835 | 7 | proto_tree_add_item(stree, hf_isakmp_sa_situation_identity_only, tvb, offset, 4, ENC_BIG_ENDIAN); |
3836 | 7 | proto_tree_add_item(stree, hf_isakmp_sa_situation_secrecy, tvb, offset, 4, ENC_BIG_ENDIAN); |
3837 | 7 | proto_tree_add_item(stree, hf_isakmp_sa_situation_integrity, tvb, offset, 4, ENC_BIG_ENDIAN); |
3838 | | |
3839 | 7 | offset += 4; |
3840 | 7 | length -= 4; |
3841 | | |
3842 | 7 | dissect_payloads(tvb, tree, isakmp_version, PLOAD_IKE_P, offset, |
3843 | 7 | length, pinfo, 0, is_request, decr_data); |
3844 | 7 | break; |
3845 | 11 | } |
3846 | 20 | case 2: { |
3847 | | /* add GDOI specific changes here for RFC 6407*/ |
3848 | 20 | if (length < 8) { /* situation + next payload + reserved2*/ |
3849 | 7 | proto_tree_add_bytes_format_value(tree, hf_isakmp_sa_situation, tvb, offset, length, |
3850 | 7 | NULL, |
3851 | 7 | "%s (length is %u, should be >= 8)", |
3852 | 7 | tvb_bytes_to_str(pinfo->pool, tvb, offset, length), length); |
3853 | 7 | return; |
3854 | 7 | } |
3855 | 13 | proto_tree_add_item(tree, hf_isakmp_sa_situation, tvb, offset, 4, ENC_NA); /* must be always 0 as per RFC 6407 no further decoding required*/ |
3856 | 13 | saattr = tvb_get_ntohs(tvb, offset+4); |
3857 | 13 | proto_tree_add_item(tree, hf_isakmp_sa_attribute_next_payload, tvb, offset+4, 2, ENC_NA); |
3858 | 13 | proto_tree_add_item(tree, hf_isakmp_reserved2 , tvb, offset+6, 2, ENC_NA); |
3859 | | |
3860 | 13 | offset += 8; |
3861 | 13 | length -= 8; |
3862 | | |
3863 | | /* possible attribute values here 15(SAK),16(SAT),18(GAP)*/ |
3864 | 13 | switch(saattr) { |
3865 | 4 | case PLOAD_IKE_SAK: |
3866 | 4 | dissect_sa_kek(tvb, pinfo, offset, length, currtree ); |
3867 | 4 | break; |
3868 | 6 | case PLOAD_IKE_SAT: |
3869 | 6 | dissect_sa_tek(tvb, pinfo, offset, length, currtree); |
3870 | 6 | break; |
3871 | 13 | } |
3872 | 12 | break; |
3873 | 13 | } |
3874 | 17 | default: |
3875 | 17 | proto_tree_add_item(tree, hf_isakmp_sa_situation, tvb, offset, length, ENC_NA); |
3876 | 17 | break; |
3877 | 48 | } |
3878 | 7.50k | } else if (isakmp_version == 2) { |
3879 | 7.48k | dissect_payloads(tvb, tree, isakmp_version, PLOAD_IKE_P, offset, |
3880 | 7.48k | length, pinfo, 0, is_request, decr_data); |
3881 | 7.48k | } |
3882 | 7.55k | } |
3883 | | |
3884 | | static void |
3885 | | dissect_proposal(tvbuff_t *tvb, packet_info *pinfo, unsigned offset, unsigned length, proto_tree *tree, int isakmp_version, void* decr_data) |
3886 | 257 | { |
3887 | 257 | uint8_t protocol_id; |
3888 | 257 | uint8_t spi_size; |
3889 | 257 | uint8_t num_transforms; |
3890 | 257 | uint8_t next_payload; |
3891 | 257 | uint16_t payload_length; |
3892 | 257 | proto_tree * ntree; |
3893 | 257 | uint8_t proposal_num; |
3894 | | |
3895 | 257 | proposal_num = tvb_get_uint8(tvb, offset); |
3896 | | |
3897 | 257 | proto_item_append_text(tree, " # %d", proposal_num); |
3898 | | |
3899 | 257 | proto_tree_add_item(tree, hf_isakmp_prop_number, tvb, offset, 1, ENC_BIG_ENDIAN); |
3900 | 257 | offset += 1; |
3901 | 257 | length -= 1; |
3902 | | |
3903 | 257 | protocol_id = tvb_get_uint8(tvb, offset); |
3904 | | |
3905 | 257 | if (isakmp_version == 1) |
3906 | 146 | { |
3907 | 146 | proto_tree_add_item(tree, hf_isakmp_prop_protoid_v1, tvb, offset, 1, ENC_BIG_ENDIAN); |
3908 | 146 | }else if (isakmp_version == 2) |
3909 | 67 | { |
3910 | 67 | proto_tree_add_item(tree, hf_isakmp_prop_protoid_v2, tvb, offset, 1, ENC_BIG_ENDIAN); |
3911 | 67 | } |
3912 | 257 | offset += 1; |
3913 | 257 | length -= 1; |
3914 | | |
3915 | 257 | spi_size = tvb_get_uint8(tvb, offset); |
3916 | 257 | proto_tree_add_item(tree, hf_isakmp_spisize, tvb, offset, 1, ENC_BIG_ENDIAN); |
3917 | 257 | offset += 1; |
3918 | 257 | length -= 1; |
3919 | | |
3920 | 257 | num_transforms = tvb_get_uint8(tvb, offset); |
3921 | 257 | proto_tree_add_item(tree, hf_isakmp_prop_transforms, tvb, offset, 1, ENC_BIG_ENDIAN); |
3922 | 257 | offset += 1; |
3923 | 257 | length -= 1; |
3924 | | |
3925 | 257 | if (spi_size) { |
3926 | 103 | proto_tree_add_item(tree, hf_isakmp_spi, tvb, offset, spi_size, ENC_NA); |
3927 | | |
3928 | 103 | offset += spi_size; |
3929 | 103 | length -= spi_size; |
3930 | 103 | } |
3931 | | |
3932 | 1.00k | while (num_transforms > 0) { |
3933 | 786 | ntree = dissect_payload_header(tvb, pinfo, offset, length, isakmp_version, |
3934 | 786 | PLOAD_IKE_T, &next_payload, &payload_length, tree); |
3935 | 786 | if (length < payload_length) { |
3936 | 21 | proto_tree_add_expert_format(tree, pinfo, &ei_isakmp_payload_bad_length, tvb, offset + 4, length, |
3937 | 21 | "Payload (bogus, length is %u, greater than remaining length %d", payload_length, length); |
3938 | 21 | break; |
3939 | 765 | } else if (payload_length < 4) { |
3940 | 13 | proto_tree_add_expert_format(tree, pinfo, &ei_isakmp_payload_bad_length, tvb, offset + 4, length, |
3941 | 13 | "Payload (bogus, length is %u, must be at least 4)", payload_length); |
3942 | 13 | break; |
3943 | 13 | } |
3944 | 752 | dissect_transform(tvb, pinfo, offset + 4, payload_length - 4, ntree, isakmp_version, protocol_id, decr_data); |
3945 | | |
3946 | 752 | offset += payload_length; |
3947 | 752 | length -= payload_length; |
3948 | 752 | num_transforms--; |
3949 | | |
3950 | 752 | } |
3951 | 257 | } |
3952 | | |
3953 | | /** Dissect an attribute header, which is common to all attributes. |
3954 | | * |
3955 | | * @param [in] tvb The tv buffer of the current data. |
3956 | | * @param [in] tree The tree to append the attribute subtree to. |
3957 | | * @param [in] offset The start of the data in tvb. |
3958 | | * @param [in] hf_attr A struct of indices pointing to attribute header field descriptions. |
3959 | | * @param [in] attr_typenames The table for translation of the attribute type id to a name. |
3960 | | * @param [out] headerlen The length of the attribute header, excluding the value. |
3961 | | * @param [out] value_len The length of the attribute value. |
3962 | | * @param [out] attr_type The attribute type, as read from the attribute header. |
3963 | | * @param [out] attr_item The root item created for this attribute. |
3964 | | * @param [out] subtree The subtree created for this attribute. |
3965 | | */ |
3966 | | static void |
3967 | | dissect_attribute_header(tvbuff_t *tvb, packet_info* pinfo, proto_tree *tree, unsigned offset, |
3968 | | attribute_common_fields hf_attr, const range_string *attr_typenames, |
3969 | | unsigned *headerlen, unsigned *value_len, unsigned *attr_type, |
3970 | | proto_item **attr_item, proto_tree **subtree) |
3971 | 4.16k | { |
3972 | 4.16k | unsigned attr_type_format; |
3973 | 4.16k | bool has_len; |
3974 | 4.16k | const char *attr_typename; |
3975 | | |
3976 | 4.16k | attr_type_format = tvb_get_ntohs(tvb, offset); |
3977 | 4.16k | has_len = !(attr_type_format & 0x8000); |
3978 | 4.16k | *attr_type = attr_type_format & 0x7fff; |
3979 | | |
3980 | 4.16k | if (has_len) { |
3981 | | /* Type/Length/Value format */ |
3982 | 2.86k | *headerlen = 4; |
3983 | 2.86k | *value_len = tvb_get_ntohs(tvb, offset + 2); |
3984 | 2.86k | } else { |
3985 | | /* Type/Value format */ |
3986 | 1.29k | *headerlen = 2; |
3987 | 1.29k | *value_len = 2; |
3988 | 1.29k | } |
3989 | | |
3990 | 4.16k | *attr_item = proto_tree_add_item(tree, hf_attr.all, tvb, offset, *headerlen + *value_len, ENC_NA); |
3991 | 4.16k | attr_typename = rval_to_str_wmem(pinfo->pool, *attr_type, attr_typenames, "Unknown Attribute Type (%02d)"); |
3992 | 4.16k | proto_item_append_text(*attr_item, " (t=%d,l=%d): %s", *attr_type, *value_len, attr_typename); |
3993 | | |
3994 | 4.16k | *subtree = proto_item_add_subtree(*attr_item, ett_isakmp_attr); |
3995 | 4.16k | proto_tree_add_item(*subtree, hf_attr.format, tvb, offset, 2, ENC_BIG_ENDIAN); |
3996 | 4.16k | proto_tree_add_uint(*subtree, hf_attr.type, tvb, offset, 2, *attr_type); |
3997 | | |
3998 | 4.16k | if (has_len) |
3999 | 2.85k | proto_tree_add_item(*subtree, hf_attr.length, tvb, offset + 2, 2, ENC_BIG_ENDIAN); |
4000 | | |
4001 | 4.16k | if (*value_len > 0) |
4002 | 2.90k | proto_tree_add_item(*subtree, hf_attr.value, tvb, offset + *headerlen, *value_len, ENC_NA); |
4003 | 4.16k | } |
4004 | | |
4005 | | /* Returns the number of bytes consumed by this attribute. */ |
4006 | | static int |
4007 | | dissect_rohc_attribute(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, unsigned offset) |
4008 | 199 | { |
4009 | 199 | unsigned headerlen, value_len, attr_type; |
4010 | 199 | proto_item *attr_item; |
4011 | 199 | proto_tree *attr_tree; |
4012 | | |
4013 | 199 | dissect_attribute_header(tvb, pinfo, tree, offset, |
4014 | 199 | hf_isakmp_notify_data_rohc_attr, rohc_attr_type, |
4015 | 199 | &headerlen, &value_len, &attr_type, |
4016 | 199 | &attr_item, &attr_tree); |
4017 | | |
4018 | 199 | offset += headerlen; |
4019 | | |
4020 | 199 | if (value_len == 0) |
4021 | 46 | { |
4022 | 46 | expert_add_info(pinfo, attr_item, &ei_isakmp_attribute_value_empty); |
4023 | 46 | return headerlen; |
4024 | 46 | } |
4025 | | |
4026 | 153 | switch(attr_type) { |
4027 | 2 | case ROHC_MAX_CID: |
4028 | 2 | proto_tree_add_item(attr_tree, hf_isakmp_notify_data_rohc_attr_max_cid, tvb, offset, value_len, ENC_BIG_ENDIAN); |
4029 | 2 | break; |
4030 | 0 | case ROHC_PROFILE: |
4031 | 0 | proto_tree_add_item(attr_tree, hf_isakmp_notify_data_rohc_attr_profile, tvb, offset, value_len, ENC_BIG_ENDIAN); |
4032 | 0 | break; |
4033 | 1 | case ROHC_INTEG: |
4034 | 1 | proto_tree_add_item(attr_tree, hf_isakmp_notify_data_rohc_attr_integ, tvb, offset, value_len, ENC_BIG_ENDIAN); |
4035 | 1 | break; |
4036 | 38 | case ROHC_ICV_LEN: |
4037 | 38 | proto_tree_add_item(attr_tree, hf_isakmp_notify_data_rohc_attr_icv_len, tvb, offset, value_len, ENC_BIG_ENDIAN); |
4038 | 38 | break; |
4039 | 1 | case ROHC_MRRU: |
4040 | 1 | proto_tree_add_item(attr_tree, hf_isakmp_notify_data_rohc_attr_mrru, tvb, offset, value_len, ENC_BIG_ENDIAN); |
4041 | 1 | break; |
4042 | | |
4043 | 102 | default: |
4044 | | /* No Default Action */ |
4045 | 102 | break; |
4046 | 153 | } |
4047 | | |
4048 | 144 | return headerlen + value_len; |
4049 | 153 | } |
4050 | | |
4051 | | /* Dissect life duration, which is variable-length. Note that this function |
4052 | | * handles both/either the security association life duration as defined in |
4053 | | * section 4.5 of RFC2407 (https://tools.ietf.org/html/rfc2407), as well as the |
4054 | | * life duration according to the attribute classes table in Appendix A of |
4055 | | * RFC2409: https://tools.ietf.org/html/rfc2409#page-33 */ |
4056 | | static void |
4057 | | dissect_life_duration(tvbuff_t *tvb, proto_tree *tree, proto_item *ti, int hf_uint32, int hf_uint64, int hf_bytes, unsigned offset, unsigned len) |
4058 | 106 | { |
4059 | 106 | switch (len) { |
4060 | 0 | case 0: |
4061 | 0 | break; |
4062 | 13 | case 1: { |
4063 | 13 | uint8_t val; |
4064 | 13 | val = tvb_get_uint8(tvb, offset); |
4065 | | |
4066 | 13 | proto_tree_add_uint(tree, hf_uint32, tvb, offset, len, val); |
4067 | 13 | proto_item_append_text(ti, ": %u", val); |
4068 | 13 | break; |
4069 | 0 | } |
4070 | 37 | case 2: { |
4071 | 37 | uint16_t val; |
4072 | 37 | val = tvb_get_ntohs(tvb, offset); |
4073 | | |
4074 | 37 | proto_tree_add_uint(tree, hf_uint32, tvb, offset, len, val); |
4075 | 37 | proto_item_append_text(ti, ": %u", val); |
4076 | 37 | break; |
4077 | 0 | } |
4078 | 11 | case 3: { |
4079 | 11 | uint32_t val; |
4080 | 11 | val = tvb_get_ntoh24(tvb, offset); |
4081 | | |
4082 | 11 | proto_tree_add_uint(tree, hf_uint32, tvb, offset, len, val); |
4083 | 11 | proto_item_append_text(ti, ": %u", val); |
4084 | 11 | break; |
4085 | 0 | } |
4086 | 21 | case 4: { |
4087 | 21 | uint32_t val; |
4088 | 21 | val = tvb_get_ntohl(tvb, offset); |
4089 | | |
4090 | 21 | proto_tree_add_uint(tree, hf_uint32, tvb, offset, len, val); |
4091 | 21 | proto_item_append_text(ti, ": %u", val); |
4092 | 21 | break; |
4093 | 0 | } |
4094 | 1 | case 5: { |
4095 | 1 | uint64_t val; |
4096 | 1 | val = tvb_get_ntoh40(tvb, offset); |
4097 | | |
4098 | 1 | proto_tree_add_uint64_format_value(tree, hf_uint64, tvb, offset, len, val, "%" PRIu64, val); |
4099 | 1 | proto_item_append_text(ti, ": %" PRIu64, val); |
4100 | 1 | break; |
4101 | 0 | } |
4102 | 5 | case 6: { |
4103 | 5 | uint64_t val; |
4104 | 5 | val = tvb_get_ntoh48(tvb, offset); |
4105 | | |
4106 | 5 | proto_tree_add_uint64_format_value(tree, hf_uint64, tvb, offset, len, val, "%" PRIu64, val); |
4107 | 5 | proto_item_append_text(ti, ": %" PRIu64, val); |
4108 | 5 | break; |
4109 | 0 | } |
4110 | 7 | case 7: { |
4111 | 7 | uint64_t val; |
4112 | 7 | val = tvb_get_ntoh56(tvb, offset); |
4113 | | |
4114 | 7 | proto_tree_add_uint64_format_value(tree, hf_uint64, tvb, offset, len, val, "%" PRIu64, val); |
4115 | 7 | proto_item_append_text(ti, ": %" PRIu64, val); |
4116 | 7 | break; |
4117 | 0 | } |
4118 | 1 | case 8: { |
4119 | 1 | uint64_t val; |
4120 | 1 | val = tvb_get_ntoh64(tvb, offset); |
4121 | | |
4122 | 1 | proto_tree_add_uint64_format_value(tree, hf_uint64, tvb, offset, len, val, "%" PRIu64, val); |
4123 | 1 | proto_item_append_text(ti, ": %" PRIu64, val); |
4124 | 1 | break; |
4125 | 0 | } |
4126 | 10 | default: |
4127 | 10 | proto_tree_add_item(tree, hf_bytes, tvb, offset, len, ENC_NA); |
4128 | 10 | proto_item_append_text(ti, ": %" PRIx64 " ...", tvb_get_ntoh64(tvb, offset)); |
4129 | 10 | break; |
4130 | 106 | } |
4131 | 106 | } |
4132 | | |
4133 | | /* Returns the number of bytes consumed by this attribute. */ |
4134 | | static int |
4135 | | dissect_ipsec_attribute(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, unsigned offset) |
4136 | 966 | { |
4137 | 966 | unsigned headerlen, value_len, attr_type; |
4138 | 966 | proto_item *attr_item; |
4139 | 966 | proto_tree *attr_tree; |
4140 | | |
4141 | 966 | dissect_attribute_header(tvb, pinfo, tree, offset, |
4142 | 966 | hf_isakmp_ipsec_attr, ipsec_attr_type, |
4143 | 966 | &headerlen, &value_len, &attr_type, |
4144 | 966 | &attr_item, &attr_tree); |
4145 | | |
4146 | 966 | offset += headerlen; |
4147 | | |
4148 | 966 | if (value_len == 0) |
4149 | 298 | { |
4150 | 298 | expert_add_info(pinfo, attr_item, &ei_isakmp_attribute_value_empty); |
4151 | 298 | return headerlen; |
4152 | 298 | } |
4153 | | |
4154 | 668 | switch(attr_type) { |
4155 | 12 | case IPSEC_ATTR_LIFE_TYPE: |
4156 | 12 | proto_tree_add_item(attr_tree, hf_isakmp_ipsec_attr_life_type, tvb, offset, value_len, ENC_BIG_ENDIAN); |
4157 | 12 | proto_item_append_text(attr_item, ": %s", val_to_str(pinfo->pool, tvb_get_ntohs(tvb, offset), attr_life_type, "Unknown %d")); |
4158 | 12 | break; |
4159 | 83 | case IPSEC_ATTR_LIFE_DURATION: |
4160 | 83 | dissect_life_duration(tvb, attr_tree, attr_item, hf_isakmp_ipsec_attr_life_duration_uint32, hf_isakmp_ipsec_attr_life_duration_uint64, hf_isakmp_ipsec_attr_life_duration_bytes, offset, value_len); |
4161 | 83 | break; |
4162 | 10 | case IPSEC_ATTR_GROUP_DESC: |
4163 | 10 | proto_tree_add_item(attr_tree, hf_isakmp_ipsec_attr_group_description, tvb, offset, value_len, ENC_BIG_ENDIAN); |
4164 | 10 | proto_item_append_text(attr_item, ": %s", val_to_str(pinfo->pool, tvb_get_ntohs(tvb, offset), dh_group, "Unknown %d")); |
4165 | 10 | break; |
4166 | 40 | case IPSEC_ATTR_ENCAP_MODE: |
4167 | 40 | proto_tree_add_item(attr_tree, hf_isakmp_ipsec_attr_encap_mode, tvb, offset, value_len, ENC_BIG_ENDIAN); |
4168 | 40 | proto_item_append_text(attr_item, ": %s", val_to_str(pinfo->pool, tvb_get_ntohs(tvb, offset), ipsec_attr_encap_mode, "Unknown %d")); |
4169 | 40 | break; |
4170 | 18 | case IPSEC_ATTR_AUTH_ALGORITHM: |
4171 | 18 | proto_tree_add_item(attr_tree, hf_isakmp_ipsec_attr_auth_algorithm, tvb, offset, value_len, ENC_BIG_ENDIAN); |
4172 | 18 | proto_item_append_text(attr_item, ": %s", val_to_str(pinfo->pool, tvb_get_ntohs(tvb, offset), ipsec_attr_auth_algo, "Unknown %d")); |
4173 | 18 | break; |
4174 | 23 | case IPSEC_ATTR_KEY_LENGTH: |
4175 | 23 | proto_tree_add_item(attr_tree, hf_isakmp_ipsec_attr_key_length, tvb, offset, value_len, ENC_BIG_ENDIAN); |
4176 | 23 | proto_item_append_text(attr_item, ": %d", tvb_get_ntohs(tvb, offset)); |
4177 | 23 | break; |
4178 | 9 | case IPSEC_ATTR_KEY_ROUNDS: |
4179 | 9 | proto_tree_add_item(attr_tree, hf_isakmp_ipsec_attr_key_rounds, tvb, offset, value_len, ENC_BIG_ENDIAN); |
4180 | 9 | proto_item_append_text(attr_item, ": %d", tvb_get_ntohs(tvb, offset)); |
4181 | 9 | break; |
4182 | 4 | case IPSEC_ATTR_CMPR_DICT_SIZE: |
4183 | 4 | proto_tree_add_item(attr_tree, hf_isakmp_ipsec_attr_cmpr_dict_size, tvb, offset, value_len, ENC_BIG_ENDIAN); |
4184 | 4 | break; |
4185 | 15 | case IPSEC_ATTR_CMPR_ALGORITHM: |
4186 | 15 | proto_tree_add_item(attr_tree, hf_isakmp_ipsec_attr_cmpr_algorithm, tvb, offset, value_len, ENC_NA); |
4187 | 15 | break; |
4188 | 7 | case IPSEC_ATTR_ECN_TUNNEL: |
4189 | 7 | proto_tree_add_item(attr_tree, hf_isakmp_ipsec_attr_ecn_tunnel, tvb, offset, value_len, ENC_BIG_ENDIAN); |
4190 | 7 | proto_item_append_text(attr_item, ": %s", val_to_str(pinfo->pool, tvb_get_ntohs(tvb, offset), ipsec_attr_ecn_tunnel, "Unknown %d")); |
4191 | 7 | break; |
4192 | 13 | case IPSEC_ATTR_EXT_SEQ_NBR: |
4193 | 13 | proto_tree_add_item(attr_tree, hf_isakmp_ipsec_attr_ext_seq_nbr, tvb, offset, value_len, ENC_BIG_ENDIAN); |
4194 | 13 | proto_item_append_text(attr_item, ": %s", val_to_str(pinfo->pool, tvb_get_ntohs(tvb, offset), ipsec_attr_ext_seq_nbr, "Unknown %d")); |
4195 | 13 | break; |
4196 | 14 | case IPSEC_ATTR_AUTH_KEY_LENGTH: |
4197 | 14 | proto_tree_add_item(attr_tree, hf_isakmp_ipsec_attr_auth_key_length, tvb, offset, value_len, ENC_BIG_ENDIAN); |
4198 | 14 | proto_item_append_text(attr_item, ": %d", tvb_get_ntohs(tvb, offset)); |
4199 | 14 | break; |
4200 | 7 | case IPSEC_ATTR_SIG_ENCO_ALGORITHM: |
4201 | 7 | proto_tree_add_item(attr_tree, hf_isakmp_ipsec_attr_sig_enco_algorithm, tvb, offset, value_len, ENC_NA); |
4202 | 7 | break; |
4203 | | |
4204 | 5 | case IPSEC_ATTR_ADDR_PRESERVATION: |
4205 | 5 | proto_tree_add_item(attr_tree, hf_isakmp_ipsec_attr_addr_preservation, tvb, offset, value_len, ENC_BIG_ENDIAN); |
4206 | 5 | proto_item_append_text(attr_item, ": %s", val_to_str(pinfo->pool, tvb_get_ntohs(tvb, offset), ipsec_attr_addr_preservation, "Unknown %d")); |
4207 | 5 | break; |
4208 | | |
4209 | 8 | case IPSEC_ATTR_SA_DIRECTION: |
4210 | 8 | proto_tree_add_item(attr_tree, hf_isakmp_ipsec_attr_sa_direction, tvb, offset, value_len, ENC_BIG_ENDIAN); |
4211 | 8 | proto_item_append_text(attr_item, ": %s", val_to_str(pinfo->pool, tvb_get_ntohs(tvb, offset), ipsec_attr_sa_direction, "Unknown %d")); |
4212 | 317 | default: |
4213 | | /* No Default Action */ |
4214 | 317 | break; |
4215 | 668 | } |
4216 | | |
4217 | 577 | return headerlen + value_len; |
4218 | 668 | } |
4219 | | |
4220 | | /* Returns the number of bytes consumed by this attribute. */ |
4221 | | static int |
4222 | | dissect_resp_lifetime_ipsec_attribute(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, unsigned offset) |
4223 | 166 | { |
4224 | 166 | unsigned headerlen, value_len, attr_type; |
4225 | 166 | proto_item *attr_item; |
4226 | 166 | proto_tree *attr_tree; |
4227 | | |
4228 | 166 | dissect_attribute_header(tvb, pinfo, tree, offset, |
4229 | 166 | hf_isakmp_resp_lifetime_ipsec_attr, ipsec_attr_type, |
4230 | 166 | &headerlen, &value_len, &attr_type, |
4231 | 166 | &attr_item, &attr_tree); |
4232 | | |
4233 | 166 | offset += headerlen; |
4234 | | |
4235 | 166 | if (value_len == 0) |
4236 | 105 | { |
4237 | 105 | expert_add_info(pinfo, attr_item, &ei_isakmp_attribute_value_empty); |
4238 | 105 | return headerlen; |
4239 | 105 | } |
4240 | | |
4241 | 61 | switch(attr_type) { |
4242 | 7 | case IPSEC_ATTR_LIFE_TYPE: |
4243 | 7 | proto_tree_add_item(attr_tree, hf_isakmp_resp_lifetime_ipsec_attr_life_type, tvb, offset, value_len, ENC_BIG_ENDIAN); |
4244 | 7 | proto_item_append_text(attr_item, ": %s", val_to_str(pinfo->pool, tvb_get_ntohs(tvb, offset), attr_life_type, "Unknown %d")); |
4245 | 7 | break; |
4246 | 8 | case IPSEC_ATTR_LIFE_DURATION: |
4247 | 8 | dissect_life_duration(tvb, attr_tree, attr_item, hf_isakmp_resp_lifetime_ipsec_attr_life_duration_uint32, hf_isakmp_resp_lifetime_ipsec_attr_life_duration_uint64, hf_isakmp_resp_lifetime_ipsec_attr_life_duration_bytes, offset, value_len); |
4248 | 8 | break; |
4249 | 38 | default: |
4250 | | /* No Default Action */ |
4251 | 38 | break; |
4252 | 61 | } |
4253 | | |
4254 | 53 | return headerlen + value_len; |
4255 | 61 | } |
4256 | | |
4257 | | /* Returns the number of bytes consumed by this attribute. */ |
4258 | | static int |
4259 | | dissect_ike_attribute(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, unsigned offset, decrypt_data_t *decr) |
4260 | 533 | { |
4261 | 533 | unsigned headerlen, value_len, attr_type; |
4262 | 533 | proto_item *attr_item; |
4263 | 533 | proto_tree *attr_tree; |
4264 | | |
4265 | 533 | dissect_attribute_header(tvb, pinfo, tree, offset, |
4266 | 533 | hf_isakmp_ike_attr, ike_attr_type, |
4267 | 533 | &headerlen, &value_len, &attr_type, |
4268 | 533 | &attr_item, &attr_tree); |
4269 | | |
4270 | 533 | offset += headerlen; |
4271 | | |
4272 | 533 | if (value_len == 0) |
4273 | 114 | { |
4274 | 114 | expert_add_info(pinfo, attr_item, &ei_isakmp_attribute_value_empty); |
4275 | 114 | return headerlen; |
4276 | 114 | } |
4277 | | |
4278 | 419 | switch(attr_type) { |
4279 | 11 | case IKE_ATTR_ENCRYPTION_ALGORITHM: |
4280 | 11 | proto_tree_add_item(attr_tree, hf_isakmp_ike_attr_encryption_algorithm, tvb, offset, value_len, ENC_BIG_ENDIAN); |
4281 | 11 | proto_item_append_text(attr_item, ": %s", val_to_str(pinfo->pool, tvb_get_ntohs(tvb, offset), ike_attr_enc_algo, "Unknown %d")); |
4282 | 11 | if (decr) decr->ike_encr_alg = tvb_get_ntohs(tvb, offset); |
4283 | 11 | break; |
4284 | 22 | case IKE_ATTR_HASH_ALGORITHM: |
4285 | 22 | proto_tree_add_item(attr_tree, hf_isakmp_ike_attr_hash_algorithm, tvb, offset, value_len, ENC_BIG_ENDIAN); |
4286 | 22 | proto_item_append_text(attr_item, ": %s", val_to_str(pinfo->pool, tvb_get_ntohs(tvb, offset), ike_attr_hash_algo, "Unknown %d")); |
4287 | 22 | if (decr) decr->ike_hash_alg = tvb_get_ntohs(tvb, offset); |
4288 | 22 | break; |
4289 | 14 | case IKE_ATTR_AUTHENTICATION_METHOD: |
4290 | | /* for GM/T 0022 IPSec VPN specification */ |
4291 | 14 | if(decr && (decr->ike_hash_alg == HMAC_SM3 || decr->ike_encr_alg == ENC_SM1_CBC || decr->ike_encr_alg == ENC_SM4_CBC)) |
4292 | 0 | { |
4293 | 0 | proto_tree_add_item(attr_tree, hf_isakmp_ike_attr_authentication_method_china, tvb, offset, value_len, ENC_BIG_ENDIAN); |
4294 | 0 | proto_item_append_text(attr_item, ": %s", val_to_str(pinfo->pool, tvb_get_ntohs(tvb, offset), ike_attr_authmeth_china, "Unknown %d")); |
4295 | |
|
4296 | 0 | } |
4297 | 14 | else |
4298 | 14 | { |
4299 | 14 | proto_tree_add_item(attr_tree, hf_isakmp_ike_attr_authentication_method, tvb, offset, value_len, ENC_BIG_ENDIAN); |
4300 | 14 | proto_item_append_text(attr_item, ": %s", val_to_str(pinfo->pool, tvb_get_ntohs(tvb, offset), ike_attr_authmeth, "Unknown %d")); |
4301 | 14 | } |
4302 | 14 | if (decr) decr->is_psk = tvb_get_ntohs(tvb, offset) == 0x01 ? true : false; |
4303 | 14 | break; |
4304 | 42 | case IKE_ATTR_GROUP_DESCRIPTION: |
4305 | 42 | proto_tree_add_item(attr_tree, hf_isakmp_ike_attr_group_description, tvb, offset, value_len, ENC_BIG_ENDIAN); |
4306 | 42 | proto_item_append_text(attr_item, ": %s", val_to_str(pinfo->pool, tvb_get_ntohs(tvb, offset), dh_group, "Unknown %d")); |
4307 | 42 | if (decr) decr->group = tvb_get_ntohs(tvb, offset); |
4308 | 42 | break; |
4309 | 8 | case IKE_ATTR_GROUP_TYPE: |
4310 | 8 | proto_tree_add_item(attr_tree, hf_isakmp_ike_attr_group_type, tvb, offset, value_len, ENC_BIG_ENDIAN); |
4311 | 8 | proto_item_append_text(attr_item, ": %s", val_to_str(pinfo->pool, tvb_get_ntohs(tvb, offset), ike_attr_grp_type, "Unknown %d")); |
4312 | 8 | break; |
4313 | 13 | case IKE_ATTR_GROUP_PRIME: |
4314 | 13 | proto_tree_add_item(attr_tree, hf_isakmp_ike_attr_group_prime, tvb, offset, value_len, ENC_NA); |
4315 | 13 | break; |
4316 | 6 | case IKE_ATTR_GROUP_GENERATOR_ONE: |
4317 | 6 | proto_tree_add_item(attr_tree, hf_isakmp_ike_attr_group_generator_one, tvb, offset, value_len, ENC_NA); |
4318 | 6 | break; |
4319 | 0 | case IKE_ATTR_GROUP_GENERATOR_TWO: |
4320 | 0 | proto_tree_add_item(attr_tree, hf_isakmp_ike_attr_group_generator_two, tvb, offset, value_len, ENC_NA); |
4321 | 0 | break; |
4322 | 8 | case IKE_ATTR_GROUP_CURVE_A: |
4323 | 8 | proto_tree_add_item(attr_tree, hf_isakmp_ike_attr_group_curve_a, tvb, offset, value_len, ENC_NA); |
4324 | 8 | break; |
4325 | 13 | case IKE_ATTR_GROUP_CURVE_B: |
4326 | 13 | proto_tree_add_item(attr_tree, hf_isakmp_ike_attr_group_curve_b, tvb, offset, value_len, ENC_NA); |
4327 | 13 | break; |
4328 | 5 | case IKE_ATTR_LIFE_TYPE: |
4329 | 5 | proto_tree_add_item(attr_tree, hf_isakmp_ike_attr_life_type, tvb, offset, value_len, ENC_BIG_ENDIAN); |
4330 | 5 | proto_item_append_text(attr_item, ": %s", val_to_str(pinfo->pool, tvb_get_ntohs(tvb, offset), attr_life_type, "Unknown %d")); |
4331 | 5 | break; |
4332 | 7 | case IKE_ATTR_LIFE_DURATION: |
4333 | 7 | dissect_life_duration(tvb, attr_tree, attr_item, hf_isakmp_ike_attr_life_duration_uint32, hf_isakmp_ike_attr_life_duration_uint64, hf_isakmp_ike_attr_life_duration_bytes, offset, value_len); |
4334 | 7 | break; |
4335 | 4 | case IKE_ATTR_PRF: |
4336 | 4 | proto_tree_add_item(attr_tree, hf_isakmp_ike_attr_prf, tvb, offset, value_len, ENC_NA); |
4337 | 4 | break; |
4338 | 10 | case IKE_ATTR_KEY_LENGTH: |
4339 | 10 | proto_tree_add_item(attr_tree, hf_isakmp_ike_attr_key_length, tvb, offset, value_len, ENC_BIG_ENDIAN); |
4340 | 10 | proto_item_append_text(attr_item, ": %d", tvb_get_ntohs(tvb, offset)); |
4341 | 10 | if (decr) decr->ike_encr_keylen = tvb_get_ntohs(tvb, offset); |
4342 | 10 | break; |
4343 | 7 | case IKE_ATTR_FIELD_SIZE: |
4344 | 7 | proto_tree_add_item(attr_tree, hf_isakmp_ike_attr_field_size, tvb, offset, value_len, ENC_NA); |
4345 | 7 | break; |
4346 | 10 | case IKE_ATTR_GROUP_ORDER: |
4347 | 10 | proto_tree_add_item(attr_tree, hf_isakmp_ike_attr_group_order, tvb, offset, value_len, ENC_NA); |
4348 | 10 | break; |
4349 | 4 | case IKE_ATTR_BLOCK_SIZE: |
4350 | 4 | proto_tree_add_item(attr_tree, hf_isakmp_ike_attr_block_size, tvb, offset, value_len, ENC_NA); |
4351 | 4 | break; |
4352 | 5 | case IKE_ATTR_ACAT: |
4353 | 5 | proto_tree_add_item(attr_tree, hf_isakmp_ike_attr_asymmetric_cryptographic_algorithm_type, tvb, offset, value_len, ENC_BIG_ENDIAN); |
4354 | 5 | proto_item_append_text(attr_item, ": %s", val_to_str(pinfo->pool, tvb_get_ntohs(tvb, offset), ike_attr_asym_algo, "Unknown %d")); |
4355 | 5 | break; |
4356 | 187 | default: |
4357 | | /* No Default Action */ |
4358 | 187 | break; |
4359 | 419 | } |
4360 | | |
4361 | 376 | return headerlen + value_len; |
4362 | 419 | } |
4363 | | |
4364 | | /* Returns the number of bytes consumed by this attribute. */ |
4365 | | static int |
4366 | | dissect_resp_lifetime_ike_attribute(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, unsigned offset) |
4367 | 115 | { |
4368 | 115 | unsigned headerlen, value_len, attr_type; |
4369 | 115 | proto_item *attr_item; |
4370 | 115 | proto_tree *attr_tree; |
4371 | | |
4372 | 115 | dissect_attribute_header(tvb, pinfo, tree, offset, |
4373 | 115 | hf_isakmp_resp_lifetime_ike_attr, ike_attr_type, |
4374 | 115 | &headerlen, &value_len, &attr_type, |
4375 | 115 | &attr_item, &attr_tree); |
4376 | | |
4377 | 115 | offset += headerlen; |
4378 | | |
4379 | 115 | if (value_len == 0) |
4380 | 61 | { |
4381 | 61 | expert_add_info(pinfo, attr_item, &ei_isakmp_attribute_value_empty); |
4382 | 61 | return headerlen; |
4383 | 61 | } |
4384 | | |
4385 | 54 | switch(attr_type) { |
4386 | 7 | case IKE_ATTR_LIFE_TYPE: |
4387 | 7 | proto_tree_add_item(attr_tree, hf_isakmp_resp_lifetime_ike_attr_life_type, tvb, offset, value_len, ENC_BIG_ENDIAN); |
4388 | 7 | proto_item_append_text(attr_item, ": %s", val_to_str(pinfo->pool, tvb_get_ntohs(tvb, offset), attr_life_type, "Unknown %d")); |
4389 | 7 | break; |
4390 | 8 | case IKE_ATTR_LIFE_DURATION: |
4391 | 8 | dissect_life_duration(tvb, attr_tree, attr_item, hf_isakmp_resp_lifetime_ike_attr_life_duration_uint32, hf_isakmp_resp_lifetime_ike_attr_life_duration_uint64, hf_isakmp_resp_lifetime_ike_attr_life_duration_bytes, offset, value_len); |
4392 | 8 | break; |
4393 | 27 | default: |
4394 | | /* No Default Action */ |
4395 | 27 | break; |
4396 | 54 | } |
4397 | | |
4398 | 42 | return headerlen + value_len; |
4399 | 54 | } |
4400 | | |
4401 | | /* Returns the number of bytes consumed by this attribute. */ |
4402 | | static int |
4403 | | dissect_ike2_transform_attribute(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, unsigned offset) |
4404 | 147 | { |
4405 | 147 | unsigned headerlen, value_len, attr_type; |
4406 | 147 | proto_item *attr_item; |
4407 | 147 | proto_tree *attr_tree; |
4408 | | |
4409 | 147 | dissect_attribute_header(tvb, pinfo, tree, offset, |
4410 | 147 | hf_isakmp_ike2_attr, transform_ike2_attr_type, |
4411 | 147 | &headerlen, &value_len, &attr_type, |
4412 | 147 | &attr_item, &attr_tree); |
4413 | | |
4414 | 147 | offset += headerlen; |
4415 | | |
4416 | 147 | if (value_len == 0) |
4417 | 66 | { |
4418 | 66 | expert_add_info(pinfo, attr_item, &ei_isakmp_attribute_value_empty); |
4419 | 66 | return headerlen; |
4420 | 66 | } |
4421 | | |
4422 | 81 | switch(attr_type) { |
4423 | 5 | case IKE2_ATTR_KEY_LENGTH: |
4424 | 5 | proto_tree_add_item(attr_tree, hf_isakmp_ike2_attr_key_length, tvb, offset, value_len, ENC_BIG_ENDIAN); |
4425 | 5 | proto_item_append_text(attr_item, ": %d", tvb_get_ntohs(tvb, offset)); |
4426 | 5 | break; |
4427 | 56 | default: |
4428 | | /* No Default Action */ |
4429 | 56 | break; |
4430 | 81 | } |
4431 | | |
4432 | 61 | return headerlen + value_len; |
4433 | 81 | } |
4434 | | |
4435 | | static void |
4436 | | dissect_transform(tvbuff_t *tvb, packet_info *pinfo, unsigned offset, unsigned length, proto_tree *tree, int isakmp_version, int protocol_id, void* decr_data) |
4437 | 739 | { |
4438 | 739 | if (isakmp_version == 1) |
4439 | 538 | { |
4440 | 538 | uint8_t transform_id; |
4441 | 538 | uint8_t transform_num; |
4442 | 538 | decrypt_data_t *decr = (decrypt_data_t *)decr_data; |
4443 | 538 | unsigned offset_end = 0; |
4444 | 538 | offset_end = offset + length; |
4445 | | |
4446 | 538 | transform_num = tvb_get_uint8(tvb, offset); |
4447 | 538 | proto_item_append_text(tree," # %d",transform_num); |
4448 | | |
4449 | 538 | proto_tree_add_item(tree, hf_isakmp_trans_number, tvb, offset, 1, ENC_BIG_ENDIAN); |
4450 | 538 | offset += 1; |
4451 | | |
4452 | 538 | transform_id = tvb_get_uint8(tvb, offset); |
4453 | 538 | switch (protocol_id) { |
4454 | 247 | case 1: /* ISAKMP */ |
4455 | 247 | proto_tree_add_uint_format_value(tree, hf_isakmp_trans_id, tvb, offset, 1, |
4456 | 247 | transform_id, "%s (%u)", |
4457 | 247 | val_to_str_const(transform_id, vs_v1_trans_isakmp, "UNKNOWN-TRANS-TYPE"), transform_id); |
4458 | 247 | break; |
4459 | 50 | case 2: /* AH */ |
4460 | 50 | proto_tree_add_uint_format_value(tree, hf_isakmp_trans_id, tvb, offset, 1, |
