?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
MSWSP: add two more Property Sets
[wireshark-wip.git] / epan / dissectors / packet-isakmp.c
blob2440d138f4b34bafab9db62e419b2e5653c5aeec
1 /* packet-isakmp.c
2 * Routines for the Internet Security Association and Key Management Protocol
3 * (ISAKMP) (RFC 2408) and the Internet IP Security Domain of Interpretation
4 * for ISAKMP (RFC 2407)
5 * Brad Robel-Forrest <brad.robel-forrest@watchguard.com>
6 *
7 * Added routines for the Internet Key Exchange (IKEv2) Protocol
8 * (draft-ietf-ipsec-ikev2-17.txt)
9 * Shoichi Sakane <sakane@tanu.org>
10 *
11 * Added routines for RFC3947 Negotiation of NAT-Traversal in the IKE
12 * ronnie sahlberg
13 *
14 * 04/2009 Added routines for decryption of IKEv2 Encrypted Payload
15 * Naoyoshi Ueda <piyomaru3141@gmail.com>
16 *
17 * $Id$
18 *
19 * Wireshark - Network traffic analyzer
20 * By Gerald Combs <gerald@wireshark.org>
21 * Copyright 1998 Gerald Combs
22 *
23 * This program is free software; you can redistribute it and/or
24 * modify it under the terms of the GNU General Public License
25 * as published by the Free Software Foundation; either version 2
26 * of the License, or (at your option) any later version.
27 *
28 * This program is distributed in the hope that it will be useful,
29 * but WITHOUT ANY WARRANTY; without even the implied warranty of
30 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
31 * GNU General Public License for more details.
32 *
33 * You should have received a copy of the GNU General Public License
34 * along with this program; if not, write to the Free Software
35 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
36 *
37 * References:
38 * IKEv2 http://www.ietf.org/rfc/rfc4306.txt?number=4306
39 * IKEv2bis http://www.ietf.org/rfc/rfc5996.txt?number=5996
40 *
41 * http://www.iana.org/assignments/isakmp-registry (last updated 2011-11-07)
42 * http://www.iana.org/assignments/ipsec-registry (last updated 2011-03-14)
43 * http://www.iana.org/assignments/ikev2-parameters (last updated 2011-12-19)
44 */
45
46 #include "config.h"
47
48 #include <glib.h>
49
50 #include <epan/packet.h>
51 #include <epan/wmem/wmem.h>
52 #include <epan/ipproto.h>
53 #include <epan/asn1.h>
54 #include <epan/reassemble.h>
55 #include <epan/dissectors/packet-x509if.h>
56 #include <epan/dissectors/packet-x509af.h>
57 #include <epan/dissectors/packet-isakmp.h>
58 #include <epan/prefs.h>
59 #include <epan/expert.h>
60
61 #ifdef HAVE_LIBGCRYPT
62 #include <wsutil/wsgcrypt.h>
63 #include <epan/strutil.h>
64 #include <epan/uat.h>
65 #endif
66
67 /* Struct for the byte_to_str, match_bytestr_idx, and match_bytestr functions */
68
69 typedef struct _byte_string {
70 const gchar *value;
71 const guint16 len;
72 const gchar *strptr;
73 } byte_string;
74
75 static int proto_isakmp = -1;
76
77 static int hf_isakmp_nat_keepalive = -1;
78 static int hf_isakmp_nat_hash = -1;
79 static int hf_isakmp_nat_original_address_ipv6 = -1;
80 static int hf_isakmp_nat_original_address_ipv4 = -1;
81
82 static int hf_isakmp_ispi = -1;
83 static int hf_isakmp_rspi = -1;
84 static int hf_isakmp_typepayload = -1;
85 static int hf_isakmp_nextpayload = -1;
86 static int hf_isakmp_criticalpayload = -1;
87 static int hf_isakmp_datapayload = -1;
88 static int hf_isakmp_extradata = -1;
89 static int hf_isakmp_version = -1;
90 static int hf_isakmp_mjver = -1;
91 static int hf_isakmp_mnver = -1;
92 static int hf_isakmp_exchangetype_v1 = -1;
93 static int hf_isakmp_exchangetype_v2 = -1;
94 static int hf_isakmp_flags = -1;
95 static int hf_isakmp_flag_e = -1;
96 static int hf_isakmp_flag_c = -1;
97 static int hf_isakmp_flag_a = -1;
98 static int hf_isakmp_flag_i = -1;
99 static int hf_isakmp_flag_v = -1;
100 static int hf_isakmp_flag_r = -1;
101 static int hf_isakmp_messageid = -1;
102 static int hf_isakmp_length = -1;
103 static int hf_isakmp_payloadlen = -1;
104 static int hf_isakmp_sa_doi = -1;
105 static int hf_isakmp_sa_situation = -1;
106 static int hf_isakmp_sa_situation_identity_only = -1;
107 static int hf_isakmp_sa_situation_secrecy = -1;
108 static int hf_isakmp_sa_situation_integrity = -1;
109 static int hf_isakmp_prop_protoid_v1 = -1;
110 static int hf_isakmp_prop_protoid_v2 = -1;
111 static int hf_isakmp_prop_number = -1;
112 static int hf_isakmp_prop_transforms = -1;
113 static int hf_isakmp_spisize = -1;
114 static int hf_isakmp_spi = -1;
115 static int hf_isakmp_trans_number = -1;
116 static int hf_isakmp_trans_id = -1;
117 static int hf_isakmp_id_type_v1 = -1;
118 static int hf_isakmp_id_type_v2 = -1;
119 static int hf_isakmp_id_protoid = -1;
120 static int hf_isakmp_id_port = -1;
121 static int hf_isakmp_id_data = -1;
122 static int hf_isakmp_id_data_ipv4_addr = -1;
123 static int hf_isakmp_id_data_fqdn = -1;
124 static int hf_isakmp_id_data_user_fqdn = -1;
125 static int hf_isakmp_id_data_ipv4_subnet = -1;
126 static int hf_isakmp_id_data_ipv4_range_start = -1;
127 static int hf_isakmp_id_data_ipv4_range_end = -1;
128 static int hf_isakmp_id_data_ipv6_addr = -1;
129 static int hf_isakmp_id_data_ipv6_subnet = -1;
130 static int hf_isakmp_id_data_ipv6_range_start = -1;
131 static int hf_isakmp_id_data_ipv6_range_end = -1;
132 static int hf_isakmp_id_data_key_id = -1;
133 static int hf_isakmp_id_data_cert = -1;
134 static int hf_isakmp_cert_encoding_v1 = -1;
135 static int hf_isakmp_cert_encoding_v2 = -1;
136 static int hf_isakmp_cert_data = -1;
137 static int hf_isakmp_certreq_type_v1 = -1;
138 static int hf_isakmp_certreq_type_v2 = -1;
139 static int hf_isakmp_certreq_authority_v1 = -1;
140 static int hf_isakmp_certreq_authority_v2 = -1;
141 static int hf_isakmp_certreq_authority_sig = -1;
142 static int hf_isakmp_auth_meth = -1;
143 static int hf_isakmp_auth_data = -1;
144 static int hf_isakmp_notify_doi = -1;
145 static int hf_isakmp_notify_protoid_v1 = -1;
146 static int hf_isakmp_notify_protoid_v2 = -1;
147 static int hf_isakmp_notify_msgtype_v1 = -1;
148 static int hf_isakmp_notify_msgtype_v2 = -1;
149 static int hf_isakmp_notify_data = -1;
150 static int hf_isakmp_notify_data_dpd_are_you_there = -1;
151 static int hf_isakmp_notify_data_dpd_are_you_there_ack = -1;
152 static int hf_isakmp_notify_data_unity_load_balance = -1;
153 static int hf_isakmp_notify_data_ipcomp_cpi = -1;
154 static int hf_isakmp_notify_data_ipcomp_transform_id = -1;
155 static int hf_isakmp_notify_data_redirect_gw_ident_type = -1;
156 static int hf_isakmp_notify_data_redirect_gw_ident_len = -1;
157 static int hf_isakmp_notify_data_redirect_new_resp_gw_ident_ipv4 = -1;
158 static int hf_isakmp_notify_data_redirect_new_resp_gw_ident_ipv6 = -1;
159 static int hf_isakmp_notify_data_redirect_new_resp_gw_ident_fqdn = -1;
160 static int hf_isakmp_notify_data_redirect_new_resp_gw_ident = -1;
161 static int hf_isakmp_notify_data_redirect_nonce_data = -1;
162 static int hf_isakmp_notify_data_redirect_org_resp_gw_ident_ipv4 = -1;
163 static int hf_isakmp_notify_data_redirect_org_resp_gw_ident_ipv6 = -1;
164 static int hf_isakmp_notify_data_redirect_org_resp_gw_ident = -1;
165 static int hf_isakmp_notify_data_ticket_lifetime = -1;
166 static int hf_isakmp_notify_data_ticket_data = -1;
167 static int hf_isakmp_notify_data_rohc_attr = -1;
168 static int hf_isakmp_notify_data_rohc_attr_type = -1;
169 static int hf_isakmp_notify_data_rohc_attr_format = -1;
170 static int hf_isakmp_notify_data_rohc_attr_length = -1;
171 static int hf_isakmp_notify_data_rohc_attr_value = -1;
172 static int hf_isakmp_notify_data_rohc_attr_max_cid = -1;
173 static int hf_isakmp_notify_data_rohc_attr_profile = -1;
174 static int hf_isakmp_notify_data_rohc_attr_integ = -1;
175 static int hf_isakmp_notify_data_rohc_attr_icv_len = -1;
176 static int hf_isakmp_notify_data_rohc_attr_mrru = -1;
177 static int hf_isakmp_notify_data_qcd_token_secret_data = -1;
178 static int hf_isakmp_notify_data_ha_nonce_data = -1;
179 static int hf_isakmp_notify_data_ha_expected_send_req_msg_id = -1;
180 static int hf_isakmp_notify_data_ha_expected_recv_req_msg_id = -1;
181 static int hf_isakmp_notify_data_ha_incoming_ipsec_sa_delta_value = -1;
182 static int hf_isakmp_notify_data_secure_password_methods = -1;
183 static int hf_isakmp_delete_doi = -1;
184 static int hf_isakmp_delete_protoid_v1 = -1;
185 static int hf_isakmp_delete_protoid_v2 = -1;
186 static int hf_isakmp_delete_spi = -1;
187 static int hf_isakmp_vid_bytes = -1;
188 static int hf_isakmp_vid_string = -1;
189 static int hf_isakmp_vid_cp_product = -1;
190 static int hf_isakmp_vid_cp_version = -1;
191 static int hf_isakmp_vid_cp_timestamp = -1;
192 static int hf_isakmp_vid_cp_reserved = -1;
193 static int hf_isakmp_vid_cp_features = -1;
194 static int hf_isakmp_vid_cisco_unity_major = -1;
195 static int hf_isakmp_vid_cisco_unity_minor = -1;
196 static int hf_isakmp_vid_ms_nt5_isakmpoakley = -1;
197 static int hf_isakmp_vid_aruba_via_auth_profile = -1;
198 static int hf_isakmp_ts_number_of_ts = -1;
199 static int hf_isakmp_ts_type = -1;
200 static int hf_isakmp_ts_protoid = -1;
201 static int hf_isakmp_ts_selector_length = -1;
202 static int hf_isakmp_ts_start_port = -1;
203 static int hf_isakmp_ts_end_port = -1;
204 static int hf_isakmp_ts_start_addr_ipv4 = -1;
205 static int hf_isakmp_ts_end_addr_ipv4 = -1;
206 static int hf_isakmp_ts_start_addr_ipv6 = -1;
207 static int hf_isakmp_ts_end_addr_ipv6 = -1;
208 static int hf_isakmp_ts_start_addr_fc = -1;
209 static int hf_isakmp_ts_end_addr_fc = -1;
210 static int hf_isakmp_ts_start_r_ctl = -1;
211 static int hf_isakmp_ts_end_r_ctl = -1;
212 static int hf_isakmp_ts_start_type = -1;
213 static int hf_isakmp_ts_end_type = -1;
214 static int hf_isakmp_ts_data = -1;
215 static int hf_isakmp_num_spis = -1;
216 static int hf_isakmp_hash = -1;
217 static int hf_isakmp_sig = -1;
218 static int hf_isakmp_nonce = -1;
219
220 static int hf_isakmp_tf_attr = -1;
221 static int hf_isakmp_tf_attr_type_v1 = -1;
222 static int hf_isakmp_tf_attr_format = -1;
223 static int hf_isakmp_tf_attr_length = -1;
224 static int hf_isakmp_tf_attr_value = -1;
225 static int hf_isakmp_tf_attr_life_type = -1;
226 static int hf_isakmp_tf_attr_life_duration_uint32 = -1;
227 static int hf_isakmp_tf_attr_life_duration_uint64 = -1;
228 static int hf_isakmp_tf_attr_life_duration_bytes = -1;
229 static int hf_isakmp_tf_attr_group_description = -1;
230 static int hf_isakmp_tf_attr_encap_mode = -1;
231 static int hf_isakmp_tf_attr_auth_algorithm = -1;
232 static int hf_isakmp_tf_attr_key_length = -1;
233 static int hf_isakmp_tf_attr_key_rounds = -1;
234 static int hf_isakmp_tf_attr_cmpr_dict_size = -1;
235 static int hf_isakmp_tf_attr_cmpr_algorithm = -1;
236 static int hf_isakmp_tf_attr_ecn_tunnel = -1;
237 static int hf_isakmp_tf_attr_ext_seq_nbr = -1;
238 static int hf_isakmp_tf_attr_auth_key_length = -1;
239 static int hf_isakmp_tf_attr_sig_enco_algorithm = -1;
240 static int hf_isakmp_tf_attr_addr_preservation = -1;
241 static int hf_isakmp_tf_attr_sa_direction = -1;
242
243 static int hf_isakmp_ike_attr = -1;
244 static int hf_isakmp_ike_attr_type = -1;
245 static int hf_isakmp_ike_attr_format = -1;
246 static int hf_isakmp_ike_attr_length = -1;
247 static int hf_isakmp_ike_attr_value = -1;
248 static int hf_isakmp_ike_attr_encryption_algorithm = -1;
249 static int hf_isakmp_ike_attr_hash_algorithm = -1;