4461 | 50 | transform_id, "%s (%u)", |
4462 | 50 | val_to_str_const(transform_id, vs_v1_trans_ah, "UNKNOWN-AH-TRANS-TYPE"), transform_id); |
4463 | 50 | break; |
4464 | 100 | case 3: /* ESP */ |
4465 | 100 | proto_tree_add_uint_format_value(tree, hf_isakmp_trans_id, tvb, offset, 1, |
4466 | 100 | transform_id, "%s (%u)", |
4467 | 100 | val_to_str_const(transform_id, vs_v1_trans_esp, "UNKNOWN-ESP-TRANS-TYPE"), transform_id); |
4468 | 100 | break; |
4469 | 47 | case 4: /* IPCOMP */ |
4470 | 47 | proto_tree_add_uint_format_value(tree, hf_isakmp_trans_id, tvb, offset, 1, |
4471 | 47 | transform_id, "%s (%u)", |
4472 | 47 | val_to_str_const(transform_id, transform_id_ipcomp, "UNKNOWN-IPCOMP-TRANS-TYPE"), transform_id); |
4473 | 47 | break; |
4474 | 92 | default: |
4475 | 92 | proto_tree_add_item(tree, hf_isakmp_trans_id, tvb, offset, 1, ENC_BIG_ENDIAN); |
4476 | 92 | break; |
4477 | 538 | } |
4478 | 536 | offset += 1; |
4479 | | |
4480 | 536 | proto_tree_add_item(tree, hf_isakmp_reserved, tvb, offset, 2, ENC_NA); |
4481 | 536 | offset += 2; |
4482 | | |
4483 | 536 | if (protocol_id == 1 && transform_id == 1) { |
4484 | 87 | if (decr) { |
4485 | | /* Allow detection of missing IKE transform attributes: |
4486 | | * Make sure their values are not carried over from another transform |
4487 | | * dissected previously. */ |
4488 | 87 | decr->ike_encr_alg = 0; |
4489 | 87 | decr->ike_encr_keylen = 0; |
4490 | 87 | decr->ike_hash_alg = 0; |
4491 | 87 | } |
4492 | 620 | while (offset < offset_end) { |
4493 | 533 | offset += dissect_ike_attribute(tvb, pinfo, tree, offset, decr); |
4494 | 533 | } |
4495 | 87 | } |
4496 | 449 | else { |
4497 | 1.16k | while (offset < offset_end) { |
4498 | 714 | offset += dissect_ipsec_attribute(tvb, pinfo, tree, offset); |
4499 | 714 | } |
4500 | 449 | } |
4501 | 536 | } |
4502 | 201 | else if(isakmp_version == 2) |
4503 | 109 | { |
4504 | 109 | uint8_t transform_type; |
4505 | 109 | unsigned offset_end = 0; |
4506 | 109 | offset_end = offset + length; |
4507 | | |
4508 | 109 | transform_type = tvb_get_uint8(tvb, offset); |
4509 | 109 | proto_tree_add_item(tree, hf_isakmp_trans_type, tvb, offset, 1, ENC_BIG_ENDIAN); |
4510 | 109 | offset += 1; |
4511 | | |
4512 | 109 | proto_tree_add_item(tree, hf_isakmp_reserved, tvb, offset, 1, ENC_NA); |
4513 | 109 | offset += 1; |
4514 | | |
4515 | 109 | switch(transform_type){ |
4516 | 3 | case TF_IKE2_ENCR: |
4517 | 3 | proto_tree_add_item(tree, hf_isakmp_trans_encr, tvb, offset, 2, ENC_BIG_ENDIAN); |
4518 | 3 | break; |
4519 | 1 | case TF_IKE2_PRF: |
4520 | 1 | proto_tree_add_item(tree, hf_isakmp_trans_prf, tvb, offset, 2, ENC_BIG_ENDIAN); |
4521 | 1 | break; |
4522 | 1 | case TF_IKE2_INTEG: |
4523 | 1 | proto_tree_add_item(tree, hf_isakmp_trans_integ, tvb, offset, 2, ENC_BIG_ENDIAN); |
4524 | 1 | break; |
4525 | 4 | case TF_IKE2_KE: |
4526 | 4 | proto_tree_add_item(tree, hf_isakmp_trans_ke, tvb, offset, 2, ENC_BIG_ENDIAN); |
4527 | 4 | break; |
4528 | 24 | case TF_IKE2_SN: |
4529 | 24 | proto_tree_add_item(tree, hf_isakmp_trans_sn, tvb, offset, 2, ENC_BIG_ENDIAN); |
4530 | 24 | break; |
4531 | 1 | case TF_IKE2_KWA: |
4532 | 1 | proto_tree_add_item(tree, hf_isakmp_trans_kwa, tvb, offset, 2, ENC_BIG_ENDIAN); |
4533 | 1 | break; |
4534 | 0 | case TF_IKE2_GCAUTH: |
4535 | 0 | proto_tree_add_item(tree, hf_isakmp_trans_gcauth, tvb, offset, 2, ENC_BIG_ENDIAN); |
4536 | 0 | break; |
4537 | 75 | default: |
4538 | 75 | proto_tree_add_item(tree, hf_isakmp_trans_id_v2, tvb, offset, 2, ENC_BIG_ENDIAN); |
4539 | 75 | break; |
4540 | 109 | } |
4541 | 108 | offset += 2; |
4542 | | |
4543 | 255 | while (offset < offset_end) { |
4544 | 147 | offset += dissect_ike2_transform_attribute(tvb, pinfo, tree, offset); |
4545 | 147 | } |
4546 | 108 | } |
4547 | 739 | } |
4548 | | |
4549 | | static void |
4550 | | dissect_key_exch(tvbuff_t *tvb, unsigned offset, unsigned length, proto_tree *tree, int isakmp_version, |
4551 | | packet_info* pinfo, void* decr_data) |
4552 | 117 | { |
4553 | 117 | if (isakmp_version == 2) { |
4554 | 31 | proto_tree_add_item(tree, hf_isakmp_key_exch_method, tvb, offset, 2, ENC_BIG_ENDIAN); |
4555 | 31 | offset += 2; |
4556 | 31 | length -= 2; |
4557 | | |
4558 | 31 | proto_tree_add_item(tree, hf_isakmp_reserved, tvb, offset, 2, ENC_NA); |
4559 | 31 | offset += 2; |
4560 | 31 | length -= 2; |
4561 | 31 | } |
4562 | | |
4563 | 117 | proto_tree_add_item(tree, hf_isakmp_key_exch_data, tvb, offset, length, ENC_NA); |
4564 | | |
4565 | 117 | if (isakmp_version == 1 && decr_data) { |
4566 | 76 | decrypt_data_t *decr = (decrypt_data_t *)decr_data; |
4567 | | |
4568 | 76 | if (decr->gi_len == 0 && addresses_equal(&decr->initiator, &pinfo->src)) { |
4569 | 34 | decr->gi = (char *)g_malloc(length); |
4570 | 34 | tvb_memcpy(tvb, decr->gi, offset, length); |
4571 | 34 | decr->gi_len = length; |
4572 | 42 | } else if (decr->gr_len == 0 && !addresses_equal(&decr->initiator, &pinfo->src)) { |
4573 | 0 | decr->gr = (char *)g_malloc(length); |
4574 | 0 | tvb_memcpy(tvb, decr->gr, offset, length); |
4575 | 0 | decr->gr_len = length; |
4576 | 0 | } |
4577 | 76 | } |
4578 | 117 | } |
4579 | | |
4580 | | static void |
4581 | | dissect_id_type(tvbuff_t *tvb, unsigned offset, unsigned length, uint8_t id_type, proto_tree *idtree, proto_item *idit, packet_info *pinfo ) |
4582 | 336 | { |
4583 | 336 | const uint8_t *str; |
4584 | 336 | asn1_ctx_t asn1_ctx; |
4585 | 336 | asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true, pinfo); |
4586 | | |
4587 | 336 | switch (id_type) { |
4588 | 51 | case IKE_ID_IPV4_ADDR: |
4589 | 51 | proto_tree_add_item(idtree, hf_isakmp_id_data_ipv4_addr, tvb, offset, 4, ENC_BIG_ENDIAN); |
4590 | 51 | proto_item_append_text(idit, "%s", tvb_ip_to_str(pinfo->pool, tvb, offset)); |
4591 | 51 | break; |
4592 | 6 | case IKE_ID_FQDN: |
4593 | 6 | proto_tree_add_item_ret_string(idtree, hf_isakmp_id_data_fqdn, tvb, offset, length, ENC_ASCII|ENC_NA, pinfo->pool, &str); |
4594 | 6 | proto_item_append_text(idit, "%s", str); |
4595 | 6 | break; |
4596 | 5 | case IKE_ID_USER_FQDN: |
4597 | 5 | proto_tree_add_item_ret_string(idtree, hf_isakmp_id_data_user_fqdn, tvb, offset, length, ENC_ASCII|ENC_NA, pinfo->pool, &str); |
4598 | 5 | proto_item_append_text(idit, "%s", str); |
4599 | 5 | break; |
4600 | 11 | case IKE_ID_IPV4_ADDR_SUBNET: |
4601 | 11 | proto_tree_add_item(idtree, hf_isakmp_id_data_ipv4_addr, tvb, offset, 4, ENC_BIG_ENDIAN); |
4602 | 11 | proto_tree_add_item(idtree, hf_isakmp_id_data_ipv4_subnet, tvb, offset+4, 4, ENC_BIG_ENDIAN); |
4603 | 11 | proto_item_append_text(idit, "%s/%s", tvb_ip_to_str(pinfo->pool, tvb, offset), tvb_ip_to_str(pinfo->pool, tvb, offset+4)); |
4604 | 11 | break; |
4605 | 20 | case IKE_ID_IPV4_ADDR_RANGE: |
4606 | 20 | proto_tree_add_item(idtree, hf_isakmp_id_data_ipv4_range_start, tvb, offset, 4, ENC_BIG_ENDIAN); |
4607 | 20 | proto_tree_add_item(idtree, hf_isakmp_id_data_ipv4_range_end, tvb, offset+4, 4, ENC_BIG_ENDIAN); |
4608 | 20 | proto_item_append_text(idit, "%s/%s", tvb_ip_to_str(pinfo->pool, tvb, offset), tvb_ip_to_str(pinfo->pool, tvb, offset+4)); |
4609 | 20 | break; |
4610 | 134 | case IKE_ID_IPV6_ADDR: |
4611 | 134 | proto_tree_add_item(idtree, hf_isakmp_id_data_ipv6_addr, tvb, offset, 16, ENC_NA); |
4612 | 134 | proto_item_append_text(idit, "%s", tvb_ip6_to_str(pinfo->pool, tvb, offset)); |
4613 | 134 | break; |
4614 | 34 | case IKE_ID_IPV6_ADDR_SUBNET: |
4615 | 34 | proto_tree_add_item(idtree, hf_isakmp_id_data_ipv6_addr, tvb, offset, 16, ENC_NA); |
4616 | 34 | proto_tree_add_item(idtree, hf_isakmp_id_data_ipv6_subnet, tvb, offset+16, 16, ENC_NA); |
4617 | 34 | proto_item_append_text(idit, "%s/%s", tvb_ip6_to_str(pinfo->pool, tvb, offset), tvb_ip6_to_str(pinfo->pool, tvb, offset+16)); |
4618 | 34 | break; |
4619 | 25 | case IKE_ID_IPV6_ADDR_RANGE: |
4620 | 25 | proto_tree_add_item(idtree, hf_isakmp_id_data_ipv6_range_start, tvb, offset, 16, ENC_NA); |
4621 | 25 | proto_tree_add_item(idtree, hf_isakmp_id_data_ipv6_range_end, tvb, offset+16, 16, ENC_NA); |
4622 | 25 | proto_item_append_text(idit, "%s/%s", tvb_ip6_to_str(pinfo->pool, tvb, offset), tvb_ip6_to_str(pinfo->pool, tvb, offset+16)); |
4623 | 25 | break; |
4624 | 5 | case IKE_ID_KEY_ID: |
4625 | 5 | proto_tree_add_item(idtree, hf_isakmp_id_data_key_id, tvb, offset, length, ENC_NA); |
4626 | 5 | break; |
4627 | 11 | case IKE_ID_DER_ASN1_DN: |
4628 | 11 | dissect_x509if_Name(false, tvb, offset, &asn1_ctx, idtree, hf_isakmp_id_data_cert); |
4629 | 11 | break; |
4630 | 34 | default: |
4631 | 34 | proto_item_append_text(idit, "%s", tvb_bytes_to_str(pinfo->pool, tvb,offset,length)); |
4632 | 34 | break; |
4633 | 336 | } |
4634 | 336 | } |
4635 | | |
4636 | | static void |
4637 | | dissect_id(tvbuff_t *tvb, unsigned offset, unsigned length, proto_tree *tree, int isakmp_version, packet_info *pinfo ) |
4638 | 314 | { |
4639 | 314 | uint8_t id_type; |
4640 | 314 | uint8_t protocol_id; |
4641 | 314 | uint16_t port; |
4642 | 314 | proto_item *idit; |
4643 | 314 | proto_tree *idtree; |
4644 | | |
4645 | 314 | id_type = tvb_get_uint8(tvb, offset); |
4646 | 314 | if (isakmp_version == 1) |
4647 | 130 | { |
4648 | 130 | proto_tree_add_item(tree, hf_isakmp_id_type_v1, tvb, offset, 1, ENC_BIG_ENDIAN); |
4649 | 184 | }else if (isakmp_version == 2) |
4650 | 105 | { |
4651 | 105 | proto_tree_add_item(tree, hf_isakmp_id_type_v2, tvb, offset, 1, ENC_BIG_ENDIAN); |
4652 | 105 | } |
4653 | 314 | offset += 1; |
4654 | 314 | length -= 1; |
4655 | | |
4656 | 314 | if (isakmp_version == 1) { |
4657 | 130 | protocol_id = tvb_get_uint8(tvb, offset); |
4658 | 130 | if (protocol_id == 0) |
4659 | 91 | proto_tree_add_uint_format_value(tree, hf_isakmp_id_protoid, tvb, offset, 1, |
4660 | 91 | protocol_id, "Unused"); |
4661 | 39 | else |
4662 | 39 | proto_tree_add_item(tree, hf_isakmp_id_protoid, tvb, offset, 1, ENC_BIG_ENDIAN); |
4663 | | |
4664 | 130 | offset += 1; |
4665 | 130 | length -= 1; |
4666 | | |
4667 | 130 | port = tvb_get_ntohs(tvb, offset); |
4668 | 130 | if (port == 0) |
4669 | 33 | proto_tree_add_uint_format_value(tree, hf_isakmp_id_port, tvb, offset, 2, |
4670 | 33 | port, "Unused"); |
4671 | 97 | else |
4672 | 97 | proto_tree_add_item(tree, hf_isakmp_id_port, tvb, offset, 2, ENC_BIG_ENDIAN); |
4673 | | |
4674 | 130 | offset += 2; |
4675 | 130 | length -= 2; |
4676 | | |
4677 | 184 | } else if (isakmp_version == 2) { |
4678 | 105 | proto_tree_add_item(tree, hf_isakmp_reserved, tvb, offset, 3, ENC_NA); |
4679 | 105 | offset += 3; |
4680 | 105 | length -= 3; |
4681 | 105 | } |
4682 | | |
4683 | | /* |
4684 | | * It shows strings of all types though some of types are not |
4685 | | * supported in IKEv2 specification actually. |
4686 | | */ |
4687 | 314 | idit = proto_tree_add_item(tree, hf_isakmp_id_data, tvb, offset, length, ENC_NA); |
4688 | 314 | idtree = proto_item_add_subtree(idit, ett_isakmp_id); |
4689 | 314 | dissect_id_type(tvb, offset, length, id_type, idtree, idit, pinfo); |
4690 | 314 | } |
4691 | | |
4692 | | static void |
4693 | | dissect_cert(tvbuff_t *tvb, unsigned offset, unsigned length, proto_tree *tree, int isakmp_version, packet_info *pinfo ) |
4694 | 9.36k | { |
4695 | 9.36k | uint8_t cert_type; |
4696 | 9.36k | asn1_ctx_t asn1_ctx; |
4697 | 9.36k | asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true, pinfo); |
4698 | 9.36k | cert_type = tvb_get_uint8(tvb, offset); |
4699 | | |
4700 | 9.36k | if (isakmp_version == 1) |
4701 | 191 | { |
4702 | 191 | proto_tree_add_item(tree, hf_isakmp_cert_encoding_v1, tvb, offset, 1, ENC_BIG_ENDIAN); |
4703 | 9.17k | }else if (isakmp_version == 2) |
4704 | 9.14k | { |
4705 | 9.14k | proto_tree_add_item(tree, hf_isakmp_cert_encoding_v2, tvb, offset, 1, ENC_BIG_ENDIAN); |
4706 | 9.14k | } |
4707 | | |
4708 | 9.36k | offset += 1; |
4709 | 9.36k | length -= 1; |
4710 | | |
4711 | 9.36k | if (isakmp_version == 1) |
4712 | 191 | { |
4713 | 191 | dissect_x509af_Certificate(false, tvb, offset, &asn1_ctx, tree, hf_isakmp_cert_data); |
4714 | 9.17k | }else if (isakmp_version == 2) |
4715 | 9.14k | { |
4716 | 9.14k | switch(cert_type){ |
4717 | 3 | case 12:{ |
4718 | 3 | proto_item *ti_url; |
4719 | | |
4720 | 3 | proto_tree_add_item(tree, hf_isakmp_cert_x509_hash, tvb, offset, 20, ENC_NA); |
4721 | 3 | offset += 20; |
4722 | 3 | length -= 20; |
4723 | | |
4724 | 3 | ti_url = proto_tree_add_item(tree, hf_isakmp_cert_x509_url, tvb, offset, length, ENC_ASCII); |
4725 | 3 | proto_item_set_url(ti_url); |
4726 | 3 | } |
4727 | 3 | break; |
4728 | 9.14k | default: |
4729 | 9.14k | dissect_x509af_Certificate(false, tvb, offset, &asn1_ctx, tree, hf_isakmp_cert_data); |
4730 | 9.14k | break; |
4731 | 9.14k | } |
4732 | 9.14k | } |
4733 | | |
4734 | 9.36k | } |
4735 | | |
4736 | | static void |
4737 | | dissect_certreq(tvbuff_t *tvb, unsigned offset, unsigned length, proto_tree *tree, int isakmp_version, packet_info *pinfo ) |
4738 | 109 | { |
4739 | 109 | uint8_t cert_type; |
4740 | 109 | asn1_ctx_t asn1_ctx; |
4741 | 109 | asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, true, pinfo); |
4742 | 109 | cert_type = tvb_get_uint8(tvb, offset); |
4743 | | |
4744 | 109 | if (isakmp_version == 1) |
4745 | 62 | { |
4746 | 62 | proto_tree_add_item(tree, hf_isakmp_certreq_type_v1, tvb, offset, 1, ENC_BIG_ENDIAN); |
4747 | 62 | }else if (isakmp_version == 2) |
4748 | 23 | { |
4749 | 23 | proto_tree_add_item(tree, hf_isakmp_certreq_type_v2, tvb, offset, 1, ENC_BIG_ENDIAN); |
4750 | 23 | } |
4751 | | |
4752 | 109 | offset += 1; |
4753 | 109 | length -= 1; |
4754 | | |
4755 | 109 | if (isakmp_version == 1) |
4756 | 62 | { |
4757 | 62 | if (length == 0) |
4758 | 7 | return; |
4759 | | |
4760 | 55 | switch(cert_type){ |
4761 | 12 | case 4: |
4762 | 12 | dissect_x509if_Name(false, tvb, offset, &asn1_ctx, tree, hf_isakmp_certreq_authority_sig); |
4763 | 12 | break; |
4764 | 43 | default: |
4765 | 43 | proto_tree_add_item(tree, hf_isakmp_certreq_authority_v1, tvb, offset, length, ENC_NA); |
4766 | 43 | break; |
4767 | 55 | } |
4768 | 55 | }else if (isakmp_version == 2) |
4769 | 23 | { |
4770 | | /* this is a list of 20 byte SHA-1 hashes */ |
4771 | 44 | while (length >= 20) { |
4772 | 21 | proto_tree_add_item(tree, hf_isakmp_certreq_authority_v2, tvb, offset, 20, ENC_NA); |
4773 | 21 | offset+=20; |
4774 | 21 | length-=20; |
4775 | 21 | } |
4776 | 23 | } |
4777 | 109 | } |
4778 | | |
4779 | | static void |
4780 | | dissect_auth(tvbuff_t *tvb, packet_info *pinfo, unsigned offset, unsigned length, proto_tree *tree) |
4781 | 278 | { |
4782 | 278 | uint32_t auth_meth; |
4783 | 278 | uint32_t asn1_len; |
4784 | 278 | proto_item * ti; |
4785 | 278 | proto_tree * subtree; |
4786 | 278 | proto_tree * asn1tree; |
4787 | | |
4788 | 278 | proto_tree_add_item_ret_uint(tree, hf_isakmp_auth_meth, tvb, offset, 1, ENC_BIG_ENDIAN, &auth_meth); |
4789 | 278 | offset += 1; |
4790 | 278 | length -= 1; |
4791 | | |
4792 | 278 | proto_tree_add_item(tree, hf_isakmp_reserved, tvb, offset, 3, ENC_NA); |
4793 | 278 | offset += 3; |
4794 | 278 | length -= 3; |
4795 | | |
4796 | 278 | ti = proto_tree_add_item(tree, hf_isakmp_auth_data, tvb, offset, length, ENC_NA); |
4797 | | |
4798 | 278 | if (auth_meth == AUTH_METH_DIGITAL_SIGNATURE) { |
4799 | 270 | subtree = proto_item_add_subtree(ti, ett_isakmp_payload_digital_signature); |
4800 | | |
4801 | 270 | proto_tree_add_item_ret_uint(subtree, hf_isakmp_auth_digital_sig_asn1_len, tvb, offset, 1, ENC_BIG_ENDIAN, &asn1_len); |
4802 | 270 | offset += 1; |
4803 | 270 | length -= 1; |
4804 | | |
4805 | | /* cast ok, since length was parsed out of one unsigned byte into uint32_t */ |
4806 | 270 | if ( (asn1_len > 0) && (asn1_len < length) ) { |
4807 | | |
4808 | 259 | ti = proto_tree_add_item(subtree, hf_isakmp_auth_digital_sig_asn1_data, tvb, offset, asn1_len, ENC_NA); |
4809 | 259 | asn1tree = proto_item_add_subtree(ti, ett_isakmp_payload_digital_signature_asn1_data); |
4810 | 259 | dissect_unknown_ber(pinfo, tvb, offset, asn1tree); |
4811 | | |
4812 | 259 | offset += asn1_len; |
4813 | 259 | length -= asn1_len; |
4814 | | |
4815 | 259 | proto_tree_add_item(subtree, hf_isakmp_auth_digital_sig_value, tvb, offset, length, ENC_NA); |
4816 | 259 | } |
4817 | 270 | } |
4818 | 278 | } |
4819 | | |
4820 | | static void |
4821 | | dissect_hash(tvbuff_t *tvb, unsigned offset, unsigned length, proto_tree *ntree) |
4822 | 113 | { |
4823 | 113 | proto_tree_add_item(ntree, hf_isakmp_hash, tvb, offset, length, ENC_NA); |
4824 | 113 | } |
4825 | | |
4826 | | static void |
4827 | | dissect_sig(tvbuff_t *tvb, unsigned offset, unsigned length, proto_tree *ntree) |
4828 | 70 | { |
4829 | 70 | proto_tree_add_item(ntree, hf_isakmp_sig, tvb, offset, length, ENC_NA); |
4830 | 70 | } |
4831 | | |
4832 | | static void |
4833 | | dissect_nonce(tvbuff_t *tvb, unsigned offset, unsigned length, proto_tree *ntree) |
4834 | 223 | { |
4835 | 223 | proto_tree_add_item(ntree, hf_isakmp_nonce, tvb, offset, length, ENC_NA); |
4836 | 223 | } |
4837 | | |
4838 | | static void dissect_symmetric_key(tvbuff_t *tvb, unsigned offset, unsigned length, proto_tree *ntree) |
4839 | 37 | { |
4840 | 37 | proto_tree_add_item(ntree, hf_isakmp_symmetric_key, tvb, offset, length, ENC_NA); |
4841 | 37 | } |
4842 | | |
4843 | | static void |
4844 | | // NOLINTNEXTLINE(misc-no-recursion) |
4845 | | dissect_cisco_fragmentation(tvbuff_t *tvb, unsigned offset, unsigned length, proto_tree *tree, packet_info *pinfo) |
4846 | 82 | { |
4847 | 82 | uint8_t seq; /* Packet sequence number, starting from 1 */ |
4848 | 82 | uint8_t last; |
4849 | 82 | proto_tree *ptree; |
4850 | 82 | ptree = proto_tree_get_parent(tree); |
4851 | 82 | if (length < 4) |
4852 | 6 | return; |
4853 | | |
4854 | 76 | proto_tree_add_item(tree, hf_isakmp_cisco_frag_packetid, tvb, offset, 2, ENC_BIG_ENDIAN); |
4855 | 76 | offset += 2; |
4856 | 76 | proto_tree_add_item_ret_uint8(tree, hf_isakmp_cisco_frag_seq, tvb, offset, 1, ENC_BIG_ENDIAN, &seq); |
4857 | 76 | offset += 1; |
4858 | 76 | proto_tree_add_item_ret_uint8(tree, hf_isakmp_cisco_frag_last, tvb, offset, 1, ENC_BIG_ENDIAN, &last); |
4859 | 76 | offset += 1; |
4860 | | /*length-=4;*/ |
4861 | | |
4862 | | /* Start Reassembly stuff for Cisco IKE fragmentation */ |
4863 | 76 | { |
4864 | 76 | bool save_fragmented; |
4865 | 76 | tvbuff_t *defrag_isakmp_tvb; |
4866 | 76 | fragment_head *frag_msg; |
4867 | | |
4868 | 76 | save_fragmented = pinfo->fragmented; |
4869 | 76 | pinfo->fragmented = true; |
4870 | 76 | frag_msg = fragment_add_seq_check(&isakmp_cisco_reassembly_table, tvb, offset, |
4871 | 76 | pinfo, |
4872 | 76 | 12345, /*FIXME: Fragmented packet id, uint16_t, somehow get CKY here */ |
4873 | 76 | NULL, |
4874 | 76 | seq-1, /* fragment sequence number, starting from 0 */ |
4875 | 76 | tvb_reported_length_remaining(tvb, offset), /* fragment length - to the end */ |
4876 | 76 | !last); /* More fragments? */ |
4877 | 76 | defrag_isakmp_tvb = process_reassembled_data(tvb, offset, pinfo, |
4878 | 76 | "Reassembled Cisco IKE", frag_msg, |
4879 | 76 | &isakmp_frag_items, /* groups and items, using same as Cisco */ |
4880 | 76 | NULL, ptree); |
4881 | | |
4882 | 76 | if (last && defrag_isakmp_tvb) { /* take it all */ |
4883 | 0 | dissect_isakmp(defrag_isakmp_tvb, pinfo, ptree, NULL); |
4884 | 0 | } |
4885 | 76 | col_append_fstr(pinfo->cinfo, COL_INFO, |
4886 | 76 | " (%sMessage fragment %u%s)", |
4887 | 76 | (last && frag_msg ? "Reassembled + " : ""), |
4888 | 76 | seq, (last ? " - last" : "")); |
4889 | 76 | pinfo->fragmented = save_fragmented; |
4890 | 76 | } |
4891 | | /* End Reassembly stuff for Cisco IKE fragmentation */ |
4892 | | |
4893 | 76 | } |
4894 | | |
4895 | | /* This is RFC7383 reassembly. */ |
4896 | | static void |
4897 | | // NOLINTNEXTLINE(misc-no-recursion) |
4898 | | dissect_ikev2_fragmentation(tvbuff_t *tvb, unsigned offset, proto_tree *tree, |
4899 | | packet_info *pinfo, unsigned message_id, uint8_t next_payload, bool is_request, void* decr_info) |
4900 | 172 | { |
4901 | 172 | uint16_t fragment_number, total_fragments; |
4902 | 172 | bool message_next_payload_set = false; |
4903 | 172 | uint8_t message_next_payload = 0; |
4904 | 172 | int iv_len, icd_len; |
4905 | 172 | int iv_offset; |
4906 | 172 | int icd_offset; |
4907 | 172 | ikev2_decrypt_data_t *key_info; |
4908 | | |
4909 | | /* Fragment Number */ |
4910 | 172 | fragment_number = tvb_get_ntohs(tvb, offset); |
4911 | 172 | total_fragments = tvb_get_ntohs(tvb, offset+2); |
4912 | 172 | proto_tree_add_item(tree, hf_isakmp_ike2_fragment_number, tvb, offset, 2, ENC_BIG_ENDIAN); |
4913 | 172 | offset += 2; |
4914 | 172 | if (fragment_number == 0) { |
4915 | 42 | proto_tree_add_expert_format(tree, pinfo, &ei_isakmp_bad_fragment_number, tvb, 0, 0, |
4916 | 42 | "Fragment number must not be zero"); |
4917 | 42 | } |
4918 | 130 | else if (fragment_number > total_fragments) { |
4919 | 80 | proto_tree_add_expert_format(tree, pinfo, &ei_isakmp_bad_fragment_number, tvb, 0, 0, |
4920 | 80 | "Fragment number (%u) must not be greater than total fragments (%u)", |
4921 | 80 | fragment_number, total_fragments); |
4922 | 80 | } |
4923 | | |
4924 | | /* During the first pass, store in the conversation the next_payload */ |
4925 | 172 | if (!pinfo->fd->visited && (fragment_number == 1)) { |
4926 | | /* Create/update conversation with message_id -> next_payload */ |
4927 | 33 | conversation_t* p_conv = find_or_create_conversation(pinfo); |
4928 | 33 | ikev2_fragmentation_state_t *p_state = wmem_new0(wmem_file_scope(), ikev2_fragmentation_state_t); |
4929 | 33 | p_state->message_id = message_id; |
4930 | 33 | p_state->next_payload = next_payload; |
4931 | | |
4932 | | /* Store the state with the conversation */ |
4933 | 33 | conversation_add_proto_data(p_conv, proto_isakmp, (void*)p_state); |
4934 | 33 | } |
4935 | | |
4936 | | /* Total fragments */ |
4937 | 172 | proto_tree_add_item(tree, hf_isakmp_ike2_total_fragments, tvb, offset, 2, ENC_BIG_ENDIAN); |
4938 | 172 | if (total_fragments == 0) { |
4939 | 42 | proto_tree_add_expert_format(tree, pinfo, &ei_isakmp_bad_fragment_number, tvb, 0, 0, |
4940 | 42 | "Total fragments must not be zero"); |
4941 | 42 | } |
4942 | | |
4943 | | /* Show fragment summary in Info column */ |
4944 | 172 | col_append_fstr(pinfo->cinfo, COL_INFO, " (fragment %u/%u)", fragment_number, total_fragments); |
4945 | | |
4946 | 172 | offset += 2; |
4947 | | |
4948 | | /* If this is the last fragment, need to know what the payload type for the reassembled message is, |
4949 | | which was included in the first fragment */ |
4950 | 172 | if (fragment_number == total_fragments) { |
4951 | 44 | if (!pinfo->fd->visited) { |
4952 | | /* On first pass, get it from the conversation info */ |
4953 | 44 | conversation_t *p_conv = find_conversation_pinfo(pinfo, 0); |
4954 | 44 | if (p_conv != NULL) { |
4955 | 44 | ikev2_fragmentation_state_t *p_state = (ikev2_fragmentation_state_t*)conversation_get_proto_data(p_conv, proto_isakmp); |
4956 | 44 | if (p_state != NULL) { |
4957 | 32 | if (p_state->message_id == message_id) { |
4958 | 15 | message_next_payload = p_state->next_payload; |
4959 | 15 | message_next_payload_set = true; |
4960 | | |
4961 | | /* Store in table for this frame for future passes */ |
4962 | 15 | g_hash_table_insert(defrag_next_payload_hash, GUINT_TO_POINTER(pinfo->num), GUINT_TO_POINTER((unsigned)message_next_payload)); |
4963 | 15 | } |
4964 | 32 | } |
4965 | 44 | } |
4966 | 44 | } |
4967 | 0 | else { |
4968 | | /* On later passes, look up in hash table by frame number */ |
4969 | 0 | message_next_payload = (uint8_t)GPOINTER_TO_UINT(g_hash_table_lookup(defrag_next_payload_hash, GUINT_TO_POINTER(pinfo->num))); |
4970 | 0 | if (message_next_payload != 0) { |
4971 | 0 | message_next_payload_set = true; |
4972 | 0 | } |
4973 | 0 | } |
4974 | 44 | } |
4975 | | |
4976 | | /* Can only know lengths of following fields if we have the key information */ |
4977 | 172 | if (decr_info) { |
4978 | 0 | key_info = (ikev2_decrypt_data_t*)(decr_info); |
4979 | 0 | iv_len = key_info->encr_spec->iv_len; |
4980 | 0 | icd_len = key_info->auth_spec->trunc_len; |
4981 | 0 | } |
4982 | 172 | else { |
4983 | | /* Can't show any more info. */ |
4984 | 172 | return; |
4985 | 172 | } |
4986 | | |
4987 | | /* Initialization Vector */ |
4988 | 0 | iv_offset = offset; |
4989 | 0 | proto_tree_add_item(tree, hf_isakmp_enc_iv, tvb, offset, iv_len, ENC_NA); |
4990 | 0 | offset += iv_len; |
4991 | |
|
4992 | 0 | icd_offset = offset + tvb_reported_length_remaining(tvb, offset) - icd_len; |
4993 | | |
4994 | | /* Encryption data */ |
4995 | 0 | proto_tree_add_item(tree, hf_isakmp_enc_data, tvb, offset, icd_offset-offset, ENC_NA); |
4996 | | |
4997 | | /* Can only check how much padding there is after decrypting... */ |
4998 | | |
4999 | | /* Start Reassembly stuff for IKE2 fragmentation */ |
5000 | 0 | { |
5001 | 0 | bool save_fragmented; |
5002 | 0 | tvbuff_t *defrag_decrypted_isakmp_tvb; |
5003 | 0 | tvbuff_t *isakmp_decrypted_fragment_tvb; |
5004 | 0 | fragment_head *frag_msg; |
5005 | 0 | uint8_t padding_length; |
5006 | 0 | uint16_t fragment_length; |
5007 | | |
5008 | | /* Decrypt but don't dissect this encrypted payload. */ |
5009 | 0 | isakmp_decrypted_fragment_tvb = dissect_enc(tvb, iv_offset, tvb_reported_length_remaining(tvb, iv_offset), tree, pinfo, |
5010 | 0 | 0, /* Payload type won't be used in this call, and may not know yet */ |
5011 | 0 | is_request, |
5012 | 0 | decr_info, |
5013 | | false /* Don't dissect decrypted tvb as not a completed payload */ |
5014 | 0 | ); |
5015 | | |
5016 | | /* Save pinfo->fragmented, will later restore it */ |
5017 | 0 | save_fragmented = pinfo->fragmented; |
5018 | 0 | pinfo->fragmented = true; |
5019 | | |
5020 | | /* Remove padding length + any padding bytes from reassembled payload */ |
5021 | 0 | padding_length = tvb_get_uint8(isakmp_decrypted_fragment_tvb, tvb_reported_length(isakmp_decrypted_fragment_tvb)-1); |
5022 | 0 | fragment_length = tvb_reported_length(isakmp_decrypted_fragment_tvb) - 1 - padding_length; |
5023 | | |
5024 | | /* Adding decrypted tvb into reassembly table here */ |
5025 | 0 | frag_msg = fragment_add_seq_check(&isakmp_ike2_reassembly_table, |
5026 | 0 | isakmp_decrypted_fragment_tvb, |
5027 | 0 | 0, /* offset */ |
5028 | 0 | pinfo, |
5029 | 0 | message_id, /* message_id from top-level header */ |
5030 | 0 | NULL, /* data? */ |
5031 | 0 | fragment_number-1, /* fragment sequence number, starting from 0 */ |
5032 | 0 | fragment_length, /* fragment - (padding_length + padding) */ |
5033 | 0 | fragment_number < total_fragments); /* More fragments? */ |
5034 | |
|
5035 | 0 | defrag_decrypted_isakmp_tvb = process_reassembled_data(tvb, offset, pinfo, |
5036 | 0 | "Reassembled IKE2", |
5037 | 0 | frag_msg, |
5038 | 0 | &isakmp_frag_items, /* Tree IDs & items - using same ones as Cisco. */ |
5039 | 0 | NULL, tree); |
5040 | |
|
5041 | 0 | if (defrag_decrypted_isakmp_tvb && key_info && message_next_payload_set) { |
5042 | | /* Completely reassembled - already decrypted - dissect reassembled payload if know next payload type */ |
5043 | 0 | col_append_str(pinfo->cinfo, COL_INFO, " (reassembled)"); |
5044 | 0 | dissect_payloads(defrag_decrypted_isakmp_tvb, tree, |
5045 | 0 | 2, /* Could store with next_payload, but wouldn't be here otherwise.. */ |
5046 | 0 | message_next_payload, |
5047 | 0 | 0, tvb_reported_length(defrag_decrypted_isakmp_tvb), |
5048 | 0 | pinfo, message_id, is_request, decr_info); |
5049 | 0 | } |
5050 | | /* Restore this flag */ |
5051 | 0 | pinfo->fragmented = save_fragmented; |
5052 | 0 | } |
5053 | | /* End Reassembly stuff for IKE2 fragmentation */ |
5054 | 0 | } |
5055 | | |
5056 | | static void |
5057 | | dissect_notif(tvbuff_t *tvb, packet_info *pinfo, unsigned offset, unsigned length, proto_tree *tree, int isakmp_version) |
5058 | 445 | { |
5059 | 445 | uint32_t doi = 0; |
5060 | 445 | uint8_t protocol_id; |
5061 | 445 | uint8_t spi_size; |
5062 | 445 | uint16_t msgtype; |
5063 | 445 | proto_item *data_item; |
5064 | 445 | proto_tree *data_tree; |
5065 | 445 | unsigned offset_end = 0; |
5066 | 445 | offset_end = offset + length; |
5067 | | |
5068 | 445 | if (isakmp_version == 1) { |
5069 | 115 | proto_tree_add_item_ret_uint(tree, hf_isakmp_notify_doi, tvb, offset, 4, ENC_BIG_ENDIAN, &doi); |
5070 | 115 | offset += 4; |
5071 | 115 | length -= 4; |
5072 | 115 | } |
5073 | | |
5074 | 445 | protocol_id = tvb_get_uint8(tvb, offset); |
5075 | 445 | if (isakmp_version == 1) |
5076 | 115 | { |
5077 | 115 | proto_tree_add_item(tree, hf_isakmp_notify_protoid_v1, tvb, offset, 1, ENC_BIG_ENDIAN); |
5078 | 330 | }else if (isakmp_version == 2) |
5079 | 319 | { |
5080 | 319 | proto_tree_add_item(tree, hf_isakmp_notify_protoid_v2, tvb, offset, 1, ENC_BIG_ENDIAN); |
5081 | 319 | } |
5082 | 445 | offset += 1; |
5083 | 445 | length -= 1; |
5084 | | |
5085 | 445 | spi_size = tvb_get_uint8(tvb, offset); |
5086 | 445 | proto_tree_add_item(tree, hf_isakmp_spisize, tvb, offset, 1, ENC_BIG_ENDIAN); |
5087 | 445 | offset += 1; |
5088 | 445 | length -= 1; |
5089 | | |
5090 | 445 | msgtype = tvb_get_ntohs(tvb, offset); |
5091 | | |
5092 | 445 | if (isakmp_version == 1) |
5093 | 115 | { |
5094 | 115 | proto_tree_add_item(tree, hf_isakmp_notify_msgtype_v1, tvb, offset, 2, ENC_BIG_ENDIAN); |
5095 | 330 | }else if (isakmp_version == 2) |
5096 | 319 | { |
5097 | 319 | if ((msgtype < 8192) || (msgtype > 16383 && msgtype < 40959 )) { |
5098 | | /* Standard error and status types */ |
5099 | 150 | proto_tree_add_uint_format_value(tree, hf_isakmp_notify_msgtype_v2, tvb, offset, 2, msgtype, "%s (%u)", |
5100 | 150 | rval_to_str_const(msgtype, notifmsg_v2_type, "Unknown"), msgtype); |
5101 | 150 | proto_item_append_text(tree, " - %s", |
5102 | 150 | rval_to_str_const(msgtype, |
5103 | 150 | notifmsg_v2_type, |
5104 | 150 | "Unknown")); |
5105 | 169 | } else { |
5106 | | /* Private error and status types */ |
5107 | 169 | proto_tree_add_uint_format_value(tree, hf_isakmp_notify_msgtype_v2, tvb, offset, 2, msgtype, "%s (%u)", |
5108 | 169 | rval_to_str_const(msgtype, notifmsg_v2_3gpp_type, "Unknown"), msgtype); |
5109 | 169 | proto_item_append_text(tree, " - %s", |
5110 | 169 | rval_to_str_const(msgtype, |
5111 | 169 | notifmsg_v2_3gpp_type, |
5112 | 169 | "Unknown")); |
5113 | 169 | } |
5114 | 319 | } |
5115 | 445 | offset += 2; |
5116 | 445 | length -= 2; |
5117 | | |
5118 | 445 | if (spi_size) { |
5119 | 375 | proto_tree_add_item(tree, hf_isakmp_spi, tvb, offset, spi_size, ENC_NA); |
5120 | 375 | offset += spi_size; |
5121 | 375 | length -= spi_size; |
5122 | 375 | } |
5123 | | |
5124 | | /* Notification Data */ |
5125 | | |
5126 | 445 | data_item = proto_tree_add_item(tree, hf_isakmp_notify_data, tvb, offset, length, ENC_NA); |
5127 | 445 | data_tree = proto_item_add_subtree(data_item, ett_isakmp_notify_data); |
5128 | | |
5129 | 445 | if (isakmp_version == 1) |
5130 | 115 | { |
5131 | 115 | switch (msgtype) { |
5132 | 86 | case 24576: /* RESPONDER LIFETIME */ |
5133 | 86 | if (protocol_id == 1) { |
5134 | | /* Phase 1 */ |
5135 | 133 | while (offset < offset_end) { |
5136 | 115 | offset += dissect_resp_lifetime_ike_attribute(tvb, pinfo, data_tree, offset); |