250 static int hf_isakmp_ike_attr_authentication_method = -1;
251 static int hf_isakmp_ike_attr_group_description = -1;
252 static int hf_isakmp_ike_attr_group_type = -1;
253 static int hf_isakmp_ike_attr_group_prime = -1;
254 static int hf_isakmp_ike_attr_group_generator_one = -1;
255 static int hf_isakmp_ike_attr_group_generator_two = -1;
256 static int hf_isakmp_ike_attr_group_curve_a = -1;
257 static int hf_isakmp_ike_attr_group_curve_b = -1;
258 static int hf_isakmp_ike_attr_life_type = -1;
259 static int hf_isakmp_ike_attr_life_duration_uint32 = -1;
260 static int hf_isakmp_ike_attr_life_duration_uint64 = -1;
261 static int hf_isakmp_ike_attr_life_duration_bytes = -1;
262 static int hf_isakmp_ike_attr_prf = -1;
263 static int hf_isakmp_ike_attr_key_length = -1;
264 static int hf_isakmp_ike_attr_field_size = -1;
265 static int hf_isakmp_ike_attr_group_order = -1;
266
267 static int hf_isakmp_trans_type = -1;
268 static int hf_isakmp_trans_encr = -1;
269 static int hf_isakmp_trans_prf = -1;
270 static int hf_isakmp_trans_integ = -1;
271 static int hf_isakmp_trans_dh = -1;
272 static int hf_isakmp_trans_esn = -1;
273 static int hf_isakmp_trans_id_v2 = -1;
274
275 static int hf_isakmp_ike2_attr = -1;
276 static int hf_isakmp_ike2_attr_type = -1;
277 static int hf_isakmp_ike2_attr_format = -1;
278 static int hf_isakmp_ike2_attr_length = -1;
279 static int hf_isakmp_ike2_attr_value = -1;
280 static int hf_isakmp_ike2_attr_key_length = -1;
281
282 static int hf_isakmp_fragments = -1;
283 static int hf_isakmp_fragment = -1;
284 static int hf_isakmp_fragment_overlap = -1;
285 static int hf_isakmp_fragment_overlap_conflicts = -1;
286 static int hf_isakmp_fragment_multiple_tails = -1;
287 static int hf_isakmp_fragment_too_long_fragment = -1;
288 static int hf_isakmp_fragment_error = -1;
289 static int hf_isakmp_fragment_count = -1;
290 static int hf_isakmp_reassembled_in = -1;
291 static int hf_isakmp_reassembled_length = -1;
292
293 static int hf_isakmp_cisco_frag_packetid = -1;
294 static int hf_isakmp_cisco_frag_seq = -1;
295 static int hf_isakmp_cisco_frag_last = -1;
296
297 static int hf_isakmp_key_exch_dh_group = -1;
298 static int hf_isakmp_key_exch_data = -1;
299 static int hf_isakmp_eap_data = -1;
300
301 static int hf_isakmp_gspm_data = -1;
302
303 static int hf_isakmp_cfg_type_v1 = -1;
304 static int hf_isakmp_cfg_identifier = -1;
305 static int hf_isakmp_cfg_type_v2 = -1;
306 static int hf_isakmp_cfg_attr = -1;
307 static int hf_isakmp_cfg_attr_type_v1 = -1;
308 static int hf_isakmp_cfg_attr_type_v2 = -1;
309 static int hf_isakmp_cfg_attr_format = -1;
310 static int hf_isakmp_cfg_attr_length = -1;
311 static int hf_isakmp_cfg_attr_value = -1;
312
313 static int hf_isakmp_cfg_attr_internal_ip4_address = -1;
314 static int hf_isakmp_cfg_attr_internal_ip4_netmask = -1;
315 static int hf_isakmp_cfg_attr_internal_ip4_dns = -1;
316 static int hf_isakmp_cfg_attr_internal_ip4_nbns = -1;
317 static int hf_isakmp_cfg_attr_internal_address_expiry = -1;
318 static int hf_isakmp_cfg_attr_internal_ip4_dhcp = -1;
319 static int hf_isakmp_cfg_attr_application_version = -1;
320 static int hf_isakmp_cfg_attr_internal_ip6_address = -1;
321 static int hf_isakmp_cfg_attr_internal_ip6_netmask = -1;
322 static int hf_isakmp_cfg_attr_internal_ip6_dns = -1;
323 static int hf_isakmp_cfg_attr_internal_ip6_nbns = -1;
324 static int hf_isakmp_cfg_attr_internal_ip6_dhcp = -1;
325 static int hf_isakmp_cfg_attr_internal_ip4_subnet_ip = -1;
326 static int hf_isakmp_cfg_attr_internal_ip4_subnet_netmask = -1;
327 static int hf_isakmp_cfg_attr_supported_attributes = -1;
328 static int hf_isakmp_cfg_attr_internal_ip6_subnet_ip = -1;
329 static int hf_isakmp_cfg_attr_internal_ip6_subnet_prefix = -1;
330 static int hf_isakmp_cfg_attr_internal_ip6_link_interface = -1;
331 static int hf_isakmp_cfg_attr_internal_ip6_link_id = -1;
332 static int hf_isakmp_cfg_attr_internal_ip6_prefix_ip = -1;
333 static int hf_isakmp_cfg_attr_internal_ip6_prefix_length = -1;
334 static int hf_isakmp_cfg_attr_xauth_type = -1;
335 static int hf_isakmp_cfg_attr_xauth_user_name = -1;
336 static int hf_isakmp_cfg_attr_xauth_user_password = -1;
337 static int hf_isakmp_cfg_attr_xauth_passcode = -1;
338 static int hf_isakmp_cfg_attr_xauth_message = -1;
339 static int hf_isakmp_cfg_attr_xauth_challenge = -1;
340 static int hf_isakmp_cfg_attr_xauth_domain = -1;
341 static int hf_isakmp_cfg_attr_xauth_status = -1;
342 static int hf_isakmp_cfg_attr_xauth_next_pin = -1;
343 static int hf_isakmp_cfg_attr_xauth_answer = -1;
344 static int hf_isakmp_cfg_attr_unity_banner = -1;
345 static int hf_isakmp_cfg_attr_unity_def_domain = -1;
346
347 static int hf_isakmp_enc_decrypted_data = -1;
348 static int hf_isakmp_enc_contained_data = -1;
349 static int hf_isakmp_enc_pad_length= -1;
350 static int hf_isakmp_enc_padding = -1;
351 static int hf_isakmp_enc_data = -1;
352 static int hf_isakmp_enc_iv = -1;
353 static int hf_isakmp_enc_icd = -1;
354
355 static gint ett_isakmp = -1;
356 static gint ett_isakmp_version = -1;
357 static gint ett_isakmp_flags = -1;
358 static gint ett_isakmp_payload = -1;
359 static gint ett_isakmp_fragment = -1;
360 static gint ett_isakmp_fragments = -1;
361 static gint ett_isakmp_sa = -1;
362 static gint ett_isakmp_tf_attr = -1;
363 static gint ett_isakmp_tf_ike_attr = -1;
364 static gint ett_isakmp_tf_ike2_attr = -1;
365 static gint ett_isakmp_id = -1;
366 static gint ett_isakmp_cfg_attr = -1;
367 static gint ett_isakmp_rohc_attr = -1;
368 #ifdef HAVE_LIBGCRYPT
369 /* For decrypted IKEv2 Encrypted payload*/
370 static gint ett_isakmp_decrypted_data = -1;
371 static gint ett_isakmp_decrypted_payloads = -1;