5137 | 115 | } |
5138 | 68 | } else if (protocol_id > 1 && doi == 1) { |
5139 | | /* Phase 2, IPsec DOI */ |
5140 | 193 | while (offset < offset_end) { |
5141 | 166 | offset += dissect_resp_lifetime_ipsec_attribute(tvb, pinfo, data_tree, offset); |
5142 | 166 | } |
5143 | 27 | } |
5144 | 86 | break; |
5145 | 0 | case 36136: /* DPD ARE YOU THERE */ |
5146 | 0 | proto_tree_add_item(tree, hf_isakmp_notify_data_dpd_are_you_there, tvb, offset, length, ENC_BIG_ENDIAN); |
5147 | 0 | break; |
5148 | 0 | case 36137: /* DPD ARE YOU THERE ACK */ |
5149 | 0 | proto_tree_add_item(tree, hf_isakmp_notify_data_dpd_are_you_there_ack, tvb, offset, length, ENC_BIG_ENDIAN); |
5150 | 0 | break; |
5151 | 0 | case 40501: /* UNITY Load Balance */ |
5152 | 0 | proto_tree_add_item(tree, hf_isakmp_notify_data_unity_load_balance, tvb, offset, length, ENC_BIG_ENDIAN); |
5153 | 0 | break; |
5154 | 29 | default: |
5155 | | /* No Default Action */ |
5156 | 29 | break; |
5157 | 115 | } |
5158 | | |
5159 | 330 | } else if (isakmp_version == 2) |
5160 | 311 | { |
5161 | 311 | switch(msgtype){ |
5162 | 5 | case 17: /* INVALID_KE_PAYLOAD */ |
5163 | 5 | proto_tree_add_item(tree, hf_isakmp_notify_data_accepted_ke_method, tvb, offset, 2, ENC_BIG_ENDIAN); |
5164 | 5 | break; |
5165 | 1 | case 16387: /* IPCOMP_SUPPORTED */ |
5166 | 1 | proto_tree_add_item(tree, hf_isakmp_notify_data_ipcomp_cpi, tvb, offset, 2, ENC_BIG_ENDIAN); |
5167 | 1 | proto_tree_add_item(tree, hf_isakmp_notify_data_ipcomp_transform_id, tvb, offset+2, 1, ENC_BIG_ENDIAN); |
5168 | 1 | break; |
5169 | 15 | case 16388: /* NAT_DETECTION_SOURCE_IP */ |
5170 | 15 | { |
5171 | | /* Calculate SHA1 following https://datatracker.ietf.org/doc/html/rfc7296#section-2.23 */ |
5172 | | |
5173 | | /* Validate length of notification data is 20 bytes for SHA1 hash. If not, mark the item as malformed */ |
5174 | 15 | if (length != 20) { |
5175 | 12 | proto_item_append_text(data_item, " [malformed: notify_data length %u]", length); |
5176 | 12 | break; |
5177 | 12 | } |
5178 | | |
5179 | | /* The SHA1 hash is calculated over the concatenation of the initiator SPI, responder SPI, source IP address and source port. */ |
5180 | | /* Buffer size derived from components: 2 SPIs (8 bytes each), max IP (16 bytes), and port (2 bytes). */ |
5181 | 3 | unsigned char buf[2 * sizeof(uint64_t) + 16 + sizeof(uint16_t)]; |
5182 | 3 | uint8_t offset_buf = 0; |
5183 | | |
5184 | | /* Get source port */ |
5185 | | /* Convert pinfo->srcport to uint16_t and to little endian */ |
5186 | 3 | uint16_t src_port = g_htons((uint16_t)pinfo->srcport); |
5187 | | |
5188 | | /* Add initiator SPI */ |
5189 | 3 | tvb_memcpy(tvb, buf + offset_buf, 0, sizeof(uint64_t)); |
5190 | 3 | offset_buf += 8; |
5191 | | |
5192 | | /* Add responder SPI */ |
5193 | 3 | tvb_memcpy(tvb, buf + offset_buf, sizeof(uint64_t), sizeof(uint64_t)); |
5194 | 3 | offset_buf += 8; |
5195 | | |
5196 | | /* Add source IP address */ |
5197 | 3 | memcpy(buf + offset_buf, pinfo->src.data, pinfo->src.len); |
5198 | 3 | offset_buf += pinfo->src.len; |
5199 | | |
5200 | | /* Add source port */ |
5201 | 3 | memcpy(buf + offset_buf, &src_port, sizeof(uint16_t)); |
5202 | 3 | offset_buf += 2; |
5203 | | |
5204 | | /* SHA1 hash of the concatenated fields. */ |
5205 | 3 | unsigned char sha1_buf[HASH_SHA1_LENGTH] = {0}; |
5206 | 3 | gcry_md_hash_buffer(GCRY_MD_SHA1, sha1_buf, buf, offset_buf); |
5207 | | |
5208 | | /* Notification_data in tvb*/ |
5209 | | /* If values are the same, then NAT was not detected. */ |
5210 | 3 | if (tvb_memeql(tvb, offset, sha1_buf, sizeof(sha1_buf)) == 0) { |
5211 | 1 | proto_item_append_text(data_item, " [correct, NAT was not detected]"); |
5212 | 2 | } else { |
5213 | | /* NAT was detected, show calculated value in hex for easier troubleshooting. */ |
5214 | 2 | char sha1_str[sizeof(sha1_buf) * 2 + 1]; |
5215 | 2 | bytes_to_hexstr(sha1_str, sha1_buf, sizeof(sha1_buf)); |
5216 | 2 | sha1_str[sizeof(sha1_buf) * 2] = '\0'; /* NULL terminate */ |
5217 | 2 | proto_item_append_text(data_item, " [not expected value, NAT detected, value should be %s]", sha1_str); |
5218 | 2 | expert_add_info(pinfo, data_item, &ei_isakmp_notify_data_nat_payload_sha1_mismatch); |
5219 | 2 | } |
5220 | 3 | break; |
5221 | 15 | } |
5222 | 15 | case 16389: /* NAT_DETECTION_DESTINATION_IP */ |
5223 | 15 | { |
5224 | | /* Calculate SHA1 following https://datatracker.ietf.org/doc/html/rfc7296#section-2.23 */ |
5225 | | |
5226 | | /* Validate length of notification data is 20 bytes for SHA1 hash. If not, mark the item as malformed */ |
5227 | 15 | if (length != 20) { |
5228 | 7 | proto_item_append_text(data_item, " [malformed: notify_data length %u]", length); |
5229 | 7 | break; |
5230 | 7 | } |
5231 | | |
5232 | | /* The SHA1 hash is calculated over the concatenation of the initiator SPI, responder SPI, destination IP address and destination port. */ |
5233 | | /* Buffer size derived from components: 2 SPIs (8 bytes each), max IP (16 bytes), and port (2 bytes). */ |
5234 | 8 | unsigned char buf[2 * sizeof(uint64_t) + 16 + sizeof(uint16_t)]; |
5235 | 8 | uint8_t offset_buf = 0; |
5236 | | |
5237 | | /* Get destination port */ |
5238 | | /* Convert pinfo->dstport to uint16_t and to little endian */ |
5239 | 8 | uint16_t dst_port = g_htons((uint16_t)pinfo->destport); |
5240 | | |
5241 | | /* Add initiator SPI */ |
5242 | 8 | tvb_memcpy(tvb, buf + offset_buf, 0, sizeof(uint64_t)); |
5243 | 8 | offset_buf += 8; |
5244 | | |
5245 | | /* Add responder SPI */ |
5246 | 8 | tvb_memcpy(tvb, buf + offset_buf, sizeof(uint64_t), sizeof(uint64_t)); |
5247 | 8 | offset_buf += 8; |
5248 | | |
5249 | | /* Add destination IP address */ |
5250 | 8 | memcpy(buf + offset_buf, pinfo->dst.data, pinfo->dst.len); |
5251 | 8 | offset_buf += pinfo->dst.len; |
5252 | | |
5253 | | /* Add destination port */ |
5254 | 8 | memcpy(buf + offset_buf, &dst_port, sizeof(uint16_t)); |
5255 | 8 | offset_buf += 2; |
5256 | | |
5257 | | /* SHA1 hash of the concatenated fields. */ |
5258 | 8 | unsigned char sha1_buf[HASH_SHA1_LENGTH] = {0}; |
5259 | 8 | gcry_md_hash_buffer(GCRY_MD_SHA1, sha1_buf, buf, offset_buf); |
5260 | | |
5261 | | /* Notification_data in tvb*/ |
5262 | | /* If values are the same, then NAT was not detected. */ |
5263 | 8 | if (tvb_memeql(tvb, offset, sha1_buf, sizeof(sha1_buf)) == 0) { |
5264 | 1 | proto_item_append_text(data_item, " [correct, NAT was not detected]"); |
5265 | 7 | } else { |
5266 | | /* NAT was detected, show calculated value in hex for easier troubleshooting. */ |
5267 | 7 | char sha1_str[sizeof(sha1_buf) * 2 + 1]; |
5268 | 7 | bytes_to_hexstr(sha1_str, sha1_buf, sizeof(sha1_buf)); |
5269 | 7 | sha1_str[sizeof(sha1_buf) * 2] = '\0'; /* NULL terminate */ |
5270 | 7 | proto_item_append_text(data_item, " [not expected value, NAT detected, value should be %s]", sha1_str); |
5271 | 7 | expert_add_info(pinfo, data_item, &ei_isakmp_notify_data_nat_payload_sha1_mismatch); |
5272 | 7 | } |
5273 | 8 | break; |
5274 | 15 | } |
5275 | 6 | case 16403: /* AUTH_LIFETIME" */ |
5276 | 6 | { |
5277 | 6 | uint32_t hours; |
5278 | 6 | uint32_t minutes; |
5279 | 6 | uint32_t seconds; |
5280 | 6 | uint32_t durations_seconds; |
5281 | | |
5282 | 6 | durations_seconds = tvb_get_uint32(tvb, offset, ENC_BIG_ENDIAN); |
5283 | | |
5284 | 6 | hours = durations_seconds / 3600; |
5285 | 6 | minutes = (durations_seconds % 3600) / 60; |
5286 | 6 | seconds = (durations_seconds % 3600) % 60; |
5287 | | |
5288 | 6 | proto_tree_add_uint_format_value(tree, hf_isakmp_notify_data_auth_lifetime, tvb, offset, length, durations_seconds, |
5289 | 6 | "%u seconds (%u hour(s) %02u minute(s) %02u second(s))", durations_seconds, hours, minutes, seconds); |
5290 | 6 | break; |
5291 | 15 | } |
5292 | 25 | case 16407: /* REDIRECT */ |
5293 | 25 | proto_tree_add_item(tree, hf_isakmp_notify_data_redirect_gw_ident_type, tvb, offset, 1, ENC_BIG_ENDIAN); |
5294 | 25 | proto_tree_add_item(tree, hf_isakmp_notify_data_redirect_gw_ident_len, tvb, offset+1, 1, ENC_BIG_ENDIAN); |
5295 | 25 | switch(tvb_get_uint8(tvb, offset)){ /* Ident Type ? */ |
5296 | 2 | case 1: |
5297 | 2 | proto_tree_add_item(tree, hf_isakmp_notify_data_redirect_new_resp_gw_ident_ipv4, tvb, offset+2, 4, ENC_BIG_ENDIAN); |
5298 | 2 | break; |
5299 | 11 | case 2: |
5300 | 11 | proto_tree_add_item(tree, hf_isakmp_notify_data_redirect_new_resp_gw_ident_ipv6, tvb, offset+2, 16, ENC_NA); |
5301 | 11 | break; |
5302 | 1 | case 3: |
5303 | 1 | proto_tree_add_item(tree, hf_isakmp_notify_data_redirect_new_resp_gw_ident_fqdn, tvb, offset+2, tvb_get_uint8(tvb,offset+1), ENC_ASCII); |
5304 | 1 | break; |
5305 | 11 | default : |
5306 | 11 | proto_tree_add_item(tree, hf_isakmp_notify_data_redirect_new_resp_gw_ident, tvb, offset+2, tvb_get_uint8(tvb,offset+1), ENC_NA); |
5307 | 11 | break; |
5308 | 25 | } |
5309 | 25 | length -= tvb_get_uint8(tvb, offset+1) + 2; |
5310 | 25 | offset += tvb_get_uint8(tvb, offset+1) + 2; |
5311 | 25 | if(length) |
5312 | 20 | { |
5313 | 20 | proto_tree_add_item(tree, hf_isakmp_notify_data_redirect_nonce_data, tvb, offset, length, ENC_NA); |
5314 | 20 | } |
5315 | 25 | break; |
5316 | 12 | case 16408: /* REDIRECT_FROM */ |
5317 | 12 | proto_tree_add_item(tree, hf_isakmp_notify_data_redirect_gw_ident_type, tvb, offset, 1, ENC_BIG_ENDIAN); |
5318 | 12 | proto_tree_add_item(tree, hf_isakmp_notify_data_redirect_gw_ident_len, tvb, offset+1, 1, ENC_BIG_ENDIAN); |
5319 | 12 | switch(tvb_get_uint8(tvb, offset)){ /* Ident Type ? */ |
5320 | 2 | case 1: |
5321 | 2 | proto_tree_add_item(tree, hf_isakmp_notify_data_redirect_org_resp_gw_ident_ipv4, tvb, offset+2, 4, ENC_BIG_ENDIAN); |
5322 | 2 | break; |
5323 | 3 | case 2: |
5324 | 3 | proto_tree_add_item(tree, hf_isakmp_notify_data_redirect_org_resp_gw_ident_ipv6, tvb, offset+2, 16, ENC_NA); |
5325 | 3 | break; |
5326 | 7 | default : |
5327 | 7 | proto_tree_add_item(tree, hf_isakmp_notify_data_redirect_org_resp_gw_ident, tvb, offset+2, tvb_get_uint8(tvb,offset+1), ENC_NA); |
5328 | 7 | break; |
5329 | 12 | } |
5330 | 12 | break; |
5331 | 12 | case 16409: /* TICKET_LT_OPAQUE */ |
5332 | 4 | proto_tree_add_item(tree, hf_isakmp_notify_data_ticket_lifetime, tvb, offset, 4, ENC_BIG_ENDIAN); |
5333 | 4 | offset += 4; |
5334 | 4 | length -= 4; |
5335 | 4 | proto_tree_add_item(tree, hf_isakmp_notify_data_ticket_data, tvb, offset, length, ENC_NA); |
5336 | 4 | break; |
5337 | 0 | case 16413: /* TICKET_OPAQUE */ |
5338 | 0 | proto_tree_add_item(tree, hf_isakmp_notify_data_ticket_data, tvb, offset, length, ENC_NA); |
5339 | 0 | break; |
5340 | 20 | case 16416: /* ROHC_SUPPORTED */ |
5341 | 219 | while (offset < offset_end) { |
5342 | 199 | offset += dissect_rohc_attribute(tvb, pinfo, tree, offset); |
5343 | 199 | } |
5344 | 20 | break; |
5345 | 3 | case 16419: /* QUICK_CRASH_DETECTION */ |
5346 | 3 | proto_tree_add_item(tree, hf_isakmp_notify_data_qcd_token_secret_data, tvb, offset, length, ENC_NA); |
5347 | 3 | break; |
5348 | 5 | case 16422: /* IKEV2_MESSAGE_ID_SYNC */ |
5349 | 5 | proto_tree_add_item(tree, hf_isakmp_notify_data_ha_nonce_data, tvb, offset, 4, ENC_BIG_ENDIAN); |
5350 | 5 | offset += 4; |
5351 | 5 | proto_tree_add_item(tree, hf_isakmp_notify_data_ha_expected_send_req_msg_id, tvb, offset, 4, ENC_BIG_ENDIAN); |
5352 | 5 | offset += 4; |
5353 | 5 | proto_tree_add_item(tree, hf_isakmp_notify_data_ha_expected_recv_req_msg_id, tvb, offset, 4, ENC_BIG_ENDIAN); |
5354 | 5 | break; |
5355 | 5 | case 16423: /* IPSEC_REPLAY_COUNTER_SYNC */ |
5356 | 5 | proto_tree_add_item(tree, hf_isakmp_notify_data_ha_incoming_ipsec_sa_delta_value, tvb, offset, length, ENC_NA); |
5357 | 5 | break; |
5358 | 3 | case 16424: /* SECURE_PASSWORD_METHODS */ |
5359 | 3 | proto_tree_add_item(tree, hf_isakmp_notify_data_secure_password_methods, tvb, offset, length, ENC_NA); |
5360 | 3 | break; |
5361 | 7 | case 16431: /*SIGNATURE_HASH_ALGORITHMS*/ |
5362 | 45 | while(offset < offset_end) { |
5363 | 38 | proto_tree_add_item(tree, hf_isakmp_notify_data_signature_hash_algorithms, tvb, offset, 2, ENC_BIG_ENDIAN); |
5364 | 38 | offset += 2; |
5365 | 38 | } |
5366 | 7 | break; |
5367 | 0 | case 41041: |
5368 | | /* private status 3GPP BACKOFF_TIMER*/ |
5369 | 0 | proto_tree_add_item(tree, hf_isakmp_notify_data_3gpp_backoff_timer_len, tvb, offset, 1, ENC_BIG_ENDIAN); |
5370 | 0 | offset++; |
5371 | 0 | de_gc_timer3(tvb, tree, pinfo, offset, 1, NULL, 0); |
5372 | 0 | break; |
5373 | 0 | case 41101: /* DEVICE_IDENTITY */ |
5374 | 0 | if(length>=3) { |
5375 | 0 | uint64_t octet; |
5376 | 0 | uint32_t bit_offset; |
5377 | | |
5378 | | /* As specified in 3GPP TS 24.302 (Section 8.2.9.2) */ |
5379 | | /* Payload Octet 5,6 - Identity length */ |
5380 | 0 | proto_tree_add_item(tree, hf_isakmp_notify_data_3gpp_device_identity_len, tvb, offset, 2, ENC_BIG_ENDIAN); |
5381 | 0 | offset += 2; |
5382 | |
|
5383 | 0 | bit_offset = offset<<3; |
5384 | 0 | bit_offset += 6; |
5385 | | |
5386 | | /* Payload Octet 7 - Identity type */ |
5387 | 0 | proto_tree_add_bits_ret_val(tree, hf_isakmp_notify_data_3gpp_device_identity_type, tvb, bit_offset, 2, &octet, ENC_BIG_ENDIAN); |
5388 | |
|
5389 | 0 | offset += 1; |
5390 | 0 | length -= 3; |
5391 | |
|
5392 | 0 | if(length==0) { |
5393 | 0 | break; |
5394 | 0 | } |
5395 | | |
5396 | | /* Payload Octet 8-n - Identity value */ |
5397 | 0 | switch (octet) { |
5398 | 0 | case 1: |
5399 | | /* IMEI */ |
5400 | 0 | proto_tree_add_item(tree, hf_isakmp_notify_data_3gpp_device_identity_imei, tvb, offset, length, ENC_BCD_DIGITS_0_9|ENC_LITTLE_ENDIAN); |
5401 | 0 | break; |
5402 | 0 | case 2: |
5403 | | /* IMEISV */ |
5404 | 0 | proto_tree_add_item(tree, hf_isakmp_notify_data_3gpp_device_identity_imeisv, tvb, offset, length, ENC_BCD_DIGITS_0_9|ENC_LITTLE_ENDIAN); |
5405 | 0 | break; |
5406 | 0 | default: |
5407 | 0 | proto_tree_add_expert(tree, pinfo, &ei_isakmp_notify_data_3gpp_unknown_device_identity, tvb, offset, length); |
5408 | 0 | break; |
5409 | 0 | } |
5410 | 0 | } |
5411 | 0 | break; |
5412 | 0 | case 41134: |
5413 | | /* private status 3GPP EMERGENCY_CALL_NUMBERS*/ |
5414 | | /* If Notify Data is not empty/missing */ |
5415 | 0 | if(length>0) |
5416 | 0 | { |
5417 | | /* As specified in 3GPP TS 24.302 (Section 8.2.9.8) and TS 24.008 (Section 10.5.3.13) */ |
5418 | 0 | proto_tree *em_call_num_tree; |
5419 | | |
5420 | | /* Main Payload Subtree */ |
5421 | 0 | em_call_num_tree = proto_tree_add_subtree(tree, tvb, offset, length, ett_isakmp_notify_data_3gpp_emergency_call_numbers_main, NULL, "Emergency Call Numbers"); |
5422 | | |
5423 | | /* MCC information Octet 5 - 6 */ |
5424 | 0 | proto_tree_add_item(tree, hf_isakmp_notify_data_3gpp_emergency_call_mcc, tvb, offset, 2, ENC_BCD_DIGITS_0_9 | ENC_LITTLE_ENDIAN); |
5425 | 0 | offset += 2; |
5426 | | /* Payload Octet 7 - Length of IE Contents */ |
5427 | 0 | uint32_t len; |
5428 | 0 | proto_tree_add_item_ret_uint(em_call_num_tree, hf_isakmp_notify_data_3gpp_emergency_call_numbers_len, tvb, offset, 1, ENC_BIG_ENDIAN, &len); |
5429 | 0 | offset += 1; |
5430 | | |
5431 | | /* Subtree for actual values */ |
5432 | 0 | de_emerg_num_list(tvb, em_call_num_tree, pinfo, offset, len, NULL, 0); |
5433 | | //proto_tree *current_emergency_call_number_tree; |
5434 | | |
5435 | | //while(offset<offset_end){ |
5436 | | // uint8_t current_em_num_len = tvb_get_uint8(tvb,offset)+1; //Total length including octets 3 and 4 for proper highlighting |
5437 | | |
5438 | | // /* Subtree for elements*/ |
5439 | | // current_emergency_call_number_tree = proto_tree_add_subtree(em_call_num_tree, tvb, offset, current_em_num_len, ett_isakmp_notify_data_3gpp_emergency_call_numbers_element, NULL, "Emergency Number"); |
5440 | | |
5441 | | // /*IE Octet 3 Number of octets used to encode the Emergency Service Category Value and the Number digits. */ |
5442 | | // proto_tree_add_item(current_emergency_call_number_tree, hf_isakmp_notify_data_3gpp_emergency_call_numbers_element_len,tvb,offset,1,ENC_BIG_ENDIAN); |
5443 | | // offset += 1; |
5444 | | |
5445 | | // /*IE Octet 4 |Spare=0|Spare=0|Spare=0|Emergency Service Category Value| |
5446 | | // * Bits 1 to 5 are coded as bits 1 to 5 of octet 3 of the Service Category |
5447 | | // * information element as specified in subclause 10.5.4.33. (TS 24.008) |
5448 | | // */ |
5449 | | // static int * const isakmp_notify_data_3gpp_emergency_call_numbers_flags[] = { |
5450 | | // &hf_isakmp_notify_data_3gpp_emergency_call_numbers_spare, |
5451 | | // &hf_isakmp_notify_data_3gpp_emergency_call_numbers_flag_b5_mountain_rescue, |
5452 | | // &hf_isakmp_notify_data_3gpp_emergency_call_numbers_flag_b4_marine_guard, |
5453 | | // &hf_isakmp_notify_data_3gpp_emergency_call_numbers_flag_b3_fire_brigade, |
5454 | | // &hf_isakmp_notify_data_3gpp_emergency_call_numbers_flag_b2_ambulance, |
5455 | | // &hf_isakmp_notify_data_3gpp_emergency_call_numbers_flag_b1_police, |
5456 | | // NULL |
5457 | | // }; |
5458 | | // proto_tree_add_bitmask_with_flags(current_emergency_call_number_tree, tvb, offset, hf_isakmp_notify_data_3gpp_emergency_call_numbers_flags, |
5459 | | // ett_isakmp_notify_data_3gpp_emergency_call_numbers_element, isakmp_notify_data_3gpp_emergency_call_numbers_flags,ENC_BIG_ENDIAN, BMT_NO_FALSE | BMT_NO_INT | BMT_NO_TFS); |
5460 | | // offset += 1; |
5461 | | |
5462 | | // /*IE Octet 5 to j | Digit_N+1 | Digit_N | */ |
5463 | | // current_em_num_len -= 2; //Not counting octets 3 and 4 |
5464 | | // proto_tree_add_item(current_emergency_call_number_tree, hf_iskamp_notify_data_3gpp_emergency_call_number, tvb, offset, current_em_num_len, ENC_BCD_DIGITS_0_9|ENC_LITTLE_ENDIAN); |
5465 | | // offset += current_em_num_len; //moving to the next number in the list |
5466 | | //} |
5467 | 0 | } |
5468 | 0 | break; |
5469 | 6 | case 61520: /* Network Overlay ID (Fortinet) */ |
5470 | 6 | proto_tree_add_item(tree, hf_isakmp_notify_data_fortinet_network_overlay_id, tvb, offset, length, ENC_BIG_ENDIAN); |
5471 | 6 | break; |
5472 | 135 | case 61696: /* FORTICLIENT_CONNECT (Fortinet) */ { |
5473 | 135 | proto_item *item_tree; |
5474 | 135 | proto_tree *forticlient_connnect_tree; |
5475 | 135 | proto_tree_add_item(tree, hf_isakmp_notify_data_fortinet_forticlient_connect, tvb, offset, length, ENC_ASCII); |
5476 | 950 | while (offset < offset_end) { |
5477 | | |
5478 | 932 | unsigned line_len; |
5479 | 932 | if (!tvb_find_uint8_length(tvb, offset, offset_end - offset, '\n', &line_len)) { |
5480 | 117 | break; |
5481 | 815 | } else { |
5482 | 815 | line_len = line_len - offset; |
5483 | 815 | } |
5484 | | |
5485 | 815 | char *line = (char*)tvb_get_string_enc(pinfo->pool, tvb, offset, line_len, ENC_ASCII); |
5486 | | |
5487 | | /* Parse KEY=VALUE */ |
5488 | 815 | char **tokens = wmem_strsplit(pinfo->pool, line, "=", 2); |
5489 | | |
5490 | 815 | item_tree = proto_tree_add_string(tree, |
5491 | 815 | hf_isakmp_notify_data_fortinet_forticlient_connect_item, |
5492 | 815 | tvb, offset, line_len, |
5493 | 815 | line); |
5494 | 815 | forticlient_connnect_tree = proto_item_add_subtree(item_tree, ett_isakmp_notify_fortinet_forticlient_connnect); |
5495 | 815 | if (tokens[0] && tokens[1]) { |
5496 | 530 | int type_len = (int)strlen(tokens[0]); |
5497 | 530 | int type_value = (int)strlen(tokens[1]); |
5498 | 530 | proto_tree_add_string(forticlient_connnect_tree, |
5499 | 530 | hf_isakmp_notify_data_fortinet_forticlient_connect_type, |
5500 | 530 | tvb, offset, type_len, |
5501 | 530 | tokens[0]); |
5502 | 530 | proto_tree_add_string(forticlient_connnect_tree, |
5503 | 530 | hf_isakmp_notify_data_fortinet_forticlient_connect_value, |
5504 | 530 | tvb, offset+type_len+1, type_value, |
5505 | 530 | tokens[1]); |
5506 | 530 | if (strcmp(tokens[0], "VER") == 0) { |
5507 | 18 | proto_tree_add_string(forticlient_connnect_tree, |
5508 | 18 | hf_isakmp_notify_data_fortinet_forticlient_connect_ver, |
5509 | 18 | tvb, offset+type_len+1, type_value, |
5510 | 18 | tokens[1]); |
5511 | | |
5512 | 512 | } else if (strcmp(tokens[0], "FCTVER") == 0) { |
5513 | 16 | proto_tree_add_string(forticlient_connnect_tree, |
5514 | 16 | hf_isakmp_notify_data_fortinet_forticlient_connect_fctver, |
5515 | 16 | tvb, offset+type_len+1, type_value, |
5516 | 16 | tokens[1]); |
5517 | 496 | } else if (strcmp(tokens[0], "UID") == 0) { |
5518 | 22 | proto_tree_add_string(forticlient_connnect_tree, |
5519 | 22 | hf_isakmp_notify_data_fortinet_forticlient_connect_uid, |
5520 | 22 | tvb, offset+type_len+1, type_value, |
5521 | 22 | tokens[1]); |
5522 | 474 | } else if (strcmp(tokens[0], "IP") == 0) { |
5523 | 20 | proto_tree_add_string(forticlient_connnect_tree, |
5524 | 20 | hf_isakmp_notify_data_fortinet_forticlient_connect_ip, |
5525 | 20 | tvb, offset+type_len+1, type_value, |
5526 | 20 | tokens[1]); |
5527 | 454 | } else if (strcmp(tokens[0], "MAC") == 0) { |
5528 | 10 | proto_tree_add_string(forticlient_connnect_tree, |
5529 | 10 | hf_isakmp_notify_data_fortinet_forticlient_connect_mac, |
5530 | 10 | tvb, offset+type_len+1, type_value, |
5531 | 10 | tokens[1]); |
5532 | 444 | } else if (strcmp(tokens[0], "HOST") == 0) { |
5533 | 9 | proto_tree_add_string(forticlient_connnect_tree, |
5534 | 9 | hf_isakmp_notify_data_fortinet_forticlient_connect_host, |
5535 | 9 | tvb, offset+type_len+1, type_value, |
5536 | 9 | tokens[1]); |
5537 | 435 | } else if (strcmp(tokens[0], "USER") == 0) { |
5538 | 14 | proto_tree_add_string(forticlient_connnect_tree, |
5539 | 14 | hf_isakmp_notify_data_fortinet_forticlient_connect_user, |
5540 | 14 | tvb, offset+type_len+1, type_value, |
5541 | 14 | tokens[1]); |
5542 | 421 | } else if (strcmp(tokens[0], "OSVER") == 0) { |
5543 | 26 | proto_tree_add_string(forticlient_connnect_tree, |
5544 | 26 | hf_isakmp_notify_data_fortinet_forticlient_connect_osver, |
5545 | 26 | tvb, offset+type_len+1, type_value, |
5546 | 26 | tokens[1]); |
5547 | 395 | } else if (strcmp(tokens[0], "REG_STATUS") == 0) { |
5548 | 9 | proto_tree_add_string(forticlient_connnect_tree, |
5549 | 9 | hf_isakmp_notify_data_fortinet_forticlient_connect_reg_status, |
5550 | 9 | tvb, offset+type_len+1, type_value, |
5551 | 9 | tokens[1]); |
5552 | 386 | } else if (strcmp(tokens[0], "EMSSN") == 0) { |
5553 | 9 | proto_tree_add_string(forticlient_connnect_tree, |
5554 | 9 | hf_isakmp_notify_data_fortinet_forticlient_connect_emssn, |
5555 | 9 | tvb, offset+type_len+1, type_value, |
5556 | 9 | tokens[1]); |
5557 | 377 | } else if (strcmp(tokens[0], "EMSID") == 0) { |
5558 | 10 | proto_tree_add_string(forticlient_connnect_tree, |
5559 | 10 | hf_isakmp_notify_data_fortinet_forticlient_connect_emsid, |
5560 | 10 | tvb, offset+type_len+1, type_value, |
5561 | 10 | tokens[1]); |
5562 | 10 | } |
5563 | 530 | } |
5564 | | |
5565 | 815 | offset += line_len + 1; /* +1 pour le LF */ |
5566 | 815 | } |
5567 | 135 | } |
5568 | 135 | break; |
5569 | 44 | default: |
5570 | | /* No Default Action */ |
5571 | 44 | break; |
5572 | 311 | } |
5573 | 311 | } |
5574 | 445 | } |
5575 | | |
5576 | | static void |
5577 | | dissect_delete(tvbuff_t *tvb, unsigned offset, unsigned length, proto_tree *tree, int isakmp_version) |
5578 | 88 | { |
5579 | 88 | uint8_t spi_size; |
5580 | | |
5581 | 88 | if (isakmp_version == 1) { |
5582 | 23 | proto_tree_add_item(tree, hf_isakmp_delete_doi, tvb, offset, 4, ENC_BIG_ENDIAN); |
5583 | 23 | offset += 4; |
5584 | 23 | length -= 4; |
5585 | 23 | proto_tree_add_item(tree, hf_isakmp_delete_protoid_v1, tvb, offset, 1, ENC_BIG_ENDIAN); |
5586 | 65 | } else if (isakmp_version == 2) |
5587 | 46 | { |
5588 | 46 | proto_tree_add_item(tree, hf_isakmp_delete_protoid_v2, tvb, offset, 1, ENC_BIG_ENDIAN); |
5589 | 46 | } |
5590 | | |
5591 | 88 | offset += 1; |
5592 | 88 | length -= 1; |
5593 | | |
5594 | 88 | spi_size = tvb_get_uint8(tvb, offset); |
5595 | 88 | proto_tree_add_item(tree, hf_isakmp_spisize, tvb, offset, 1, ENC_BIG_ENDIAN); |
5596 | 88 | offset += 1; |
5597 | 88 | length -= 1; |
5598 | | |
5599 | 88 | proto_tree_add_item(tree, hf_isakmp_num_spis, tvb, offset, 2, ENC_BIG_ENDIAN); |
5600 | 88 | offset += 2; |
5601 | 88 | length -= 2; |
5602 | | |
5603 | 88 | if (spi_size > 0) { |
5604 | 843 | while (length > 0) { |
5605 | 808 | proto_tree_add_item(tree, hf_isakmp_delete_spi, tvb, offset, spi_size, ENC_NA); |
5606 | 808 | offset+=spi_size; |
5607 | 808 | length-=spi_size; |
5608 | 808 | } |
5609 | 35 | } |
5610 | 88 | } |
5611 | | |
5612 | | |
5613 | | static int |
5614 | | dissect_vid(tvbuff_t *tvb, packet_info* pinfo, unsigned offset, unsigned length, proto_tree *tree) |
5615 | 206 | { |
5616 | 206 | const uint8_t * pVID; |
5617 | 206 | const char * vendorstring; |
5618 | | |
5619 | 206 | pVID = tvb_get_ptr(tvb, offset, length); |
5620 | | |
5621 | 206 | vendorstring = bytesprefix_to_str(pinfo->pool, pVID, (size_t)length, vendor_id, "Unknown Vendor ID"); |
5622 | 206 | proto_tree_add_item(tree, hf_isakmp_vid_bytes, tvb, offset, length, ENC_NA); |
5623 | 206 | proto_tree_add_string(tree, hf_isakmp_vid_string, tvb, offset, length, vendorstring); |
5624 | 206 | proto_item_append_text(tree," : %s", vendorstring); |
5625 | | |
5626 | | /* very old CryptPro/GOST (Check Point R65) VID */ |
5627 | 206 | if (length >= 24 && memcmp(pVID, VID_CP_01_R65, 20) == 0) |
5628 | 5 | { |
5629 | 5 | offset += 20; |
5630 | 5 | proto_tree_add_item(tree, hf_isakmp_vid_cp_product, tvb, offset, 4, ENC_BIG_ENDIAN); |
5631 | 5 | offset +=4; |
5632 | 5 | proto_tree_add_item(tree, hf_isakmp_vid_cp_version, tvb, offset, 4, ENC_BIG_ENDIAN); |
5633 | 5 | offset +=4; |
5634 | 5 | proto_tree_add_item(tree, hf_isakmp_vid_cp_timestamp, tvb, offset, 4, ENC_BIG_ENDIAN); |
5635 | 5 | offset +=4; |
5636 | 5 | proto_tree_add_item(tree, hf_isakmp_vid_cp_reserved, tvb, offset, 4, ENC_BIG_ENDIAN); |
5637 | 5 | offset +=4; |
5638 | 5 | proto_tree_add_item(tree, hf_isakmp_vid_cp_features, tvb, offset, 4, ENC_BIG_ENDIAN); |
5639 | 5 | offset +=4; |
5640 | 5 | } |
5641 | | |
5642 | | /* Cisco Unity VID */ |
5643 | 206 | if (length >= 14 && memcmp(pVID, VID_CISCO_UNITY, 14) == 0) |
5644 | 6 | { |
5645 | 6 | offset += 14; |
5646 | 6 | proto_tree_add_item(tree, hf_isakmp_vid_cisco_unity_major, tvb, offset, 1, ENC_BIG_ENDIAN); |
5647 | 6 | proto_item_append_text(tree, " %u", tvb_get_uint8(tvb,offset)); |
5648 | 6 | offset += 1; |
5649 | 6 | proto_tree_add_item(tree, hf_isakmp_vid_cisco_unity_minor, tvb, offset, 1, ENC_BIG_ENDIAN); |
5650 | 6 | proto_item_append_text(tree, ".%u", tvb_get_uint8(tvb,offset)); |
5651 | 6 | offset += 1; |
5652 | 6 | } |
5653 | | |
5654 | | /* VID_MS_NT5_ISAKMPOAKLEY */ |
5655 | 206 | if (length >= 16 && memcmp(pVID, VID_MS_NT5_ISAKMPOAKLEY, 16) == 0) |
5656 | 8 | { |
5657 | 8 | offset += 16; |
5658 | 8 | proto_tree_add_item(tree, hf_isakmp_vid_ms_nt5_isakmpoakley, tvb, offset, 4, ENC_BIG_ENDIAN); |
5659 | 8 | offset += 4; |
5660 | 8 | } |
5661 | | |
5662 | | /* VID_ARUBA_VIA_AUTH_PROFILE */ |
5663 | 206 | if (length >= 19 && memcmp(pVID, VID_ARUBA_VIA_AUTH_PROFILE, 19) == 0) |
5664 | 10 | { |
5665 | 10 | offset += 19; |
5666 | 10 | proto_tree_add_item(tree, hf_isakmp_vid_aruba_via_auth_profile, tvb, offset, length-19, ENC_ASCII); |
5667 | 10 | offset += 4; |
5668 | 10 | } |
5669 | | |
5670 | | /* VID_FORTIGATE (Fortinet) */ |
5671 | 206 | if (length >= 12 && memcmp(pVID, VID_FORTINET_FORTIGATE, 12) == 0) |
5672 | 7 | { |
5673 | 7 | offset += 12; |
5674 | 7 | proto_tree_add_item(tree, hf_isakmp_vid_fortinet_fortigate_release, tvb, offset, 2, ENC_BIG_ENDIAN); |
5675 | 7 | offset += 2; |
5676 | 7 | proto_tree_add_item(tree, hf_isakmp_vid_fortinet_fortigate_build, tvb, offset, 2, ENC_BIG_ENDIAN); |
5677 | 7 | offset += 2; |
5678 | 7 | } |
5679 | 206 | return offset; |
5680 | 206 | } |
5681 | | |
5682 | | /* Returns the number of bytes consumed by this attribute. */ |
5683 | | static int |
5684 | | dissect_config_attribute(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, unsigned offset, int isakmp_version, bool is_request) |
5685 | 1.74k | { |
5686 | 1.74k | const range_string *vs_cfgattr; |
5687 | 1.74k | unsigned headerlen, value_len, attr_type; |
5688 | 1.74k | proto_item *attr_item; |
5689 | 1.74k | proto_tree *attr_tree; |
5690 | 1.74k | unsigned i; |
5691 | 1.74k | const uint8_t* str; |
5692 | | |
5693 | 1.74k | if (isakmp_version == 1) { |
5694 | 793 | vs_cfgattr = vs_v1_cfgattr; |
5695 | 793 | hf_isakmp_cfg_attr.type = hf_isakmp_cfg_attr_type_v1; |
5696 | 953 | } else if (isakmp_version == 2) { |
5697 | 953 | vs_cfgattr = vs_v2_cfgattr; |
5698 | 953 | hf_isakmp_cfg_attr.type = hf_isakmp_cfg_attr_type_v2; |
5699 | 953 | } else { |
5700 | | /* Fail gracefully in case of an unsupported isakmp_version. */ |
5701 | 0 | return 4; |
5702 | 0 | } |
5703 | | |
5704 | 1.74k | dissect_attribute_header(tvb, pinfo, tree, offset, |
5705 | 1.74k | hf_isakmp_cfg_attr, vs_cfgattr, |
5706 | 1.74k | &headerlen, &value_len, &attr_type, |
5707 | 1.74k | &attr_item, &attr_tree); |
5708 | | |
5709 | 1.74k | offset += headerlen; |
5710 | | |
5711 | 1.74k | if (value_len == 0) |
5712 | 382 | { |
5713 | | /* Don't complain about zero length if part of a config request - values will be assigned and included in the response message */ |
5714 | 382 | if (!is_request) { |
5715 | 163 | expert_add_info(pinfo, attr_item, &ei_isakmp_attribute_value_empty); |
5716 | 163 | } |
5717 | 382 | return headerlen; |
5718 | 382 | } |
5719 | | |
5720 | 1.36k | switch (attr_type) { |
5721 | 40 | case INTERNAL_IP4_ADDRESS: /* 1 */ |
5722 | 40 | if (value_len % 4 == 0) |
5723 | 32 | { |
5724 | 106 | for (i = 0; i < value_len / 4; i++) |
5725 | 74 | { |
5726 | 74 | proto_tree_add_item(attr_tree, hf_isakmp_cfg_attr_internal_ip4_address, tvb, offset, 4, ENC_BIG_ENDIAN); |
5727 | 74 | offset += 4; |
5728 | 74 | } |
5729 | 32 | } |
5730 | 40 | break; |
5731 | 48 | case INTERNAL_IP4_NETMASK: /* 2 */ |
5732 | 48 | proto_tree_add_item(attr_tree, hf_isakmp_cfg_attr_internal_ip4_netmask, tvb, offset, 4, ENC_BIG_ENDIAN); |
5733 | 48 | break; |
5734 | 17 | case INTERNAL_IP4_DNS: /* 3 */ |
5735 | 17 | if (value_len % 4 == 0) |
5736 | 13 | { |
5737 | 92 | for (i = 0; i < value_len / 4; i++) |
5738 | 79 | { |
5739 | 79 | proto_tree_add_item(attr_tree, hf_isakmp_cfg_attr_internal_ip4_dns, tvb, offset, 4, ENC_BIG_ENDIAN); |
5740 | 79 | offset += 4; |
5741 | 79 | } |
5742 | 13 | } |
5743 | 17 | break; |
5744 | 81 | case INTERNAL_IP4_NBNS: /* 4 */ |
5745 | 81 | if (value_len % 4 == 0) |
5746 | 63 | { |
5747 | 164 | for (i = 0; i < value_len / 4; i++) |
5748 | 101 | { |
5749 | 101 | proto_tree_add_item(attr_tree, hf_isakmp_cfg_attr_internal_ip4_nbns, tvb, offset, 4, ENC_BIG_ENDIAN); |
5750 | 101 | offset += 4; |
5751 | 101 | } |
5752 | 63 | } |
5753 | 81 | break; |
5754 | 24 | case INTERNAL_ADDRESS_EXPIRY: /* 5 */ |
5755 | 24 | proto_tree_add_item(attr_tree, hf_isakmp_cfg_attr_internal_address_expiry, tvb, offset, 4, ENC_BIG_ENDIAN); |
5756 | 24 | break; |
5757 | 20 | case INTERNAL_IP4_DHCP: /* 6 */ |
5758 | 20 | if (value_len % 4 == 0) |
5759 | 10 | { |
5760 | 34 | for (i = 0; i < value_len / 4; i++) |
5761 | 24 | { |
5762 | 24 | proto_tree_add_item(attr_tree, hf_isakmp_cfg_attr_internal_ip4_dhcp, tvb, offset, 4, ENC_BIG_ENDIAN); |
5763 | 24 | offset += 4; |
5764 | 24 | } |
5765 | 10 | } |
5766 | 20 | break; |
5767 | 14 | case APPLICATION_VERSION: /* 7 */ |
5768 | 14 | proto_tree_add_item_ret_string(attr_tree, hf_isakmp_cfg_attr_application_version, tvb, offset, value_len, ENC_ASCII|ENC_NA, pinfo->pool, &str); |
5769 | 14 | proto_item_append_text(attr_item, ": %s", str); |
5770 | 14 | break; |
5771 | 28 | case INTERNAL_IP6_ADDRESS: /* 8 */ |
5772 | 28 | if (value_len % 17 == 0) |
5773 | 10 | { |
5774 | 45 | for (i = 0; i < value_len / 17; i++) |
5775 | 35 | { |
5776 | 35 | proto_tree_add_item(attr_tree, hf_isakmp_cfg_attr_internal_ip6_address_ip, tvb, offset, 16, ENC_NA); |
5777 | 35 | offset += 16; |
5778 | 35 | proto_tree_add_item(attr_tree, hf_isakmp_cfg_attr_internal_ip6_address_prefix, tvb, offset, 1, ENC_BIG_ENDIAN); |
5779 | 35 | offset += 1; |
5780 | 35 | } |
5781 | 10 | } |
5782 | 28 | break; |
5783 | 24 | case INTERNAL_IP6_NETMASK: /* 9 Only in IKEv1 */ |
5784 | 24 | proto_tree_add_item(attr_tree, hf_isakmp_cfg_attr_internal_ip6_netmask, tvb, offset, 16, ENC_NA); |
5785 | 24 | break; |
5786 | 33 | case INTERNAL_IP6_DNS: /* 10 */ |
5787 | 33 | if (value_len % 16 == 0) |
5788 | 13 | { |
5789 | 59 | for (i = 0; i < value_len / 16; i++) |
5790 | 46 | { |
5791 | 46 | proto_tree_add_item(attr_tree, hf_isakmp_cfg_attr_internal_ip6_dns, tvb, offset, 16, ENC_NA); |
5792 | 46 | offset += 16; |
5793 | 46 | } |
5794 | 13 | } |
5795 | 33 | break; |
5796 | 15 | case INTERNAL_IP6_NBNS: /* 11 */ |
5797 | 15 | if (value_len % 16 == 0) |
5798 | 11 | { |
5799 | 50 | for (i = 0; i < value_len / 16; i++) |
5800 | 39 | { |
5801 | 39 | proto_tree_add_item(attr_tree, hf_isakmp_cfg_attr_internal_ip6_nbns, tvb, offset, 16, ENC_NA); |
5802 | 39 | offset += 16; |
5803 | 39 | } |
5804 | 11 | } |
5805 | 15 | break; |
5806 | 25 | case INTERNAL_IP6_DHCP: /* 12 */ |
5807 | 25 | if (value_len % 16 == 0) |
5808 | 11 | { |
5809 | 35 | for (i = 0; i < value_len / 16; i++) |
5810 | 24 | { |
5811 | 24 | proto_tree_add_item(attr_tree, hf_isakmp_cfg_attr_internal_ip6_dhcp, tvb, offset, 16, ENC_NA); |
5812 | 24 | offset += 16; |
5813 | 24 | } |
5814 | 11 | } |
5815 | 25 | break; |
5816 | 24 | case INTERNAL_IP4_SUBNET: /* 13 */ |
5817 | 24 | if (value_len % 8 == 0) |
5818 | 11 | { |
5819 | 44 | for (i = 0; i < value_len / 8; i++) |
5820 | 33 | { |
5821 | 33 | proto_tree_add_item(attr_tree, hf_isakmp_cfg_attr_internal_ip4_subnet_ip, tvb, offset, 4, ENC_BIG_ENDIAN); |
5822 | 33 | offset += 4; |
5823 | 33 | proto_tree_add_item(attr_tree, hf_isakmp_cfg_attr_internal_ip4_subnet_netmask, tvb, offset, 4, ENC_BIG_ENDIAN); |
5824 | 33 | offset += 4; |
5825 | 33 | } |
5826 | 11 | } |
5827 | 24 | break; |
5828 | 17 | case SUPPORTED_ATTRIBUTES: /* 14 */ |
5829 | 17 | if (value_len % 2 == 0) |
5830 | 13 | { |
5831 | 102 | for (i = 0; i < value_len / 2; i++) |
5832 | 89 | { |
5833 | 89 | proto_tree_add_item(attr_tree, hf_isakmp_cfg_attr_supported_attributes, tvb, offset, 2, ENC_BIG_ENDIAN); |
5834 | 89 | offset += 2; |
5835 | 89 | } |
5836 | 13 | } |
5837 | 17 | break; |
5838 | 15 | case INTERNAL_IP6_SUBNET: /* 15 */ |
5839 | 15 | if (value_len % 17 == 0) |
5840 | 3 | { |
5841 | 14 | for (i = 0; i < value_len / 17; i++) |
5842 | 11 | { |
5843 | 11 | proto_tree_add_item(attr_tree, hf_isakmp_cfg_attr_internal_ip6_subnet_ip, tvb, offset, 16, ENC_NA); |
5844 | 11 | offset += 16; |
5845 | 11 | proto_tree_add_item(attr_tree, hf_isakmp_cfg_attr_internal_ip6_subnet_prefix, tvb, offset, 1, ENC_BIG_ENDIAN); |
5846 | 11 | offset += 1; |
5847 | 11 | } |
5848 | 3 | } |
5849 | 15 | break; |
5850 | 10 | case INTERNAL_IP6_LINK: /* 17 */ |
5851 | 10 | proto_tree_add_item(attr_tree, hf_isakmp_cfg_attr_internal_ip6_link_interface, tvb, offset, 8, ENC_BIG_ENDIAN); |
5852 | 10 | offset += 8; |
5853 | 10 | proto_tree_add_item(attr_tree, hf_isakmp_cfg_attr_internal_ip6_link_id, tvb, offset, value_len - 8, ENC_NA); |
5854 | 10 | break; |
5855 | 6 | case INTERNAL_IP6_PREFIX: /* 18 */ |
5856 | 6 | if (value_len % 17 == 0) |
5857 | 3 | { |
5858 | 9 | for (i = 0; i < value_len / 17; i++) |
5859 | 6 | { |
5860 | 6 | proto_tree_add_item(attr_tree, hf_isakmp_cfg_attr_internal_ip6_prefix_ip, tvb, offset, 16, ENC_NA); |
5861 | 6 | offset += 16; |
5862 | 6 | proto_tree_add_item(attr_tree, hf_isakmp_cfg_attr_internal_ip6_prefix_length, tvb, offset, 1, ENC_BIG_ENDIAN); |
5863 | 6 | offset += 1; |
5864 | 6 | } |
5865 | 3 | } |
5866 | 6 | break; |
5867 | 21 | case P_CSCF_IP4_ADDRESS: /* 20 */ |
5868 | 21 | if (value_len % 4 == 0) |
5869 | 16 | { |
5870 | 64 | for (i = 0; i < value_len / 4; i++) |
5871 | 48 | { |
5872 | 48 | proto_tree_add_item(attr_tree, hf_isakmp_cfg_attr_p_cscf_ip4_address, tvb, offset, 4, ENC_BIG_ENDIAN); |
5873 | 48 | offset += 4; |
5874 | 48 | } |
5875 | 16 | } |
5876 | 21 | break; |
5877 | 14 | case P_CSCF_IP6_ADDRESS: /* 21 */ |
5878 | 14 | if (value_len % 16 == 0) |
5879 | 8 | { |
5880 | 35 | for (i = 0; i < value_len / 16; i++) |
5881 | 27 | { |
5882 | 27 | proto_tree_add_item(attr_tree, hf_isakmp_cfg_attr_p_cscf_ip6_address, tvb, offset, 16, ENC_NA); |
5883 | 27 | offset += 16; |
5884 | 27 | } |
5885 | 8 | } |
5886 | 14 | break; |
5887 | 6 | case INTERNAL_DNS_DOMAIN: /* 25 */ |
5888 | 6 | proto_tree_add_item_ret_string(attr_tree, hf_isakmp_cfg_attr_internal_dns_domain, tvb, offset, value_len, ENC_ASCII|ENC_NA, pinfo->pool, &str); |
5889 | 6 | proto_item_append_text(attr_item, ": %s", str); |
5890 | 6 | break; |
5891 | 13 | case XAUTH_TYPE: /* 16520 */ |
5892 | 13 | proto_tree_add_item(attr_tree, hf_isakmp_cfg_attr_xauth_type, tvb, offset, value_len, ENC_BIG_ENDIAN); |
5893 | 13 | proto_item_append_text(attr_item, ": %s", rval_to_str_wmem(pinfo->pool, tvb_get_ntohs(tvb, offset), cfgattr_xauth_type, "Unknown %d")); |
5894 | 13 | break; |
5895 | 7 | case XAUTH_USER_NAME: /* 16521 */ |
5896 | 7 | proto_tree_add_item_ret_string(attr_tree, hf_isakmp_cfg_attr_xauth_user_name, tvb, offset, value_len, ENC_ASCII|ENC_NA, pinfo->pool, &str); |
5897 | 7 | proto_item_append_text(attr_item, ": %s", str); |
5898 | 7 | break; |
5899 | 4 | case XAUTH_USER_PASSWORD: /* 16522 */ |
5900 | 4 | proto_tree_add_item_ret_string(attr_tree, hf_isakmp_cfg_attr_xauth_user_password, tvb, offset, value_len, ENC_ASCII|ENC_NA, pinfo->pool, &str); |
5901 | 4 | proto_item_append_text(attr_item, ": %s", str); |
5902 | 4 | break; |
5903 | 1 | case XAUTH_PASSCODE: /* 16523 */ |
5904 | 1 | proto_tree_add_item_ret_string(attr_tree, hf_isakmp_cfg_attr_xauth_passcode, tvb, offset, value_len, ENC_ASCII|ENC_NA, pinfo->pool, &str); |
5905 | 1 | proto_item_append_text(attr_item, ": %s", str); |
5906 | 1 | break; |
5907 | 2 | case XAUTH_MESSAGE: /* 16524 */ |
5908 | 2 | proto_tree_add_item_ret_string(attr_tree, hf_isakmp_cfg_attr_xauth_message, tvb, offset, value_len, ENC_ASCII|ENC_NA, pinfo->pool, &str); |
5909 | 2 | proto_item_append_text(attr_item, ": %s", str); |
5910 | 2 | break; |
5911 | 6 | case XAUTH_CHALLENGE: /* 16525 */ |
5912 | 6 | proto_tree_add_item_ret_string(attr_tree, hf_isakmp_cfg_attr_xauth_challenge, tvb, offset, value_len, ENC_ASCII|ENC_NA, pinfo->pool, &str); |
5913 | 6 | proto_item_append_text(attr_item, ": %s", str); |
5914 | 6 | break; |
5915 | 8 | case XAUTH_DOMAIN: /* 16526 */ |
5916 | 8 | proto_tree_add_item_ret_string(attr_tree, hf_isakmp_cfg_attr_xauth_domain, tvb, offset, value_len, ENC_ASCII|ENC_NA, pinfo->pool, &str); |
5917 | 8 | proto_item_append_text(attr_item, ": %s", str); |
5918 | 8 | break; |
5919 | 7 | case XAUTH_STATUS: /* 16527 */ |
5920 | 7 | proto_tree_add_item(attr_tree, hf_isakmp_cfg_attr_xauth_status, tvb, offset, value_len, ENC_BIG_ENDIAN); |
5921 | 7 | proto_item_append_text(attr_item, ": %s", val_to_str(pinfo->pool, tvb_get_ntohs(tvb, offset), cfgattr_xauth_status, "Unknown %d")); |
5922 | 7 | break; |
5923 | 7 | case XAUTH_NEXT_PIN: /* 16528 */ |
5924 | 7 | proto_tree_add_item_ret_string(attr_tree, hf_isakmp_cfg_attr_xauth_next_pin, tvb, offset, value_len, ENC_ASCII|ENC_NA, pinfo->pool, &str); |
5925 | 7 | proto_item_append_text(attr_item, ": %s", str); |
5926 | 7 | break; |
5927 | 3 | case XAUTH_ANSWER: /* 16527 */ |
5928 | 3 | proto_tree_add_item_ret_string(attr_tree, hf_isakmp_cfg_attr_xauth_answer, tvb, offset, value_len, ENC_ASCII|ENC_NA, pinfo->pool, &str); |
5929 | 3 | proto_item_append_text(attr_item, ": %s", str); |
5930 | 3 | break; |
5931 | | |
5932 | 7 | case FORTINET_AUTO_NEGOTIATE: /* 21514 */ |
5933 | 7 | proto_tree_add_item(attr_tree, hf_isakmp_cfg_attr_fortinet_auto_negotiate, tvb, offset, 2, ENC_BIG_ENDIAN); |
5934 | 7 | break; |
5935 | 8 | case FORTINET_KEEP_ALIVE: /* 21515 */ |
5936 | 8 | proto_tree_add_item(attr_tree, hf_isakmp_cfg_attr_fortinet_keep_alive, tvb, offset, 2, ENC_BIG_ENDIAN); |
5937 | 8 | break; |
5938 | 16 | case FORTINET_DNS_SUFFIX: /* 21516 */ |
5939 | 16 | proto_tree_add_item_ret_string(attr_tree, hf_isakmp_cfg_attr_fortinet_dns_suffix, tvb, offset, value_len, ENC_ASCII|ENC_NA, pinfo->pool, &str); |
5940 | 16 | proto_item_append_text(attr_item, ": %s", str); |
5941 | 16 | break; |
5942 | | |
5943 | 30 | case UNITY_BANNER: /* 28672 */ |
5944 | 30 | proto_tree_add_item_ret_string(attr_tree, hf_isakmp_cfg_attr_unity_banner, tvb, offset, value_len, ENC_ASCII|ENC_NA, pinfo->pool, &str); |
5945 | 30 | proto_item_append_text(attr_item, ": %s", str); |
5946 | 30 | break; |
5947 | 4 | case UNITY_SAVE_PASSWD: /* 28673 */ |
5948 | 4 | proto_tree_add_item(attr_tree, hf_isakmp_cfg_attr_unity_save_passwd, tvb, offset, 2, ENC_BIG_ENDIAN); |
5949 | 4 | break; |
5950 | 5 | case UNITY_SPLIT_EXCLUDE: /* 28678 */ |
5951 | 5 | proto_tree_add_item(attr_tree, hf_isakmp_cfg_attr_unity_split_exclude, tvb, offset, 2, ENC_BIG_ENDIAN); |
5952 | 5 | break; |
5953 | 11 | case UNITY_DEF_DOMAIN: /* 28674 */ |
5954 | 11 | proto_tree_add_item_ret_string(attr_tree, hf_isakmp_cfg_attr_unity_def_domain, tvb, offset, value_len, ENC_ASCII|ENC_NA, pinfo->pool, &str); |
5955 | 11 | proto_item_append_text(attr_item, ": %s", str); |
5956 | 11 | break; |
5957 | | /* TODO: Support other UNITY Attributes ! */ |
5958 | 674 | default: |
5959 | | /* No Default Action */ |
5960 | 674 | break; |
5961 | 1.36k | } |
5962 | | |
5963 | 1.29k | return headerlen + value_len; |
5964 | 1.36k | } |
5965 | | |
5966 | | static void |
5967 | | dissect_config(tvbuff_t *tvb, packet_info *pinfo, unsigned offset, unsigned length, proto_tree *tree, int isakmp_version, bool is_request) |
5968 | 284 | { |
5969 | 284 | unsigned offset_end = 0; |
5970 | 284 | offset_end = offset + length; |
5971 | 284 | if (isakmp_version == 1) { |
5972 | | |
5973 | 117 | proto_tree_add_item(tree, hf_isakmp_cfg_type_v1,tvb, offset, 1, ENC_BIG_ENDIAN); |
5974 | 117 | offset += 1; |
5975 | | |
5976 | 117 | proto_tree_add_item(tree, hf_isakmp_reserved, tvb, offset, 1, ENC_NA); |
5977 | 117 | offset += 1; |
5978 | | |
5979 | 117 | proto_tree_add_item(tree, hf_isakmp_cfg_identifier, tvb, offset, 2, ENC_BIG_ENDIAN); |
5980 | 117 | offset += 2; |
5981 | | |
5982 | 167 | } else if (isakmp_version == 2) { |
5983 | | |
5984 | 162 | proto_tree_add_item(tree, hf_isakmp_cfg_type_v2,tvb, offset, 1, ENC_BIG_ENDIAN); |
5985 | 162 | offset += 1; |
5986 | | |
5987 | 162 | proto_tree_add_item(tree, hf_isakmp_reserved, tvb, offset, 3, ENC_NA); |
5988 | 162 | offset += 3; |
5989 | | |
5990 | 162 | } else { |
5991 | | /* Skip attribute dissection for unknown IKE versions. */ |
5992 | 5 | return; |
5993 | 5 | } |
5994 | | |
5995 | 2.02k | while (offset < offset_end) { |
5996 | 1.74k | offset += dissect_config_attribute(tvb, pinfo, tree, offset, isakmp_version, is_request); |
5997 | 1.74k | } |
5998 | 279 | } |
5999 | | |
6000 | | static void |
6001 | | dissect_sa_kek(tvbuff_t *tvb, packet_info *pinfo _U_, unsigned offset, unsigned length, proto_tree *tree) |
6002 | 65 | { |
6003 | 65 | unsigned payload_end = 0; |
6004 | 65 | uint32_t src_id_length, dst_id_length; |
6005 | | |
6006 | 65 | uint8_t next_payload; |
6007 | 65 | uint16_t payload_length; |
6008 | | |
6009 | 65 | next_payload = tvb_get_uint8(tvb, offset); |
6010 | 65 | payload_length = tvb_get_ntohs(tvb, offset + 2); |
6011 | | |
6012 | 65 | payload_end = offset + payload_length; |
6013 | 65 | proto_tree_add_item(tree, hf_isakmp_sak_next_payload, tvb, offset, 1, ENC_BIG_ENDIAN); |
6014 | 65 | proto_tree_add_item(tree, hf_isakmp_sak_reserved, tvb, offset+1, 1, ENC_BIG_ENDIAN); |
6015 | 65 | proto_tree_add_item(tree, hf_isakmp_sak_payload_len, tvb, offset+2, 2, ENC_BIG_ENDIAN); |
6016 | 65 | offset += 4; |
6017 | | |
6018 | 65 | proto_tree_add_item(tree, hf_isakmp_sak_protocol, tvb, offset, 1, ENC_BIG_ENDIAN); |
6019 | 65 | offset += 1; |
6020 | 65 | proto_tree_add_item(tree, hf_isakmp_sak_src_id_type, tvb, offset, 1, ENC_BIG_ENDIAN); |
6021 | 65 | offset += 1; |
6022 | 65 | proto_tree_add_item(tree, hf_isakmp_sak_src_id_port, tvb, offset, 2, ENC_BIG_ENDIAN); |
6023 | 65 | offset += 2; |
6024 | 65 | proto_tree_add_item_ret_uint(tree, hf_isakmp_sak_src_id_length, tvb, offset, 1, ENC_BIG_ENDIAN, &src_id_length); |
6025 | 65 | offset += 1; |
6026 | 65 | if (src_id_length > 0) { |
6027 | 29 | proto_tree_add_item(tree, hf_isakmp_sak_src_id_data, tvb, offset, src_id_length, ENC_NA); |
6028 | 29 | offset += src_id_length; |
6029 | 29 | } |
6030 | 65 | proto_tree_add_item(tree, hf_isakmp_sak_dst_id_type, tvb, offset, 1, ENC_BIG_ENDIAN); |
6031 | 65 | offset += 1; |
6032 | 65 | proto_tree_add_item(tree, hf_isakmp_sak_dst_id_port, tvb, offset, 2, ENC_BIG_ENDIAN); |
6033 | 65 | offset += 2; |
6034 | 65 | proto_tree_add_item_ret_uint(tree, hf_isakmp_sak_dst_id_length, tvb, offset, 1, ENC_BIG_ENDIAN, &dst_id_length); |
6035 | 65 | offset += 1; |
6036 | 65 | if (dst_id_length > 0) { |
6037 | 25 | proto_tree_add_item(tree, hf_isakmp_sak_dst_id_data, tvb, offset, dst_id_length, ENC_NA); |
6038 | 25 | offset += dst_id_length; |
6039 | 25 | } |
6040 | 65 | proto_tree_add_item(tree, hf_isakmp_sak_spi, tvb, offset, 16, ENC_NA); |
6041 | 65 | offset += 16; |
6042 | 65 | proto_tree_add_item(tree, hf_isakmp_reserved, tvb, offset, 4, ENC_NA); |
6043 | 65 | offset += 4; |
6044 | 254 | while (offset < payload_end) { |
6045 | 189 | offset += dissect_ipsec_attribute(tvb, pinfo, tree, offset); |
6046 | 189 | } |
6047 | 65 | if(PLOAD_IKE_SAT == next_payload) |
6048 | 4 | { |
6049 | 4 | dissect_sa_tek(tvb, pinfo, offset, length, tree); |
6050 | 4 | } |
6051 | | /* GAP payload could also be here*/ |
6052 | 65 | } |
6053 | | |
6054 | | static void |
6055 | | // NOLINTNEXTLINE(misc-no-recursion) |
6056 | | dissect_sa_tek(tvbuff_t *tvb, packet_info *pinfo _U_, unsigned offset, unsigned length, proto_tree *tree) |
6057 | 62 | { |
6058 | 62 | unsigned offset_end = 0, payload_end=0; |
6059 | 62 | uint32_t protocol_id, src_id_length, dst_id_length; |
6060 | 62 | offset_end = offset + length; |
6061 | 62 | uint8_t next_payload, id_type; |
6062 | 62 | uint16_t payload_length; |
6063 | 62 | proto_item * ti; |
6064 | 62 | proto_item * ntree; |
6065 | 62 | proto_item * idit; |
6066 | 62 | proto_tree * idtree; |
6067 | | |
6068 | 62 | next_payload = tvb_get_uint8(tvb, offset); |
6069 | 62 | payload_length = tvb_get_ntohs(tvb, offset + 2); |
6070 | | |
6071 | 62 | payload_end = offset + payload_length; |
6072 | | |
6073 | 62 | ti = proto_tree_add_uint(tree, hf_isakmp_typepayload, tvb, offset, payload_length, PLOAD_IKE_SAT); |
6074 | | |
6075 | 62 | ntree = proto_item_add_subtree(ti, ett_isakmp_payload); |
6076 | | |
6077 | 62 | proto_tree_add_item(ntree, hf_isakmp_sat_next_payload, tvb, offset, 1, ENC_BIG_ENDIAN); |
6078 | 62 | proto_tree_add_item(ntree, hf_isakmp_sat_reserved, tvb, offset+1, 1, ENC_BIG_ENDIAN); |
6079 | 62 | proto_tree_add_item(ntree, hf_isakmp_sat_payload_len, tvb, offset+2, 2, ENC_BIG_ENDIAN); |
6080 | | |
6081 | 62 | offset += 4; |
6082 | 62 | proto_tree_add_item_ret_uint(ntree, hf_isakmp_sat_protocol_id, tvb, offset, 1, ENC_BIG_ENDIAN, &protocol_id); |
6083 | 62 | offset += 1; |
6084 | 62 | if (protocol_id == 1 || protocol_id == 2) { |
6085 | 38 | proto_tree_add_item(ntree, hf_isakmp_sat_protocol, tvb, offset, 1, ENC_BIG_ENDIAN); |
6086 | 38 | offset += 1; |
6087 | 38 | proto_tree_add_item_ret_uint8(ntree, hf_isakmp_sat_src_id_type, tvb, offset, 1, ENC_BIG_ENDIAN, &id_type); |
6088 | 38 | offset += 1; |
6089 | 38 | proto_tree_add_item(ntree, hf_isakmp_sat_src_id_port, tvb, offset, 2, ENC_BIG_ENDIAN); |
6090 | 38 | offset += 2; |
6091 | 38 | proto_tree_add_item_ret_uint(ntree, hf_isakmp_sat_src_id_length, tvb, offset, 2, ENC_BIG_ENDIAN, &src_id_length); |
6092 | 38 | offset += 2; |
6093 | 38 | if (src_id_length > 0) { |
6094 | 11 | idit = proto_tree_add_item(ntree, hf_isakmp_sat_src_id_data, tvb, offset, src_id_length, ENC_NA); |
6095 | 11 | idtree = proto_item_add_subtree(idit, ett_isakmp_id); |
6096 | 11 | dissect_id_type(tvb, offset, src_id_length, id_type, idtree, idit, pinfo); |
6097 | 11 | offset += src_id_length; |
6098 | 11 | } |
6099 | 38 | proto_tree_add_item_ret_uint8(ntree, hf_isakmp_sat_dst_id_type, tvb, offset, 1, ENC_BIG_ENDIAN, &id_type); |
6100 | 38 | offset += 1; |
6101 | 38 | proto_tree_add_item(ntree, hf_isakmp_sat_dst_id_port, tvb, offset, 2, ENC_BIG_ENDIAN); |
6102 | 38 | offset += 2; |
6103 | 38 | proto_tree_add_item_ret_uint(ntree, hf_isakmp_sat_dst_id_length, tvb, offset, 2, ENC_BIG_ENDIAN, &dst_id_length); |
6104 | 38 | offset += 2; |
6105 | 38 | if (dst_id_length > 0) { |
6106 | 16 | idit = proto_tree_add_item(ntree, hf_isakmp_sat_dst_id_data, tvb, offset, dst_id_length, ENC_NA); |
6107 | 16 | idtree = proto_item_add_subtree(idit, ett_isakmp_id); |
6108 | 16 | dissect_id_type(tvb, offset, dst_id_length, id_type, idtree, idit, pinfo); |
6109 | 16 | offset += dst_id_length; |
6110 | 16 | } |
6111 | 38 | proto_tree_add_item(ntree, hf_isakmp_sat_transform_id, tvb, offset, 1, ENC_BIG_ENDIAN); |
6112 | 38 | offset += 1; |
6113 | 38 | proto_tree_add_item(ntree, hf_isakmp_sat_spi, tvb, offset, 4, ENC_NA); |
6114 | 38 | offset += 4; |
6115 | 101 | while (offset < payload_end) { |
6116 | 63 | offset += dissect_ipsec_attribute(tvb, pinfo, ntree, offset); |
6117 | 63 | } |
6118 | 38 | if(PLOAD_IKE_SAT == next_payload) |
6119 | 14 | { |
6120 | 14 | increment_dissection_depth(pinfo); |
6121 | 14 | dissect_sa_tek(tvb, pinfo, offset, length, tree); |
6122 | 14 | decrement_dissection_depth(pinfo); |
6123 | 14 | } |
6124 | 38 | } else { |
6125 | 24 | proto_tree_add_item(ntree, hf_isakmp_sat_payload, tvb, offset, offset_end - offset, ENC_NA); |
6126 | 24 | } |
6127 | | |
6128 | 62 | } |
6129 | | |
6130 | | /* Returns the number of bytes consumed by this attribute. */ |
6131 | | static int |
6132 | | dissect_tek_key_attribute(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, unsigned offset) |
6133 | 295 | { |
6134 | 295 | unsigned headerlen, value_len, attr_type; |
6135 | 295 | proto_item *attr_item; |
6136 | 295 | proto_tree *attr_tree; |
6137 | | |
6138 | 295 | dissect_attribute_header(tvb, pinfo, tree, offset, |
6139 | 295 | hf_isakmp_tek_key_attr, tek_key_attr_type, |
6140 | 295 | &headerlen, &value_len, &attr_type, |
6141 | 295 | &attr_item, &attr_tree); |
6142 | | |
6143 | 295 | if (value_len == 0) |
6144 | 147 | { |
6145 | 147 | expert_add_info(pinfo, attr_item, &ei_isakmp_attribute_value_empty); |
6146 | 147 | return headerlen; |
6147 | 147 | } |
6148 | | |
6149 | 148 | return headerlen + value_len; |
6150 | 295 | } |
6151 | | |
6152 | | static void |
6153 | | dissect_key_download(tvbuff_t *tvb, packet_info *pinfo _U_, unsigned offset, unsigned length, proto_tree *tree, int isakmp_version) |
6154 | 98 | { |
6155 | 98 | unsigned offset_end = 0, payload_end; |
6156 | 98 | uint32_t num_key_pkt, kdp_length, kdp_spi_size; |
6157 | 98 | proto_item *kd_item; |
6158 | 98 | proto_tree *payload_tree; |
6159 | 98 | offset_end = offset + length; |
6160 | | |
6161 | 98 | if (isakmp_version == 1) { |
6162 | | |
6163 | 63 | proto_tree_add_item_ret_uint(tree, hf_isakmp_kd_num_key_pkt, tvb, offset, 2, ENC_BIG_ENDIAN, &num_key_pkt); |
6164 | 63 | offset += 2; |
6165 | 63 | proto_tree_add_item(tree, hf_isakmp_reserved, tvb, offset, 2, ENC_NA); |
6166 | 63 | offset += 2; |
6167 | 178 | while ((num_key_pkt > 0) && (offset_end > offset)) { |
6168 | 115 | kd_item = proto_tree_add_item(tree, hf_isakmp_kd_payload, tvb, offset, tvb_get_ntohs(tvb, offset + 2), ENC_NA); |
6169 | 115 | payload_tree = proto_item_add_subtree(kd_item, ett_isakmp_kd); |
6170 | 115 | proto_tree_add_item(payload_tree, hf_isakmp_kdp_type, tvb, offset, 1, ENC_BIG_ENDIAN); |
6171 | 115 | offset += 1; |
6172 | 115 | proto_tree_add_item(payload_tree, hf_isakmp_reserved, tvb, offset, 1, ENC_NA); |
6173 | 115 | offset += 1; |
6174 | 115 | proto_tree_add_item_ret_uint(payload_tree, hf_isakmp_kdp_length, tvb, offset, 2, ENC_BIG_ENDIAN, &kdp_length); |
6175 | 115 | payload_end = offset + kdp_length -2; |
6176 | 115 | offset += 2; |
6177 | 115 | proto_tree_add_item_ret_uint(payload_tree, hf_isakmp_kdp_spi_size, tvb, offset, 1, ENC_BIG_ENDIAN, &kdp_spi_size); |
6178 | 115 | offset += 1; |
6179 | 115 | if (kdp_spi_size > 0) { |
6180 | 45 | proto_tree_add_item(payload_tree, hf_isakmp_kdp_spi, tvb, offset, kdp_spi_size, ENC_NA); |
6181 | 45 | offset += kdp_spi_size; |
6182 | 45 | } |
6183 | 410 | while (offset < payload_end) { |
6184 | 295 | offset += dissect_tek_key_attribute(tvb, pinfo, payload_tree, offset); |
6185 | 295 | } |
6186 | 115 | num_key_pkt -= 1; |
6187 | 115 | } |
6188 | | |
6189 | 63 | } else { |
6190 | | /* TODO: For IKEv2: currently only draft status: draft-yeung-g-ikev2-15 */ |
6191 | | /* Skip dissection for unknown IKE versions. */ |
6192 | 35 | return; |
6193 | 35 | } |
6194 | 98 | } |
6195 | | |
6196 | | static void |
6197 | | dissect_sequence(tvbuff_t *tvb, packet_info *pinfo, unsigned offset, unsigned length, proto_tree *tree) |
6198 | 34 | { |
6199 | 34 | if (length != 4) { |
6200 | 19 | proto_tree_add_expert_format(tree, pinfo, &ei_isakmp_payload_bad_length, tvb, 0, 0, |
6201 | 19 | "Payload (bogus, length is %u, should be 4", length); |
6202 | 19 | return; |
6203 | 19 | } |
6204 | 15 | proto_tree_add_item(tree, hf_isakmp_seq_seq, tvb, offset, 4, ENC_BIG_ENDIAN); |
6205 | 15 | } |
6206 | | |
6207 | | static void |
6208 | | dissect_nat_discovery(tvbuff_t *tvb, unsigned offset, unsigned length, proto_tree *tree ) |
6209 | 137 | { |
6210 | 137 | proto_tree_add_item(tree, hf_isakmp_nat_hash, tvb, offset, length, ENC_NA); |
6211 | 137 | } |
6212 | | |
6213 | | static void |
6214 | | dissect_nat_original_address(tvbuff_t *tvb, unsigned offset, unsigned length _U_, proto_tree *tree, int isakmp_version) |
6215 | 319 | { |
6216 | 319 | uint8_t id_type; |
6217 | | |
6218 | 319 | id_type = tvb_get_uint8(tvb, offset); |
6219 | 319 | if (isakmp_version == 1) |
6220 | 180 | { |
6221 | 180 | proto_tree_add_item(tree, hf_isakmp_id_type_v1, tvb, offset, 1, ENC_BIG_ENDIAN); |
6222 | 180 | }else if (isakmp_version == 2) |
6223 | 97 | { |
6224 | 97 | proto_tree_add_item(tree, hf_isakmp_id_type_v2, tvb, offset, 1, ENC_BIG_ENDIAN); |
6225 | 97 | } |
6226 | 319 | offset += 1; |
6227 | | |
6228 | 319 | offset += 3; /* reserved */ |
6229 | | |
6230 | 319 | switch (id_type) { |
6231 | | |
6232 | 46 | case IKE_ID_IPV4_ADDR: |
6233 | 46 | proto_tree_add_item(tree, hf_isakmp_nat_original_address_ipv4, tvb, offset, 4, ENC_BIG_ENDIAN); |
6234 | 46 | break; |
6235 | | |
6236 | 65 | case IKE_ID_IPV6_ADDR: |
6237 | 65 | proto_tree_add_item(tree, hf_isakmp_nat_original_address_ipv6, tvb, offset, 16, ENC_NA); |
6238 | 65 | break; |
6239 | | |
6240 | 208 | default: |
6241 | 208 | break; |
6242 | 319 | } |
6243 | 319 | } |
6244 | | |
6245 | | static int |
6246 | | dissect_ts(tvbuff_t *tvb, packet_info* pinfo, unsigned offset, proto_tree *payload_tree) |
6247 | 323 | { |
6248 | 323 | uint8_t tstype, protocol_id; |
6249 | 323 | uint16_t len; |
6250 | 323 | proto_item *ts_item; |
6251 | 323 | proto_tree *tree; |
6252 | 323 | const char *ts_typename; |
6253 | | |
6254 | 323 | len = tvb_get_uint16(tvb, offset + 2, ENC_BIG_ENDIAN); |
6255 | 323 | if (len < 4) |
6256 | 98 | return 4; |
6257 | | |
6258 | 225 | ts_item = proto_tree_add_item(payload_tree, hf_isakmp_ts_data, tvb, offset, len, ENC_NA); |
6259 | 225 | tree = proto_item_add_subtree(ts_item, ett_isakmp_ts); |
6260 | | |
6261 | 225 | tstype = tvb_get_uint8(tvb, offset); |
6262 | 225 | proto_tree_add_item(tree, hf_isakmp_ts_type, tvb, offset, 1, ENC_BIG_ENDIAN); |
6263 | 225 | ts_typename = rval_to_str_wmem(pinfo->pool, tstype, traffic_selector_type, "Unknown Type (%d)"); |
6264 | 225 | proto_item_append_text(ts_item, ": %s", ts_typename); |
6265 | | |
6266 | 225 | offset += 1; |
6267 | | |
6268 | 225 | switch (tstype) { |
6269 | 31 | case IKEV2_TS_IPV4_ADDR_RANGE: |
6270 | 31 | protocol_id = tvb_get_uint8(tvb, offset); |
6271 | 31 | if (protocol_id == 0) |
6272 | 17 | proto_tree_add_uint_format_value(tree, hf_isakmp_ts_protoid, tvb, offset,1, |
6273 | 17 | protocol_id, "Unused"); |
6274 | 14 | else |
6275 | 14 | proto_tree_add_item(tree, hf_isakmp_ts_protoid, tvb, offset, 1, ENC_BIG_ENDIAN); |
6276 | 31 | offset += 1; |
6277 | | |
6278 | 31 | proto_tree_add_item(tree, hf_isakmp_ts_selector_length, tvb, offset, 2, ENC_BIG_ENDIAN); |
6279 | 31 | offset += 2; |
6280 | | |
6281 | 31 | proto_tree_add_item(tree, hf_isakmp_ts_start_port, tvb, offset, 2, ENC_BIG_ENDIAN); |
6282 | 31 | offset += 2; |
6283 | | |
6284 | 31 | proto_tree_add_item(tree, hf_isakmp_ts_end_port, tvb, offset, 2, ENC_BIG_ENDIAN); |
6285 | 31 | offset += 2; |
6286 | | |
6287 | 31 | proto_tree_add_item(tree, hf_isakmp_ts_start_addr_ipv4, tvb, offset, 4, ENC_BIG_ENDIAN); |
6288 | 31 | offset += 4; |
6289 | | |
6290 | 31 | proto_tree_add_item(tree, hf_isakmp_ts_end_addr_ipv4, tvb, offset, 4, ENC_BIG_ENDIAN); |
6291 | 31 | break; |
6292 | | |
6293 | 25 | case IKEV2_TS_IPV6_ADDR_RANGE: |
6294 | 25 | protocol_id = tvb_get_uint8(tvb, offset); |
6295 | 25 | if (protocol_id == 0) |
6296 | 7 | proto_tree_add_uint_format_value(tree, hf_isakmp_ts_protoid, tvb, offset,1, |
6297 | 7 | protocol_id, "Unused"); |
6298 | 18 | else |
6299 | 18 | proto_tree_add_item(tree, hf_isakmp_ts_protoid, tvb, offset, 1, ENC_BIG_ENDIAN); |
6300 | 25 | offset += 1; |
6301 | | |
6302 | 25 | proto_tree_add_item(tree, hf_isakmp_ts_selector_length, tvb, offset, 2, ENC_BIG_ENDIAN); |
6303 | 25 | offset += 2; |
6304 | | |
6305 | 25 | proto_tree_add_item(tree, hf_isakmp_ts_start_port, tvb, offset, 2, ENC_BIG_ENDIAN); |
6306 | 25 | offset += 2; |
6307 | | |
6308 | 25 | proto_tree_add_item(tree, hf_isakmp_ts_end_port, tvb, offset, 2, ENC_BIG_ENDIAN); |
6309 | 25 | offset += 2; |
6310 | | |
6311 | 25 | proto_tree_add_item(tree, hf_isakmp_ts_start_addr_ipv6, tvb, offset, 16, ENC_NA); |
6312 | 25 | offset += 16; |
6313 | | |
6314 | 25 | proto_tree_add_item(tree, hf_isakmp_ts_end_addr_ipv6, tvb, offset, 16, ENC_NA); |
6315 | 25 | break; |
6316 | | |
6317 | 28 | case IKEV2_TS_FC_ADDR_RANGE: |
6318 | 28 | proto_tree_add_item(tree, hf_isakmp_reserved, tvb, offset, 1, ENC_NA); |
6319 | 28 | offset += 1; |
6320 | | |
6321 | 28 | proto_tree_add_item(tree, hf_isakmp_ts_selector_length, tvb, offset, 2, ENC_BIG_ENDIAN); |
6322 | 28 | offset += 2; |
6323 | | |
6324 | 28 | proto_tree_add_item(tree, hf_isakmp_reserved, tvb, offset, 1, ENC_NA); |
6325 | 28 | offset += 1; |
6326 | | |
6327 | 28 | proto_tree_add_item(tree, hf_isakmp_ts_start_addr_fc, tvb, offset, 3, ENC_BIG_ENDIAN); |
6328 | 28 | offset += 3; |
6329 | | |
6330 | 28 | proto_tree_add_item(tree, hf_isakmp_reserved, tvb, offset, 1, ENC_NA); |
6331 | 28 | offset += 1; |
6332 | | |
6333 | 28 | proto_tree_add_item(tree, hf_isakmp_ts_end_addr_fc, tvb, offset, 3, ENC_BIG_ENDIAN); |
6334 | 28 | offset += 3; |
6335 | | |
6336 | 28 | proto_tree_add_item(tree, hf_isakmp_ts_start_r_ctl, tvb, offset, 1, ENC_BIG_ENDIAN); |
6337 | 28 | offset += 1; |
6338 | | |
6339 | 28 | proto_tree_add_item(tree, hf_isakmp_ts_end_r_ctl, tvb, offset, 1, ENC_BIG_ENDIAN); |
6340 | 28 | offset += 1; |
6341 | | |
6342 | 28 | proto_tree_add_item(tree, hf_isakmp_ts_start_type, tvb, offset, 1, ENC_BIG_ENDIAN); |
6343 | 28 | offset += 1; |
6344 | | |
6345 | 28 | proto_tree_add_item(tree, hf_isakmp_ts_end_type, tvb, offset, 1, ENC_BIG_ENDIAN); |
6346 | 28 | break; |
6347 | 225 | } |
6348 | | |
6349 | 224 | return len; |
6350 | 225 | } |
6351 | | |
6352 | | static void |
6353 | | dissect_ts_payload(tvbuff_t *tvb, packet_info* pinfo, unsigned offset, unsigned length, proto_tree *tree) |
6354 | 991 | { |
6355 | 991 | uint8_t num; |
6356 | 991 | unsigned offset_end = offset + length; |
6357 | | |
6358 | 991 | num = tvb_get_uint8(tvb, offset); |
6359 | 991 | proto_item_append_text(tree," # %d", num); |
6360 | 991 | proto_tree_add_item(tree, hf_isakmp_ts_number_of_ts, tvb, offset, 1, ENC_BIG_ENDIAN); |
6361 | 991 | offset += 1; |
6362 | | |
6363 | 991 | proto_tree_add_item(tree, hf_isakmp_reserved, tvb, offset, 3, ENC_NA); |
6364 | 991 | offset += 3; |
6365 | | |
6366 | 1.31k | while (offset < offset_end) { |
6367 | 323 | offset += dissect_ts(tvb, pinfo, offset, tree); |
6368 | 323 | } |
6369 | 991 | } |
6370 | | |
6371 | | /* For IKEv2, decrypt payload if necessary and dissect using inner_payload */ |
6372 | | /* For RFC 7383 reassembly, only need decrypted payload, so don't set dissect_payload_now .*/ |
6373 | | /* TODO: rename? */ |
6374 | | static tvbuff_t* |
6375 | | // NOLINTNEXTLINE(misc-no-recursion) |
6376 | | dissect_enc(tvbuff_t *tvb, |
6377 | | unsigned offset, |
6378 | | unsigned length, |
6379 | | proto_tree *tree, |
6380 | | packet_info *pinfo, |
6381 | | uint8_t inner_payload, |
6382 | | bool is_request, |
6383 | | void* decr_info, |
6384 | | bool dissect_payload_now) |
6385 | 85 | { |
6386 | 85 | ikev2_decrypt_data_t *key_info = NULL; |
6387 | 85 | unsigned iv_len, icd_len, decr_data_len, md_len, icv_len, encr_key_len, encr_iv_len; |
6388 | 85 | uint8_t pad_len; |
6389 | 85 | unsigned char *iv = NULL, *encr_data = NULL, *decr_data = NULL, *entire_message = NULL, *md = NULL, *encr_iv = NULL; |
6390 | 85 | gcry_cipher_hd_t cipher_hd; |
6391 | 85 | gcry_md_hd_t md_hd; |
6392 | 85 | gcry_error_t err; |
6393 | 85 | proto_item *item = NULL, *icd_item = NULL, *encr_data_item = NULL, *padlen_item = NULL, *iv_item = NULL; |
6394 | 85 | tvbuff_t *decr_tvb = NULL; |
6395 | 85 | int payloads_len, encr_data_len; |
6396 | 85 | proto_tree *decr_tree = NULL, *decr_payloads_tree = NULL; |
6397 | 85 | unsigned char *aa_data = NULL, *icv_data = NULL; |
6398 | 85 | unsigned aad_len = 0; |
6399 | | |
6400 | 85 | if (decr_info) { |
6401 | | /* Need decryption details to know field lengths. */ |
6402 | 0 | key_info = (ikev2_decrypt_data_t*)(decr_info); |
6403 | | |
6404 | | /* Check if encr/auth specs are set properly (if for some case not, wireshark would crash) */ |
6405 | 0 | if (!key_info->encr_spec || !key_info->auth_spec) { |
6406 | 0 | REPORT_DISSECTOR_BUG("IKEv2: decryption/integrity specs not set-up properly: encr_spec: %p, auth_spec: %p", |
6407 | 0 | (void *)key_info->encr_spec, (void*)key_info->auth_spec); |
6408 | 0 | } |
6409 | |
|
6410 | 0 | iv_len = key_info->encr_spec->iv_len; |
6411 | 0 | icv_len = key_info->encr_spec->icv_len; |
6412 | 0 | icd_len = icv_len ? icv_len : key_info->auth_spec->trunc_len; |