372 #endif /* HAVE_LIBGCRYPT */
373
374 static expert_field ei_isakmp_enc_iv = EI_INIT;
375 static expert_field ei_isakmp_ikev2_integrity_checksum = EI_INIT;
376 static expert_field ei_isakmp_enc_data_length_mult_block_size = EI_INIT;
377 static expert_field ei_isakmp_enc_pad_length_big = EI_INIT;
378
379 static dissector_handle_t eap_handle = NULL;
380
381 static reassembly_table isakmp_reassembly_table;
382
383 static const fragment_items isakmp_frag_items = {
384 /* Fragment subtrees */
385 &ett_isakmp_fragment,
386 &ett_isakmp_fragments,
387 /* Fragment fields */
388 &hf_isakmp_fragments,
389 &hf_isakmp_fragment,
390 &hf_isakmp_fragment_overlap,
391 &hf_isakmp_fragment_overlap_conflicts,
392 &hf_isakmp_fragment_multiple_tails,
393 &hf_isakmp_fragment_too_long_fragment,
394 &hf_isakmp_fragment_error,
395 &hf_isakmp_fragment_count,
396 /* Reassembled in field */
397 &hf_isakmp_reassembled_in,
398 /* Reassembled length field */
399 &hf_isakmp_reassembled_length,
400 /* Reassembled data field */
401 NULL,
402 /* Tag */
403 "Message fragments"
404 };
405 /* IKE port number assigned by IANA */
406 #define UDP_PORT_ISAKMP 500
407 #define TCP_PORT_ISAKMP 500
408
409 /*
410 * Identifier Type
411 * RFC2407 for IKEv1
412 * RFC3554 for ID_LIST
413 * RFC4306 for IKEv2
414 * RFC4595 for ID_FC_NAME
415 */
416 #define IKE_ID_IPV4_ADDR 1
417 #define IKE_ID_FQDN 2
418 #define IKE_ID_USER_FQDN 3
419 #define IKE_ID_IPV4_ADDR_SUBNET 4
420 #define IKE_ID_IPV6_ADDR 5
421 #define IKE_ID_IPV6_ADDR_SUBNET 6
422 #define IKE_ID_IPV4_ADDR_RANGE 7
423 #define IKE_ID_IPV6_ADDR_RANGE 8
424 #define IKE_ID_DER_ASN1_DN 9
425 #define IKE_ID_DER_ASN1_GN 10
426 #define IKE_ID_KEY_ID 11
427 #define IKE_ID_LIST 12
428 #define IKE_ID_FC_NAME 12
429 #define IKE_ID_RFC822_ADDR 3
430 /*
431 * Traffic Selector Type
432 * Not in use for IKEv1
433 */
434 #define IKEV2_TS_IPV4_ADDR_RANGE 7
435 #define IKEV2_TS_IPV6_ADDR_RANGE 8
436 #define IKEV2_TS_FC_ADDR_RANGE 9
437 /*
438 * Configuration Payload Attribute Types
439 * draft-ietf-ipsec-isakmp-mode-cfg-05.txt for IKEv1
440 * draft-ietf-ipsec-isakmp-xauth-06.txt and draft-beaulieu-ike-xauth-02.txt for XAUTH
441 * RFC4306 for IKEv2
442 * RFC5739 for INTERNAL_IP6_LINK and INTERNAL_IP6_PREFIX
443 */
444 #define INTERNAL_IP4_ADDRESS 1
445 #define INTERNAL_IP4_NETMASK 2
446 #define INTERNAL_IP4_DNS 3
447 #define INTERNAL_IP4_NBNS 4
448 #define INTERNAL_ADDRESS_EXPIRY 5
449 #define INTERNAL_IP4_DHCP 6
450 #define APPLICATION_VERSION 7
451 #define INTERNAL_IP6_ADDRESS 8
452 #define INTERNAL_IP6_NETMASK 9
453 #define INTERNAL_IP6_DNS 10
454 #define INTERNAL_IP6_NBNS 11
455 #define INTERNAL_IP6_DHCP 12
456 #define INTERNAL_IP4_SUBNET 13
457 #define SUPPORTED_ATTRIBUTES 14
458 #define INTERNAL_IP6_SUBNET 15
459 #define MIP6_HOME_PREFIX 16
460 #define INTERNAL_IP6_LINK 17
461 #define INTERNAL_IP6_PREFIX 18
462 /* checkpoint configuration attributes */
463 #define CHKPT_DEF_DOMAIN 16387
464 #define CHKPT_MAC_ADDRESS 16388
465 #define CHKPT_MARCIPAN_REASON_CODE 16389
466 #define CHKPT_UNKNOWN1 16400
467 #define CHKPT_UNKNOWN2 16401
468 #define CHKPT_UNKNOWN3 16402
469 /* XAUTH configuration attributes */
470 #define XAUTH_TYPE 16520
471 #define XAUTH_USER_NAME 16521
472 #define XAUTH_USER_PASSWORD 16522
473 #define XAUTH_PASSCODE 16523
474 #define XAUTH_MESSAGE 16524
475 #define XAUTH_CHALLENGE 16525
476 #define XAUTH_DOMAIN 16526
477 #define XAUTH_STATUS 16527
478 #define XAUTH_NEXT_PIN 16528
479 #define XAUTH_ANSWER 16529
480 /* unity (CISCO) configuration attributes */
481 #define UNITY_BANNER 28672
482 #define UNITY_SAVE_PASSWD 28673
483 #define UNITY_DEF_DOMAIN 28674
484 #define UNITY_SPLIT_DOMAIN 28675
485 #define UNITY_SPLIT_INCLUDE 28676
486 #define UNITY_NATT_PORT 28677
487 #define UNITY_SPLIT_EXCLUDE 28678
488 #define UNITY_PFS 28679
489 #define UNITY_FW_TYPE 28680
490 #define UNITY_BACKUP_SERVERS 28681
491 #define UNITY_DDNS_HOSTNAME 28682
492
493 /* Payload Type
494 * RFC2408 / RFC3547 for IKEv1
495 * RFC4306 for IKEv2
496 */
497 #define PLOAD_IKE_NONE 0
498 #define PLOAD_IKE_SA 1
499 #define PLOAD_IKE_P 2
500 #define PLOAD_IKE_T 3
501 #define PLOAD_IKE_KE 4
502 #define PLOAD_IKE_ID 5
503 #define PLOAD_IKE_CERT 6
504 #define PLOAD_IKE_CR 7
505 #define PLOAD_IKE_HASH 8
506 #define PLOAD_IKE_SIG 9
507 #define PLOAD_IKE_NONCE 10
508 #define PLOAD_IKE_N 11
509 #define PLOAD_IKE_D 12
510 #define PLOAD_IKE_VID 13
511 #define PLOAD_IKE_A 14
512 #define PLOAD_IKE_NAT_D48 15
513 #define PLOAD_IKE_NAT_OA58 16
514 #define PLOAD_IKE_NAT_D 20
515 #define PLOAD_IKE_NAT_OA 21
516 #define PLOAD_IKE_GAP 22
517 #define PLOAD_IKE2_SA 33
518 #define PLOAD_IKE2_KE 34
519 #define PLOAD_IKE2_IDI 35
520 #define PLOAD_IKE2_IDR 36
521 #define PLOAD_IKE2_CERT 37
522 #define PLOAD_IKE2_CERTREQ 38
523 #define PLOAD_IKE2_AUTH 39
524 #define PLOAD_IKE2_NONCE 40
525 #define PLOAD_IKE2_N 41
526 #define PLOAD_IKE2_D 42
527 #define PLOAD_IKE2_V 43
528 #define PLOAD_IKE2_TSI 44
529 #define PLOAD_IKE2_TSR 45
530 #define PLOAD_IKE2_SK 46
531 #define PLOAD_IKE2_CP 47
532 #define PLOAD_IKE2_EAP 48
533 #define PLOAD_IKE2_GSPM 49
534 #define PLOAD_IKE_NAT_D13 130
535 #define PLOAD_IKE_NAT_OA14 131
536 #define PLOAD_IKE_CISCO_FRAG 132
537 /*
538 * IPSEC Situation Definition (RFC2407)
539 */
540 #define SIT_IDENTITY_ONLY 0x01
541 #define SIT_SECRECY 0x02
542 #define SIT_INTEGRITY 0x04
543
544
545 static const value_string exchange_v1_type[] = {
546 { 0, "NONE" },
547 { 1, "Base" },
548 { 2, "Identity Protection (Main Mode)" },
549 { 3, "Authentication Only" },
550 { 4, "Aggressive" },
551 { 5, "Informational" },
552 { 6, "Transaction (Config Mode)" },
553 { 32, "Quick Mode" },
554 { 33, "New Group Mode" },
555 { 0, NULL },
556 };
557
558 static const value_string exchange_v2_type[] = {
559 { 34, "IKE_SA_INIT" },
560 { 35, "IKE_AUTH " },
561 { 36, "CREATE_CHILD_SA" },
562 { 37, "INFORMATIONAL" },
563 { 38, "IKE_SESSION_RESUME" }, /* RFC5723 */
564 { 0, NULL },
565 };
566
567 static const value_string frag_last_vals[] = {
568 { 0, "More fragments" },
569 { 1, "Last fragment" },
570 { 0, NULL },
571 };
572 /* Ex vs_proto */
573 static const value_string protoid_v1_type[] = {
574 { 0, "RESERVED" },
575 { 1, "ISAKMP" },
576 { 2, "IPSEC_AH" },
577 { 3, "IPSEC_ESP" },
578 { 4, "IPCOMP" },
579 { 5, "GIGABEAM_RADIO" }, /* RFC4705 */
580 { 0, NULL },
581 };
582
583 static const value_string protoid_v2_type[] = {
584 { 0, "RESERVED" },
585 { 1, "IKE" },
586 { 2, "AH" },
587 { 3, "ESP" },
588 { 4, "FC_ESP_HEADER" },
589 { 5, "FC_CT_AUTHENTICATION" },
590 { 0, NULL },
591 };
592
593 static const range_string payload_type[] = {
594 { PLOAD_IKE_NONE,PLOAD_IKE_NONE, "NONE / No Next Payload " },
595 { PLOAD_IKE_SA,PLOAD_IKE_SA, "Security Association" },
596 { PLOAD_IKE_P,PLOAD_IKE_P, "Proposal" },
597 { PLOAD_IKE_T,PLOAD_IKE_T, "Transform" },
598 { PLOAD_IKE_KE,PLOAD_IKE_KE, "Key Exchange" },
599 { PLOAD_IKE_ID,PLOAD_IKE_ID, "Identification" },
600 { PLOAD_IKE_CERT,PLOAD_IKE_CERT, "Certificate" },
601 { PLOAD_IKE_CR,PLOAD_IKE_CR, "Certificate Request" },
602 { PLOAD_IKE_HASH,PLOAD_IKE_HASH, "Hash" },
603 { PLOAD_IKE_SIG,PLOAD_IKE_SIG, "Signature" },
604 { PLOAD_IKE_NONCE,PLOAD_IKE_NONCE, "Nonce" },
605 { PLOAD_IKE_N,PLOAD_IKE_N, "Notification" },
606 { PLOAD_IKE_D,PLOAD_IKE_D, "Delete" },
607 { PLOAD_IKE_VID,PLOAD_IKE_VID, "Vendor ID" },
608 { PLOAD_IKE_A,PLOAD_IKE_A, "Attributes" }, /* draft-ietf-ipsec-isakmp-mode-cfg-05.txt */
609 { PLOAD_IKE_NAT_D48,PLOAD_IKE_NAT_D48, "NAT-Discovery" }, /* draft-ietf-ipsec-nat-t-ike-04 to 08 */
610 { PLOAD_IKE_NAT_OA58,PLOAD_IKE_NAT_OA58, "NAT-Original Address"}, /* draft-ietf-ipsec-nat-t-ike-05 to 08*/
611 { PLOAD_IKE_NAT_D,PLOAD_IKE_NAT_D, "NAT-D (RFC 3947)" },
612 { PLOAD_IKE_NAT_OA,PLOAD_IKE_NAT_OA, "NAT-OA (RFC 3947)"},
613 { PLOAD_IKE_GAP,PLOAD_IKE_GAP, "Group Associated Policy"},
614 { PLOAD_IKE2_SA,PLOAD_IKE2_SA, "Security Association"},
615 { PLOAD_IKE2_KE,PLOAD_IKE2_KE, "Key Exchange"},
616 { PLOAD_IKE2_IDI,PLOAD_IKE2_IDI, "Identification - Initiator"},
617 { PLOAD_IKE2_IDR,PLOAD_IKE2_IDR, "Identification - Responder"},
618 { PLOAD_IKE2_CERT,PLOAD_IKE2_CERT, "Certificate"},
619 { PLOAD_IKE2_CERTREQ,PLOAD_IKE2_CERTREQ, "Certificate Request"},
620 { PLOAD_IKE2_AUTH,PLOAD_IKE2_AUTH, "Authentication"},
621 { PLOAD_IKE2_NONCE,PLOAD_IKE2_NONCE, "Nonce"},
622 { PLOAD_IKE2_N,PLOAD_IKE2_N, "Notify"},
623 { PLOAD_IKE2_D,PLOAD_IKE2_D, "Delete"},
624 { PLOAD_IKE2_V,PLOAD_IKE2_V, "Vendor ID"},
625 { PLOAD_IKE2_TSI,PLOAD_IKE2_TSI, "Traffic Selector - Initiator"},
626 { PLOAD_IKE2_TSR,PLOAD_IKE2_TSR, "Traffic Selector - Responder"},
627 { PLOAD_IKE2_SK,PLOAD_IKE2_SK, "Encrypted and Authenticated"},
628 { PLOAD_IKE2_CP,PLOAD_IKE2_CP, "Configuration"},
629 { PLOAD_IKE2_EAP,PLOAD_IKE2_EAP, "Extensible Authentication"},
630 { PLOAD_IKE2_GSPM,PLOAD_IKE2_GSPM, "Generic Secure Password Method"},
631 { 50,127, "Unassigned" },
632 { 128,129, "Private Use" },
633 { PLOAD_IKE_NAT_D13,PLOAD_IKE_NAT_D13, "NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03)"},
634 { PLOAD_IKE_NAT_OA14,PLOAD_IKE_NAT_OA14, "NAT-OA (draft-ietf-ipsec-nat-t-ike-01 to 03)"},
635 { PLOAD_IKE_CISCO_FRAG,PLOAD_IKE_CISCO_FRAG, "Cisco-Fragmentation"},
636 { 133,256, "Private Use" },
637 { 0,0, NULL },
638 };
639
640 /*
641 * ISAKMP Domain of Interpretation (DOI)
642 * RFC2408 for ISAKMP
643 * RFC2407 for IPSEC
644 * RFC3547 for GDOI
645 */
646 static const value_string doi_type[] = {
647 { 0, "ISAKMP" },
648 { 1, "IPSEC" },
649 { 2, "GDOI" },
650 { 0, NULL },
651 };
652
653 /* Transform Type */
654
655 #define ISAKMP_ATTR_LIFE_TYPE 1
656 #define ISAKMP_ATTR_LIFE_DURATION 2
657 #define ISAKMP_ATTR_GROUP_DESC 3
658 #define ISAKMP_ATTR_ENCAP_MODE 4
659 #define ISAKMP_ATTR_AUTH_ALGORITHM 5
660 #define ISAKMP_ATTR_KEY_LENGTH 6
661 #define ISAKMP_ATTR_KEY_ROUNDS 7
662 #define ISAKMP_ATTR_CMPR_DICT_SIZE 8
663 #define ISAKMP_ATTR_CMPR_ALGORITHM 9
664 #define ISAKMP_ATTR_ECN_TUNNEL 10 /* [RFC3168] */
665 #define ISAKMP_ATTR_EXT_SEQ_NBR 11 /* [RFC4304] */
666 #define ISAKMP_ATTR_AUTH_KEY_LENGTH 12 /* [RFC4359] */
667 #define ISAKMP_ATTR_SIG_ENCO_ALGORITHM 13 /* [RFC4359] */
668 #define ISAKMP_ATTR_ADDR_PRESERVATION 14 /* [RFC6407] */
669 #define ISAKMP_ATTR_SA_DIRECTION 15 /* [RFC6407] */
670
671 static const value_string transform_isakmp_attr_type[] = {
672 { ISAKMP_ATTR_LIFE_TYPE, "SA-Life-Type" },
673 { ISAKMP_ATTR_LIFE_DURATION, "SA-Life-Duration" },
674 { ISAKMP_ATTR_GROUP_DESC, "Group-Description" },
675 { ISAKMP_ATTR_ENCAP_MODE, "Encapsulation-Mode" },
676 { ISAKMP_ATTR_AUTH_ALGORITHM, "Authentication-Algorithm" },
677 { ISAKMP_ATTR_KEY_LENGTH, "Key-Length" },
678 { ISAKMP_ATTR_KEY_ROUNDS, "Key-Rounds" },
679 { ISAKMP_ATTR_CMPR_DICT_SIZE, "Compress-Dictionary-Size" },
680 { ISAKMP_ATTR_CMPR_ALGORITHM, "Compress-Private-Algorithm" },
681 { ISAKMP_ATTR_ECN_TUNNEL, "ECN Tunnel" },
682 { ISAKMP_ATTR_EXT_SEQ_NBR, "Extended (64-bit) Sequence Number" },
683 { ISAKMP_ATTR_AUTH_KEY_LENGTH, "Authentication Key Length" },
684 { ISAKMP_ATTR_SIG_ENCO_ALGORITHM, "Signature Encoding Algorithm" },
685 { ISAKMP_ATTR_ADDR_PRESERVATION, "Address Preservation" },
686 { ISAKMP_ATTR_SA_DIRECTION, "SA Direction" },
687 { 0, NULL },
688 };
689
690 /* Transform IKE Type */
691 #define IKE_ATTR_ENCRYPTION_ALGORITHM 1