6413 | 0 | encr_data_len = length - iv_len - icd_len; |
6414 | 0 | encr_key_len = key_info->encr_spec->key_len; |
6415 | 0 | encr_iv_len = iv_len; |
6416 | | |
6417 | | /* |
6418 | | * Zero or negative length of encrypted data shows that the user specified |
6419 | | * wrong encryption algorithm and/or authentication algorithm. |
6420 | | */ |
6421 | 0 | if (encr_data_len <= 0) { |
6422 | 0 | proto_tree_add_expert(tree, pinfo, &ei_isakmp_enc_iv, tvb, offset, length); |
6423 | 0 | return NULL; |
6424 | 0 | } |
6425 | | |
6426 | | /* |
6427 | | * Add the IV to the tree and store it in a packet scope buffer for later decryption |
6428 | | * if the specified encryption algorithm uses IV. |
6429 | | */ |
6430 | 0 | if (iv_len) { |
6431 | 0 | if (dissect_payload_now) { |
6432 | 0 | iv_item = proto_tree_add_item(tree, hf_isakmp_enc_iv, tvb, offset, iv_len, ENC_NA); |
6433 | 0 | proto_item_append_text(iv_item, " (%d bytes)", iv_len); |
6434 | 0 | } |
6435 | 0 | iv = (unsigned char *)tvb_memdup(pinfo->pool, tvb, offset, iv_len); |
6436 | 0 | encr_iv = iv; |
6437 | |
|
6438 | 0 | offset += iv_len; |
6439 | 0 | } |
6440 | | |
6441 | | /* |
6442 | | * Add the encrypted portion to the tree and store it in a packet scope buffer for later decryption. |
6443 | | */ |
6444 | 0 | if (dissect_payload_now) { |
6445 | 0 | encr_data_item = proto_tree_add_item(tree, hf_isakmp_enc_data, tvb, offset, encr_data_len, ENC_NA); |
6446 | 0 | proto_item_append_text(encr_data_item, " (%d bytes)",encr_data_len); |
6447 | 0 | proto_item_append_text(encr_data_item, " <%s>", val_to_str(pinfo->pool, key_info->encr_spec->number, vs_ikev2_encr_algs, "Unknown cipher: %d")); |
6448 | 0 | } |
6449 | 0 | encr_data = (unsigned char *)tvb_memdup(pinfo->pool, tvb, offset, encr_data_len); |
6450 | 0 | offset += encr_data_len; |
6451 | | |
6452 | | /* |
6453 | | * Add the ICD (Integrity Checksum Data) to the tree before decryption to ensure |
6454 | | * the ICD be displayed even if the decryption fails. |
6455 | | */ |
6456 | 0 | if (icd_len) { |
6457 | 0 | icd_item = proto_tree_add_item(tree, hf_isakmp_enc_icd, tvb, offset, icd_len, ENC_NA); |
6458 | 0 | proto_item_append_text(icd_item, " (%d bytes)",icd_len); |
6459 | | |
6460 | | /* |
6461 | | * Recalculate ICD value if the specified authentication algorithm allows it. |
6462 | | */ |
6463 | 0 | if (icv_len) { |
6464 | | /* For GCM/CCM algorithms ICD is computed during decryption. |
6465 | | Must save offset and length of authenticated additional data (whole ISAKMP header |
6466 | | without iv and encrypted data) and ICV for later verification */ |
6467 | 0 | aad_len = offset - iv_len - encr_data_len; |
6468 | 0 | aa_data = (unsigned char *)tvb_memdup(pinfo->pool, tvb, 0, aad_len); |
6469 | 0 | icv_data = (unsigned char *)tvb_memdup(pinfo->pool, tvb, offset, icv_len); |
6470 | 0 | } else |
6471 | 0 | if (key_info->auth_spec->gcry_alg) { |
6472 | 0 | proto_item_append_text(icd_item, " <%s>", val_to_str(pinfo->pool, key_info->auth_spec->number, vs_ikev2_auth_algs, "Unknown mac algo: %d")); |
6473 | 0 | err = gcry_md_open(&md_hd, key_info->auth_spec->gcry_alg, key_info->auth_spec->gcry_flag); |
6474 | 0 | if (err) { |
6475 | 0 | REPORT_DISSECTOR_BUG("IKEv2 hashing error: algorithm %d: gcry_md_open failed: %s", |
6476 | 0 | key_info->auth_spec->gcry_alg, gcry_strerror(err)); |
6477 | 0 | } |
6478 | 0 | err = gcry_md_setkey(md_hd, key_info->auth_key, key_info->auth_spec->key_len); |
6479 | 0 | if (err) { |
6480 | 0 | gcry_md_close(md_hd); |
6481 | 0 | REPORT_DISSECTOR_BUG("IKEv2 hashing error: algorithm %s, key length %u: gcry_md_setkey failed: %s", |
6482 | 0 | gcry_md_algo_name(key_info->auth_spec->gcry_alg), key_info->auth_spec->key_len, gcry_strerror(err)); |
6483 | 0 | } |
6484 | | |
6485 | | /* Calculate hash over the bytes from the beginning of the ISAKMP header to the right before the ICD. */ |
6486 | 0 | entire_message = (unsigned char *)tvb_memdup(pinfo->pool, tvb, 0, offset); |
6487 | 0 | gcry_md_write(md_hd, entire_message, offset); |
6488 | 0 | md = gcry_md_read(md_hd, 0); |
6489 | 0 | md_len = gcry_md_get_algo_dlen(key_info->auth_spec->gcry_alg); |
6490 | 0 | if (md_len < icd_len) { |
6491 | 0 | gcry_md_close(md_hd); |
6492 | 0 | REPORT_DISSECTOR_BUG("IKEv2 hashing error: algorithm %s: gcry_md_get_algo_dlen returned %d which is smaller than icd length %d", |
6493 | 0 | gcry_md_algo_name(key_info->auth_spec->gcry_alg), md_len, icd_len); |
6494 | 0 | } |
6495 | 0 | if (tvb_memeql(tvb, offset, md, icd_len) == 0) { |
6496 | 0 | proto_item_append_text(icd_item, "[correct]"); |
6497 | 0 | } else { |
6498 | 0 | proto_item_append_text(icd_item, "[incorrect, should be %s]", bytes_to_str(pinfo->pool, md, icd_len)); |
6499 | 0 | expert_add_info(pinfo, icd_item, &ei_isakmp_ikev2_integrity_checksum); |
6500 | 0 | } |
6501 | 0 | gcry_md_close(md_hd); |
6502 | 0 | } else { |
6503 | 0 | proto_item_append_text(icd_item, "[not validated]"); |
6504 | 0 | } |
6505 | 0 | } |
6506 | | |
6507 | | /* |
6508 | | * Confirm encrypted data length is multiple of block size. |
6509 | | */ |
6510 | 0 | if (encr_data_len % key_info->encr_spec->block_len != 0) { |
6511 | 0 | proto_item_append_text(encr_data_item, "[Invalid length, should be a multiple of block size (%u)]", |
6512 | 0 | key_info->encr_spec->block_len); |
6513 | 0 | expert_add_info(pinfo, encr_data_item, &ei_isakmp_enc_data_length_mult_block_size); |
6514 | 0 | return NULL; |
6515 | 0 | } |
6516 | | |
6517 | | /* |
6518 | | * Allocate buffer for decrypted data. |
6519 | | */ |
6520 | 0 | decr_data = (unsigned char*)wmem_alloc(pinfo->pool, encr_data_len); |
6521 | 0 | decr_data_len = encr_data_len; |
6522 | | |
6523 | | /* |
6524 | | * If the cipher is NULL, just copy the encrypted data to the decrypted data buffer. |
6525 | | * And otherwise perform decryption with libgcrypt. |
6526 | | */ |
6527 | 0 | if (key_info->encr_spec->number == IKEV2_ENCR_NULL) { |
6528 | 0 | memcpy(decr_data, encr_data, decr_data_len); |
6529 | 0 | } else { |
6530 | 0 | err = gcry_cipher_open(&cipher_hd, key_info->encr_spec->gcry_alg, key_info->encr_spec->gcry_mode, 0); |
6531 | 0 | if (err) { |
6532 | 0 | REPORT_DISSECTOR_BUG("IKEv2 decryption error: algorithm %d, mode %d: gcry_cipher_open failed: %s", |
6533 | 0 | key_info->encr_spec->gcry_alg, key_info->encr_spec->gcry_mode, gcry_strerror(err)); |
6534 | 0 | } |
6535 | | |
6536 | | /* Handling CTR mode and AEAD ciphers */ |
6537 | 0 | if( key_info->encr_spec->salt_len ) { |
6538 | 0 | unsigned encr_iv_offset = 0; |
6539 | 0 | encr_key_len = key_info->encr_spec->key_len - key_info->encr_spec->salt_len; |
6540 | 0 | encr_iv_len = key_info->encr_spec->salt_len + iv_len; |
6541 | 0 | if (key_info->encr_spec->gcry_mode == GCRY_CIPHER_MODE_CTR) { |
6542 | 0 | encr_iv_len = (unsigned)gcry_cipher_get_algo_blklen(key_info->encr_spec->gcry_alg); |
6543 | 0 | if ((key_info->encr_spec->number >= IKEV2_ENCR_AES_CCM_128_16 && key_info->encr_spec->number <= IKEV2_ENCR_AES_CCM_256_12)) |
6544 | 0 | encr_iv_offset = 1; |
6545 | 0 | } |
6546 | |
|
6547 | 0 | if (key_info->encr_spec->salt_len > key_info->encr_spec->key_len || encr_iv_len < encr_iv_offset + key_info->encr_spec->salt_len + iv_len) { |
6548 | 0 | gcry_cipher_close(cipher_hd); |
6549 | 0 | REPORT_DISSECTOR_BUG("IKEv2 decryption error: algorithm %d, key length %d, salt length %d, input iv length %d, cipher iv length: %d: invalid length(s) of cipher parameters", |
6550 | 0 | key_info->encr_spec->gcry_alg, encr_key_len, key_info->encr_spec->salt_len, iv_len, encr_iv_len); |
6551 | 0 | } |
6552 | |
|
6553 | 0 | encr_iv = (unsigned char *)wmem_alloc0(pinfo->pool, encr_iv_len); |
6554 | 0 | memcpy( encr_iv + encr_iv_offset, key_info->encr_key + encr_key_len, key_info->encr_spec->salt_len ); |
6555 | 0 | if(iv) { |
6556 | 0 | memcpy( encr_iv + encr_iv_offset + key_info->encr_spec->salt_len, iv, iv_len ); |
6557 | 0 | } |
6558 | 0 | if (key_info->encr_spec->gcry_mode == GCRY_CIPHER_MODE_CTR) { |
6559 | 0 | encr_iv[encr_iv_len-1] = 1; |
6560 | | /* fallback for gcrypt not having AEAD ciphers */ |
6561 | 0 | if ((key_info->encr_spec->number >= IKEV2_ENCR_AES_GCM_128_16 && key_info->encr_spec->number <= IKEV2_ENCR_AES_GCM_256_12)) |
6562 | 0 | encr_iv[encr_iv_len-1]++; |
6563 | 0 | if ((key_info->encr_spec->number >= IKEV2_ENCR_AES_CCM_128_16 && key_info->encr_spec->number <= IKEV2_ENCR_AES_CCM_256_12)) |
6564 | 0 | encr_iv[0] = (unsigned char)(encr_iv_len - 2 - key_info->encr_spec->salt_len - iv_len); |
6565 | 0 | } |
6566 | 0 | } |
6567 | |
|
6568 | 0 | err = gcry_cipher_setkey(cipher_hd, key_info->encr_key, encr_key_len); |
6569 | 0 | if (err) { |
6570 | 0 | REPORT_DISSECTOR_BUG("IKEv2 decryption error: algorithm %d, key length %d: gcry_cipher_setkey failed: %s", |
6571 | 0 | key_info->encr_spec->gcry_alg, encr_key_len, gcry_strerror(err)); |
6572 | 0 | } |
6573 | 0 | if (key_info->encr_spec->gcry_mode == GCRY_CIPHER_MODE_CTR) |
6574 | 0 | err = gcry_cipher_setctr(cipher_hd, encr_iv, encr_iv_len); |
6575 | 0 | else |
6576 | 0 | err = gcry_cipher_setiv(cipher_hd, encr_iv, encr_iv_len); |
6577 | 0 | if (err) { |
6578 | 0 | REPORT_DISSECTOR_BUG("IKEv2 decryption error: algorithm %d, iv length %d: gcry_cipher_setiv/gcry_cipher_setctr failed: %s", |
6579 | 0 | key_info->encr_spec->gcry_alg, encr_iv_len, gcry_strerror(err)); |
6580 | 0 | } |
6581 | |
|
6582 | 0 | if (key_info->encr_spec->gcry_mode == GCRY_CIPHER_MODE_CCM) { |
6583 | 0 | uint64_t ccm_lengths[3]; |
6584 | 0 | ccm_lengths[0] = encr_data_len; |
6585 | 0 | ccm_lengths[1] = aad_len; |
6586 | 0 | ccm_lengths[2] = icv_len; |
6587 | |
|
6588 | 0 | err = gcry_cipher_ctl(cipher_hd, GCRYCTL_SET_CCM_LENGTHS, ccm_lengths, sizeof(ccm_lengths)); |
6589 | 0 | if (err) { |
6590 | 0 | gcry_cipher_close(cipher_hd); |
6591 | 0 | REPORT_DISSECTOR_BUG("IKEv2 decryption error: algorithm %d: gcry_cipher_ctl(GCRYCTL_SET_CCM_LENGTHS) failed: %s", |
6592 | 0 | key_info->encr_spec->gcry_alg, gcry_strerror(err)); |
6593 | 0 | } |
6594 | 0 | } |
6595 | |
|
6596 | 0 | if (aad_len) { |
6597 | 0 | err = gcry_cipher_authenticate(cipher_hd, aa_data, aad_len); |
6598 | 0 | if (err) { |
6599 | 0 | gcry_cipher_close(cipher_hd); |
6600 | 0 | REPORT_DISSECTOR_BUG("IKEv2 decryption error: algorithm %d: gcry_cipher_authenticate failed: %s", |
6601 | 0 | key_info->encr_spec->gcry_alg, gcry_strerror(err)); |
6602 | 0 | } |
6603 | 0 | } |
6604 | |
|
6605 | 0 | err = gcry_cipher_decrypt(cipher_hd, decr_data, decr_data_len, encr_data, encr_data_len); |
6606 | 0 | if (err) { |
6607 | 0 | gcry_cipher_close(cipher_hd); |
6608 | 0 | REPORT_DISSECTOR_BUG("IKEv2 decryption error: algorithm %d: gcry_cipher_decrypt failed: %s", |
6609 | 0 | key_info->encr_spec->gcry_alg, gcry_strerror(err)); |
6610 | 0 | } |
6611 | |
|
6612 | 0 | if (icv_len) { |
6613 | | /* gcry_cipher_checktag() doesn't work on 1.6.x version well - requires all of 16 bytes |
6614 | | * of ICV, so it won't work with 12 and 8 bytes of ICV. |
6615 | | * For 1.7.x version of libgcrypt we could use it safely. But for libgcrypt-1.6.x |
6616 | | * we need to read tag from library and compare manually. Using that way we can also show |
6617 | | * correct value if it is not valid. |
6618 | | * CCM mode is not affected, but requires to pass icv_len to cry_cipher_gettag(). |
6619 | | * |
6620 | | * Unfortunately gcrypt_cipher_gettag() have nothing similar to gcry_md_read(), |
6621 | | * so we need copy data to buffer here. |
6622 | | * Here, depending on cgrypt version gcm length shall be given differently: |
6623 | | * - in 1.7.x length can be of any approved length (4,8,12,13,14,15,16 bytes), |
6624 | | * - in 1.6.x length must be equal of cipher block length. Aaargh... :-( |
6625 | | * We use accepted for both versions length of block size for GCM (16 bytes). |
6626 | | * For CCM length given must be the same as given to gcry_cipher_ctl(GCRYCTL_SET_CCM_LENGTHS) |
6627 | | * |
6628 | | * XXX: We now require libgcrypt 1.8.0, so presumably this could |
6629 | | * be updated? |
6630 | | */ |
6631 | 0 | unsigned char *tag; |
6632 | 0 | unsigned tag_len = icv_len; |
6633 | 0 | if (key_info->encr_spec->gcry_mode == GCRY_CIPHER_MODE_GCM) |
6634 | 0 | tag_len = (unsigned)gcry_cipher_get_algo_blklen(key_info->encr_spec->gcry_alg); |
6635 | |
|
6636 | 0 | if (tag_len < icv_len) { |
6637 | 0 | gcry_cipher_close(cipher_hd); |
6638 | 0 | REPORT_DISSECTOR_BUG("IKEv2 decryption error: algorithm %d: gcry_cipher_get_algo_blklen returned %d which is smaller than icv length %d", |
6639 | 0 | key_info->encr_spec->gcry_alg, tag_len, icv_len); |
6640 | 0 | } |
6641 | |
|
6642 | 0 | tag = (unsigned char *)wmem_alloc(pinfo->pool, tag_len); |
6643 | 0 | err = gcry_cipher_gettag(cipher_hd, tag, tag_len); |
6644 | 0 | if (err) { |
6645 | 0 | gcry_cipher_close(cipher_hd); |
6646 | 0 | REPORT_DISSECTOR_BUG("IKEv2 decryption error: algorithm %d: gcry_cipher_gettag failed: %s", |
6647 | 0 | key_info->encr_spec->gcry_alg, gcry_strerror(err)); |
6648 | 0 | } |
6649 | 0 | else if (memcmp(tag, icv_data, icv_len) == 0) |
6650 | 0 | proto_item_append_text(icd_item, "[correct]"); |
6651 | 0 | else { |
6652 | 0 | proto_item_append_text(icd_item, "[incorrect, should be %s]", bytes_to_str(pinfo->pool, tag, icv_len)); |
6653 | 0 | expert_add_info(pinfo, icd_item, &ei_isakmp_ikev2_integrity_checksum); |
6654 | 0 | } |
6655 | 0 | } |
6656 | |
|
6657 | 0 | gcry_cipher_close(cipher_hd); |
6658 | 0 | } |
6659 | |
|
6660 | 0 | decr_tvb = tvb_new_child_real_data(tvb, decr_data, decr_data_len, decr_data_len); |
6661 | 0 | add_new_data_source(pinfo, decr_tvb, "Decrypted Data"); |
6662 | 0 | item = proto_tree_add_item(tree, hf_isakmp_enc_decrypted_data, decr_tvb, 0, decr_data_len, ENC_NA); |
6663 | 0 | proto_item_append_text(item, " (%d byte%s)", decr_data_len, plurality(decr_data_len, "", "s")); |
6664 | | |
6665 | | /* Move the ICD item to the bottom of the tree. */ |
6666 | 0 | if (icd_item) { |
6667 | 0 | proto_tree_move_item(tree, item, icd_item); |
6668 | 0 | } |
6669 | 0 | decr_tree = proto_item_add_subtree(item, ett_isakmp_decrypted_data); |
6670 | |
|
6671 | 0 | pad_len = tvb_get_uint8(decr_tvb, decr_data_len - 1); |
6672 | 0 | payloads_len = decr_data_len - 1 - pad_len; |
6673 | |
|
6674 | 0 | if (payloads_len > 0) { |
6675 | 0 | item = proto_tree_add_item(decr_tree, hf_isakmp_enc_contained_data, decr_tvb, 0, payloads_len, ENC_NA); |
6676 | 0 | proto_item_append_text(item, " (%d byte%s)", payloads_len, plurality(payloads_len, "", "s")); |
6677 | 0 | decr_payloads_tree = proto_item_add_subtree(item, ett_isakmp_decrypted_payloads); |
6678 | 0 | } |
6679 | |
|
6680 | 0 | padlen_item = proto_tree_add_item(decr_tree, hf_isakmp_enc_pad_length, decr_tvb, payloads_len + pad_len, 1, ENC_BIG_ENDIAN); |
6681 | 0 | if (pad_len > 0) { |
6682 | 0 | if (payloads_len < 0) { |
6683 | 0 | proto_item_append_text(padlen_item, " [too long]"); |
6684 | 0 | expert_add_info(pinfo, padlen_item, &ei_isakmp_enc_pad_length_big); |
6685 | 0 | } else { |
6686 | 0 | item = proto_tree_add_item(decr_tree, hf_isakmp_enc_padding, decr_tvb, payloads_len, pad_len, ENC_NA); |
6687 | 0 | proto_item_append_text(item, " (%d byte%s)", pad_len, plurality(pad_len, "", "s")); |
6688 | 0 | proto_tree_move_item(decr_tree, item, padlen_item); |
6689 | 0 | } |
6690 | 0 | } |
6691 | | |
6692 | | /* |
6693 | | * We dissect the inner payloads at last in order to ensure displaying Padding, Pad Length and ICD |
6694 | | * even if the dissection fails. This may occur when the user specify wrong encryption key. |
6695 | | */ |
6696 | 0 | if (dissect_payload_now) { |
6697 | 0 | dissect_payloads(decr_tvb, decr_payloads_tree, 2, inner_payload, 0, payloads_len, pinfo, 0, is_request, decr_info); |
6698 | 0 | } |
6699 | 85 | }else{ |
6700 | 85 | proto_tree_add_item(tree, hf_isakmp_enc_iv, tvb, offset, 4, ENC_NA); |
6701 | 85 | proto_tree_add_item(tree, hf_isakmp_enc_data, tvb, offset+4 , length, ENC_NA); |
6702 | 85 | } |
6703 | 85 | return decr_tvb; |
6704 | 85 | } |
6705 | | |
6706 | | static void |
6707 | | dissect_eap(tvbuff_t *tvb, unsigned offset, unsigned length, proto_tree *tree, packet_info *pinfo) |
6708 | 7 | { |
6709 | 7 | tvbuff_t *eap_tvb; |
6710 | | |
6711 | 7 | eap_tvb = tvb_new_subset_length(tvb, offset, length); |
6712 | 7 | if ((eap_tvb != NULL)&& eap_handle != NULL){ |
6713 | 7 | call_dissector(eap_handle, eap_tvb, pinfo, tree); |
6714 | 7 | }else{ |
6715 | 0 | proto_tree_add_item(tree, hf_isakmp_eap_data, tvb, offset, length, ENC_NA); |
6716 | 0 | } |
6717 | 7 | } |
6718 | | |
6719 | | static void |
6720 | | dissect_gspm(tvbuff_t *tvb, unsigned offset, unsigned length, proto_tree *tree) |
6721 | 159 | { |
6722 | 159 | proto_tree_add_item(tree, hf_isakmp_gspm_data, tvb, offset, length, ENC_NA); |
6723 | | |
6724 | 159 | } |
6725 | | |
6726 | | /* |
6727 | | https://datatracker.ietf.org/doc/html/rfc9329#name-tcp-encapsulated-stream-pre |
6728 | | |
6729 | | 4. TCP-Encapsulated Stream Prefix |
6730 | | |
6731 | | Each stream of bytes used for IKE and IPsec encapsulation MUST begin with a fixed sequence of 6 bytes as a magic value |
6732 | | , containing the characters "IKETCP" as ASCII values. |
6733 | | |
6734 | | 0 1 2 3 4 5 |
6735 | | +------+------+------+------+------+------+ |
6736 | | | 0x49 | 0x4b | 0x45 | 0x54 | 0x43 | 0x50 | |
6737 | | +------+------+------+------+------+------+ |
6738 | | |
6739 | | |
6740 | | */ |
6741 | | |
6742 | 2.78k | #define IKETCP_MAGIC 0x494B45544350 |
6743 | | |
6744 | | static int |
6745 | | dissect_iketcp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_) |
6746 | 0 | { |
6747 | 0 | unsigned offset = 0; |
6748 | 0 | uint32_t length; |
6749 | 0 | tvbuff_t *payload_tvb; |
6750 | | |
6751 | | /* IKETCP Magic Packet*/ |
6752 | 0 | if (tvb_get_ntoh48(tvb, 0) == IKETCP_MAGIC) { |
6753 | 0 | col_set_str(pinfo->cinfo, COL_PROTOCOL, "IKETCP"); |
6754 | 0 | col_set_str(pinfo->cinfo, COL_INFO, "MAGIC PACKET"); |
6755 | 0 | proto_tree_add_item(tree, hf_isakmp_iketcp_magic, tvb, offset, 6, ENC_ASCII); |
6756 | 0 | offset += 6; |
6757 | 0 | return offset; |
6758 | 0 | } |
6759 | | |
6760 | | /* Check Non-ESP Marker => ISAKMP */ |
6761 | 0 | if (tvb_get_ntohs(tvb, 2) == 0) { |
6762 | 0 | proto_tree_add_item_ret_uint(tree, hf_isakmp_iketcp_length, tvb, offset, 2, ENC_BIG_ENDIAN, &length); |
6763 | 0 | offset += 2; |
6764 | 0 | proto_tree_add_item(tree, hf_isakmp_iketcp_non_esp_marker, tvb, offset, 4, ENC_NA); |
6765 | 0 | offset += 4; |
6766 | 0 | payload_tvb = tvb_new_subset_length(tvb, offset, length); |
6767 | 0 | offset = dissect_isakmp(payload_tvb, pinfo, tree, data); |
6768 | 0 | } else { |
6769 | 0 | proto_tree_add_item_ret_uint(tree, hf_isakmp_iketcp_length, tvb, offset, 2, ENC_BIG_ENDIAN, &length); |
6770 | 0 | offset += 2; |
6771 | 0 | payload_tvb = tvb_new_subset_length(tvb, offset, length); |
6772 | 0 | call_dissector(esp_handle, payload_tvb, pinfo, tree); |
6773 | 0 | offset += length; |
6774 | 0 | } |
6775 | |
|
6776 | 0 | return offset; |
6777 | 0 | } |
6778 | | |
6779 | | static bool |
6780 | | dissect_iketcp_heur(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree _U_, void *data _U_) |
6781 | 3.00k | { |
6782 | 3.00k | conversation_t *conversation; |
6783 | | |
6784 | 3.00k | if (tvb_captured_length(tvb) < 6) { |
6785 | 222 | return false; |
6786 | 222 | } |
6787 | | |
6788 | 2.78k | if (tvb_get_ntoh48(tvb, 0) != IKETCP_MAGIC) { |
6789 | 2.78k | return false; |
6790 | 2.78k | } |
6791 | | |
6792 | 2 | conversation = find_or_create_conversation(pinfo); |
6793 | 2 | conversation_set_dissector_from_frame_number(conversation, pinfo->num, iketcp_handle); |
6794 | 2 | return true; |
6795 | 2.78k | } |
6796 | | |
6797 | | /* |
6798 | | * Protocol initialization |
6799 | | */ |
6800 | | |
6801 | | static unsigned |
6802 | 947 | isakmp_hash_func(const void *c) { |
6803 | 947 | const uint8_t *i_cookie = (const uint8_t *) c; |
6804 | 947 | unsigned val = 0, keychunk, i; |
6805 | | |
6806 | | /* XOR our icookie down to the size of a unsigned */ |
6807 | 2.84k | for (i = 0; i < COOKIE_SIZE - (COOKIE_SIZE % (unsigned)sizeof(keychunk)); i += (unsigned)sizeof(keychunk)) { |
6808 | 1.89k | memcpy(&keychunk, &i_cookie[i], sizeof(keychunk)); |
6809 | 1.89k | val ^= keychunk; |
6810 | 1.89k | } |
6811 | | |
6812 | 947 | return val; |
6813 | 947 | } |
6814 | | |
6815 | | static int |
6816 | 885 | isakmp_equal_func(const void *ic1, const void *ic2) { |
6817 | | |
6818 | 885 | if (memcmp(ic1, ic2, COOKIE_SIZE) == 0) |
6819 | 581 | return 1; |
6820 | | |
6821 | 304 | return 0; |
6822 | 885 | } |
6823 | | |
6824 | 9.74k | static unsigned ikev2_key_hash_func(const void *k) { |
6825 | 9.74k | const ikev2_uat_data_key_t *key = (const ikev2_uat_data_key_t*)k; |
6826 | 9.74k | unsigned hash, *key_segs; |
6827 | 9.74k | size_t key_segcount, i; |
6828 | | |
6829 | 9.74k | hash = 0; |
6830 | | |
6831 | | /* |
6832 | | * XOR our icookie down to the size of a unsigned. |
6833 | | * |
6834 | | * The cast to unsigned suppresses a warning 64-bit-to-32-bit narrowing |
6835 | | * from some buggy C compilers (I'm looking at *you*, |
6836 | | * i686-apple-darwin11-llvm-gcc-4.2 (GCC) 4.2.1 |
6837 | | * (Based on Apple Inc. build 5658) (LLVM build 2336.11.00).) |
6838 | | */ |
6839 | 9.74k | key_segcount = key->spii_len / (unsigned)sizeof(unsigned); |
6840 | 9.74k | key_segs = (unsigned *)key->spii; |
6841 | 29.2k | for (i = 0; i < key_segcount; i++) { |
6842 | 19.4k | hash ^= key_segs[i]; |
6843 | 19.4k | } |
6844 | 9.74k | key_segcount = key->spir_len / (unsigned)sizeof(unsigned); |
6845 | 9.74k | key_segs = (unsigned *)key->spir; |
6846 | 29.2k | for (i = 0; i < key_segcount; i++) { |
6847 | 19.4k | hash ^= key_segs[i]; |
6848 | 19.4k | } |
6849 | | |
6850 | 9.74k | return hash; |
6851 | 9.74k | } |
6852 | | |
6853 | 0 | static int ikev2_key_equal_func(const void *k1, const void *k2) { |
6854 | 0 | const ikev2_uat_data_key_t *key1 = (const ikev2_uat_data_key_t *)k1; |
6855 | 0 | const ikev2_uat_data_key_t *key2 = (const ikev2_uat_data_key_t *)k2; |
6856 | 0 | if (key1->spii_len != key2->spii_len) return 0; |
6857 | 0 | if (key1->spir_len != key2->spir_len) return 0; |
6858 | 0 | if (memcmp(key1->spii, key2->spii, key1->spii_len) != 0) return 0; |
6859 | 0 | if (memcmp(key1->spir, key2->spir, key1->spir_len) != 0) return 0; |
6860 | | |
6861 | 0 | return 1; |
6862 | 0 | } |
6863 | | |
6864 | | static void |
6865 | | free_cookie_key(void *key_arg) |
6866 | 0 | { |
6867 | 0 | uint8_t *ic_key = (uint8_t *)key_arg; |
6868 | |
|
6869 | 0 | g_slice_free1(COOKIE_SIZE, ic_key); |
6870 | 0 | } |
6871 | | |
6872 | | static void |
6873 | | free_cookie_value(void *value) |
6874 | 0 | { |
6875 | 0 | decrypt_data_t *decr = (decrypt_data_t *)value; |
6876 | |
|
6877 | 0 | g_free(decr->gi); |
6878 | 0 | g_free(decr->gr); |
6879 | 0 | g_hash_table_destroy(decr->iv_hash); |
6880 | 0 | g_slice_free1(sizeof(decrypt_data_t), decr); |
6881 | 0 | } |
6882 | | |
6883 | | static void |
6884 | 16 | isakmp_init_protocol(void) { |
6885 | 16 | unsigned i; |
6886 | 16 | decrypt_data_t *decr; |
6887 | 16 | uint8_t *ic_key; |
6888 | 16 | isakmp_hash = g_hash_table_new_full(isakmp_hash_func, isakmp_equal_func, |
6889 | 16 | free_cookie_key, free_cookie_value); |
6890 | | |
6891 | 16 | for (i = 0; i < num_ikev1_uat_data; i++) { |
6892 | 0 | ic_key = (uint8_t *)g_slice_alloc(COOKIE_SIZE); |
6893 | 0 | memcpy(ic_key, ikev1_uat_data[i].icookie, COOKIE_SIZE); |
6894 | |
|
6895 | 0 | decr = create_decrypt_data(); |
6896 | 0 | memcpy(decr->secret, ikev1_uat_data[i].key, ikev1_uat_data[i].key_len); |
6897 | 0 | decr->secret_len = ikev1_uat_data[i].key_len; |
6898 | |
|
6899 | 0 | g_hash_table_insert(isakmp_hash, ic_key, decr); |
6900 | 0 | } |
6901 | 16 | ikev2_key_hash = g_hash_table_new(ikev2_key_hash_func, ikev2_key_equal_func); |
6902 | 16 | for (i = 0; i < num_ikev2_uat_data; i++) { |
6903 | 0 | g_hash_table_insert(ikev2_key_hash, &(ikev2_uat_data[i].key), &(ikev2_uat_data[i])); |
6904 | | /* Need find references to algorithms (as UAT table editing looses data not stored in file) */ |
6905 | 0 | ikev2_uat_data[i].encr_spec = ikev2_decrypt_find_encr_spec(ikev2_uat_data[i].encr_alg); |
6906 | 0 | ikev2_uat_data[i].auth_spec = ikev2_decrypt_find_auth_spec(ikev2_uat_data[i].auth_alg); |
6907 | 0 | } |
6908 | 16 | defrag_next_payload_hash = g_hash_table_new(g_direct_hash, g_direct_equal); |
6909 | 16 | } |
6910 | | |
6911 | | static void |
6912 | 0 | isakmp_cleanup_protocol(void) { |
6913 | 0 | g_hash_table_destroy(isakmp_hash); |
6914 | 0 | g_hash_table_destroy(ikev2_key_hash); |
6915 | 0 | g_hash_table_destroy(defrag_next_payload_hash); |
6916 | 0 | } |
6917 | | |
6918 | 0 | UAT_BUFFER_CB_DEF(ikev1_users, icookie, ikev1_uat_data_key_t, icookie, icookie_len) Unexecuted instantiation: packet-ike.c:ikev1_users_icookie_set_cb Unexecuted instantiation: packet-ike.c:ikev1_users_icookie_tostr_cb |
6919 | 0 | UAT_BUFFER_CB_DEF(ikev1_users, key, ikev1_uat_data_key_t, key, key_len) Unexecuted instantiation: packet-ike.c:ikev1_users_key_set_cb Unexecuted instantiation: packet-ike.c:ikev1_users_key_tostr_cb |
6920 | | |
6921 | 0 | static bool ikev1_uat_data_update_cb(void* p, char** err) { |
6922 | 0 | const ikev1_uat_data_key_t *ud = (ikev1_uat_data_key_t *)p; |
6923 | |
|
6924 | 0 | if (ud->icookie_len != COOKIE_SIZE) { |
6925 | 0 | *err = ws_strdup_printf("Length of Initiator's COOKIE must be %d octets (%d hex characters).", COOKIE_SIZE, COOKIE_SIZE * 2); |
6926 | 0 | return false; |
6927 | 0 | } |
6928 | | |
6929 | 0 | if (ud->key_len == 0) { |
6930 | 0 | *err = g_strdup("Must have Encryption key."); |
6931 | 0 | return false; |
6932 | 0 | } |
6933 | | |
6934 | 0 | if (ud->key_len > MAX_KEY_SIZE) { |
6935 | 0 | *err = ws_strdup_printf("Length of Encryption key limited to %d octets (%d hex characters).", MAX_KEY_SIZE, MAX_KEY_SIZE * 2); |
6936 | 0 | return false; |
6937 | 0 | } |
6938 | | |
6939 | 0 | return true; |
6940 | 0 | } |
6941 | | |
6942 | | static void* |
6943 | | ikev1_uat_data_copy_cb(void *dest, const void *source, size_t len _U_) |
6944 | 0 | { |
6945 | 0 | const ikev1_uat_data_key_t* o = (const ikev1_uat_data_key_t*)source; |
6946 | 0 | ikev1_uat_data_key_t* d = (ikev1_uat_data_key_t*)dest; |
6947 | |
|
6948 | 0 | d->icookie = (unsigned char *)g_memdup2(o->icookie, o->icookie_len); |
6949 | 0 | d->icookie_len = o->icookie_len; |
6950 | 0 | d->key = (unsigned char *)g_memdup2(o->key, o->key_len); |
6951 | 0 | d->key_len = o->key_len; |
6952 | |
|
6953 | 0 | return dest; |
6954 | 0 | } |
6955 | | |
6956 | | static void |
6957 | | ikev1_uat_data_free_cb(void *r) |
6958 | 0 | { |
6959 | 0 | ikev1_uat_data_key_t *rec = (ikev1_uat_data_key_t *)r; |
6960 | 0 | g_free(rec->icookie); |
6961 | 0 | g_free(rec->key); |
6962 | 0 | } |
6963 | | |
6964 | 0 | UAT_BUFFER_CB_DEF(ikev2_users, spii, ikev2_uat_data_t, key.spii, key.spii_len) Unexecuted instantiation: packet-ike.c:ikev2_users_spii_set_cb Unexecuted instantiation: packet-ike.c:ikev2_users_spii_tostr_cb |
6965 | 0 | UAT_BUFFER_CB_DEF(ikev2_users, spir, ikev2_uat_data_t, key.spir, key.spir_len) Unexecuted instantiation: packet-ike.c:ikev2_users_spir_set_cb Unexecuted instantiation: packet-ike.c:ikev2_users_spir_tostr_cb |
6966 | 0 | UAT_BUFFER_CB_DEF(ikev2_users, sk_ei, ikev2_uat_data_t, sk_ei, sk_ei_len) Unexecuted instantiation: packet-ike.c:ikev2_users_sk_ei_set_cb Unexecuted instantiation: packet-ike.c:ikev2_users_sk_ei_tostr_cb |
6967 | 0 | UAT_BUFFER_CB_DEF(ikev2_users, sk_er, ikev2_uat_data_t, sk_er, sk_er_len) Unexecuted instantiation: packet-ike.c:ikev2_users_sk_er_set_cb Unexecuted instantiation: packet-ike.c:ikev2_users_sk_er_tostr_cb |
6968 | 0 | UAT_VS_DEF(ikev2_users, encr_alg, ikev2_uat_data_t, unsigned, IKEV2_ENCR_3DES, IKEV2_ENCR_3DES_STR) Unexecuted instantiation: packet-ike.c:ikev2_users_encr_alg_set_cb Unexecuted instantiation: packet-ike.c:ikev2_users_encr_alg_tostr_cb |
6969 | 0 | UAT_BUFFER_CB_DEF(ikev2_users, sk_ai, ikev2_uat_data_t, sk_ai, sk_ai_len) Unexecuted instantiation: packet-ike.c:ikev2_users_sk_ai_set_cb Unexecuted instantiation: packet-ike.c:ikev2_users_sk_ai_tostr_cb |
6970 | 0 | UAT_BUFFER_CB_DEF(ikev2_users, sk_ar, ikev2_uat_data_t, sk_ar, sk_ar_len) Unexecuted instantiation: packet-ike.c:ikev2_users_sk_ar_set_cb Unexecuted instantiation: packet-ike.c:ikev2_users_sk_ar_tostr_cb |
6971 | 0 | UAT_VS_DEF(ikev2_users, auth_alg, ikev2_uat_data_t, unsigned, IKEV2_AUTH_HMAC_SHA1_96, IKEV2_AUTH_HMAC_SHA1_96_STR) Unexecuted instantiation: packet-ike.c:ikev2_users_auth_alg_set_cb Unexecuted instantiation: packet-ike.c:ikev2_users_auth_alg_tostr_cb |
6972 | | |
6973 | | static void* |
6974 | | ikev2_uat_data_copy_cb(void *dest, const void *source, size_t len _U_) |
6975 | 0 | { |
6976 | 0 | const ikev2_uat_data_t* o = (const ikev2_uat_data_t*)source; |
6977 | 0 | ikev2_uat_data_t* d = (ikev2_uat_data_t*)dest; |
6978 | |
|
6979 | 0 | d->key.spii = (unsigned char *)g_memdup2(o->key.spii, o->key.spii_len); |
6980 | 0 | d->key.spii_len = o->key.spii_len; |
6981 | |
|
6982 | 0 | d->key.spir = (unsigned char *)g_memdup2(o->key.spir, o->key.spir_len); |
6983 | 0 | d->key.spir_len = o->key.spir_len; |
6984 | |
|
6985 | 0 | d->encr_alg = o->encr_alg; |
6986 | 0 | d->auth_alg = o->auth_alg; |
6987 | |
|
6988 | 0 | d->sk_ei = (unsigned char *)g_memdup2(o->sk_ei, o->sk_ei_len); |
6989 | 0 | d->sk_ei_len = o->sk_ei_len; |
6990 | |
|
6991 | 0 | d->sk_er = (unsigned char *)g_memdup2(o->sk_er, o->sk_er_len); |
6992 | 0 | d->sk_er_len = o->sk_er_len; |
6993 | |
|
6994 | 0 | d->sk_ai = (unsigned char *)g_memdup2(o->sk_ai, o->sk_ai_len); |
6995 | 0 | d->sk_ai_len = o->sk_ai_len; |
6996 | |
|
6997 | 0 | d->sk_ar = (unsigned char *)g_memdup2(o->sk_ar, o->sk_ar_len); |
6998 | 0 | d->sk_ar_len = o->sk_ar_len; |
6999 | |
|
7000 | 0 | d->encr_spec = (const ikev2_encr_alg_spec_t *)g_memdup2(o->encr_spec, sizeof(ikev2_encr_alg_spec_t)); |
7001 | 0 | d->auth_spec = (const ikev2_auth_alg_spec_t *)g_memdup2(o->auth_spec, sizeof(ikev2_auth_alg_spec_t)); |
7002 | |
|
7003 | 0 | return dest; |
7004 | 0 | } |
7005 | | |
7006 | 0 | static bool ikev2_uat_data_update_cb(void* p, char** err) { |
7007 | 0 | ikev2_uat_data_t *ud = (ikev2_uat_data_t *)p; |
7008 | |
|
7009 | 0 | if (ud->key.spii_len != COOKIE_SIZE) { |
7010 | 0 | *err = ws_strdup_printf("Length of Initiator's SPI must be %d octets (%d hex characters).", COOKIE_SIZE, COOKIE_SIZE * 2); |
7011 | 0 | return false; |
7012 | 0 | } |
7013 | | |
7014 | 0 | if (ud->key.spir_len != COOKIE_SIZE) { |
7015 | 0 | *err = ws_strdup_printf("Length of Responder's SPI must be %d octets (%d hex characters).", COOKIE_SIZE, COOKIE_SIZE * 2); |
7016 | 0 | return false; |
7017 | 0 | } |
7018 | | |
7019 | 0 | if ((ud->encr_spec = ikev2_decrypt_find_encr_spec(ud->encr_alg)) == NULL) { |
7020 | 0 | REPORT_DISSECTOR_BUG("Couldn't get IKEv2 encryption algorithm spec."); |
7021 | 0 | } |
7022 | |
|
7023 | 0 | if ((ud->auth_spec = ikev2_decrypt_find_auth_spec(ud->auth_alg)) == NULL) { |
7024 | 0 | REPORT_DISSECTOR_BUG("Couldn't get IKEv2 authentication algorithm spec."); |
7025 | 0 | } |
7026 | |
|
7027 | 0 | if (ud->encr_spec->icv_len && ud->auth_spec->number != IKEV2_AUTH_NONE) { |