692 #define IKE_ATTR_HASH_ALGORITHM 2
693 #define IKE_ATTR_AUTHENTICATION_METHOD 3
694 #define IKE_ATTR_GROUP_DESCRIPTION 4
695 #define IKE_ATTR_GROUP_TYPE 5
696 #define IKE_ATTR_GROUP_PRIME 6
697 #define IKE_ATTR_GROUP_GENERATOR_ONE 7
698 #define IKE_ATTR_GROUP_GENERATOR_TWO 8
699 #define IKE_ATTR_GROUP_CURVE_A 9
700 #define IKE_ATTR_GROUP_CURVE_B 10
701 #define IKE_ATTR_LIFE_TYPE 11
702 #define IKE_ATTR_LIFE_DURATION 12
703 #define IKE_ATTR_PRF 13
704 #define IKE_ATTR_KEY_LENGTH 14
705 #define IKE_ATTR_FIELD_SIZE 15
706 #define IKE_ATTR_GROUP_ORDER 16
707
708
709
710 static const value_string transform_ike_attr_type[] = {
711 { IKE_ATTR_ENCRYPTION_ALGORITHM,"Encryption-Algorithm" },
712 { IKE_ATTR_HASH_ALGORITHM, "Hash-Algorithm" },
713 { IKE_ATTR_AUTHENTICATION_METHOD,"Authentication-Method" },
714 { IKE_ATTR_GROUP_DESCRIPTION, "Group-Description" },
715 { IKE_ATTR_GROUP_TYPE, "Group-Type" },
716 { IKE_ATTR_GROUP_PRIME, "Group-Prime" },
717 { IKE_ATTR_GROUP_GENERATOR_ONE,"Group-Generator-One" },
718 { IKE_ATTR_GROUP_GENERATOR_TWO,"Group-Generator-Two" },
719 { IKE_ATTR_GROUP_CURVE_A, "Group-Curve-A" },
720 { IKE_ATTR_GROUP_CURVE_B, "Group-Curve-B" },
721 { IKE_ATTR_LIFE_TYPE, "Life-Type" },
722 { IKE_ATTR_LIFE_DURATION, "Life-Duration" },
723 { IKE_ATTR_PRF, "PRF" },
724 { IKE_ATTR_KEY_LENGTH, "Key-Length" },
725 { IKE_ATTR_FIELD_SIZE, "Field-Size" },
726 { IKE_ATTR_GROUP_ORDER, "Group-Order" },
727 { 0, NULL },
728 };
729
730 #if 0
731 static const value_string vs_v2_sttr[] = {
732 { 1, "SA-Life-Type" },
733 { 2, "SA-Life-Duration" },
734 { 3, "Group-Description" },
735 { 4, "Encapsulation-Mode" },
736 { 5, "Authentication-Algorithm" },
737 { 6, "Key-Length" },
738 { 7, "Key-Rounds" },
739 { 8, "Compress-Dictionary-Size" },
740 { 9, "Compress-Private-Algorithm" },
741 { 10, "ECN Tunnel" },
742 { 0, NULL },
743 };
744 #endif
745
746 static const value_string vs_v1_trans_isakmp[] = {
747 { 0, "RESERVED" },
748 { 1, "KEY_IKE" },
749 { 0, NULL },
750 };
751
752 static const value_string vs_v1_trans_ah[] = {
753 { 0, "RESERVED" },
754 { 1, "RESERVED" },
755 { 2, "MD5" },
756 { 3, "SHA" },
757 { 4, "DES" },
758 { 5, "SHA2-256" },
759 { 6, "SHA2-384" },
760 { 7, "SHA2-512" },
761 { 0, NULL },
762 };
763
764 static const value_string vs_v1_trans_esp[] = {
765 { 0, "RESERVED" },
766 { 1, "DES-IV64" },
767 { 2, "DES" },
768 { 3, "3DES" },
769 { 4, "RC5" },
770 { 5, "IDEA" },
771 { 6, "CAST" },
772 { 7, "BLOWFISH" },
773 { 8, "3IDEA" },
774 { 9, "DES-IV32" },
775 { 10, "RC4" },
776 { 11, "NULL" },
777 { 12, "AES" },
778 { 0, NULL },
779 };
780
781 static const value_string transform_id_ipcomp[] = {
782 { 0, "RESERVED" },
783 { 1, "OUI" },
784 { 2, "DEFLATE" },
785 { 3, "LZS" },
786 { 4, "LZJH" },
787 { 0, NULL },
788 };
789 static const value_string redirect_gateway_identity_type[] = {
790 { 1, "IPv4 address" },
791 { 2, "IPv6 address" },
792 { 3, "FQDN" },
793 { 0, NULL },
794 };
795 static const value_string transform_attr_sa_life_type[] = {
796 { 0, "RESERVED" },
797 { 1, "Seconds" },
798 { 2, "Kilobytes" },
799 { 0, NULL },
800 };
801
802 static const value_string transform_attr_encap_type[] = {
803 { 0, "RESERVED" },
804 { 1, "Tunnel" },
805 { 2, "Transport" },
806 { 3, "UDP-Encapsulated-Tunnel" }, /* RFC3947 */
807 { 4, "UDP-Encapsulated-Transport" }, /* RFC3947 */
808 { 61440, "Check Point IPSec UDP Encapsulation" },
809 { 61443, "UDP-Encapsulated-Tunnel (draft)" },
810 { 61444, "UDP-Encapsulated-Transport (draft)" },
811 { 0, NULL },
812 };
813
814 static const value_string transform_attr_auth_type[] = {
815 { 0, "RESERVED" },
816 { 1, "HMAC-MD5" },
817 { 2, "HMAC-SHA" },
818 { 3, "DES-MAC" },
819 { 4, "KPDK" },
820 { 5, "HMAC-SHA2-256" },
821 { 6, "HMAC-SHA2-384" },
822 { 7, "HMAC-SHA2-512" },
823 { 8, "HMAC-RIPEMD" }, /* [RFC2857] */
824 { 9, "AES-XCBC-MAC" }, /* [RFC3566] */
825 { 10, "SIG-RSA" }, /* [RFC4359] */
826 { 11, "AES-128-GMAC" }, /* [RFC4543][Errata1821] */
827 { 12, "AES-192-GMAC" }, /* [RFC4543][Errata1821] */
828 { 13, "AES-256-GMAC" }, /* [RFC4543][Errata1821] */
829
830 /*
831 Values 11-61439 are reserved to IANA. Values 61440-65535 are
832 for private use.
833 */
834 { 0, NULL },
835 };
836
837 #define ENC_DES_CBC 1
838 #define ENC_IDEA_CBC 2
839 #define ENC_BLOWFISH_CBC 3
840 #define ENC_RC5_R16_B64_CBC 4
841 #define ENC_3DES_CBC 5
842 #define ENC_CAST_CBC 6
843 #define ENC_AES_CBC 7
844 #define ENC_CAMELLIA_CBC 8
845
846 static const value_string transform_attr_enc_type[] = {
847 { 0, "RESERVED" },
848 { ENC_DES_CBC, "DES-CBC" },
849 { ENC_IDEA_CBC, "IDEA-CBC" },
850 { ENC_BLOWFISH_CBC, "BLOWFISH-CBC" },
851 { ENC_RC5_R16_B64_CBC, "RC5-R16-B64-CBC" },
852 { ENC_3DES_CBC, "3DES-CBC" },
853 { ENC_CAST_CBC, "CAST-CBC" },
854 { ENC_AES_CBC, "AES-CBC" },
855 { ENC_CAMELLIA_CBC, "CAMELLIA-CBC" },
856 { 0, NULL },
857 };
858
859 #define HMAC_MD5 1
860 #define HMAC_SHA 2
861 #define HMAC_TIGER 3
862 #define HMAC_SHA2_256 4
863 #define HMAC_SHA2_384 5
864 #define HMAC_SHA2_512 6
865
866 static const value_string transform_attr_hash_type[] = {
867 { 0, "RESERVED" },
868 { HMAC_MD5, "MD5" },
869 { HMAC_SHA, "SHA" },
870 { HMAC_TIGER, "TIGER" },
871 { HMAC_SHA2_256, "SHA2-256" },
872 { HMAC_SHA2_384, "SHA2-384" },
873 { HMAC_SHA2_512, "SHA2-512" },
874 { 0, NULL },
875 };
876
877 static const value_string transform_attr_ecn_type[] = {
878 { 0, "RESERVED" },
879 { 1, "Allowed" },
880 { 2, "Forbidden" },
881 { 0, NULL },
882 };
883
884 static const value_string transform_attr_ext_seq_nbr_type[] = {
885 { 0, "RESERVED" },
886 { 1, "64-bit Sequence Number" },
887 { 0, NULL },
888 };
889
890 #if 0
891 static const value_string transform_attr_sig_enco_algo_type[] = {