7028 | 0 | char* encr_str = val_to_str(NULL, ud->encr_spec->number, vs_ikev2_encr_algs, "other-%d"); |
7029 | 0 | *err = ws_strdup_printf("Selected encryption_algorithm %s requires selecting NONE integrity algorithm.", encr_str); |
7030 | 0 | wmem_free(NULL, encr_str); |
7031 | 0 | return false; |
7032 | 0 | } |
7033 | | |
7034 | 0 | if (ud->sk_ei_len != ud->encr_spec->key_len) { |
7035 | 0 | *err = ws_strdup_printf("Length of SK_ei (%u octets) does not match the key length (%u octets) of the selected encryption algorithm.", |
7036 | 0 | ud->sk_ei_len, ud->encr_spec->key_len); |
7037 | 0 | return false; |
7038 | 0 | } |
7039 | | |
7040 | 0 | if (ud->sk_er_len != ud->encr_spec->key_len) { |
7041 | 0 | *err = ws_strdup_printf("Length of SK_er (%u octets) does not match the key length (%u octets) of the selected encryption algorithm.", |
7042 | 0 | ud->sk_er_len, ud->encr_spec->key_len); |
7043 | 0 | return false; |
7044 | 0 | } |
7045 | | |
7046 | 0 | if (ud->sk_ai_len != ud->auth_spec->key_len) { |
7047 | 0 | *err = ws_strdup_printf("Length of SK_ai (%u octets) does not match the key length (%u octets) of the selected integrity algorithm.", |
7048 | 0 | ud->sk_ai_len, ud->auth_spec->key_len); |
7049 | 0 | return false; |
7050 | 0 | } |
7051 | | |
7052 | 0 | if (ud->sk_ar_len != ud->auth_spec->key_len) { |
7053 | 0 | *err = ws_strdup_printf("Length of SK_ar (%u octets) does not match the key length (%u octets) of the selected integrity algorithm.", |
7054 | 0 | ud->sk_ar_len, ud->auth_spec->key_len); |
7055 | 0 | return false; |
7056 | 0 | } |
7057 | | |
7058 | 0 | return true; |
7059 | 0 | } |
7060 | | |
7061 | | static void |
7062 | | ikev2_uat_data_free_cb(void *r) |
7063 | 0 | { |
7064 | 0 | ikev2_uat_data_t *rec = (ikev2_uat_data_t *)r; |
7065 | 0 | g_free(rec->key.spii); |
7066 | 0 | g_free(rec->key.spir); |
7067 | 0 | g_free(rec->sk_ei); |
7068 | 0 | g_free(rec->sk_er); |
7069 | 0 | g_free(rec->sk_ai); |
7070 | 0 | g_free(rec->sk_ar); |
7071 | 0 | } |
7072 | | |
7073 | | void |
7074 | | proto_register_isakmp(void) |
7075 | 16 | { |
7076 | 16 | module_t *isakmp_module; |
7077 | 16 | static hf_register_info hf[] = { |
7078 | 16 | { &hf_isakmp_ispi, |
7079 | 16 | { "Initiator SPI", "ike.ispi", |
7080 | 16 | FT_BYTES, BASE_NONE, NULL, 0x0, |
7081 | 16 | NULL, HFILL }}, |
7082 | 16 | { &hf_isakmp_rspi, |
7083 | 16 | { "Responder SPI", "ike.rspi", |
7084 | 16 | FT_BYTES, BASE_NONE, NULL, 0x0, |
7085 | 16 | NULL, HFILL }}, |
7086 | 16 | { &hf_isakmp_typepayload, |
7087 | 16 | { "Payload", "ike.typepayload", |
7088 | 16 | FT_UINT8,BASE_RANGE_STRING | BASE_DEC, RVALS(payload_type), 0x0, |
7089 | 16 | NULL, HFILL }}, |
7090 | 16 | { &hf_isakmp_nextpayload, |
7091 | 16 | { "Next payload", "ike.nextpayload", |
7092 | 16 | FT_UINT8, BASE_RANGE_STRING | BASE_DEC, RVALS(payload_type), 0x0, |
7093 | 16 | NULL, HFILL }}, |
7094 | 16 | { &hf_isakmp_criticalpayload, |
7095 | 16 | { "Critical Bit", "ike.criticalpayload", |
7096 | 16 | FT_BOOLEAN, 8,TFS(&tfs_critical_not_critical), 0x80, |
7097 | 16 | "IKEv2 Critical Payload", HFILL }}, |
7098 | 16 | { &hf_isakmp_reserved7, |
7099 | 16 | { "Reserved", "ike.reserved7", |
7100 | 16 | FT_UINT8, BASE_HEX, NULL, 0x7F, |
7101 | 16 | NULL, HFILL }}, |
7102 | 16 | { &hf_isakmp_reserved, |
7103 | 16 | { "Reserved", "ike.reserved", |
7104 | 16 | FT_BYTES, BASE_NONE, NULL, 0x0, |
7105 | 16 | NULL, HFILL }}, |
7106 | 16 | { &hf_isakmp_extradata, |
7107 | 16 | { "Extra data", "ike.extradata", |
7108 | 16 | FT_BYTES, BASE_NONE, NULL, 0x0, |
7109 | 16 | NULL, HFILL }}, |
7110 | 16 | { &hf_isakmp_datapayload, |
7111 | 16 | { "Data Payload", "ike.datapayload", |
7112 | 16 | FT_BYTES, BASE_NONE, NULL, 0x0, |
7113 | 16 | "Data Payload (undissected)", HFILL }}, |
7114 | 16 | { &hf_isakmp_version, |
7115 | 16 | { "Version", "ike.version", |
7116 | 16 | FT_UINT8, BASE_HEX, NULL, 0x0, |
7117 | 16 | "IKE Version (major + minor)", HFILL }}, |
7118 | 16 | { &hf_isakmp_mjver, |
7119 | 16 | { "MjVer", "ike.mjver", |
7120 | 16 | FT_UINT8, BASE_HEX, NULL, 0xF0, |
7121 | 16 | NULL, HFILL }}, |
7122 | 16 | { &hf_isakmp_mnver, |
7123 | 16 | { "MnVer", "ike.mnver", |
7124 | 16 | FT_UINT8, BASE_HEX, NULL, 0x0F, |
7125 | 16 | NULL, HFILL }}, |
7126 | 16 | { &hf_isakmp_exchangetype_v1, |
7127 | 16 | { "Exchange type", "ike.exchangetype", |
7128 | 16 | FT_UINT8, BASE_DEC, VALS(exchange_v1_type), 0x0, |
7129 | 16 | NULL, HFILL }}, |
7130 | 16 | { &hf_isakmp_exchangetype_v2, |
7131 | 16 | { "Exchange type", "ike.exchangetype", |
7132 | 16 | FT_UINT8, BASE_DEC, VALS(exchange_v2_type), 0x0, |
7133 | 16 | NULL, HFILL }}, |
7134 | 16 | { &hf_isakmp_flags, |
7135 | 16 | { "Flags", "ike.flags", |
7136 | 16 | FT_UINT8, BASE_HEX, NULL, 0x0, |
7137 | 16 | NULL, HFILL }}, |
7138 | 16 | { &hf_isakmp_flag_e, |
7139 | 16 | { "Encryption", "ike.flag_e", |
7140 | 16 | FT_BOOLEAN, 8, TFS(&flag_e), E_FLAG, |
7141 | 16 | "Encryption Bit", HFILL }}, |
7142 | 16 | { &hf_isakmp_flag_c, |
7143 | 16 | { "Commit", "ike.flag_c", |
7144 | 16 | FT_BOOLEAN, 8, TFS(&flag_c), C_FLAG, |
7145 | 16 | "Commit Bit", HFILL }}, |
7146 | 16 | { &hf_isakmp_flag_a, |
7147 | 16 | { "Authentication", "ike.flag_a", |
7148 | 16 | FT_BOOLEAN, 8, TFS(&flag_a), A_FLAG, |
7149 | 16 | "Authentication Bit", HFILL }}, |
7150 | 16 | { &hf_isakmp_flag_i, |
7151 | 16 | { "Initiator", "ike.flag_i", |
7152 | 16 | FT_BOOLEAN, 8, TFS(&flag_i), I_FLAG, |
7153 | 16 | "Initiator Bit", HFILL }}, |
7154 | 16 | { &hf_isakmp_flag_v, |
7155 | 16 | { "Version", "ike.flag_v", |
7156 | 16 | FT_BOOLEAN, 8, TFS(&flag_v), V_FLAG, |
7157 | 16 | "Version Bit", HFILL }}, |
7158 | 16 | { &hf_isakmp_flag_r, |
7159 | 16 | { "Response", "ike.flag_r", |
7160 | 16 | FT_BOOLEAN, 8, TFS(&tfs_response_request), R_FLAG, |
7161 | 16 | "Response Bit", HFILL }}, |
7162 | 16 | { &hf_isakmp_messageid, |
7163 | 16 | { "Message ID", "ike.messageid", |
7164 | 16 | FT_UINT32, BASE_HEX, NULL, 0x0, |
7165 | 16 | NULL, HFILL }}, |
7166 | 16 | { &hf_isakmp_length, |
7167 | 16 | { "Length", "ike.length", |
7168 | 16 | FT_UINT32, BASE_DEC, NULL, 0x0, |
7169 | 16 | NULL, HFILL }}, |
7170 | 16 | { &hf_isakmp_payloadlen, |
7171 | 16 | { "Payload length", "ike.payloadlength", |
7172 | 16 | FT_UINT16, BASE_DEC, NULL, 0x0, |
7173 | 16 | NULL, HFILL }}, |
7174 | 16 | { &hf_isakmp_sa_doi, |
7175 | 16 | { "Domain of interpretation", "ike.sa.doi", |
7176 | 16 | FT_UINT32, BASE_DEC, VALS(doi_type), 0x0, |
7177 | 16 | NULL, HFILL }}, |
7178 | 16 | { &hf_isakmp_sa_situation, |
7179 | 16 | { "Situation", "ike.sa.situation", |
7180 | 16 | FT_BYTES, BASE_NONE, NULL, 0x0, |
7181 | 16 | "SA Situation", HFILL }}, |
7182 | 16 | { &hf_isakmp_sa_attribute_next_payload, |
7183 | 16 | { "SA Attribute Next Payload", "ike.sa.next_attribute_payload", |
7184 | 16 | FT_BYTES, BASE_NONE, NULL, 0x0, |
7185 | 16 | "Payloads that define specific security association attributes for the KEK and/or TEKs", HFILL }}, |
7186 | 16 | { &hf_isakmp_reserved2, |
7187 | 16 | { "Reserved2", "ike.reserved2", |
7188 | 16 | FT_BYTES, BASE_NONE, NULL, 0x0, |
7189 | 16 | NULL, HFILL }}, |
7190 | 16 | { &hf_isakmp_sa_situation_identity_only, |
7191 | 16 | { "Identity Only", "ike.sa.situation.identity_only", |
7192 | 16 | FT_BOOLEAN, 32, NULL, SIT_IDENTITY_ONLY, |
7193 | 16 | "The type specifies that the SA will be identified by source identity information present in an associated Identification Payload", HFILL }}, |
7194 | 16 | { &hf_isakmp_sa_situation_secrecy, |
7195 | 16 | { "Secrecy", "ike.sa.situation.secrecy", |
7196 | 16 | FT_BOOLEAN, 32, NULL, SIT_SECRECY, |
7197 | 16 | "The type specifies that the SA is being negotiated in an environment that requires labeled secrecy.", HFILL }}, |
7198 | 16 | { &hf_isakmp_sa_situation_integrity, |
7199 | 16 | { "Integrity", "ike.sa.situation.integrity", |
7200 | 16 | FT_BOOLEAN, 32, NULL, SIT_INTEGRITY, |
7201 | 16 | "The type specifies that the SA is being negotiated in an environment that requires labeled integrity", HFILL }}, |
7202 | 16 | { &hf_isakmp_prop_protoid_v1, |
7203 | 16 | { "Protocol ID", "ike.prop.protoid", |
7204 | 16 | FT_UINT32, BASE_DEC, VALS(protoid_v1_type), 0x0, |
7205 | 16 | "IKEv1 Proposal Protocol ID", HFILL }}, |
7206 | 16 | { &hf_isakmp_prop_protoid_v2, |
7207 | 16 | { "Protocol ID", "ike.prop.protoid", |
7208 | 16 | FT_UINT32, BASE_DEC, VALS(protoid_v2_type), 0x0, |
7209 | 16 | "IKEv2 Proposal Protocol ID", HFILL }}, |
7210 | 16 | { &hf_isakmp_prop_number, |
7211 | 16 | { "Proposal number", "ike.prop.number", |
7212 | 16 | FT_UINT8, BASE_DEC, NULL, 0x0, |
7213 | 16 | NULL, HFILL }}, |
7214 | 16 | { &hf_isakmp_spisize, |
7215 | 16 | { "SPI Size", "ike.spisize", |
7216 | 16 | FT_UINT8, BASE_DEC, NULL, 0x0, |
7217 | 16 | NULL, HFILL }}, |
7218 | 16 | { &hf_isakmp_spi, |
7219 | 16 | { "SPI", "ike.spi", |
7220 | 16 | FT_BYTES, BASE_NONE, NULL, 0x0, |
7221 | 16 | NULL, HFILL }}, |
7222 | 16 | { &hf_isakmp_prop_transforms, |
7223 | 16 | { "Proposal transforms", "ike.prop.transforms", |
7224 | 16 | FT_UINT8, BASE_DEC, NULL, 0x0, |
7225 | 16 | NULL, HFILL }}, |
7226 | 16 | { &hf_isakmp_trans_number, |
7227 | 16 | { "Transform number", "ike.trans.number", |
7228 | 16 | FT_UINT8, BASE_DEC, NULL, 0x0, |
7229 | 16 | NULL, HFILL }}, |
7230 | 16 | { &hf_isakmp_trans_id, |
7231 | 16 | { "Transform ID", "ike.trans.id", |
7232 | 16 | FT_UINT8, BASE_DEC, NULL, 0x0, |
7233 | 16 | NULL, HFILL }}, |
7234 | 16 | { &hf_isakmp_id_type_v1, |
7235 | 16 | { "ID type", "ike.id.type", |
7236 | 16 | FT_UINT8, BASE_RANGE_STRING | BASE_DEC, RVALS(vs_v1_id_type), 0x0, |
7237 | 16 | "IKEv1 ID Type", HFILL }}, |
7238 | 16 | { &hf_isakmp_id_type_v2, |
7239 | 16 | { "ID type", "ike.id.type", |
7240 | 16 | FT_UINT8, BASE_RANGE_STRING | BASE_DEC, RVALS(vs_v2_id_type), 0x0, |
7241 | 16 | "IKEv2 ID Type", HFILL }}, |
7242 | 16 | { &hf_isakmp_id_protoid, |
7243 | 16 | { "Protocol ID", "ike.id.protoid", |
7244 | 16 | FT_UINT8, BASE_DEC|BASE_EXT_STRING, &ipproto_val_ext, 0x0, |
7245 | 16 | "ID Protocol ID", HFILL }}, |
7246 | 16 | { &hf_isakmp_id_port, |
7247 | 16 | { "Port", "ike.id.port", |
7248 | 16 | FT_UINT16, BASE_DEC, NULL, 0x0, |
7249 | 16 | "ID Port", HFILL }}, |
7250 | 16 | { &hf_isakmp_id_data, |
7251 | 16 | { "Identification Data:", "ike.id.data", |
7252 | 16 | FT_NONE, BASE_NONE, NULL, 0x0, |
7253 | 16 | NULL, HFILL }}, |
7254 | 16 | { &hf_isakmp_id_data_ipv4_addr, |
7255 | 16 | { "ID_IPV4_ADDR", "ike.id.data.ipv4_addr", |
7256 | 16 | FT_IPv4, BASE_NONE, NULL, 0x0, |
7257 | 16 | "The type specifies a single four (4) octet IPv4 address", HFILL }}, |
7258 | 16 | { &hf_isakmp_id_data_fqdn, |
7259 | 16 | { "ID_FQDN", "ike.id.data.fqdn", |
7260 | 16 | FT_STRING, BASE_NONE, NULL, 0x0, |
7261 | 16 | "The type specifies a fully-qualified domain name string", HFILL }}, |
7262 | 16 | { &hf_isakmp_id_data_user_fqdn, |
7263 | 16 | { "ID_FQDN", "ike.id.data.user_fqdn", |
7264 | 16 | FT_STRING, BASE_NONE, NULL, 0x0, |
7265 | 16 | "The type specifies a fully-qualified username string", HFILL }}, |
7266 | 16 | { &hf_isakmp_id_data_ipv4_subnet, |
7267 | 16 | { "ID_IPV4_SUBNET", "ike.id.data.ipv4_subnet", |
7268 | 16 | FT_IPv4, BASE_NONE, NULL, 0x0, |
7269 | 16 | "The second is an IPv4 network mask", HFILL }}, |
7270 | 16 | { &hf_isakmp_id_data_ipv4_range_start, |
7271 | 16 | { "ID_IPV4_RANGE (Start)", "ike.id.data.ipv4_range_start", |
7272 | 16 | FT_IPv4, BASE_NONE, NULL, 0x0, |
7273 | 16 | "The first value is the beginning IPv4 address (inclusive)", HFILL }}, |
7274 | 16 | { &hf_isakmp_id_data_ipv4_range_end, |
7275 | 16 | { "ID_IPV4_RANGE (End)", "ike.id.data.ipv4_range_end", |
7276 | 16 | FT_IPv4, BASE_NONE, NULL, 0x0, |
7277 | 16 | "The second value is the ending IPv4 address (inclusive)", HFILL }}, |
7278 | 16 | { &hf_isakmp_id_data_ipv6_addr, |
7279 | 16 | { "ID_IPV6_ADDR", "ike.id.data.ipv6_addr", |
7280 | 16 | FT_IPv6, BASE_NONE, NULL, 0x0, |
7281 | 16 | "The type specifies a single sixteen (16) octet IPv6 address", HFILL }}, |
7282 | 16 | { &hf_isakmp_id_data_ipv6_subnet, |
7283 | 16 | { "ID_IPV6A_ADDR_SUBNET", "ike.id.data.ipv6_subnet", |
7284 | 16 | FT_IPv6, BASE_NONE, NULL, 0x0, |
7285 | 16 | "The type specifies a range of IPv6 addresses represented by two sixteen (16) octet values", HFILL }}, |
7286 | 16 | { &hf_isakmp_id_data_ipv6_range_start, |
7287 | 16 | { "ID_IPV6_ADDR_RANGE (Start)", "ike.id.data.ipv6_range_start", |
7288 | 16 | FT_IPv6, BASE_NONE, NULL, 0x0, |
7289 | 16 | "The first value is the beginning IPv6 address (inclusive)", HFILL }}, |
7290 | 16 | { &hf_isakmp_id_data_ipv6_range_end, |
7291 | 16 | { "ID_IPV6_ADDR_RANGE (End)", "ike.id.data.ipv6_range_end", |
7292 | 16 | FT_IPv6, BASE_NONE, NULL, 0x0, |
7293 | 16 | "the second value is the ending IPv6 address (inclusive)", HFILL }}, |
7294 | 16 | { &hf_isakmp_id_data_key_id, |
7295 | 16 | { "ID_KEY_ID", "ike.id.data.key_id", |
7296 | 16 | FT_BYTES, BASE_NONE, NULL, 0x0, |
7297 | 16 | "The type specifies an opaque byte stream which may be used to pass vendor-specific information necessary to identify which pre-shared key should be used to authenticate Aggressive mode negotiations", HFILL }}, |
7298 | 16 | { &hf_isakmp_id_data_cert, |
7299 | 16 | { "ID_DER_ASN1_DN", "ike.id.data.der_asn1_dn", |
7300 | 16 | FT_UINT32, BASE_DEC, NULL, 0x0, |
7301 | 16 | NULL, HFILL } }, |
7302 | 16 | { &hf_isakmp_cert_encoding_v1, |
7303 | 16 | { "Certificate Encoding", "ike.cert.encoding", |
7304 | 16 | FT_UINT8, BASE_RANGE_STRING | BASE_DEC, RVALS(cert_v1_type), 0x0, |
7305 | 16 | "IKEv1 Certificate Encoding", HFILL }}, |
7306 | 16 | { &hf_isakmp_cert_encoding_v2, |
7307 | 16 | { "Certificate Encoding", "ike.cert.encoding", |
7308 | 16 | FT_UINT8, BASE_RANGE_STRING | BASE_DEC, RVALS(cert_v2_type), 0x0, |
7309 | 16 | "IKEv2 Certificate Encoding", HFILL }}, |
7310 | 16 | { &hf_isakmp_cert_data, |
7311 | 16 | { "Certificate Data", "ike.cert.data", |
7312 | 16 | FT_NONE, BASE_NONE, NULL, 0x0, |
7313 | 16 | NULL, HFILL }}, |
7314 | 16 | { &hf_isakmp_cert_x509_hash, |
7315 | 16 | { "Hash", "ike.cert.x509.hash", |
7316 | 16 | FT_BYTES, BASE_NONE, NULL, 0x0, |
7317 | 16 | NULL, HFILL }}, |
7318 | 16 | { &hf_isakmp_cert_x509_url, |
7319 | 16 | { "URL", "ike.cert.x509.url", |
7320 | 16 | FT_STRING, BASE_NONE, NULL, 0x0, |
7321 | 16 | NULL, HFILL }}, |
7322 | 16 | { &hf_isakmp_certreq_type_v1, |
7323 | 16 | { "Certificate Type", "ike.certreq.type", |
7324 | 16 | FT_UINT8, BASE_RANGE_STRING | BASE_DEC, RVALS(cert_v1_type), 0x0, |
7325 | 16 | "IKEv1 Certificate Type", HFILL }}, |
7326 | 16 | { &hf_isakmp_certreq_type_v2, |
7327 | 16 | { "Certificate Type", "ike.certreq.type", |
7328 | 16 | FT_UINT8, BASE_RANGE_STRING | BASE_DEC, RVALS(cert_v2_type), 0x0, |
7329 | 16 | "IKEv2 Certificate Type", HFILL }}, |
7330 | 16 | { &hf_isakmp_auth_meth, |
7331 | 16 | { "Authentication Method", "ike.auth.method", |
7332 | 16 | FT_UINT8, BASE_RANGE_STRING | BASE_DEC, RVALS(authmeth_v2_type), 0x0, |
7333 | 16 | NULL, HFILL }}, |
7334 | 16 | { &hf_isakmp_auth_data, |
7335 | 16 | { "Authentication Data", "ike.auth.data", |
7336 | 16 | FT_BYTES, BASE_NONE, NULL, 0x0, |
7337 | 16 | NULL, HFILL }}, |
7338 | 16 | { &hf_isakmp_auth_digital_sig_asn1_len, |
7339 | 16 | { "ASN.1 Length", "ike.auth.data.sig.asn1.len", |
7340 | 16 | FT_UINT8, BASE_DEC, NULL, 0x0, |
7341 | 16 | "IKEv2 Authentication Data Digital Signature ASN.1 Length", HFILL } }, |
7342 | 16 | { &hf_isakmp_auth_digital_sig_asn1_data, |
7343 | 16 | { "ASN.1 Data", "ike.auth.data.sig.asn1.data", |
7344 | 16 | FT_BYTES, BASE_NONE, NULL, 0x0, |
7345 | 16 | "IKEv2 Authentication Data Digital Signature ASN.1 Data", HFILL } }, |
7346 | 16 | { &hf_isakmp_auth_digital_sig_value, |
7347 | 16 | { "Signature Value", "ike.auth.data.sig.value", |
7348 | 16 | FT_BYTES, BASE_NONE, NULL, 0x0, |
7349 | 16 | "IKEv2 Authentication Data Digital Signature Value", HFILL } }, |
7350 | 16 | { &hf_isakmp_notify_doi, |
7351 | 16 | { "Domain of interpretation", "ike.notify.doi", |
7352 | 16 | FT_UINT32, BASE_DEC, VALS(doi_type), 0x0, |
7353 | 16 | "IKEv1 Notify Domain of Interpretation", HFILL }}, |
7354 | 16 | { &hf_isakmp_notify_protoid_v1, |
7355 | 16 | { "Protocol ID", "ike.notify.protoid", |
7356 | 16 | FT_UINT32, BASE_DEC, VALS(protoid_v1_type), 0x0, |
7357 | 16 | "IKEv1 Notify Protocol ID", HFILL }}, |
7358 | 16 | { &hf_isakmp_notify_protoid_v2, |
7359 | 16 | { "Protocol ID", "ike.notify.protoid", |
7360 | 16 | FT_UINT32, BASE_DEC, VALS(protoid_v2_type), 0x0, |
7361 | 16 | "IKEv2 Notify Protocol ID", HFILL }}, |
7362 | 16 | { &hf_isakmp_notify_msgtype_v1, |
7363 | 16 | { "Notify Message Type", "ike.notify.msgtype", |
7364 | 16 | FT_UINT16, BASE_RANGE_STRING | BASE_DEC, RVALS(notifmsg_v1_type), 0x0, |
7365 | 16 | "IKEv1 Notify Message Type", HFILL }}, |
7366 | 16 | { &hf_isakmp_notify_msgtype_v2, |
7367 | 16 | { "Notify Message Type", "ike.notify.msgtype", |
7368 | 16 | FT_UINT16, BASE_RANGE_STRING | BASE_DEC, RVALS(notifmsg_v2_type), 0x0, |
7369 | 16 | "IKEv2 Notify Message Type", HFILL }}, |
7370 | 16 | { &hf_isakmp_notify_data, |
7371 | 16 | { "Notification DATA", "ike.notify.data", |
7372 | 16 | FT_BYTES, BASE_NONE, NULL, 0x0, |
7373 | 16 | NULL, HFILL }}, |
7374 | 16 | { &hf_isakmp_notify_data_dpd_are_you_there, |
7375 | 16 | { "DPD ARE-YOU-THERE sequence", "ike.notify.data.dpd.are_you_there", |
7376 | 16 | FT_UINT32, BASE_DEC, NULL, 0x0, |
7377 | 16 | NULL, HFILL }}, |
7378 | 16 | { &hf_isakmp_notify_data_dpd_are_you_there_ack, |
7379 | 16 | { "DPD ARE-YOU-THERE-ACK sequence", "ike.notify.data.dpd.are_you_there_ack", |
7380 | 16 | FT_UINT32, BASE_DEC, NULL, 0x0, |
7381 | 16 | NULL, HFILL }}, |
7382 | 16 | { &hf_isakmp_notify_data_unity_load_balance, |
7383 | 16 | { "UNITY LOAD BALANCE", "ike.notify.data.unity.load_balance", |
7384 | 16 | FT_IPv4, BASE_NONE, NULL, 0x0, |
7385 | 16 | NULL, HFILL }}, |
7386 | 16 | { &hf_isakmp_notify_data_fortinet_network_overlay_id, |
7387 | 16 | { "Network Overlay ID", "ike.notify.data.fortinet.network_overlay_id", |
7388 | 16 | FT_UINT8, BASE_DEC_HEX, NULL, 0x0, |
7389 | 16 | NULL, HFILL }}, |
7390 | 16 | { &hf_isakmp_notify_data_fortinet_forticlient_connect, |
7391 | 16 | { "Forticlient connect", "ike.notify.data.fortinet.forticlient_connect", |
7392 | 16 | FT_STRING, BASE_NONE, NULL, 0x0, |
7393 | 16 | NULL, HFILL }}, |
7394 | 16 | { &hf_isakmp_notify_data_fortinet_forticlient_connect_item, |
7395 | 16 | { "Config", "ike.notify.data.fortinet.forticlient_connect.item", |
7396 | 16 | FT_STRING, BASE_NONE, NULL, 0x0, |
7397 | 16 | NULL, HFILL }}, |
7398 | 16 | { &hf_isakmp_notify_data_fortinet_forticlient_connect_type, |
7399 | 16 | { "Type", "ike.notify.data.fortinet.forticlient_connect.type", |
7400 | 16 | FT_STRING, BASE_NONE, NULL, 0x0, |
7401 | 16 | NULL, HFILL }}, |
7402 | 16 | { &hf_isakmp_notify_data_fortinet_forticlient_connect_value, |
7403 | 16 | { "Value", "ike.notify.data.fortinet.forticlient_connect.value", |
7404 | 16 | FT_STRING, BASE_NONE, NULL, 0x0, |
7405 | 16 | NULL, HFILL }}, |
7406 | 16 | { &hf_isakmp_notify_data_fortinet_forticlient_connect_ver, |
7407 | 16 | { "Ver", "ike.notify.data.fortinet.forticlient_connect.ver", |
7408 | 16 | FT_STRING, BASE_NONE, NULL, 0x0, |
7409 | 16 | NULL, HFILL }}, |
7410 | 16 | { &hf_isakmp_notify_data_fortinet_forticlient_connect_fctver, |
7411 | 16 | { "FCTVER", "ike.notify.data.fortinet.forticlient_connect.fctver", |
7412 | 16 | FT_STRING, BASE_NONE, NULL, 0x0, |
7413 | 16 | NULL, HFILL }}, |
7414 | 16 | { &hf_isakmp_notify_data_fortinet_forticlient_connect_uid, |
7415 | 16 | { "UID", "ike.notify.data.fortinet.forticlient_connect.uid", |
7416 | 16 | FT_STRING, BASE_NONE, NULL, 0x0, |
7417 | 16 | NULL, HFILL }}, |
7418 | 16 | { &hf_isakmp_notify_data_fortinet_forticlient_connect_ip, |
7419 | 16 | { "IP", "ike.notify.data.fortinet.forticlient_connect.ip", |
7420 | 16 | FT_STRING, BASE_NONE, NULL, 0x0, |
7421 | 16 | NULL, HFILL }}, |
7422 | 16 | { &hf_isakmp_notify_data_fortinet_forticlient_connect_mac, |
7423 | 16 | { "MAC", "ike.notify.data.fortinet.forticlient_connect.mac", |
7424 | 16 | FT_STRING, BASE_NONE, NULL, 0x0, |
7425 | 16 | NULL, HFILL }}, |
7426 | 16 | { &hf_isakmp_notify_data_fortinet_forticlient_connect_host, |
7427 | 16 | { "Host", "ike.notify.data.fortinet.forticlient_connect.host", |
7428 | 16 | FT_STRING, BASE_NONE, NULL, 0x0, |
7429 | 16 | NULL, HFILL }}, |
7430 | 16 | { &hf_isakmp_notify_data_fortinet_forticlient_connect_user, |
7431 | 16 | { "User", "ike.notify.data.fortinet.forticlient_connect.user", |
7432 | 16 | FT_STRING, BASE_NONE, NULL, 0x0, |
7433 | 16 | NULL, HFILL }}, |
7434 | 16 | { &hf_isakmp_notify_data_fortinet_forticlient_connect_osver, |
7435 | 16 | { "OSVER", "ike.notify.data.fortinet.forticlient_connect.osver", |
7436 | 16 | FT_STRING, BASE_NONE, NULL, 0x0, |
7437 | 16 | NULL, HFILL }}, |
7438 | 16 | { &hf_isakmp_notify_data_fortinet_forticlient_connect_reg_status, |
7439 | 16 | { "REG STATUS", "ike.notify.data.fortinet.forticlient_connect.reg_status", |
7440 | 16 | FT_STRING, BASE_NONE, NULL, 0x0, |
7441 | 16 | NULL, HFILL }}, |
7442 | 16 | { &hf_isakmp_notify_data_fortinet_forticlient_connect_emssn, |
7443 | 16 | { "EMS SN", "ike.notify.data.fortinet.forticlient_connect.emssn", |
7444 | 16 | FT_STRING, BASE_NONE, NULL, 0x0, |
7445 | 16 | NULL, HFILL }}, |
7446 | 16 | { &hf_isakmp_notify_data_fortinet_forticlient_connect_emsid, |
7447 | 16 | { "EMS ID", "ike.notify.data.fortinet.forticlient_connect.emsid", |
7448 | 16 | FT_STRING, BASE_NONE, NULL, 0x0, |
7449 | 16 | NULL, HFILL }}, |
7450 | 16 | { &hf_isakmp_notify_data_accepted_ke_method, |
7451 | 16 | { "Accepted KE method", "ike.notify.data.accepted_ke_method", |
7452 | 16 | FT_UINT16, BASE_DEC, VALS(dh_group), 0x0, |
7453 | 16 | NULL, HFILL }}, |
7454 | 16 | { &hf_isakmp_notify_data_ipcomp_cpi, |
7455 | 16 | { "IPCOMP CPI", "ike.notify.data.ipcomp.cpi", |
7456 | 16 | FT_UINT16, BASE_DEC, NULL, 0x0, |
7457 | 16 | NULL, HFILL }}, |
7458 | 16 | { &hf_isakmp_notify_data_ipcomp_transform_id, |
7459 | 16 | { "IPCOMP Transform ID", "ike.notify.data.ipcomp.transform_id", |
7460 | 16 | FT_UINT8, BASE_DEC, VALS(transform_id_ipcomp), 0x0, |
7461 | 16 | NULL, HFILL }}, |
7462 | 16 | { &hf_isakmp_notify_data_auth_lifetime, |
7463 | 16 | { "Authentication Lifetime", "ike.notify.data.auth_lifetime", |
7464 | 16 | FT_UINT32, BASE_DEC, NULL, 0x0, |
7465 | 16 | NULL, HFILL }}, |
7466 | 16 | { &hf_isakmp_notify_data_redirect_gw_ident_type, |
7467 | 16 | { "Gateway Identity Type", "ike.notify.data.redirect.gw_ident.type", |
7468 | 16 | FT_UINT8, BASE_DEC, VALS(redirect_gateway_identity_type), 0x0, |
7469 | 16 | NULL, HFILL }}, |
7470 | 16 | { &hf_isakmp_notify_data_redirect_gw_ident_len, |
7471 | 16 | { "Gateway Identity Length", "ike.notify.data.redirect.gw_ident.len", |
7472 | 16 | FT_UINT8, BASE_DEC, NULL, 0x0, |
7473 | 16 | NULL, HFILL }}, |
7474 | 16 | { &hf_isakmp_notify_data_redirect_new_resp_gw_ident_ipv4, |
7475 | 16 | { "New Responder Gateway Identity (IPv4)", "ike.notify.data.redirect.new_resp_gw_ident.ipv4", |
7476 | 16 | FT_IPv4, BASE_NONE, NULL, 0x0, |
7477 | 16 | NULL, HFILL }}, |
7478 | 16 | { &hf_isakmp_notify_data_redirect_new_resp_gw_ident_ipv6, |
7479 | 16 | { "New Responder Gateway Identity (IPv6)", "ike.notify.data.redirect.new_resp_gw_ident.ipv6", |
7480 | 16 | FT_IPv6, BASE_NONE, NULL, 0x0, |
7481 | 16 | NULL, HFILL }}, |
7482 | 16 | { &hf_isakmp_notify_data_redirect_new_resp_gw_ident_fqdn, |
7483 | 16 | { "New Responder Gateway Identity (FQDN)", "ike.notify.data.redirect.new_resp_gw_ident.fqdn", |
7484 | 16 | FT_STRING, BASE_NONE, NULL, 0x0, |
7485 | 16 | NULL, HFILL }}, |
7486 | 16 | { &hf_isakmp_notify_data_redirect_new_resp_gw_ident, |
7487 | 16 | { "New Responder Gateway Identity (DATA)", "ike.notify.data.redirect.new_resp_gw_ident.data", |
7488 | 16 | FT_BYTES, BASE_NONE, NULL, 0x0, |
7489 | 16 | NULL, HFILL }}, |
7490 | 16 | { &hf_isakmp_notify_data_redirect_nonce_data, |
7491 | 16 | { "Redirect Nonce Data", "ike.notify.data.redirect.nonce_data", |
7492 | 16 | FT_BYTES, BASE_NONE, NULL, 0x0, |
7493 | 16 | NULL, HFILL }}, |
7494 | 16 | { &hf_isakmp_notify_data_redirect_org_resp_gw_ident_ipv4, |
7495 | 16 | { "Original Responder Gateway Identity (IPv4)", "ike.notify.data.redirect.org_resp_gw_ident.ipv4", |
7496 | 16 | FT_IPv4, BASE_NONE, NULL, 0x0, |
7497 | 16 | NULL, HFILL }}, |
7498 | 16 | { &hf_isakmp_notify_data_redirect_org_resp_gw_ident_ipv6, |
7499 | 16 | { "Original Responder Gateway Identity (IPv6)", "ike.notify.data.redirect.org_resp_gw_ident.ipv6", |
7500 | 16 | FT_IPv6, BASE_NONE, NULL, 0x0, |
7501 | 16 | NULL, HFILL }}, |
7502 | 16 | { &hf_isakmp_notify_data_redirect_org_resp_gw_ident, |
7503 | 16 | { "Original Responder Gateway Identity (DATA)", "ike.notify.data.redirect.org_resp_gw_ident.data", |
7504 | 16 | FT_BYTES, BASE_NONE, NULL, 0x0, |
7505 | 16 | NULL, HFILL }}, |
7506 | | |
7507 | 16 | { &hf_isakmp_notify_data_ticket_lifetime, |
7508 | 16 | { "TICKET OPAQUE Lifetime", "ike.notify.data.ticket_opaque.lifetime", |
7509 | 16 | FT_UINT32, BASE_DEC, NULL, 0x0, |
7510 | 16 | "The Lifetime field contains a relative time value, the number of seconds until the ticket expires (encoded as an unsigned integer).", HFILL }}, |
7511 | 16 | { &hf_isakmp_notify_data_ticket_data, |
7512 | 16 | { "TICKET OPAQUE Data", "ike.notify.data.ticket_opaque.data", |
7513 | 16 | FT_BYTES, BASE_NONE, NULL, 0x0, |
7514 | 16 | NULL, HFILL }}, |
7515 | | |
7516 | | /* ROHC Attributes Type */ |
7517 | 16 | { &hf_isakmp_notify_data_rohc_attr.all, |
7518 | 16 | { "ROHC Attribute Type", "ike.notify.data.rohc.attr", |
7519 | 16 | FT_NONE, BASE_NONE, NULL, 0x00, |
7520 | 16 | NULL, HFILL }}, |
7521 | 16 | { &hf_isakmp_notify_data_rohc_attr.type, |
7522 | 16 | { "ROHC Attribute Type", "ike.notify.data.rohc.attr.type", |
7523 | 16 | FT_UINT16, BASE_RANGE_STRING | BASE_DEC, RVALS(rohc_attr_type), 0x00, |
7524 | 16 | NULL, HFILL }}, |
7525 | 16 | { &hf_isakmp_notify_data_rohc_attr.format, |
7526 | 16 | { "ROHC Format", "ike.notify.data.rohc.attr.format", |
7527 | 16 | FT_BOOLEAN, 16, TFS(&attribute_format), 0x8000, |
7528 | 16 | NULL, HFILL }}, |
7529 | 16 | { &hf_isakmp_notify_data_rohc_attr.length, |
7530 | 16 | { "Length", "ike.notify.data.rohc.attr.length", |
7531 | 16 | FT_UINT16, BASE_DEC, NULL, 0x00, |
7532 | 16 | NULL, HFILL }}, |
7533 | 16 | { &hf_isakmp_notify_data_rohc_attr.value, |
7534 | 16 | { "Value", "ike.notify.data.rohc.attr.value", |
7535 | 16 | FT_BYTES, BASE_NONE, NULL, 0x00, |
7536 | 16 | NULL, HFILL }}, |
7537 | 16 | { &hf_isakmp_notify_data_rohc_attr_max_cid, |
7538 | 16 | { "Maximum Context Identifier", "ike.notify.data.rohc.attr.max_cid", |
7539 | 16 | FT_UINT16, BASE_DEC, NULL, 0x00, |
7540 | 16 | NULL, HFILL }}, |
7541 | 16 | { &hf_isakmp_notify_data_rohc_attr_profile, |
7542 | 16 | { "ROHC Profile", "ike.notify.data.rohc.attr.profile", |
7543 | 16 | FT_UINT16, BASE_DEC, NULL, 0x00, |
7544 | 16 | NULL, HFILL }}, |
7545 | 16 | { &hf_isakmp_notify_data_rohc_attr_integ, |
7546 | 16 | { "ROHC Integrity Algorithm", "ike.notify.data.rohc.attr.integ", |
7547 | 16 | FT_UINT16, BASE_DEC, VALS(transform_ike2_integ_type), 0x00, |
7548 | 16 | NULL, HFILL }}, |
7549 | 16 | { &hf_isakmp_notify_data_rohc_attr_icv_len, |
7550 | 16 | { "ROHC ICV Length in bytes", "ike.notify.data.rohc.attr.icv_len", |
7551 | 16 | FT_UINT16, BASE_DEC, NULL, 0x00, |
7552 | 16 | NULL, HFILL }}, |
7553 | 16 | { &hf_isakmp_notify_data_rohc_attr_mrru, |
7554 | 16 | { "MRRU", "ike.notify.data.rohc.attr.mrru", |
7555 | 16 | FT_UINT16, BASE_DEC, NULL, 0x00, |
7556 | 16 | NULL, HFILL }}, |
7557 | | |
7558 | 16 | { &hf_isakmp_notify_data_qcd_token_secret_data, |
7559 | 16 | { "Token Secret Data", "ike.notify.data.qcd.token_secret_data", |
7560 | 16 | FT_BYTES, BASE_NONE, NULL, 0x0, |
7561 | 16 | NULL, HFILL }}, |
7562 | | |
7563 | 16 | { &hf_isakmp_notify_data_ha_nonce_data, |
7564 | 16 | { "Nonce Data", "ike.notify.data.ha.nonce_data", |
7565 | 16 | FT_UINT32, BASE_HEX, NULL, 0x0, |
7566 | 16 | "Random nonce data, the data should be identical in the synchronization request and response", HFILL }}, |
7567 | 16 | { &hf_isakmp_notify_data_ha_expected_send_req_msg_id, |
7568 | 16 | { "EXPECTED SEND REQ MESSAGE ID", "ike.notify.data.ha.expected_send_req_message_id", |
7569 | 16 | FT_UINT32, BASE_HEX, NULL, 0x0, |
7570 | 16 | "Indicate the Message ID it will use in the next request that it will send to the other protocol peer", HFILL }}, |
7571 | 16 | { &hf_isakmp_notify_data_ha_expected_recv_req_msg_id, |
7572 | 16 | { "EXPECTED RECV REQ MESSAGE ID", "ike.notify.data.ha.expected_recv_req_message_id", |
7573 | 16 | FT_UINT32, BASE_HEX, NULL, 0x0, |
7574 | 16 | "Indicate the Message ID it is expecting in the next request to be received from the other protocol peer", HFILL }}, |
7575 | 16 | { &hf_isakmp_notify_data_ha_incoming_ipsec_sa_delta_value, |
7576 | 16 | { "Incoming IPsec SA delta value", "ike.notify.data.ha.incoming_ipsec_sa_delta_value", |
7577 | 16 | FT_BYTES, BASE_NONE, NULL, 0x0, |
7578 | 16 | "The sender requests that the peer should increment all the Child SA Replay Counters for the sender's incomingtraffic by this value", HFILL }}, |
7579 | 16 | { &hf_isakmp_notify_data_secure_password_methods, |
7580 | 16 | { "Secure Password Methods", "ike.notify.data.secure_password_methods", |
7581 | 16 | FT_BYTES, BASE_NONE, NULL, 0x0, |
7582 | 16 | NULL, HFILL }}, |
7583 | 16 | { &hf_isakmp_notify_data_signature_hash_algorithms, |
7584 | 16 | { "Supported Signature Hash Algorithm", "ike.notify.data.signature_hash_algorithms", |
7585 | 16 | FT_UINT16, BASE_RANGE_STRING | BASE_DEC, RVALS(signature_hash_algorithms), 0x0, |
7586 | 16 | NULL, HFILL }}, |
7587 | | |
7588 | 16 | { &hf_isakmp_delete_doi, |
7589 | 16 | { "Domain of interpretation", "ike.delete.doi", |
7590 | 16 | FT_UINT32, BASE_DEC, VALS(doi_type), 0x0, |
7591 | 16 | "ISAKMP Delete Domain of Interpretation", HFILL }}, |
7592 | 16 | { &hf_isakmp_delete_protoid_v1, |
7593 | 16 | { "Protocol ID", "ike.delete.protoid", |
7594 | 16 | FT_UINT32, BASE_DEC, VALS(protoid_v1_type), 0x0, |
7595 | 16 | "ISAKMP Delete Protocol ID", HFILL }}, |
7596 | 16 | { &hf_isakmp_delete_protoid_v2, |
7597 | 16 | { "Protocol ID", "ike.delete.protoid", |
7598 | 16 | FT_UINT32, BASE_DEC, VALS(protoid_v2_type), 0x0, |
7599 | 16 | "IKEv2 Delete Protocol ID", HFILL }}, |
7600 | 16 | { &hf_isakmp_delete_spi, |
7601 | 16 | { "Delete SPI", "ike.delete.spi", |
7602 | 16 | FT_BYTES, BASE_NONE, NULL, 0x0, |
7603 | 16 | "Identifies the specific security association(s) to delete", HFILL }}, |
7604 | 16 | { &hf_isakmp_vid_bytes, |
7605 | 16 | { "Vendor ID", "ike.vid_bytes", |
7606 | 16 | FT_BYTES, BASE_NONE, NULL, 0x0, |
7607 | 16 | NULL, HFILL }}, |
7608 | 16 | { &hf_isakmp_vid_string, |
7609 | 16 | { "Vendor ID", "ike.vid_string", |
7610 | 16 | FT_STRING, BASE_NONE, NULL, 0x0, |
7611 | 16 | NULL, HFILL }}, |
7612 | 16 | { &hf_isakmp_vid_cp_product, |
7613 | 16 | { "Checkpoint Product", "ike.vid.cp.product", |
7614 | 16 | FT_UINT32, BASE_DEC, VALS(cp_product), 0x0, |
7615 | 16 | NULL, HFILL }}, |
7616 | 16 | { &hf_isakmp_vid_cp_version, |