892 { 0, "RESERVED" },
893 { 1, "RSASSA-PKCS1-v1_5" },
894 { 2, "RSASSA-PSS" },
895 { 0, NULL },
896 };
897 #endif
898
899 static const value_string transform_attr_addr_preservation_type[] = {
900 { 0, "Reserved" },
901 { 1, "None" },
902 { 2, "Source-Only" },
903 { 3, "Destination-Only" },
904 { 4, "Source-and-Destination" },
905 { 0, NULL },
906 };
907
908 static const value_string transform_attr_sa_direction_type[] = {
909 { 0, "Reserved" },
910 { 1, "Sender-Only" },
911 { 2, "Receiver-Only" },
912 { 3, "Symmetric" },
913 { 0, NULL },
914 };
915
916 static const value_string transform_attr_authmeth_type[] = {
917 { 0, "RESERVED" },
918 { 1, "PSK" },
919 { 2, "DSS-SIG" },
920 { 3, "RSA-SIG" },
921 { 4, "RSA-ENC" },
922 { 5, "RSA-Revised-ENC" },
923 { 6, "Encryption with El-Gamal" },
924 { 7, "Revised encryption with El-Gamal" },
925 { 8, "ECDSA signatures" },
926 { 9, "AES-XCBC-MAC" },
927 { 64221, "HybridInitRSA" },
928 { 64222, "HybridRespRSA" },
929 { 64223, "HybridInitDSS" },
930 { 64224, "HybridRespDSS" },
931 { 65001, "XAUTHInitPreShared" },
932 { 65002, "XAUTHRespPreShared" },
933 { 65003, "XAUTHInitDSS" },
934 { 65004, "XAUTHRespDSS" },
935 { 65005, "XAUTHInitRSA" },
936 { 65006, "XAUTHRespRSA" },
937 { 65007, "XAUTHInitRSAEncryption" },
938 { 65008, "XAUTHRespRSAEncryption" },
939 { 65009, "XAUTHInitRSARevisedEncryption" },
940 { 65010, "XAUTHRespRSARevisedEncryption" },
941 { 0, NULL },
942 };
943
944
945 static const value_string transform_dh_group_type[] = {
946 { 0, "UNDEFINED - 0" },
947 { 1, "Default 768-bit MODP group" },
948 { 2, "Alternate 1024-bit MODP group" },
949 { 3, "EC2N group on GP[2^155] group" },
950 { 4, "EC2N group on GP[2^185] group" },
951 { 5, "1536 bit MODP group" },
952 { 6, "EC2N group over GF[2^163]" },
953 { 7, "EC2N group over GF[2^163]" },
954 { 8, "EC2N group over GF[2^283]" },
955 { 9, "EC2N group over GF[2^283]" },
956 { 10, "EC2N group over GF[2^409]" },
957 { 11, "EC2N group over GF[2^409]" },
958 { 12, "EC2N group over GF[2^571]" },
959 { 13, "EC2N group over GF[2^571]" },
960 { 14, "2048 bit MODP group" },
961 { 15, "3072 bit MODP group" },
962 { 16, "4096 bit MODP group" },
963 { 17, "6144 bit MODP group" },
964 { 18, "8192 bit MODP group" },
965 { 19, "256-bit random ECP group" },
966 { 20, "384-bit random ECP group" },
967 { 21, "521-bit random ECP group" },
968 { 22, "1024-bit MODP Group with 160-bit Prime Order Subgroup" },
969 { 23, "2048-bit MODP Group with 224-bit Prime Order Subgroup" },
970 { 24, "2048-bit MODP Group with 256-bit Prime Order Subgroup" },
971 { 25, "192-bit Random ECP Group" },
972 { 26, "224-bit Random ECP Group" },
973 { 0, NULL }
974 };
975
976 static const value_string transform_attr_grp_type[] = {
977 { 0, "UNDEFINED - 0" },
978 { 1, "MODP" },
979 { 2, "ECP" },
980 { 3, "EC2N" },
981 { 0, NULL },
982 };
983
984 #define TF_IKE2_ENCR 1
985 #define TF_IKE2_PRF 2
986 #define TF_IKE2_INTEG 3
987 #define TF_IKE2_DH 4
988 #define TF_IKE2_ESN 5
989 static const range_string transform_ike2_type[] = {
990 { 0,0, "RESERVED" },
991 { TF_IKE2_ENCR,TF_IKE2_ENCR, "Encryption Algorithm (ENCR)" },
992 { TF_IKE2_PRF,TF_IKE2_PRF, "Pseudo-random Function (PRF)"},
993 { TF_IKE2_INTEG,TF_IKE2_INTEG,"Integrity Algorithm (INTEG)"},
994 { TF_IKE2_DH,TF_IKE2_DH, "Diffie-Hellman Group (D-H)"},
995 { TF_IKE2_ESN,TF_IKE2_ESN, "Extended Sequence Numbers (ESN)"},
996 { 6,240, "Reserved to IANA"},
997 { 241,255, "Private Use"},
998 { 0,0, NULL },
999 };
1000 /* For Transform Type 1 (Encryption Algorithm), defined Transform IDs */
1001 static const value_string transform_ike2_encr_type[] = {
1002 { 0, "RESERVED" },
1003 { 1, "ENCR_DES_IV64" },
1004 { 2, "ENCR_DES" },
1005 { 3, "ENCR_3DES" },
1006 { 4, "ENCR_RC5" },
1007 { 5, "ENCR_IDEA" },
1008 { 6, "ENCR_CAST" },
1009 { 7, "ENCR_BLOWFISH" },
1010 { 8, "ENCR_3IDEA" },
1011 { 9, "ENCR_DES_IV32" },
1012 { 10, "RESERVED" },
1013 { 11, "ENCR_NULL" },
1014 { 12, "ENCR_AES_CBC" },
1015 { 13, "ENCR_AES_CTR" }, /* [RFC3686] */
1016 { 14, "ENCR_AES-CCM_8" }, /* [RFC4309] */
1017 { 15, "ENCR-AES-CCM_12" }, /* [RFC4309] */
1018 { 16, "ENCR-AES-CCM_16" }, /* [RFC4309] */
1019 { 17, "UNASSIGNED" },
1020 { 18, "AES-GCM with a 8 octet ICV" }, /* [RFC4106] */
1021 { 19, "AES-GCM with a 12 octet ICV" }, /* [RFC4106] */
1022 { 20, "AES-GCM with a 16 octet ICV" }, /* [RFC4106] */
1023 { 21, "ENCR_NULL_AUTH_AES_GMAC" }, /* [RFC4543] */
1024 { 22, "Reserved for IEEE P1619 XTS-AES" }, /* [Ball] */
1025 { 23, "ENCR_CAMELLIA_CBC" }, /* [RFC5529] */
1026 { 24, "ENCR_CAMELLIA_CTR" }, /* [RFC5529] */
1027 { 25, "ENCR_CAMELLIA_CCM with an 8-octet ICV" }, /* [RFC5529] */
1028 { 26, "ENCR_CAMELLIA_CCM with a 12-octet ICV" }, /* [RFC5529] */
1029 { 27, "ENCR_CAMELLIA_CCM with a 16-octet ICV" }, /* [RFC5529] */
1030 /*
1031 * 28-1023 RESERVED TO IANA [RFC4306]
1032 * 1024-65535 PRIVATE USE [RFC4306]
1033 */
1034 { 0, NULL },
1035 };
1036
1037 /* For Transform Type 2 (Pseudo-random Function), defined Transform IDs */
1038 static const value_string transform_ike2_prf_type[] = {
1039 { 0, "RESERVED" },
1040 { 1, "PRF_HMAC_MD5" },
1041 { 2, "PRF_HMAC_SHA1" },
1042 { 3, "PRF_HMAC_TIGER" },
1043 { 4, "PRF_AES128_CBC" },
1044 { 5, "PRF_HMAC_SHA2_256" }, /* [RFC4868] */
1045 { 6, "PRF_HMAC_SHA2_384" }, /* [RFC4868] */
1046 { 7, "PRF_HMAC_SHA2_512" }, /* [RFC4868] */
1047 { 8, "PRF_AES128_CMAC6" }, /* [RFC4615] */
1048 /*
1049 9-1023 RESERVED TO IANA [RFC4306]
1050 1024-65535 PRIVATE USE [RFC4306]
1051 */
1052 { 0, NULL },
1053 };
1054
1055 /* For Transform Type 3 (Integrity Algorithm), defined Transform IDs */
1056 static const value_string transform_ike2_integ_type[] = {