7617 | 16 | { "Checkpoint Version", "ike.vid.cp.version", |
7618 | 16 | FT_UINT32, BASE_DEC, VALS(cp_version), 0x0, |
7619 | 16 | "Encoded Version number", HFILL }}, |
7620 | 16 | { &hf_isakmp_vid_cp_timestamp, |
7621 | 16 | { "Checkpoint Timestamp", "ike.vid.cp.timestamp", |
7622 | 16 | FT_UINT32, BASE_DEC, NULL, 0x0, |
7623 | 16 | "Timestamp (NGX only; always zero in 4.1 or NG)", HFILL }}, |
7624 | 16 | { &hf_isakmp_vid_cp_reserved, |
7625 | 16 | { "Checkpoint Reserved", "ike.vid.cp.reserved", |
7626 | 16 | FT_UINT32, BASE_HEX, NULL, 0x0, |
7627 | 16 | NULL, HFILL }}, |
7628 | 16 | { &hf_isakmp_vid_cp_features, |
7629 | 16 | { "Checkpoint Features", "ike.vid.cp.features", |
7630 | 16 | FT_UINT32, BASE_HEX, NULL, 0x0, |
7631 | 16 | NULL, HFILL }}, |
7632 | | |
7633 | 16 | { &hf_isakmp_vid_cisco_unity_major, |
7634 | 16 | { "CISCO-UNITY Major version", "ike.vid.cisco_unity.major", |
7635 | 16 | FT_UINT8, BASE_DEC, NULL, 0x0, |
7636 | 16 | NULL, HFILL }}, |
7637 | 16 | { &hf_isakmp_vid_cisco_unity_minor, |
7638 | 16 | { "CISCO-UNITY Minor version", "ike.vid.cisco_unity.minor", |
7639 | 16 | FT_UINT8, BASE_DEC, NULL, 0x0, |
7640 | 16 | NULL, HFILL }}, |
7641 | | |
7642 | 16 | { &hf_isakmp_vid_ms_nt5_isakmpoakley, |
7643 | 16 | { "MS NT5 ISAKMPOAKLEY", "ike.vid.ms_nt5_isakmpoakley", |
7644 | 16 | FT_UINT32, BASE_DEC, VALS(ms_nt5_isakmpoakley_type), 0x0, |
7645 | 16 | NULL, HFILL }}, |
7646 | | |
7647 | 16 | { &hf_isakmp_vid_aruba_via_auth_profile, |
7648 | 16 | { "Auth Profile", "ike.vid.aruba_via_auth_profile", |
7649 | 16 | FT_STRING, BASE_NONE, NULL, 0x0, |
7650 | 16 | "Aruba Networks Auth Profile for VIA Client", HFILL }}, |
7651 | | |
7652 | 16 | { &hf_isakmp_vid_fortinet_fortigate_release, |
7653 | 16 | { "Release", "ike.vid.fortinet.fortigate.release", |
7654 | 16 | FT_UINT16, BASE_DEC, NULL, 0x0, |
7655 | 16 | "Release of Fortigate", HFILL }}, |
7656 | | |
7657 | 16 | { &hf_isakmp_vid_fortinet_fortigate_build, |
7658 | 16 | { "Build", "ike.vid.fortinet.fortigate.build", |
7659 | 16 | FT_UINT16, BASE_DEC, NULL, 0x0, |
7660 | 16 | "Build of Fortigate", HFILL }}, |
7661 | | |
7662 | 16 | { &hf_isakmp_ts_number_of_ts, |
7663 | 16 | { "Number of Traffic Selectors", "ike.ts.number", |
7664 | 16 | FT_UINT8, BASE_DEC, NULL, 0x0, |
7665 | 16 | NULL, HFILL }}, |
7666 | 16 | { &hf_isakmp_ts_type, |
7667 | 16 | { "Traffic Selector Type", "ike.ts.type", |
7668 | 16 | FT_UINT8, BASE_RANGE_STRING | BASE_DEC, RVALS(traffic_selector_type), 0x0, |
7669 | 16 | NULL, HFILL }}, |
7670 | 16 | { &hf_isakmp_ts_protoid, |
7671 | 16 | { "Protocol ID", "ike.ts.protoid", |
7672 | 16 | FT_UINT8, BASE_DEC|BASE_EXT_STRING, &ipproto_val_ext, 0x0, |
7673 | 16 | "IKEv2 Traffic Selector Protocol ID", HFILL }}, |
7674 | 16 | { &hf_isakmp_ts_selector_length, |
7675 | 16 | { "Selector Length", "ike.ts.selector_length", |
7676 | 16 | FT_UINT16, BASE_DEC, NULL, 0x0, |
7677 | 16 | NULL, HFILL }}, |
7678 | 16 | { &hf_isakmp_ts_start_port, |
7679 | 16 | { "Start Port", "ike.ts.start_port", |
7680 | 16 | FT_UINT16, BASE_DEC, NULL, 0x0, |
7681 | 16 | NULL, HFILL }}, |
7682 | 16 | { &hf_isakmp_ts_end_port, |
7683 | 16 | { "End Port", "ike.ts.end_port", |
7684 | 16 | FT_UINT16, BASE_DEC, NULL, 0x0, |
7685 | 16 | NULL, HFILL }}, |
7686 | 16 | { &hf_isakmp_ts_start_addr_ipv4, |
7687 | 16 | { "Starting Addr", "ike.ts.start_ipv4", |
7688 | 16 | FT_IPv4, BASE_NONE, NULL, 0x0, |
7689 | 16 | NULL, HFILL }}, |
7690 | 16 | { &hf_isakmp_ts_end_addr_ipv4, |
7691 | 16 | { "Ending Addr", "ike.ts.end_ipv4", |
7692 | 16 | FT_IPv4, BASE_NONE, NULL, 0x0, |
7693 | 16 | NULL, HFILL }}, |
7694 | 16 | { &hf_isakmp_ts_start_addr_ipv6, |
7695 | 16 | { "Starting Addr", "ike.ts.start_ipv6", |
7696 | 16 | FT_IPv6, BASE_NONE, NULL, 0x0, |
7697 | 16 | NULL, HFILL }}, |
7698 | 16 | { &hf_isakmp_ts_end_addr_ipv6, |
7699 | 16 | { "Ending Addr", "ike.ts.end_ipv6", |
7700 | 16 | FT_IPv6, BASE_NONE, NULL, 0x0, |
7701 | 16 | NULL, HFILL }}, |
7702 | 16 | { &hf_isakmp_ts_start_addr_fc, |
7703 | 16 | { "Starting Addr", "ike.ts.start_fc", |
7704 | 16 | FT_UINT32, BASE_DEC, NULL, 0x0, |
7705 | 16 | NULL, HFILL }}, |
7706 | 16 | { &hf_isakmp_ts_end_addr_fc, |
7707 | 16 | { "Ending Addr", "ike.ts.end_fc", |
7708 | 16 | FT_UINT32, BASE_DEC, NULL, 0x0, |
7709 | 16 | NULL, HFILL }}, |
7710 | 16 | { &hf_isakmp_ts_start_r_ctl, |
7711 | 16 | { "Starting R_CTL", "ike.ts.start_r_ctl", |
7712 | 16 | FT_UINT8, BASE_DEC, NULL, 0x0, |
7713 | 16 | NULL, HFILL }}, |
7714 | 16 | { &hf_isakmp_ts_end_r_ctl, |
7715 | 16 | { "Ending R_CTL", "ike.ts.end_r_ctl", |
7716 | 16 | FT_UINT8, BASE_DEC, NULL, 0x0, |
7717 | 16 | NULL, HFILL }}, |
7718 | 16 | { &hf_isakmp_ts_start_type, |
7719 | 16 | { "Starting Type", "ike.ts.start_type", |
7720 | 16 | FT_UINT8, BASE_DEC, NULL, 0x0, |
7721 | 16 | NULL, HFILL }}, |
7722 | 16 | { &hf_isakmp_ts_end_type, |
7723 | 16 | { "Ending Type", "ike.ts.end_type", |
7724 | 16 | FT_UINT8, BASE_DEC, NULL, 0x0, |
7725 | 16 | NULL, HFILL }}, |
7726 | 16 | { &hf_isakmp_ts_data, |
7727 | 16 | { "Traffic Selector", "ike.ts.data", |
7728 | 16 | FT_NONE, BASE_NONE, NULL, 0x0, |
7729 | 16 | "An individual traffic selector", HFILL }}, |
7730 | | |
7731 | 16 | { &hf_isakmp_num_spis, |
7732 | 16 | { "Number of SPIs", "ike.spinum", |
7733 | 16 | FT_UINT16, BASE_DEC, NULL, 0x0, |
7734 | 16 | "ISAKMP Number of SPIs", HFILL }}, |
7735 | 16 | { &hf_isakmp_hash, |
7736 | 16 | { "Hash DATA", "ike.hash", |
7737 | 16 | FT_BYTES, BASE_NONE, NULL, 0x0, |
7738 | 16 | NULL, HFILL }}, |
7739 | 16 | { &hf_isakmp_sig, |
7740 | 16 | { "Signature DATA", "ike.sig", |
7741 | 16 | FT_BYTES, BASE_NONE, NULL, 0x0, |
7742 | 16 | NULL, HFILL }}, |
7743 | 16 | { &hf_isakmp_nonce, |
7744 | 16 | { "Nonce DATA", "ike.nonce", |
7745 | 16 | FT_BYTES, BASE_NONE, NULL, 0x0, |
7746 | 16 | NULL, HFILL }}, |
7747 | 16 | { &hf_isakmp_symmetric_key, |
7748 | 16 | { "symmetric key", "ike.symmetric_key", |
7749 | 16 | FT_BYTES, BASE_NONE, NULL, 0x0, |
7750 | 16 | NULL, HFILL }}, |
7751 | 16 | { &hf_isakmp_ike2_fragment_number, |
7752 | 16 | { "Fragment Number", "ike.frag.number", |
7753 | 16 | FT_UINT16, BASE_DEC, NULL, 0x0, |
7754 | 16 | NULL, HFILL }}, |
7755 | 16 | { &hf_isakmp_ike2_total_fragments, |
7756 | 16 | { "Total Fragments", "ike.frag.total", |
7757 | 16 | FT_UINT16, BASE_DEC, NULL, 0x0, |
7758 | 16 | "Total number of fragments", HFILL }}, |
7759 | | |
7760 | 16 | { &hf_isakmp_cisco_frag_packetid, |
7761 | 16 | { "Frag ID", "ike.frag.packetid", |
7762 | 16 | FT_UINT16, BASE_HEX, NULL, 0x0, |
7763 | 16 | "Fragment packet-id", HFILL }}, |
7764 | 16 | { &hf_isakmp_cisco_frag_seq, |
7765 | 16 | { "Frag seq", "ike.frag.seq", |
7766 | 16 | FT_UINT8, BASE_DEC, NULL, 0x0, |
7767 | 16 | "Fragment number", HFILL }}, |
7768 | 16 | { &hf_isakmp_cisco_frag_last, |
7769 | 16 | { "Frag last", "ike.frag.last", |
7770 | 16 | FT_UINT8, BASE_DEC, VALS(frag_last_vals), 0x0, |
7771 | 16 | "Last fragment", HFILL }}, |
7772 | 16 | { &hf_isakmp_fragments, |
7773 | 16 | {"Message fragments", "ike.fragments", |
7774 | 16 | FT_NONE, BASE_NONE, NULL, 0x00, NULL, HFILL } }, |
7775 | 16 | { &hf_isakmp_fragment, |
7776 | 16 | {"Message fragment", "ike.fragment", |
7777 | 16 | FT_FRAMENUM, BASE_NONE, NULL, 0x00, NULL, HFILL } }, |
7778 | 16 | { &hf_isakmp_fragment_overlap, |
7779 | 16 | {"Message fragment overlap", "ike.fragment.overlap", |
7780 | 16 | FT_BOOLEAN, BASE_NONE, NULL, 0x0, NULL, HFILL } }, |
7781 | 16 | { &hf_isakmp_fragment_overlap_conflicts, |
7782 | 16 | {"Message fragment overlapping with conflicting data", |
7783 | 16 | "ike.fragment.overlap.conflicts", |
7784 | 16 | FT_BOOLEAN, BASE_NONE, NULL, 0x0, NULL, HFILL } }, |
7785 | 16 | { &hf_isakmp_fragment_multiple_tails, |
7786 | 16 | {"Message has multiple tail fragments", |
7787 | 16 | "ike.fragment.multiple_tails", |
7788 | 16 | FT_BOOLEAN, BASE_NONE, NULL, 0x0, NULL, HFILL } }, |
7789 | 16 | { &hf_isakmp_fragment_too_long_fragment, |
7790 | 16 | {"Message fragment too long", "ike.fragment.too_long_fragment", |
7791 | 16 | FT_BOOLEAN, BASE_NONE, NULL, 0x0, NULL, HFILL } }, |
7792 | 16 | { &hf_isakmp_fragment_error, |
7793 | 16 | {"Message defragmentation error", "ike.fragment.error", |
7794 | 16 | FT_FRAMENUM, BASE_NONE, NULL, 0x00, NULL, HFILL } }, |
7795 | 16 | { &hf_isakmp_fragment_count, |
7796 | 16 | {"Message fragment count", "ike.fragment.count", |
7797 | 16 | FT_UINT32, BASE_DEC, NULL, 0x00, NULL, HFILL } }, |
7798 | 16 | { &hf_isakmp_reassembled_in, |
7799 | 16 | {"Reassembled in", "ike.reassembled.in", |
7800 | 16 | FT_FRAMENUM, BASE_NONE, NULL, 0x00, NULL, HFILL } }, |
7801 | 16 | { &hf_isakmp_reassembled_length, |
7802 | 16 | {"Reassembled IKE length", "ike.reassembled.length", |
7803 | 16 | FT_UINT32, BASE_DEC, NULL, 0x00, NULL, HFILL } }, |
7804 | 16 | { &hf_isakmp_certreq_authority_sig, |
7805 | 16 | { "Certificate Authority Signature", "ike.ike.certreq.authority.sig", |
7806 | 16 | FT_UINT32, BASE_DEC, NULL, 0x0, |
7807 | 16 | NULL, HFILL } }, |
7808 | 16 | { &hf_isakmp_certreq_authority_v1, |
7809 | 16 | { "Certificate Authority Data", "ike.ike.certreq.authority", |
7810 | 16 | FT_BYTES, BASE_NONE, NULL, 0x0, |
7811 | 16 | NULL, HFILL } }, |
7812 | 16 | { &hf_isakmp_certreq_authority_v2, |
7813 | 16 | { "Certificate Authority Data", "ike.ike.certreq.authority", |
7814 | 16 | FT_BYTES, BASE_NONE, NULL, 0x0, |
7815 | 16 | "SHA-1 hash of the Certificate Authority", HFILL } }, |
7816 | 16 | { &hf_isakmp_nat_keepalive, |
7817 | 16 | { "NAT Keepalive", "ike.ike.nat_keepalive", |
7818 | 16 | FT_NONE, BASE_NONE, NULL, 0x0, "NAT Keepalive packet", HFILL } }, |
7819 | 16 | { &hf_isakmp_nat_hash, |
7820 | 16 | { "HASH of the address and port", "ike.ike.nat_hash", |
7821 | 16 | FT_BYTES, BASE_NONE, NULL, 0x00, |
7822 | 16 | NULL, HFILL }}, |
7823 | 16 | { &hf_isakmp_nat_original_address_ipv4, |
7824 | 16 | { "NAT Original IPv4 Address", "ike.ike.nat_original_address_ipv4", |
7825 | 16 | FT_IPv4, BASE_NONE, NULL, 0x00, |
7826 | 16 | NULL, HFILL }}, |
7827 | 16 | { &hf_isakmp_nat_original_address_ipv6, |
7828 | 16 | { "NAT Original IPv6 Address", "ike.ike.nat_original_address_ipv6", |
7829 | 16 | FT_IPv6, BASE_NONE, NULL, 0x00, |
7830 | 16 | NULL, HFILL }}, |
7831 | | |
7832 | | /*tek key download type (ISAKMP phase 2 GDOI)*/ |
7833 | 16 | { &hf_isakmp_tek_key_attr.all, |
7834 | 16 | { "Key download Tek Attribute", "ike.key_download.attr", |
7835 | 16 | FT_NONE, BASE_NONE, NULL, 0x00, |
7836 | 16 | NULL, HFILL }}, |
7837 | 16 | { &hf_isakmp_tek_key_attr.type, |
7838 | 16 | { "Type", "ike.key_download.attr.type", |
7839 | 16 | FT_UINT16, BASE_RANGE_STRING | BASE_DEC, NULL, 0x00, |
7840 | 16 | "key_download Attribute type", HFILL }}, |
7841 | 16 | { &hf_isakmp_tek_key_attr.format, |
7842 | 16 | { "Format", "ike.key_download.attr.format", |
7843 | 16 | FT_BOOLEAN, 16, TFS(&attribute_format), 0x8000, |
7844 | 16 | "key_download Attribute format", HFILL }}, |
7845 | 16 | { &hf_isakmp_tek_key_attr.length, |
7846 | 16 | { "Length", "ike.key_download.attr.length", |
7847 | 16 | FT_UINT16, BASE_DEC, NULL, 0x00, |
7848 | 16 | "key_download Attribute length", HFILL }}, |
7849 | 16 | { &hf_isakmp_tek_key_attr.value, |
7850 | 16 | { "Value", "ike.key_download.attr.value", |
7851 | 16 | FT_BYTES, BASE_NONE, NULL, 0x00, |
7852 | 16 | "key_download Attribute value", HFILL }}, |
7853 | | /* IPsec SA Attributes (ISAKMP Phase 2) */ |
7854 | 16 | { &hf_isakmp_ipsec_attr.all, |
7855 | 16 | { "IPsec Attribute", "ike.ipsec.attr", |
7856 | 16 | FT_NONE, BASE_NONE, NULL, 0x00, |
7857 | 16 | NULL, HFILL }}, |
7858 | 16 | { &hf_isakmp_ipsec_attr.type, |
7859 | 16 | { "Type", "ike.ipsec.attr.type", |
7860 | 16 | FT_UINT16, BASE_RANGE_STRING | BASE_DEC, RVALS(ipsec_attr_type), 0x00, |
7861 | 16 | "IPsec Attribute type", HFILL }}, |
7862 | 16 | { &hf_isakmp_ipsec_attr.format, |
7863 | 16 | { "Format", "ike.ipsec.attr.format", |
7864 | 16 | FT_BOOLEAN, 16, TFS(&attribute_format), 0x8000, |
7865 | 16 | "IPsec Attribute format", HFILL }}, |
7866 | 16 | { &hf_isakmp_ipsec_attr.length, |
7867 | 16 | { "Length", "ike.ipsec.attr.length", |
7868 | 16 | FT_UINT16, BASE_DEC, NULL, 0x00, |
7869 | 16 | "IPsec Attribute length", HFILL }}, |
7870 | 16 | { &hf_isakmp_ipsec_attr.value, |
7871 | 16 | { "Value", "ike.ipsec.attr.value", |
7872 | 16 | FT_BYTES, BASE_NONE, NULL, 0x00, |
7873 | 16 | "IPsec Attribute value", HFILL }}, |
7874 | 16 | { &hf_isakmp_ipsec_attr_life_type, |
7875 | 16 | { "Life Type", "ike.ipsec.attr.life_type", |
7876 | 16 | FT_UINT16, BASE_DEC, VALS(attr_life_type), 0x00, |
7877 | 16 | "The unit (seconds or kilobytes) of the associated Life Duration attribute.", HFILL }}, |
7878 | 16 | { &hf_isakmp_ipsec_attr_life_duration_uint32, |
7879 | 16 | { "Life Duration", "ike.ipsec.attr.life_duration", |
7880 | 16 | FT_UINT32, BASE_DEC, NULL, 0x00, |
7881 | 16 | NULL, HFILL }}, |
7882 | 16 | { &hf_isakmp_ipsec_attr_life_duration_uint64, |
7883 | 16 | { "Life Duration", "ike.ipsec.attr.life_duration64", |
7884 | 16 | FT_UINT64, BASE_DEC, NULL, 0x00, |
7885 | 16 | NULL, HFILL }}, |
7886 | 16 | { &hf_isakmp_ipsec_attr_life_duration_bytes, |
7887 | 16 | { "Life Duration", "ike.ipsec.attr.life_duration_bytes", |
7888 | 16 | FT_BYTES, BASE_NONE, NULL, 0x00, |
7889 | 16 | NULL, HFILL }}, |
7890 | 16 | { &hf_isakmp_ipsec_attr_group_description, |
7891 | 16 | { "Group Description", "ike.ipsec.attr.group_description", |
7892 | 16 | FT_UINT16, BASE_DEC, VALS(dh_group), 0x00, |
7893 | 16 | NULL, HFILL }}, |
7894 | 16 | { &hf_isakmp_ipsec_attr_encap_mode, |
7895 | 16 | { "Encapsulation Mode", "ike.ipsec.attr.encap_mode", |
7896 | 16 | FT_UINT16, BASE_DEC, VALS(ipsec_attr_encap_mode), 0x00, |
7897 | 16 | NULL, HFILL }}, |
7898 | 16 | { &hf_isakmp_ipsec_attr_auth_algorithm, |
7899 | 16 | { "Authentication Algorithm", "ike.ipsec.attr.auth_algorithm", |
7900 | 16 | FT_UINT16, BASE_DEC, VALS(ipsec_attr_auth_algo), 0x00, |
7901 | 16 | NULL, HFILL }}, |
7902 | 16 | { &hf_isakmp_ipsec_attr_key_length, |
7903 | 16 | { "Key Length", "ike.ipsec.attr.key_length", |
7904 | 16 | FT_UINT16, BASE_DEC, NULL, 0x00, |
7905 | 16 | NULL, HFILL }}, |
7906 | 16 | { &hf_isakmp_ipsec_attr_key_rounds, |
7907 | 16 | { "Key Rounds", "ike.ipsec.attr.key_rounds", |
7908 | 16 | FT_UINT16, BASE_DEC, NULL, 0x00, |
7909 | 16 | NULL, HFILL }}, |
7910 | 16 | { &hf_isakmp_ipsec_attr_cmpr_dict_size, |
7911 | 16 | { "Compress Dictionary Size", "ike.ipsec.attr.cmpr_dict_size", |
7912 | 16 | FT_UINT16, BASE_DEC, NULL, 0x00, |
7913 | 16 | NULL, HFILL }}, |
7914 | 16 | { &hf_isakmp_ipsec_attr_cmpr_algorithm, |
7915 | 16 | { "Compress Private Algorithm", "ike.ipsec.attr.cmpr_algorithm", |
7916 | 16 | FT_BYTES, BASE_NONE, NULL, 0x00, |
7917 | 16 | NULL, HFILL }}, |
7918 | 16 | { &hf_isakmp_ipsec_attr_ecn_tunnel, |
7919 | 16 | { "ECN Tunnel", "ike.ipsec.attr.ecn_tunnel", |
7920 | 16 | FT_UINT16, BASE_DEC, VALS(ipsec_attr_ecn_tunnel), 0x00, |
7921 | 16 | NULL, HFILL }}, |
7922 | 16 | { &hf_isakmp_ipsec_attr_ext_seq_nbr, |
7923 | 16 | { "Extended (64-bit) Sequence Number", "ike.ipsec.attr.ext_seq_nbr", |
7924 | 16 | FT_UINT16, BASE_DEC, VALS(ipsec_attr_ext_seq_nbr), 0x00, |
7925 | 16 | NULL, HFILL }}, |
7926 | 16 | { &hf_isakmp_ipsec_attr_auth_key_length, |
7927 | 16 | { "Authentication Key Length", "ike.ipsec.attr.auth_key_length", |
7928 | 16 | FT_UINT16, BASE_DEC, NULL, 0x00, |
7929 | 16 | NULL, HFILL }}, |
7930 | 16 | { &hf_isakmp_ipsec_attr_sig_enco_algorithm, |
7931 | 16 | { "Signature Encoding Algorithm", "ike.ipsec.attr.sig_enco_algorithm", |
7932 | 16 | FT_BYTES, BASE_NONE, NULL, 0x00, |
7933 | 16 | NULL, HFILL }}, |
7934 | 16 | { &hf_isakmp_ipsec_attr_addr_preservation, |
7935 | 16 | { "Address Preservation", "ike.ipsec.attr.addr_preservation", |
7936 | 16 | FT_UINT16, BASE_DEC, VALS(ipsec_attr_addr_preservation), 0x00, |
7937 | 16 | NULL, HFILL }}, |
7938 | 16 | { &hf_isakmp_ipsec_attr_sa_direction, |
7939 | 16 | { "SA Direction", "ike.ipsec.attr.sa_direction", |
7940 | 16 | FT_UINT16, BASE_DEC, VALS(ipsec_attr_sa_direction), 0x00, |
7941 | 16 | NULL, HFILL }}, |
7942 | | |
7943 | | /* Responder Lifetime Notification for IPsec SA */ |
7944 | 16 | { &hf_isakmp_resp_lifetime_ipsec_attr.all, |
7945 | 16 | { "IPsec Attribute", "ike.notify.data.resp_lifetime.ipsec.attr", |
7946 | 16 | FT_NONE, BASE_NONE, NULL, 0x00, |
7947 | 16 | NULL, HFILL }}, |
7948 | 16 | { &hf_isakmp_resp_lifetime_ipsec_attr.type, |
7949 | 16 | { "Type", "ike.notify.data.resp_lifetime.ipsec.attr.type", |
7950 | 16 | FT_UINT16, BASE_RANGE_STRING | BASE_DEC, RVALS(ipsec_attr_type), 0x00, |
7951 | 16 | "IPsec Attribute type", HFILL }}, |
7952 | 16 | { &hf_isakmp_resp_lifetime_ipsec_attr.format, |
7953 | 16 | { "Format", "ike.notify.data.resp_lifetime.ipsec.attr.format", |
7954 | 16 | FT_BOOLEAN, 16, TFS(&attribute_format), 0x8000, |
7955 | 16 | "IPsec Attribute format", HFILL }}, |
7956 | 16 | { &hf_isakmp_resp_lifetime_ipsec_attr.length, |
7957 | 16 | { "Length", "ike.notify.data.resp_lifetime.ipsec.attr.length", |
7958 | 16 | FT_UINT16, BASE_DEC, NULL, 0x00, |
7959 | 16 | "IPsec Attribute length", HFILL }}, |
7960 | 16 | { &hf_isakmp_resp_lifetime_ipsec_attr.value, |
7961 | 16 | { "Value", "ike.notify.data.resp_lifetime.ipsec.attr.value", |
7962 | 16 | FT_BYTES, BASE_NONE, NULL, 0x00, |
7963 | 16 | "IPsec Attribute value", HFILL }}, |
7964 | | |
7965 | 16 | { &hf_isakmp_resp_lifetime_ipsec_attr_life_type, |
7966 | 16 | { "Life Type", "ike.notify.data.resp_lifetime.ipsec.attr.life_type", |
7967 | 16 | FT_UINT16, BASE_DEC, VALS(attr_life_type), 0x00, |
7968 | 16 | "The unit (seconds or kilobytes) of the associated Life Duration attribute.", HFILL }}, |
7969 | 16 | { &hf_isakmp_resp_lifetime_ipsec_attr_life_duration_uint32, |
7970 | 16 | { "Life Duration", "ike.notify.data.resp_lifetime.ipsec.attr.life_duration", |
7971 | 16 | FT_UINT32, BASE_DEC, NULL, 0x00, |
7972 | 16 | NULL, HFILL }}, |
7973 | 16 | { &hf_isakmp_resp_lifetime_ipsec_attr_life_duration_uint64, |
7974 | 16 | { "Life Duration", "ike.notify.data.resp_lifetime.ipsec.attr.life_duration64", |
7975 | 16 | FT_UINT64, BASE_DEC, NULL, 0x00, |
7976 | 16 | NULL, HFILL }}, |
7977 | 16 | { &hf_isakmp_resp_lifetime_ipsec_attr_life_duration_bytes, |
7978 | 16 | { "Life Duration", "ike.notify.data.resp_lifetime.ipsec.attr.life_duration_bytes", |
7979 | 16 | FT_BYTES, BASE_NONE, NULL, 0x00, |
7980 | 16 | NULL, HFILL }}, |
7981 | | |
7982 | | /* IKEv1 SA Attributes (ISAKMP SA, Phase 1) */ |
7983 | 16 | { &hf_isakmp_ike_attr.all, |
7984 | 16 | { "IKE Attribute", "ike.ike.attr", |
7985 | 16 | FT_NONE, BASE_NONE, NULL, 0x00, |
7986 | 16 | NULL, HFILL }}, |
7987 | 16 | { &hf_isakmp_ike_attr.type, |
7988 | 16 | { "Type", "ike.ike.attr.type", |
7989 | 16 | FT_UINT16, BASE_RANGE_STRING | BASE_DEC, RVALS(ike_attr_type), 0x00, |
7990 | 16 | "IKEv1 Attribute type", HFILL }}, |
7991 | 16 | { &hf_isakmp_ike_attr.format, |
7992 | 16 | { "Format", "ike.ike.attr.format", |
7993 | 16 | FT_BOOLEAN, 16, TFS(&attribute_format), 0x8000, |
7994 | 16 | "IKEv1 Attribute format", HFILL }}, |
7995 | 16 | { &hf_isakmp_ike_attr.length, |
7996 | 16 | { "Length", "ike.ike.attr.length", |
7997 | 16 | FT_UINT16, BASE_DEC, NULL, 0x00, |
7998 | 16 | "IKEv1 Attribute length", HFILL }}, |
7999 | 16 | { &hf_isakmp_ike_attr.value, |
8000 | 16 | { "Value", "ike.ike.attr.value", |
8001 | 16 | FT_BYTES, BASE_NONE, NULL, 0x00, |
8002 | 16 | "IKEv1 Attribute value", HFILL }}, |
8003 | | |
8004 | 16 | { &hf_isakmp_ike_attr_encryption_algorithm, |
8005 | 16 | { "Encryption Algorithm", "ike.ike.attr.encryption_algorithm", |
8006 | 16 | FT_UINT16, BASE_DEC, VALS(ike_attr_enc_algo), 0x00, |
8007 | 16 | NULL, HFILL }}, |
8008 | 16 | { &hf_isakmp_ike_attr_hash_algorithm, |
8009 | 16 | { "HASH Algorithm", "ike.ike.attr.hash_algorithm", |
8010 | 16 | FT_UINT16, BASE_DEC, VALS(ike_attr_hash_algo), 0x00, |
8011 | 16 | NULL, HFILL }}, |
8012 | 16 | { &hf_isakmp_ike_attr_authentication_method, |
8013 | 16 | { "Authentication Method", "ike.ike.attr.authentication_method", |
8014 | 16 | FT_UINT16, BASE_DEC, VALS(ike_attr_authmeth), 0x00, |
8015 | 16 | NULL, HFILL }}, |
8016 | 16 | { &hf_isakmp_ike_attr_authentication_method_china, |
8017 | 16 | { "Authentication Method for China IPsec VPN specification", "ike.ike.attr.authentication_method_china", |
8018 | 16 | FT_UINT16, BASE_DEC, VALS(ike_attr_authmeth_china), 0x00, |
8019 | 16 | NULL, HFILL }}, |
8020 | 16 | { &hf_isakmp_ike_attr_group_description, |
8021 | 16 | { "Group Description", "ike.ike.attr.group_description", |
8022 | 16 | FT_UINT16, BASE_DEC, VALS(dh_group), 0x00, |
8023 | 16 | NULL, HFILL }}, |
8024 | 16 | { &hf_isakmp_ike_attr_group_type, |
8025 | 16 | { "Group Type", "ike.ike.attr.group_type", |
8026 | 16 | FT_UINT16, BASE_DEC, VALS(ike_attr_grp_type), 0x00, |
8027 | 16 | NULL, HFILL }}, |
8028 | 16 | { &hf_isakmp_ike_attr_group_prime, |
8029 | 16 | { "Group Prime", "ike.ike.attr.group_prime", |
8030 | 16 | FT_BYTES, BASE_NONE, NULL, 0x00, |
8031 | 16 | NULL, HFILL }}, |
8032 | 16 | { &hf_isakmp_ike_attr_group_generator_one, |
8033 | 16 | { "Group Generator One", "ike.ike.attr.group_generator_one", |
8034 | 16 | FT_BYTES, BASE_NONE, NULL, 0x00, |
8035 | 16 | NULL, HFILL }}, |
8036 | 16 | { &hf_isakmp_ike_attr_group_generator_two, |
8037 | 16 | { "Group Generator Two", "ike.ike.attr.group_generator_two", |
8038 | 16 | FT_BYTES, BASE_NONE, NULL, 0x00, |
8039 | 16 | NULL, HFILL }}, |
8040 | 16 | { &hf_isakmp_ike_attr_group_curve_a, |
8041 | 16 | { "Group Curve A", "ike.ike.attr.group_curve_a", |
8042 | 16 | FT_BYTES, BASE_NONE, NULL, 0x00, |
8043 | 16 | NULL, HFILL }}, |
8044 | 16 | { &hf_isakmp_ike_attr_group_curve_b, |
8045 | 16 | { "Group Curve B", "ike.ike.attr.group_curve_b", |
8046 | 16 | FT_BYTES, BASE_NONE, NULL, 0x00, |
8047 | 16 | NULL, HFILL }}, |
8048 | 16 | { &hf_isakmp_ike_attr_life_type, |
8049 | 16 | { "Life Type", "ike.ike.attr.life_type", |
8050 | 16 | FT_UINT16, BASE_DEC, VALS(attr_life_type), 0x00, |
8051 | 16 | "The unit (seconds or kilobytes) of the associated Life Duration attribute.", HFILL }}, |
8052 | 16 | { &hf_isakmp_ike_attr_life_duration_uint32, |
8053 | 16 | { "Life Duration", "ike.ike.attr.life_duration", |
8054 | 16 | FT_UINT32, BASE_DEC, NULL, 0x00, |
8055 | 16 | NULL, HFILL }}, |
8056 | 16 | { &hf_isakmp_ike_attr_life_duration_uint64, |
8057 | 16 | { "Life Duration", "ike.ike.attr.life_duration64", |
8058 | 16 | FT_UINT64, BASE_DEC, NULL, 0x00, |
8059 | 16 | NULL, HFILL }}, |
8060 | 16 | { &hf_isakmp_ike_attr_life_duration_bytes, |
8061 | 16 | { "Life Duration", "ike.ike.attr.life_duration_bytes", |
8062 | 16 | FT_BYTES, BASE_NONE, NULL, 0x00, |
8063 | 16 | NULL, HFILL }}, |
8064 | 16 | { &hf_isakmp_ike_attr_prf, |
8065 | 16 | { "PRF", "ike.ike.attr.prf", |
8066 | 16 | FT_BYTES, BASE_NONE, NULL, 0x00, |
8067 | 16 | NULL, HFILL }}, |
8068 | 16 | { &hf_isakmp_ike_attr_key_length, |
8069 | 16 | { "Key Length", "ike.ike.attr.key_length", |
8070 | 16 | FT_UINT16, BASE_DEC, NULL, 0x00, |
8071 | 16 | NULL, HFILL }}, |
8072 | 16 | { &hf_isakmp_ike_attr_field_size, |
8073 | 16 | { "Field Size", "ike.ike.attr.field_size", |
8074 | 16 | FT_BYTES, BASE_NONE, NULL, 0x00, |
8075 | 16 | NULL, HFILL }}, |
8076 | 16 | { &hf_isakmp_ike_attr_group_order, |
8077 | 16 | { "Group Order", "ike.ike.attr.group_order", |
8078 | 16 | FT_BYTES, BASE_NONE, NULL, 0x00, |
8079 | 16 | NULL, HFILL }}, |
8080 | 16 | { &hf_isakmp_ike_attr_block_size, |
8081 | 16 | { "Block Size", "ike.ike.attr.block_size", |
8082 | 16 | FT_BYTES, BASE_NONE, NULL, 0x00, |
8083 | 16 | NULL, HFILL }}, |
8084 | 16 | { &hf_isakmp_ike_attr_asymmetric_cryptographic_algorithm_type, |
8085 | 16 | { "Asymmetric Cryptographic Algorithm Type", "ike.ike.attr.asymmetric_cryptographic_algorithm_type", |
8086 | 16 | FT_UINT16, BASE_DEC, VALS(ike_attr_asym_algo), 0x00, |
8087 | 16 | NULL, HFILL }}, |
8088 | | |
8089 | | /* Responder Lifetime Notification for IKEv1 SA */ |
8090 | 16 | { &hf_isakmp_resp_lifetime_ike_attr.all, |
8091 | 16 | { "IKE Attribute", "ike.notify.data.resp_lifetime.ike.attr", |
8092 | 16 | FT_NONE, BASE_NONE, NULL, 0x00, |
8093 | 16 | NULL, HFILL }}, |
8094 | 16 | { &hf_isakmp_resp_lifetime_ike_attr.type, |
8095 | 16 | { "Type", "ike.notify.data.resp_lifetime.ike.attr.type", |
8096 | 16 | FT_UINT16, BASE_RANGE_STRING | BASE_DEC, RVALS(ike_attr_type), 0x00, |
8097 | 16 | "IKEv1 Attribute type", HFILL }}, |
8098 | 16 | { &hf_isakmp_resp_lifetime_ike_attr.format, |
8099 | 16 | { "Format", "ike.notify.data.resp_lifetime.ike.attr.format", |
8100 | 16 | FT_BOOLEAN, 16, TFS(&attribute_format), 0x8000, |
8101 | 16 | "IKEv1 Attribute format", HFILL }}, |
8102 | 16 | { &hf_isakmp_resp_lifetime_ike_attr.length, |
8103 | 16 | { "Length", "ike.notify.data.resp_lifetime.ike.attr.length", |
8104 | 16 | FT_UINT16, BASE_DEC, NULL, 0x00, |
8105 | 16 | "IKEv1 Attribute length", HFILL }}, |
8106 | 16 | { &hf_isakmp_resp_lifetime_ike_attr.value, |
8107 | 16 | { "Value", "ike.notify.data.resp_lifetime.ike.attr.value", |
8108 | 16 | FT_BYTES, BASE_NONE, NULL, 0x00, |
8109 | 16 | "IKEv1 Attribute value", HFILL }}, |
8110 | | |
8111 | 16 | { &hf_isakmp_resp_lifetime_ike_attr_life_type, |
8112 | 16 | { "Life Type", "ike.notify.data.resp_lifetime.ike.attr.life_type", |
8113 | 16 | FT_UINT16, BASE_DEC, VALS(attr_life_type), 0x00, |
8114 | 16 | "The unit (seconds or kilobytes) of the associated Life Duration attribute.", HFILL }}, |
8115 | 16 | { &hf_isakmp_resp_lifetime_ike_attr_life_duration_uint32, |
8116 | 16 | { "Life Duration", "ike.notify.data.resp_lifetime.ike.attr.life_duration", |
8117 | 16 | FT_UINT32, BASE_DEC, NULL, 0x00, |
8118 | 16 | NULL, HFILL }}, |
8119 | 16 | { &hf_isakmp_resp_lifetime_ike_attr_life_duration_uint64, |
8120 | 16 | { "Life Duration", "ike.notify.data.resp_lifetime.ike.attr.life_duration64", |
8121 | 16 | FT_UINT64, BASE_DEC, NULL, 0x00, |
8122 | 16 | NULL, HFILL }}, |
8123 | 16 | { &hf_isakmp_resp_lifetime_ike_attr_life_duration_bytes, |
8124 | 16 | { "Life Duration", "ike.notify.data.resp_lifetime.ike.attr.life_duration_bytes", |
8125 | 16 | FT_BYTES, BASE_NONE, NULL, 0x00, |
8126 | 16 | NULL, HFILL }}, |
8127 | | |
8128 | | /* IKEv2 Transform */ |
8129 | 16 | { &hf_isakmp_trans_type, |
8130 | 16 | { "Transform Type", "ike.tf.type", |
8131 | 16 | FT_UINT8, BASE_RANGE_STRING | BASE_DEC, RVALS(transform_ike2_type), 0x00, |
8132 | 16 | NULL, HFILL }}, |
8133 | | |
8134 | 16 | { &hf_isakmp_trans_encr, |
8135 | 16 | { "Transform ID (ENCR)", "ike.tf.id.encr", |
8136 | 16 | FT_UINT16, BASE_DEC, VALS(transform_ike2_encr_type), 0x00, |
8137 | 16 | NULL, HFILL }}, |
8138 | 16 | { &hf_isakmp_trans_prf, |
8139 | 16 | { "Transform ID (PRF)", "ike.tf.id.prf", |
8140 | 16 | FT_UINT16, BASE_DEC, VALS(transform_ike2_prf_type), 0x00, |
8141 | 16 | NULL, HFILL }}, |
8142 | 16 | { &hf_isakmp_trans_integ, |
8143 | 16 | { "Transform ID (INTEG)", "ike.tf.id.integ", |
8144 | 16 | FT_UINT16, BASE_DEC, VALS(transform_ike2_integ_type), 0x00, |
8145 | 16 | NULL, HFILL }}, |
8146 | 16 | { &hf_isakmp_trans_ke, |
8147 | 16 | { "Transform ID (KE)", "ike.tf.id.ke", |
8148 | 16 | FT_UINT16, BASE_DEC, VALS(dh_group), 0x00, |
8149 | 16 | NULL, HFILL }}, |
8150 | 16 | { &hf_isakmp_trans_sn, |
8151 | 16 | { "Transform ID (SN)", "ike.tf.id.esn", |
8152 | 16 | FT_UINT16, BASE_DEC, VALS(transform_ike2_sn_type), 0x00, |
8153 | 16 | NULL, HFILL }}, |
8154 | 16 | { &hf_isakmp_trans_kwa, |
8155 | 16 | { "Transform ID (KWA)", "ike.tf.id.kwa", |
8156 | 16 | FT_UINT16, BASE_DEC, VALS(transform_ike2_kwa_type), 0x00, |
8157 | 16 | NULL, HFILL }}, |
8158 | 16 | { &hf_isakmp_trans_gcauth, |
8159 | 16 | { "Transform ID (GCAUTH)", "ike.tf.id.gcauth", |
8160 | 16 | FT_UINT16, BASE_DEC, VALS(transform_ike2_gcauth_type), 0x00, |
8161 | 16 | NULL, HFILL }}, |
8162 | 16 | { &hf_isakmp_trans_id_v2, |
8163 | 16 | { "Transform ID", "ike.tf.id", |
8164 | 16 | FT_UINT16, BASE_DEC, NULL, 0x00, |
8165 | 16 | NULL, HFILL }}, |
8166 | | |
8167 | | /* IKEv2 Transform Attributes */ |
8168 | 16 | { &hf_isakmp_ike2_attr.all, |
8169 | 16 | { "Transform Attribute", "ike.ike2.attr", |
8170 | 16 | FT_NONE, BASE_NONE, NULL, 0x00, |
8171 | 16 | "IKEv2 Transform Attribute", HFILL }}, |
8172 | 16 | { &hf_isakmp_ike2_attr.type, |
8173 | 16 | { "Type", "ike.ike2.attr.type", |
8174 | 16 | FT_UINT16, BASE_RANGE_STRING | BASE_DEC, RVALS(transform_ike2_attr_type), 0x00, |
8175 | 16 | "IKEv2 Transform Attribute type", HFILL }}, |
8176 | 16 | { &hf_isakmp_ike2_attr.format, |
8177 | 16 | { "Format", "ike.ike2.attr.format", |
8178 | 16 | FT_BOOLEAN, 16, TFS(&attribute_format), 0x8000, |
8179 | 16 | "IKEv2 Transform Attribute format", HFILL }}, |
8180 | 16 | { &hf_isakmp_ike2_attr.length, |
8181 | 16 | { "Length", "ike.ike2.attr.length", |
8182 | 16 | FT_UINT16, BASE_DEC, NULL, 0x00, |
8183 | 16 | "IKEv2 Transform Attribute length", HFILL }}, |
8184 | 16 | { &hf_isakmp_ike2_attr.value, |
8185 | 16 | { "Value", "ike.ike2.attr.value", |
8186 | 16 | FT_BYTES, BASE_NONE, NULL, 0x00, |
8187 | 16 | "IKEv2 Transform Attribute value", HFILL }}, |
8188 | 16 | { &hf_isakmp_ike2_attr_key_length, |
8189 | 16 | { "Key Length", "ike.ike2.attr.key_length", |
8190 | 16 | FT_UINT16, BASE_DEC, NULL, 0x00, |
8191 | 16 | NULL, HFILL }}, |
8192 | | |
8193 | | |
8194 | 16 | { &hf_isakmp_key_exch_method, |
8195 | 16 | { "Key Exchange Method", "ike.key_exchange.method", |
8196 | 16 | FT_UINT16, BASE_DEC, VALS(dh_group), 0x00, |
8197 | 16 | NULL, HFILL }}, |
8198 | 16 | { &hf_isakmp_key_exch_data, |
8199 | 16 | { "Key Exchange Data", "ike.key_exchange.data", |
8200 | 16 | FT_BYTES, BASE_NONE, NULL, 0x00, |
8201 | 16 | NULL, HFILL }}, |
8202 | 16 | { &hf_isakmp_eap_data, |
8203 | 16 | { "EAP Message", "ike.eap.data", |
8204 | 16 | FT_BYTES, BASE_NONE, NULL, 0x00, |
8205 | 16 | NULL, HFILL }}, |
8206 | | |
8207 | 16 | { &hf_isakmp_gspm_data, |
8208 | 16 | { "GSPM", "ike.gspm.data", |
8209 | 16 | FT_BYTES, BASE_NONE, NULL, 0x00, |
8210 | 16 | "Generic Secure Password Method", HFILL }}, |
8211 | | |
8212 | | /* Config Payload */ |
8213 | 16 | { &hf_isakmp_cfg_type_v1, |
8214 | 16 | { "Type", "ike.cfg.type", |
8215 | 16 | FT_UINT8, BASE_RANGE_STRING | BASE_DEC, RVALS(vs_v1_cfgtype), 0x0, |
8216 | 16 | "IKEv1 Config Type", HFILL }}, |
8217 | 16 | { &hf_isakmp_cfg_identifier, |
8218 | 16 | { "Identifier", "ike.cfg.identifier", |
8219 | 16 | FT_UINT16, BASE_DEC, NULL, 0x0, |
8220 | 16 | "IKEv1 Config Identifier", HFILL }}, |
8221 | 16 | { &hf_isakmp_cfg_type_v2, |
8222 | 16 | { "Type", "ike.cfg.type", |
8223 | 16 | FT_UINT8, BASE_RANGE_STRING | BASE_DEC, RVALS(vs_v2_cfgtype), 0x0, |
8224 | 16 | "IKEv2 Config Type", HFILL }}, |
8225 | | |
8226 | | /* Config Attributes */ |
8227 | 16 | { &hf_isakmp_cfg_attr.all, |
8228 | 16 | { "Config Attribute", "ike.cfg.attr", |
8229 | 16 | FT_NONE, BASE_NONE, NULL, 0x00, |
8230 | 16 | NULL, HFILL }}, |
8231 | 16 | { &hf_isakmp_cfg_attr_type_v1, |
8232 | 16 | { "Type", "ike.cfg.attr.type", |
8233 | 16 | FT_UINT16, BASE_RANGE_STRING | BASE_DEC, RVALS(vs_v1_cfgattr), 0x00, |
8234 | 16 | "IKEv1 Config Attribute type", HFILL }}, |
8235 | 16 | { &hf_isakmp_cfg_attr_type_v2, |
8236 | 16 | { "Type", "ike.cfg.attr.type", |
8237 | 16 | FT_UINT16, BASE_RANGE_STRING | BASE_DEC, RVALS(vs_v2_cfgattr), 0x00, |
8238 | 16 | "IKEv2 Config Attribute type", HFILL }}, |
8239 | 16 | { &hf_isakmp_cfg_attr.format, |
8240 | 16 | { "Format", "ike.cfg.attr.format", |
8241 | 16 | FT_BOOLEAN, 16, TFS(&attribute_format), 0x8000, |
8242 | 16 | "Config Attribute format", HFILL }}, |
8243 | 16 | { &hf_isakmp_cfg_attr.length, |
8244 | 16 | { "Length", "ike.cfg.attr.length", |
8245 | 16 | FT_UINT16, BASE_DEC, NULL, 0x00, |
8246 | 16 | "Config Attribute length", HFILL }}, |
8247 | 16 | { &hf_isakmp_cfg_attr.value, |
8248 | 16 | { "Value", "ike.cfg.attr.value", |
8249 | 16 | FT_BYTES, BASE_NONE, NULL, 0x00, |
8250 | 16 | "Config Attribute value", HFILL }}, |
8251 | 16 | { &hf_isakmp_cfg_attr_internal_ip4_address, |
8252 | 16 | { "INTERNAL IP4 ADDRESS", "ike.cfg.attr.internal_ip4_address", |
8253 | 16 | FT_IPv4, BASE_NONE, NULL, 0x00, |
8254 | 16 | "An IPv4 address on the internal network", HFILL }}, |
8255 | 16 | { &hf_isakmp_cfg_attr_internal_ip4_netmask, |
8256 | 16 | { "INTERNAL IP4 NETMASK", "ike.cfg.attr.internal_ip4_netmask", |
8257 | 16 | FT_IPv4, BASE_NETMASK, NULL, 0x00, |
8258 | 16 | "The internal network's netmask", HFILL }}, |
8259 | 16 | { &hf_isakmp_cfg_attr_internal_ip4_dns, |
8260 | 16 | { "INTERNAL IP4 DNS", "ike.cfg.attr.internal_ip4_dns", |
8261 | 16 | FT_IPv4, BASE_NONE, NULL, 0x00, |
8262 | 16 | "An IPv4 address of a DNS server within the network", HFILL }}, |
8263 | 16 | { &hf_isakmp_cfg_attr_internal_ip4_nbns, |
8264 | 16 | { "INTERNAL IP4 NBNS", "ike.cfg.attr.internal_ip4_nbns", |
8265 | 16 | FT_IPv4, BASE_NONE, NULL, 0x00, |
8266 | 16 | "An IPv4 address of a NetBios Name Server (WINS) within the network", HFILL }}, |
8267 | 16 | { &hf_isakmp_cfg_attr_internal_address_expiry, |
8268 | 16 | { "INTERNAL ADDRESS EXPIRY (Secs)", "ike.cfg.attr.internal_address_expiry", |
8269 | 16 | FT_UINT32, BASE_DEC, NULL, 0x00, |
8270 | 16 | "Specifies the number of seconds that the host can use the internal IP address", HFILL }}, |
8271 | 16 | { &hf_isakmp_cfg_attr_internal_ip4_dhcp, |
8272 | 16 | { "INTERNAL IP4 DHCP", "ike.cfg.attr.internal_ip4_dhcp", |
8273 | 16 | FT_IPv4, BASE_NONE, NULL, 0x00, |
8274 | 16 | "the host to send any internal DHCP requests to the address", HFILL }}, |
8275 | 16 | { &hf_isakmp_cfg_attr_application_version, |
8276 | 16 | { "APPLICATION VERSION", "ike.cfg.attr.application_version", |
8277 | 16 | FT_STRING, BASE_NONE, NULL, 0x00, |
8278 | 16 | "The version or application information of the IPsec host", HFILL }}, |
8279 | 16 | { &hf_isakmp_cfg_attr_internal_ip6_address_ip, |
8280 | 16 | { "INTERNAL IP6 ADDRESS", "ike.cfg.attr.internal_ip6_address", |
8281 | 16 | FT_IPv6, BASE_NONE, NULL, 0x00, |
8282 | 16 | "An IPv6 address on the internal network", HFILL }}, |
8283 | 16 | { &hf_isakmp_cfg_attr_internal_ip6_address_prefix, |
8284 | 16 | { "INTERNAL IP6 ADDRESS (PREFIX)", "ike.cfg.attr.internal_ip6_address.prefix", |
8285 | 16 | FT_UINT8, BASE_DEC, NULL, 0x00, |
8286 | 16 | NULL, HFILL }}, |
8287 | 16 | { &hf_isakmp_cfg_attr_internal_ip6_netmask, |
8288 | 16 | { "INTERNAL IP6 NETMASK", "ike.cfg.attr.internal_ip6_netmask", |
8289 | 16 | FT_IPv6, BASE_NONE, NULL, 0x00, |
8290 | 16 | "The internal network's netmask", HFILL }}, |
8291 | 16 | { &hf_isakmp_cfg_attr_internal_ip6_dns, |
8292 | 16 | { "INTERNAL IP6 DNS", "ike.cfg.attr.internal_ip6_dns", |
8293 | 16 | FT_IPv6, BASE_NONE, NULL, 0x00, |
8294 | 16 | "An IPv6 address of a DNS server within the network", HFILL }}, |
8295 | 16 | { &hf_isakmp_cfg_attr_internal_ip6_nbns, |
8296 | 16 | { "INTERNAL IP6 NBNS", "ike.cfg.attr.internal_ip6_nbns", |
8297 | 16 | FT_IPv6, BASE_NONE, NULL, 0x00, |
8298 | 16 | "An IPv6 address of a NetBios Name Server (WINS) within the network", HFILL }}, |
8299 | 16 | { &hf_isakmp_cfg_attr_internal_ip6_dhcp, |
8300 | 16 | { "INTERNAL IP6 DHCP", "ike.cfg.attr.internal_ip6_dhcp", |
8301 | 16 | FT_IPv6, BASE_NONE, NULL, 0x00, |
8302 | 16 | "The host to send any internal DHCP requests to the address", HFILL }}, |
8303 | 16 | { &hf_isakmp_cfg_attr_internal_ip4_subnet_ip, |
8304 | 16 | { "INTERNAL IP4 SUBNET (IP)", "ike.cfg.attr.internal_ip4_subnet_ip", |
8305 | 16 | FT_IPv4, BASE_NONE, NULL, 0x00, |
8306 | 16 | "The protected sub-networks that this edge-device protects (IP)", HFILL }}, |
8307 | 16 | { &hf_isakmp_cfg_attr_internal_ip4_subnet_netmask, |
8308 | 16 | { "INTERNAL IP4 SUBNET (NETMASK)", "ike.cfg.attr.internal_ip4_subnet_netmask", |
8309 | 16 | FT_IPv4, BASE_NETMASK, NULL, 0x00, |
8310 | 16 | "The protected sub-networks that this edge-device protects (IP)", HFILL }}, |
8311 | 16 | { &hf_isakmp_cfg_attr_supported_attributes, |
8312 | 16 | { "SUPPORTED ATTRIBUTES", "ike.cfg.attr.supported_attributes", |
8313 | 16 | FT_UINT16, BASE_DEC, NULL, 0x00, |
8314 | 16 | NULL, HFILL }}, |
8315 | 16 | { &hf_isakmp_cfg_attr_internal_ip6_subnet_ip, |
8316 | 16 | { "INTERNAL_IP6_SUBNET (IP)", "ike.cfg.attr.internal_ip6_subnet_ip", |
8317 | 16 | FT_IPv6, BASE_NONE, NULL, 0x00, |
8318 | 16 | NULL, HFILL }}, |
8319 | 16 | { &hf_isakmp_cfg_attr_internal_ip6_subnet_prefix, |
8320 | 16 | { "INTERNAL_IP6_SUBNET (PREFIX)", "ike.cfg.attr.internal_ip6_subnet_prefix", |
8321 | 16 | FT_UINT8, BASE_DEC, NULL, 0x00, |
8322 | 16 | NULL, HFILL }}, |
8323 | 16 | { &hf_isakmp_cfg_attr_internal_ip6_link_interface, |
8324 | 16 | { "INTERNAL_IP6_LINK (Link-Local Interface ID)", "ike.cfg.attr.internal_ip6_link_interface", |
8325 | 16 | FT_UINT64, BASE_DEC, NULL, 0x00, |
8326 | 16 | "The Interface ID used for link-local address (by the party that sent this attribute)", HFILL }}, |
8327 | 16 | { &hf_isakmp_cfg_attr_internal_ip6_link_id, |
8328 | 16 | { "INTERNAL_IP6_LINK (IKEv2 Link ID)", "ike.cfg.attr.internal_ip6_link_id", |
8329 | 16 | FT_BYTES, BASE_NONE, NULL, 0x00, |
8330 | 16 | "The Link ID is selected by the VPN gateway and is treated as an opaque octet string by the client.", HFILL }}, |
8331 | 16 | { &hf_isakmp_cfg_attr_internal_ip6_prefix_ip, |
8332 | 16 | { "INTERNAL_IP6_PREFIX (IP)", "ike.cfg.attr.internal_ip6_prefix_ip", |
8333 | 16 | FT_IPv6, BASE_NONE, NULL, 0x00, |
8334 | 16 | "An IPv6 prefix assigned to the virtual link", HFILL }}, |
8335 | 16 | { &hf_isakmp_cfg_attr_internal_ip6_prefix_length, |
8336 | 16 | { "INTERNAL_IP6_PREFIX (Length)", "ike.cfg.attr.internal_ip6_prefix_length", |
8337 | 16 | FT_UINT8, BASE_DEC, NULL, 0x00, |
8338 | 16 | "The length of the prefix in bits (usually 64)", HFILL }}, |
8339 | 16 | { &hf_isakmp_cfg_attr_p_cscf_ip4_address, |
8340 | 16 | { "P_CSCF_IP4_ADDRESS (IP)", "ike.cfg.attr.p_cscf_ip4_address", |
8341 | 16 | FT_IPv4, BASE_NONE, NULL, 0x00, |
8342 | 16 | "An IPv4 address of the P-CSCF server", HFILL }}, |
8343 | 16 | { &hf_isakmp_cfg_attr_p_cscf_ip6_address, |
8344 | 16 | { "P_CSCF_IP6_ADDRESS (IP)", "ike.cfg.attr.p_cscf_ip6_address", |
8345 | 16 | FT_IPv6, BASE_NONE, NULL, 0x00, |
8346 | 16 | "An IPv6 address of the P-CSCF server", HFILL }}, |
8347 | 16 | { &hf_isakmp_cfg_attr_internal_dns_domain, |
8348 | 16 | { "INTERNAL_DNS_DOMAIN", "ike.cfg.attr.internal_dns_domain", |
8349 | 16 | FT_STRING, BASE_NONE, NULL, 0x00, |
8350 | 16 | NULL, HFILL }}, |
8351 | | |
8352 | 16 | { &hf_isakmp_cfg_attr_xauth_type, |
8353 | 16 | { "XAUTH TYPE", "ike.cfg.attr.xauth.type", |
8354 | 16 | FT_UINT16, BASE_RANGE_STRING | BASE_DEC, RVALS(cfgattr_xauth_type), 0x00, |
8355 | 16 | "The type of extended authentication requested", HFILL }}, |
8356 | 16 | { &hf_isakmp_cfg_attr_xauth_user_name, |
8357 | 16 | { "XAUTH USER NAME", "ike.cfg.attr.xauth.user_name", |
8358 | 16 | FT_STRING, BASE_NONE, NULL, 0x00, |
8359 | 16 | "The user name", HFILL }}, |
8360 | 16 | { &hf_isakmp_cfg_attr_xauth_user_password, |
8361 | 16 | { "XAUTH USER PASSWORD", "ike.cfg.attr.xauth.user_password", |
8362 | 16 | FT_STRING, BASE_NONE, NULL, 0x00, |
8363 | 16 | "The user's password", HFILL }}, |
8364 | 16 | { &hf_isakmp_cfg_attr_xauth_passcode, |
8365 | 16 | { "XAUTH PASSCODE", "ike.cfg.attr.xauth.passcode", |
8366 | 16 | FT_STRING, BASE_NONE, NULL, 0x00, |
8367 | 16 | "A token card's passcode", HFILL }}, |
8368 | 16 | { &hf_isakmp_cfg_attr_xauth_message, |
8369 | 16 | { "XAUTH MESSAGE", "ike.cfg.attr.xauth.message", |
8370 | 16 | FT_STRING, BASE_NONE, NULL, 0x00, |
8371 | 16 | "A textual message from an edge device to an IPSec host", HFILL }}, |
8372 | 16 | { &hf_isakmp_cfg_attr_xauth_challenge, |
8373 | 16 | { "XAUTH CHALLENGE", "ike.cfg.attr.xauth.challenge", |
8374 | 16 | FT_STRING, BASE_NONE, NULL, 0x00, |
8375 | 16 | "A challenge string sent from the edge device to the IPSec host for it to include in its calculation of a password", HFILL }}, |
8376 | 16 | { &hf_isakmp_cfg_attr_xauth_domain, |
8377 | 16 | { "XAUTH DOMAIN", "ike.cfg.attr.xauth.domain", |
8378 | 16 | FT_STRING, BASE_NONE, NULL, 0x00, |
8379 | 16 | "The domain to be authenticated in", HFILL }}, |
8380 | 16 | { &hf_isakmp_cfg_attr_xauth_status, |
8381 | 16 | { "XAUTH STATUS", "ike.cfg.attr.xauth.status", |
8382 | 16 | FT_UINT16, BASE_DEC, VALS(cfgattr_xauth_status), 0x00, |
8383 | 16 | "A variable that is used to denote authentication success or failure", HFILL }}, |
8384 | 16 | { &hf_isakmp_cfg_attr_xauth_next_pin, |
8385 | 16 | { "XAUTH TYPE", "ike.cfg.attr.xauth.next_pin", |
8386 | 16 | FT_STRING, BASE_NONE, NULL, 0x00, |
8387 | 16 | "A variable which is used when the edge device is requesting that the user choose a new pin number", HFILL }}, |
8388 | 16 | { &hf_isakmp_cfg_attr_xauth_answer, |
8389 | 16 | { "XAUTH ANSWER", "ike.cfg.attr.xauth.answer", |
8390 | 16 | FT_STRING, BASE_NONE, NULL, 0x00, |
8391 | 16 | "A variable length ASCII string used to send input to the edge device", HFILL }}, |
8392 | 16 | { &hf_isakmp_cfg_attr_fortinet_auto_negotiate, |
8393 | 16 | { "FORTINET AUTO NEGOTIATE", "ike.cfg.attr.fortinet.auto_negotiate", |
8394 | 16 | FT_UINT16, BASE_DEC, NULL, 0x00, |
8395 | 16 | NULL, HFILL }}, |
8396 | 16 | { &hf_isakmp_cfg_attr_fortinet_keep_alive, |
8397 | 16 | { "FORTINET KEEP ALIVE", "ike.cfg.attr.fortinet.keep_alive", |
8398 | 16 | FT_UINT16, BASE_DEC, NULL, 0x00, |
8399 | 16 | NULL, HFILL }}, |
8400 | 16 | { &hf_isakmp_cfg_attr_fortinet_dns_suffix, |
8401 | 16 | { "FORTINET DNS SUFFIX", "ike.cfg.attr.fortinet.dns_suffix", |
8402 | 16 | FT_STRING, BASE_NONE, NULL, 0x00, |
8403 | 16 | NULL, HFILL }}, |
8404 | 16 | { &hf_isakmp_cfg_attr_unity_banner, |
8405 | 16 | { "UNITY BANNER", "ike.cfg.attr.unity.banner", |
8406 | 16 | FT_STRING, BASE_NONE, NULL, 0x00, |
8407 | 16 | NULL, HFILL }}, |
8408 | 16 | { &hf_isakmp_cfg_attr_unity_save_passwd, |
8409 | 16 | { "UNITY SAVE PASSWD", "ike.cfg.attr.unity.save_passwd", |
8410 | 16 | FT_BOOLEAN, 16, NULL, 0x0001, |
8411 | 16 | NULL, HFILL }}, |
8412 | 16 | { &hf_isakmp_cfg_attr_unity_split_exclude, |
8413 | 16 | { "UNITY SPLIT EXCLUDE", "ike.cfg.attr.unity.split_exclude", |
8414 | 16 | FT_BOOLEAN, 16, NULL, 0x0001, |
8415 | 16 | NULL, HFILL }}, |
8416 | 16 | { &hf_isakmp_cfg_attr_unity_def_domain, |
8417 | 16 | { "UNITY DEF DOMAIN", "ike.cfg.attr.unity.def_domain", |
8418 | 16 | FT_STRING, BASE_NONE, NULL, 0x00, |
8419 | 16 | NULL, HFILL }}, |
8420 | | |
8421 | | /* SA KEK Payload */ |
8422 | 16 | { &hf_isakmp_sak_next_payload, |
8423 | 16 | { "Next Payload", "ike.sak.nextpayload", |
8424 | 16 | FT_UINT8, BASE_DEC, NULL, 0x0, |
8425 | 16 | NULL, HFILL }}, |
8426 | 16 | { &hf_isakmp_sak_reserved, |
8427 | 16 | { "Reserved", "ike.sak.reserved", |
8428 | 16 | FT_UINT8, BASE_DEC, NULL, 0x0, |
8429 | 16 | NULL, HFILL }}, |
8430 | 16 | { &hf_isakmp_sak_payload_len , |
8431 | 16 | { "Payload length", "ike.sak.payload_len", |
8432 | 16 | FT_UINT16, BASE_DEC, NULL, 0x0, |
8433 | 16 | NULL, HFILL }}, |
8434 | 16 | { &hf_isakmp_sak_protocol, |
8435 | 16 | { "Protocol ID", "ike.sak.protoid", |
8436 | 16 | FT_UINT8, BASE_DEC|BASE_EXT_STRING, &ipproto_val_ext, 0x0, |
8437 | 16 | NULL, HFILL }}, |
8438 | 16 | { &hf_isakmp_sak_src_id_type, |
8439 | 16 | { "SRC ID Type", "ike.sak.src_id_type", |
8440 | 16 | FT_UINT8, BASE_RANGE_STRING | BASE_DEC, RVALS(vs_v1_id_type), 0x0, |
8441 | 16 | NULL, HFILL }}, |
8442 | 16 | { &hf_isakmp_sak_src_id_port, |
8443 | 16 | { "SRC ID Port", "ike.sak.src_id_port", |
8444 | 16 | FT_UINT16, BASE_DEC, NULL, 0x0, |
8445 | 16 | NULL, HFILL }}, |
8446 | 16 | { &hf_isakmp_sak_src_id_length, |
8447 | 16 | { "SRC ID Data Length", "ike.sak.src_id_length", |
8448 | 16 | FT_UINT8, BASE_DEC, NULL, 0x0, |
8449 | 16 | NULL, HFILL }}, |
8450 | 16 | { &hf_isakmp_sak_src_id_data, |
8451 | 16 | { "SRC ID Data", "ike.sak.src_id_data", |
8452 | 16 | FT_BYTES, BASE_NONE, NULL, 0x0, |
8453 | 16 | NULL, HFILL }}, |
8454 | 16 | { &hf_isakmp_sak_dst_id_type, |
8455 | 16 | { "DST ID Type", "ike.sak.dst_id_type", |
8456 | 16 | FT_UINT8, BASE_RANGE_STRING | BASE_DEC, RVALS(vs_v1_id_type), 0x0, |
8457 | 16 | NULL, HFILL }}, |
8458 | 16 | { &hf_isakmp_sak_dst_id_port, |
8459 | 16 | { "DST ID Port", "ike.sak.dst_id_port", |
8460 | 16 | FT_UINT16, BASE_DEC, NULL, 0x0, |
8461 | 16 | NULL, HFILL }}, |
8462 | 16 | { &hf_isakmp_sak_dst_id_length, |
8463 | 16 | { "DST ID Data Length", "ike.sak.dst_id_length", |
8464 | 16 | FT_UINT8, BASE_DEC, NULL, 0x0, |
8465 | 16 | NULL, HFILL }}, |
8466 | 16 | { &hf_isakmp_sak_dst_id_data, |
8467 | 16 | { "DST ID Data", "ike.sak.dst_id_data", |
8468 | 16 | FT_BYTES, BASE_NONE, NULL, 0x0, |
8469 | 16 | NULL, HFILL }}, |
8470 | 16 | { &hf_isakmp_sak_spi, |
8471 | 16 | { "SPI", "ike.sak.spi", |
8472 | 16 | FT_BYTES, BASE_NONE, NULL, 0x0, |
8473 | 16 | NULL, HFILL }}, |
8474 | | |
8475 | | /* SA TEK Payload */ |
8476 | 16 | { &hf_isakmp_sat_next_payload, |
8477 | 16 | { "Next Payload", "ike.sat.nextpayload", |
8478 | 16 | FT_UINT8, BASE_DEC, NULL, 0x0, |
8479 | 16 | NULL, HFILL }}, |
8480 | 16 | { &hf_isakmp_sat_reserved, |
8481 | 16 | { "Reserved", "ike.sat.reserved", |
8482 | 16 | FT_UINT8, BASE_DEC, NULL, 0x0, |
8483 | 16 | NULL, HFILL }}, |
8484 | 16 | { &hf_isakmp_sat_payload_len , |
8485 | 16 | { "Payload length", "ike.sat.payload_len", |
8486 | 16 | FT_UINT16, BASE_DEC, NULL, 0x0, |
8487 | 16 | NULL, HFILL }}, |
8488 | 16 | { &hf_isakmp_sat_protocol_id, |
8489 | 16 | { "Protocol ID", "ike.sat.protocol_id", |
8490 | 16 | FT_UINT8, BASE_RANGE_STRING | BASE_DEC, RVALS(sat_protocol_ids), 0x0, |
8491 | 16 | NULL, HFILL }}, |
8492 | 16 | { &hf_isakmp_sat_protocol, |
8493 | 16 | { "Internet Protocol", "ike.sat.protocol", |
8494 | 16 | FT_UINT8, BASE_DEC|BASE_EXT_STRING, &ipproto_val_ext, 0x0, |
8495 | 16 | NULL, HFILL }}, |
8496 | 16 | { &hf_isakmp_sat_src_id_type, |
8497 | 16 | { "SRC ID Type", "ike.sat.src_id_type", |
8498 | 16 | FT_UINT8, BASE_RANGE_STRING | BASE_DEC, RVALS(vs_v1_id_type), 0x0, |
8499 | 16 | NULL, HFILL }}, |
8500 | 16 | { &hf_isakmp_sat_src_id_port, |
8501 | 16 | { "SRC ID Port", "ike.sat.src_id_port", |
8502 | 16 | FT_UINT16, BASE_DEC, NULL, 0x0, |
8503 | 16 | NULL, HFILL }}, |
8504 | 16 | { &hf_isakmp_sat_src_id_length, |
8505 | 16 | { "SRC ID Data Length", "ike.sat.src_id_length", |
8506 | 16 | FT_UINT16, BASE_DEC, NULL, 0x0, |
8507 | 16 | NULL, HFILL }}, |
8508 | 16 | { &hf_isakmp_sat_src_id_data, |
8509 | 16 | { "SRC ID Data", "ike.sat.src_id_data", |
8510 | 16 | FT_BYTES, BASE_NONE, NULL, 0x0, |
8511 | 16 | NULL, HFILL }}, |
8512 | 16 | { &hf_isakmp_sat_dst_id_type, |
8513 | 16 | { "DST ID Type", "ike.sat.dst_id_type", |
8514 | 16 | FT_UINT8, BASE_RANGE_STRING | BASE_DEC, RVALS(vs_v1_id_type), 0x0, |
8515 | 16 | NULL, HFILL }}, |
8516 | 16 | { &hf_isakmp_sat_dst_id_port, |
8517 | 16 | { "DST ID Port", "ike.sat.dst_id_port", |
8518 | 16 | FT_UINT16, BASE_DEC, NULL, 0x0, |
8519 | 16 | NULL, HFILL }}, |
8520 | 16 | { &hf_isakmp_sat_dst_id_length, |
8521 | 16 | { "DST ID Data Length", "ike.sat.dst_id_length", |
8522 | 16 | FT_UINT16, BASE_DEC, NULL, 0x0, |
8523 | 16 | NULL, HFILL }}, |
8524 | 16 | { &hf_isakmp_sat_dst_id_data, |
8525 | 16 | { "DST ID Data", "ike.sat.dst_id_data", |
8526 | 16 | FT_BYTES, BASE_NONE, NULL, 0x0, |
8527 | 16 | NULL, HFILL }}, |
8528 | 16 | { &hf_isakmp_sat_transform_id, |
8529 | 16 | { "Transform ID", "ike.sat.transform_id", |
8530 | 16 | FT_UINT8, BASE_DEC, NULL, 0x0, |
8531 | 16 | NULL, HFILL }}, |
8532 | 16 | { &hf_isakmp_sat_spi, |
8533 | 16 | { "SPI", "ike.sat.spi", |
8534 | 16 | FT_BYTES, BASE_NONE, NULL, 0x0, |
8535 | 16 | NULL, HFILL }}, |
8536 | 16 | { &hf_isakmp_sat_payload, |
8537 | 16 | { "TEK Payload", "ike.sat.payload", |
8538 | 16 | FT_BYTES, BASE_NONE, NULL, 0x0, |
8539 | 16 | NULL, HFILL }}, |
8540 | | |
8541 | | /* Key Download Payload */ |
8542 | 16 | { &hf_isakmp_kd_num_key_pkt, |
8543 | 16 | { "Number of Key Packets", "ike.kd.num_pkt", |
8544 | 16 | FT_UINT16, BASE_DEC, NULL, 0x0, |
8545 | 16 | NULL, HFILL }}, |
8546 | 16 | { &hf_isakmp_kd_payload, |
8547 | 16 | { "Key Download Payload", "ike.kd.payload", |
8548 | 16 | FT_NONE, BASE_NONE, NULL, 0x0, |
8549 | 16 | NULL, HFILL }}, |
8550 | 16 | { &hf_isakmp_kdp_type, |
8551 | 16 | { "Type", "ike.kd.payload.type", |
8552 | 16 | FT_UINT8, BASE_RANGE_STRING | BASE_DEC, RVALS(key_download_types), 0x0, |
8553 | 16 | NULL, HFILL }}, |
8554 | 16 | { &hf_isakmp_kdp_length, |
8555 | 16 | { "Length", "ike.kd.payload.length", |
8556 | 16 | FT_UINT16, BASE_DEC, NULL, 0x0, |
8557 | 16 | NULL, HFILL }}, |
8558 | 16 | { &hf_isakmp_kdp_spi_size, |
8559 | 16 | { "SPI Size", "ike.kd.payload.spi_size", |
8560 | 16 | FT_UINT8, BASE_DEC, NULL, 0x0, |
8561 | 16 | NULL, HFILL }}, |
8562 | 16 | { &hf_isakmp_kdp_spi, |
8563 | 16 | { "SPI", "ike.kd.payload.spi", |
8564 | 16 | FT_BYTES, BASE_NONE, NULL, 0x0, |
8565 | 16 | NULL, HFILL }}, |
8566 | | /* Sequence Payload */ |
8567 | 16 | { &hf_isakmp_seq_seq, |
8568 | 16 | { "Sequence Number", "ike.seq.seq", |
8569 | 16 | FT_UINT32, BASE_DEC, NULL, 0x0, |
8570 | 16 | NULL, HFILL }}, |
8571 | | |
8572 | 16 | { &hf_isakmp_enc_decrypted_data, |
8573 | 16 | { "Decrypted Data", "ike.enc.decrypted", |
8574 | 16 | FT_NONE, BASE_NONE, NULL, 0x0, |
8575 | 16 | NULL, HFILL }}, |
8576 | 16 | { &hf_isakmp_enc_contained_data, |
8577 | 16 | { "Contained Data", "ike.enc.contained", |
8578 | 16 | FT_NONE, BASE_NONE, NULL, 0x0, |
8579 | 16 | NULL, HFILL }}, |
8580 | 16 | { &hf_isakmp_enc_padding, |
8581 | 16 | { "Padding", "ike.enc.padding", |
8582 | 16 | FT_NONE, BASE_NONE, NULL, 0x0, |
8583 | 16 | NULL, HFILL }}, |
8584 | 16 | { &hf_isakmp_enc_pad_length, |
8585 | 16 | { "Pad Length", "ike.enc.pad_length", |
8586 | 16 | FT_UINT8, BASE_DEC, NULL, 0x0, |
8587 | 16 | NULL, HFILL }}, |
8588 | 16 | { &hf_isakmp_enc_data, |
8589 | 16 | { "Encrypted Data", "ike.enc.data", |
8590 | 16 | FT_NONE, BASE_NONE, NULL, 0x0, |
8591 | 16 | NULL, HFILL }}, |
8592 | 16 | { &hf_isakmp_enc_iv, |
8593 | 16 | { "Initialization Vector", "ike.enc.iv", |
8594 | 16 | FT_BYTES, BASE_NONE, NULL, 0x0, |
8595 | 16 | NULL, HFILL }}, |
8596 | 16 | { &hf_isakmp_enc_icd, |
8597 | 16 | { "Integrity Checksum Data", "ike.enc.icd", |
8598 | 16 | FT_BYTES, BASE_NONE, NULL, 0x0, |
8599 | 16 | NULL, HFILL }}, |
8600 | 16 | { &hf_isakmp_notify_data_3gpp_backoff_timer_len, |
8601 | 16 | { "Length", "ike.notify.priv.3gpp.backoff_timer_len", |
8602 | 16 | FT_UINT8, BASE_DEC, NULL, 0x0, |
8603 | 16 | NULL, HFILL }}, |
8604 | | |
8605 | 16 | { &hf_isakmp_notify_data_3gpp_device_identity_len, |
8606 | 16 | { "Identity Length", "ike.notify.priv.3gpp.device_identity_len", |
8607 | 16 | FT_UINT16, BASE_DEC, NULL, 0x0, |
8608 | 16 | NULL, HFILL }}, |
8609 | 16 | { &hf_isakmp_notify_data_3gpp_device_identity_type, |
8610 | 16 | { "Identity Type", "ike.notify.priv.3gpp.device_identity_type", |
8611 | 16 | FT_UINT8, BASE_DEC, VALS(device_identity_types), 0x0, |
8612 | 16 | NULL, HFILL }}, |
8613 | 16 | { &hf_isakmp_notify_data_3gpp_device_identity_imei, |
8614 | 16 | { "IMEI", "ike.notify.priv.3gpp.device_identity_imei", |
8615 | 16 | FT_STRING, BASE_NONE, NULL, 0, |
8616 | 16 | NULL, HFILL }}, |
8617 | 16 | { &hf_isakmp_notify_data_3gpp_device_identity_imeisv, |
8618 | 16 | { "IMEISV", "ike.notify.priv.3gpp.device_identity_imeisv", |
8619 | 16 | FT_STRING, BASE_NONE, NULL, 0, |
8620 | 16 | NULL, HFILL }}, |
8621 | | |
8622 | 16 | { &hf_isakmp_notify_data_3gpp_emergency_call_mcc, |
8623 | 16 | { "MCC", "ike.notify.priv.3gpp.emergency_call_mcc", |
8624 | 16 | FT_STRING, BASE_NONE, NULL, 0x0, |
8625 | 16 | NULL, HFILL }}, |
8626 | 16 | { &hf_isakmp_notify_data_3gpp_emergency_call_numbers_len, |
8627 | 16 | { "Total Length", "ike.notify.priv.3gpp.emergency_call_numbers_len", |
8628 | 16 | FT_UINT8, BASE_DEC, NULL, 0x0, |
8629 | 16 | NULL, HFILL } }, |
8630 | 16 | { &hf_isakmp_notify_data_3gpp_emergency_call_numbers_spare, |
8631 | 16 | { "Spare", "ike.notify.priv.3gpp.emergency_call_numbers_spare", |
8632 | 16 | FT_UINT8, BASE_DEC, NULL, 0xE0, |
8633 | 16 | NULL, HFILL }}, |
8634 | 16 | { &hf_isakmp_notify_data_3gpp_emergency_call_numbers_element_len, |
8635 | 16 | { "Length", "ike.notify.priv.3gpp.emergency_call_numbers_element_len", |
8636 | 16 | FT_UINT8, BASE_DEC, NULL, 0, |
8637 | 16 | NULL, HFILL }}, |
8638 | | |
8639 | 16 | { &hf_isakmp_notify_data_3gpp_emergency_call_numbers_flags, |
8640 | 16 | { "Service Category Value", "ike.notify.priv.3gpp.emergency_call_numbers_flags", |
8641 | 16 | FT_UINT8, BASE_HEX, NULL, 0x0, |
8642 | 16 | NULL, HFILL }}, |
8643 | | |
8644 | 16 | { &hf_isakmp_notify_data_3gpp_emergency_call_numbers_flag_b1_police, |
8645 | 16 | { "Police", "ike.notify.priv.3gpp.emergency_call_numbers_flag_b1_police", |
8646 | 16 | FT_UINT8, BASE_DEC, NULL, 0x01, |
8647 | 16 | NULL, HFILL }}, |
8648 | 16 | { &hf_isakmp_notify_data_3gpp_emergency_call_numbers_flag_b2_ambulance, |
8649 | 16 | { "Ambulance", "ike.notify.priv.3gpp.emergency_call_numbers_flag_b2_ambulance", |
8650 | 16 | FT_UINT8, BASE_DEC, NULL, 0x02, |
8651 | 16 | NULL, HFILL }}, |
8652 | 16 | { &hf_isakmp_notify_data_3gpp_emergency_call_numbers_flag_b3_fire_brigade, |
8653 | 16 | { "Fire Brigade", "ike.notify.priv.3gpp.emergency_call_numbers_flag_b3_fire_brigade", |
8654 | 16 | FT_UINT8, BASE_DEC, NULL, 0x04, |
8655 | 16 | NULL, HFILL }}, |
8656 | 16 | { &hf_isakmp_notify_data_3gpp_emergency_call_numbers_flag_b4_marine_guard, |
8657 | 16 | { "Marine Guard", "ike.notify.priv.3gpp.emergency_call_numbers_b4_marine_guard", |
8658 | 16 | FT_UINT8, BASE_DEC, NULL, 0x08, |
8659 | 16 | NULL, HFILL }}, |
8660 | 16 | { &hf_isakmp_notify_data_3gpp_emergency_call_numbers_flag_b5_mountain_rescue, |
8661 | 16 | { "Mountain Rescue", "ike.notify.priv.3gpp.emergency_call_numbers_flag_b5_mountain_rescue", |
8662 | 16 | FT_UINT8, BASE_DEC, NULL, 0x10, |
8663 | 16 | NULL, HFILL }}, |
8664 | 16 | { &hf_iskamp_notify_data_3gpp_emergency_call_number, |
8665 | 16 | { "Emergency Number", "ike.notify.priv.3gpp.emergency_call_number", |
8666 | 16 | FT_STRING, BASE_NONE, NULL, 0x0, |
8667 | 16 | NULL, HFILL }}, |
8668 | | |
8669 | | /* RFC9329 : IKETCP */ |
8670 | 16 | { &hf_isakmp_iketcp_magic, |
8671 | 16 | { "IKETCP Magic", "ike.iketcp.magic", |
8672 | 16 | FT_STRING, BASE_NONE, NULL, 0x00, |
8673 | 16 | NULL, HFILL }}, |
8674 | 16 | { &hf_isakmp_iketcp_length, |
8675 | 16 | { "Length", "ike.iketcp.length", |
8676 | 16 | FT_UINT16, BASE_DEC, NULL, 0x00, |
8677 | 16 | NULL, HFILL }}, |
8678 | 16 | { &hf_isakmp_iketcp_non_esp_marker, |
8679 | 16 | { "Non-ESP Marker", "ike.iketcp.non_esp_marker", |
8680 | 16 | FT_BYTES, BASE_NONE, NULL, 0x00, |
8681 | 16 | "Should be Zero", HFILL }}, |
8682 | 16 | }; |
8683 | | |
8684 | | |
8685 | | |
8686 | 16 | static int *ett[] = { |
8687 | 16 | &ett_isakmp, |
8688 | 16 | &ett_isakmp_version, |
8689 | 16 | &ett_isakmp_flags, |
8690 | 16 | &ett_isakmp_payload, |
8691 | 16 | &ett_isakmp_payload_digital_signature, |
8692 | 16 | &ett_isakmp_payload_digital_signature_asn1_data, |
8693 | 16 | &ett_isakmp_fragment, |
8694 | 16 | &ett_isakmp_fragments, |
8695 | 16 | &ett_isakmp_sa, |
8696 | 16 | &ett_isakmp_attr, |
8697 | 16 | &ett_isakmp_id, |
8698 | 16 | &ett_isakmp_notify_data, |
8699 | 16 | &ett_isakmp_notify_data_3gpp_emergency_call_numbers_main, |
8700 | 16 | &ett_isakmp_notify_data_3gpp_emergency_call_numbers_element, |
8701 | 16 | &ett_isakmp_notify_fortinet_forticlient_connnect, |
8702 | 16 | &ett_isakmp_ts, |
8703 | 16 | &ett_isakmp_kd, |
8704 | 16 | &ett_isakmp_decrypted_data, |
8705 | 16 | &ett_isakmp_decrypted_payloads |
8706 | 16 | }; |
8707 | | |
8708 | 16 | static ei_register_info ei[] = { |
8709 | 16 | { &ei_isakmp_enc_iv, { "ike.enc.iv.not_enough_data", PI_MALFORMED, PI_WARN, "Not enough data in IKEv2 Encrypted payload", EXPFILL }}, |
8710 | 16 | { &ei_isakmp_ikev2_integrity_checksum, { "ike.ikev2.integrity_checksum", PI_CHECKSUM, PI_WARN, "IKEv2 Integrity Checksum Data is incorrect", EXPFILL }}, |
8711 | 16 | { &ei_isakmp_enc_data_length_mult_block_size, { "ike.enc_data_length_mult_block_size", PI_MALFORMED, PI_WARN, "Encrypted data length isn't a multiple of block size", EXPFILL }}, |
8712 | 16 | { &ei_isakmp_enc_pad_length_big, { "ike.enc.pad_length.big", PI_MALFORMED, PI_WARN, "Pad length is too big", EXPFILL }}, |
8713 | 16 | { &ei_isakmp_attribute_value_empty, { "ike.attribute_value_empty", PI_PROTOCOL, PI_NOTE, "Attribute value is empty", EXPFILL }}, |
8714 | 16 | { &ei_isakmp_payload_bad_length, { "ike.payloadlength.invalid", PI_MALFORMED, PI_ERROR, "Invalid payload length", EXPFILL }}, |
8715 | 16 | { &ei_isakmp_bad_fragment_number, { "ike.fragment_number.invalid", PI_MALFORMED, PI_ERROR, "Invalid fragment numbering", EXPFILL }}, |
8716 | 16 | { &ei_isakmp_notify_data_3gpp_unknown_device_identity, { "ike.notify.priv.3gpp.unknown_device_identity", PI_PROTOCOL, PI_WARN, "Type of device identity not known", EXPFILL }}, |
8717 | 16 | { &ei_isakmp_notify_data_nat_payload_sha1_mismatch, { "ike.notify.nat_payload.sha1_mismatch", PI_PROTOCOL, PI_NOTE, "SHA1 mismatch in NAT payload. NAT was detected", EXPFILL }}, |
8718 | 16 | }; |
8719 | | |
8720 | 16 | expert_module_t* expert_isakmp; |
8721 | | |
8722 | 16 | static uat_field_t ikev1_uat_flds[] = { |
8723 | 16 | UAT_FLD_BUFFER(ikev1_users, icookie, "Initiator's COOKIE", "Initiator's COOKIE"), |
8724 | 16 | UAT_FLD_BUFFER(ikev1_users, key, "Encryption Key", "Encryption Key"), |
8725 | 16 | UAT_END_FIELDS |
8726 | 16 | }; |
8727 | | |
8728 | 16 | static uat_field_t ikev2_uat_flds[] = { |
8729 | 16 | UAT_FLD_BUFFER(ikev2_users, spii, "Initiator's SPI", "Initiator's SPI value of the IKE_SA"), |
8730 | 16 | UAT_FLD_BUFFER(ikev2_users, spir, "Responder's SPI", "Responder's SPI value of the IKE_SA"), |
8731 | 16 | UAT_FLD_BUFFER(ikev2_users, sk_ei, "SK_ei", "Key used to encrypt/decrypt IKEv2 packets from initiator to responder"), |
8732 | 16 | UAT_FLD_BUFFER(ikev2_users, sk_er, "SK_er", "Key used to encrypt/decrypt IKEv2 packets from responder to initiator"), |
8733 | 16 | UAT_FLD_VS(ikev2_users, encr_alg, "Encryption algorithm", vs_ikev2_encr_algs, "Encryption algorithm of IKE_SA"), |
8734 | 16 | UAT_FLD_BUFFER(ikev2_users, sk_ai, "SK_ai", "Key used to calculate Integrity Checksum Data for IKEv2 packets from initiator to responder"), |
8735 | 16 | UAT_FLD_BUFFER(ikev2_users, sk_ar, "SK_ar", "Key used to calculate Integrity Checksum Data for IKEv2 packets from responder to initiator"), |
8736 | 16 | UAT_FLD_VS(ikev2_users, auth_alg, "Integrity algorithm", vs_ikev2_auth_algs, "Integrity algorithm of IKE_SA"), |
8737 | 16 | UAT_END_FIELDS |
8738 | 16 | }; |
8739 | | |
8740 | 16 | proto_isakmp = proto_register_protocol("Internet Key Exchange", "IKE", "ike"); |
8741 | 16 | proto_register_alias(proto_isakmp, "isakmp"); |
8742 | 16 | proto_register_field_array(proto_isakmp, hf, array_length(hf)); |
8743 | 16 | proto_register_subtree_array(ett, array_length(ett)); |
8744 | 16 | expert_isakmp = expert_register_protocol(proto_isakmp); |
8745 | 16 | expert_register_field_array(expert_isakmp, ei, array_length(ei)); |
8746 | 16 | register_init_routine(&isakmp_init_protocol); |
8747 | 16 | register_cleanup_routine(&isakmp_cleanup_protocol); |
8748 | 16 | reassembly_table_register(&isakmp_cisco_reassembly_table, |
8749 | 16 | &addresses_reassembly_table_functions); |
8750 | 16 | reassembly_table_register(&isakmp_ike2_reassembly_table, |
8751 | 16 | &addresses_reassembly_table_functions); |
8752 | | |
8753 | 16 | isakmp_handle = register_dissector("ike", dissect_isakmp, proto_isakmp); |
8754 | | /* For backwards compatibility */ |
8755 | 16 | isakmp_handle = register_dissector("isakmp", dissect_isakmp, proto_isakmp); |
8756 | 16 | iketcp_handle = register_dissector("iketcp", dissect_iketcp, proto_isakmp); |
8757 | | |
8758 | 16 | isakmp_module = prefs_register_protocol(proto_isakmp, NULL); |
8759 | 16 | ikev1_uat = uat_new("IKEv1 Decryption Table", |
8760 | 16 | sizeof(ikev1_uat_data_key_t), |
8761 | 16 | "ikev1_decryption_table", |
8762 | 16 | true, |
8763 | 16 | &ikev1_uat_data, |
8764 | 16 | &num_ikev1_uat_data, |
8765 | 16 | UAT_AFFECTS_DISSECTION, /* affects dissection of packets, but not set of named fields */ |
8766 | 16 | NULL, |
8767 | 16 | ikev1_uat_data_copy_cb, |
8768 | 16 | ikev1_uat_data_update_cb, |
8769 | 16 | ikev1_uat_data_free_cb, |
8770 | 16 | NULL, |
8771 | 16 | NULL, |
8772 | 16 | ikev1_uat_flds); |
8773 | | |
8774 | 16 | prefs_register_uat_preference(isakmp_module, |
8775 | 16 | "ikev1_decryption_table", |
8776 | 16 | "IKEv1 Decryption Table", |
8777 | 16 | "Table of IKE_SA security parameters for decryption of IKEv1 packets", |
8778 | 16 | ikev1_uat); |
8779 | | |
8780 | 16 | ikev2_uat = uat_new("IKEv2 Decryption Table", |
8781 | 16 | sizeof(ikev2_uat_data_t), |
8782 | 16 | "ikev2_decryption_table", |
8783 | 16 | true, |
8784 | 16 | &ikev2_uat_data, |
8785 | 16 | &num_ikev2_uat_data, |
8786 | 16 | UAT_AFFECTS_DISSECTION, /* affects dissection of packets, but not set of named fields */ |
8787 | 16 | "ChIKEv2DecryptionSection", |
8788 | 16 | ikev2_uat_data_copy_cb, |
8789 | 16 | ikev2_uat_data_update_cb, |
8790 | 16 | ikev2_uat_data_free_cb, |
8791 | 16 | NULL, |
8792 | 16 | NULL, |
8793 | 16 | ikev2_uat_flds); |
8794 | | |
8795 | 16 | prefs_register_uat_preference(isakmp_module, |
8796 | 16 | "ikev2_decryption_table", |
8797 | 16 | "IKEv2 Decryption Table", |
8798 | 16 | "Table of IKE_SA security parameters for decryption of IKEv2 packets", |
8799 | 16 | ikev2_uat); |
8800 | 16 | } |
8801 | | |
8802 | | void |
8803 | | proto_reg_handoff_isakmp(void) |
8804 | 16 | { |
8805 | 16 | eap_handle = find_dissector_add_dependency("eap", proto_isakmp); |
8806 | 16 | esp_handle = find_dissector_add_dependency("esp", proto_isakmp); |
8807 | 16 | heur_dissector_add("tcp", dissect_iketcp_heur, "IKE over TCP", "iketcp", proto_isakmp, HEURISTIC_ENABLE); |
8808 | 16 | dissector_add_uint_with_preference("udp.port", UDP_PORT_ISAKMP, isakmp_handle); |
8809 | 16 | dissector_add_uint_with_preference("tcp.port", TCP_PORT_ISAKMP, isakmp_handle); |
8810 | 16 | } |
8811 | | |
8812 | | /* |
8813 | | * Editor modelines - https://www.wireshark.org/tools/modelines.html |
8814 | | * |
8815 | | * Local variables: |
8816 | | * c-basic-offset: 2 |
8817 | | * tab-width: 8 |
8818 | | * indent-tabs-mode: nil |
8819 | | * End: |
8820 | | * |
8821 | | * vi: set shiftwidth=2 tabstop=8 expandtab: |
8822 | | * :indentSize=2:tabSize=8:noTabs=true: |
8823 | | */ |