1057 { 0, "NONE" },
1058 { 1, "AUTH_HMAC_MD5_96" },
1059 { 2, "AUTH_HMAC_SHA1_96" },
1060 { 3, "AUTH_DES_MAC" },
1061 { 4, "AUTH_KPDK_MD5" },
1062 { 5, "AUTH_AES_XCBC_96" },
1063 { 6, "AUTH_HMAC_MD5_128" }, /* [RFC4595] */
1064 { 7, "AUTH_HMAC_SHA1_160" }, /* [RFC4595] */
1065 { 8, "AUTH_AES_CMAC_96" }, /* [RFC4494] */
1066 { 9, "AUTH_AES_128_GMAC" }, /* [RFC4543] */
1067 { 10, "AUTH_AES_192_GMAC" }, /* [RFC4543] */
1068 { 11, "AUTH_AES_256_GMAC" }, /* [RFC4543] */
1069 { 12, "AUTH_HMAC_SHA2_256_128" }, /* [RFC4868] */
1070 { 13, "AUTH_HMAC_SHA2_384_192" }, /* [RFC4868] */
1071 { 14, "AUTH_HMAC_SHA2_512_256" }, /* [RFC4868] */
1072 /*
1073 15-1023 RESERVED TO IANA [RFC4306]
1074 1024-65535 PRIVATE USE [RFC4306]
1075 */
1076 { 0, NULL },
1077 };
1078 /* For Transform Type 5 (Extended Sequence Numbers), defined Transform */
1079 static const value_string transform_ike2_esn_type[] = {
1080 { 0, "No Extended Sequence Numbers" },
1081 { 1, "Extended Sequence Numbers" },
1082 { 0, NULL },
1083 };
1084 /* Transform IKE2 Type */
1085 #define IKE2_ATTR_KEY_LENGTH 14
1086
1087 static const value_string transform_ike2_attr_type[] = {
1088 { IKE2_ATTR_KEY_LENGTH, "Key-Length" },
1089 { 0, NULL },
1090 };
1091
1092 static const range_string cert_v1_type[] = {
1093 { 0,0, "NONE" },
1094 { 1,1, "PKCS #7 wrapped X.509 certificate" },
1095 { 2,2, "PGP Certificate" },
1096 { 3,3, "DNS Signed Key" },
1097 { 4,4, "X.509 Certificate - Signature" },
1098 { 5,5, "X.509 Certificate - Key Exchange" },
1099 { 6,6, "Kerberos Tokens" },
1100 { 7,7, "Certificate Revocation List (CRL)" },
1101 { 8,8, "Authority Revocation List (ARL)" },
1102 { 9,9, "SPKI Certificate" },
1103 { 10,10, "X.509 Certificate - Attribute" },
1104 { 11,255, "RESERVED" },
1105 { 0,0, NULL },
1106 };
1107
1108 static const range_string cert_v2_type[] = {
1109 { 0,0, "RESERVED" },
1110 { 1,1, "PKCS #7 wrapped X.509 certificate" },
1111 { 2,2, "PGP Certificate" },
1112 { 3,3, "DNS Signed Key" },
1113 { 4,4, "X.509 Certificate - Signature" },
1114 { 5,5, "*undefined by any document*" },
1115 { 6,6, "Kerberos Tokens" },
1116 { 7,7, "Certificate Revocation List (CRL)" },
1117 { 8,8, "Authority Revocation List (ARL)" },
1118 { 9,9, "SPKI Certificate" },
1119 { 10,10, "X.509 Certificate - Attribute" },
1120 { 11,11, "Raw RSA Key" },
1121 { 12,12, "Hash and URL of X.509 certificate" },
1122 { 13,13, "Hash and URL of X.509 bundle" },
1123 { 14,14, "OCSP Content" }, /* [RFC4806] */
1124 { 15,200, "RESERVED to IANA" },
1125 { 201,255, "PRIVATE USE" },
1126 { 0,0, NULL },
1127 };
1128
1129 static const range_string authmeth_v2_type[] = {
1130 { 0,0, "RESERVED TO IANA" },
1131 { 1,1, "RSA Digital Signature" },
1132 { 2,2, "Shared Key Message Integrity Code" },
1133 { 3,3, "DSS Digital Signature" },
1134 { 4,8, "RESERVED TO IANA" },
1135 { 9,9, "ECDSA with SHA-256 on the P-256 curve" }, /* RFC4754 */
1136 { 10,10, "ECDSA with SHA-256 on the P-256 curve" }, /* RFC4754 */
1137 { 11,11, "ECDSA with SHA-256 on the P-256 curve" }, /* RFC4754 */
1138 { 12,12, "Generic Secure Password Authentication Method" }, /* RFC6467 */
1139 { 13,200, "RESERVED TO IANA" },
1140 { 201,255, "PRIVATE USE" },
1141 { 0,0, NULL },
1142 };
1143
1144 static const range_string notifmsg_v1_type[] = {
1145 { 0,0, "<UNKNOWN>" },
1146 { 1,1, "INVALID-PAYLOAD-TYPE" },
1147 { 2,2, "DOI-NOT-SUPPORTED" },
1148 { 3,3, "SITUATION-NOT-SUPPORTED" },
1149 { 4,4, "INVALID-COOKIE" },
1150 { 5,5, "INVALID-MAJOR-VERSION" },
1151 { 6,6, "INVALID-MINOR-VERSION" },
1152 { 7,7, "INVALID-EXCHANGE-TYPE" },
1153 { 8,8, "INVALID-FLAGS" },
1154 { 9,9, "INVALID-MESSAGE-ID" },
1155 { 10,10, "INVALID-PROTOCOL-ID" },
1156 { 11,11, "INVALID-SPI" },
1157 { 12,12, "INVALID-TRANSFORM-ID" },
1158 { 13,13, "ATTRIBUTES-NOT-SUPPORTED" },
1159 { 14,14, "NO-PROPOSAL-CHOSEN" },
1160 { 15,15, "BAD-PROPOSAL-SYNTAX" },
1161 { 16,16, "PAYLOAD-MALFORMED" },
1162 { 17,17, "INVALID-KEY-INFORMATION" },
1163 { 18,18, "INVALID-ID-INFORMATION" },
1164 { 19,19, "INVALID-CERT-ENCODING" },
1165 { 20,20, "INVALID-CERTIFICATE" },
1166 { 21,21, "CERT-TYPE-UNSUPPORTED" },
1167 { 22,22, "INVALID-CERT-AUTHORITY" },
1168 { 23,23, "INVALID-HASH-INFORMATION" },
1169 { 24,24, "AUTHENTICATION-FAILED" },
1170 { 25,25, "INVALID-SIGNATURE" },
1171 { 26,26, "ADDRESS-NOTIFICATION" },
1172 { 27,27, "NOTIFY-SA-LIFETIME" },
1173 { 28,28, "CERTIFICATE-UNAVAILABLE" },
1174 { 29,29, "UNSUPPORTED-EXCHANGE-TYPE" },
1175 { 30,30, "UNEQUAL-PAYLOAD-LENGTHS" },
1176 { 31,8191, "RESERVED (Future Use)" },
1177 { 8192,16383, "Private Use" },
1178 { 16384,16384,"CONNECTED" },
1179 { 16385,24575,"RESERVED (Future Use)" },
1180 { 24576,24576,"RESPONDER-LIFETIME" },
1181 { 24577,24577,"REPLAY-STATUS" },
1182 { 24578,24578,"INITIAL-CONTACT" },
1183 { 24579,32767,"DOI-specific codes" },
1184 { 32768,36135,"Private Use" },
1185 { 36136,36136,"R-U-THERE" },
1186 { 36137,36137,"R-U-THERE-ACK" },
1187 { 36138,40500,"Private Use" },
1188 { 40501,40501,"UNITY-LOAD-BALANCE" },
1189 { 40502,40502,"UNITY-UNKNOWN" },
1190 { 40503,40503,"UNITY-GROUP-HASH" },
1191 { 40503,40959,"Private Use" },
1192 { 40960,65535,"RESERVED (Future Use)" },
1193 { 0,0, NULL },
1194 };
1195
1196 static const range_string notifmsg_v2_type[] = {
1197 { 0,0, "RESERVED" },
1198 { 1,1, "UNSUPPORTED_CRITICAL_PAYLOAD" },
1199 { 2,3, "RESERVED" },
1200 { 4,4, "INVALID_IKE_SPI" },
1201 { 5,5, "INVALID_MAJOR_VERSION" },
1202 { 6,6, "RESERVED" },
1203 { 7,7, "INVALID_SYNTAX" },
1204 { 8,8, "RESERVED" },
1205 { 9,9, "INVALID_MESSAGE_ID" },
1206 { 10,10, "RESERVED" },
1207 { 11,11, "INVALID_SPI" },
1208 { 12,13, "RESERVED" },
1209 { 14,14, "NO_PROPOSAL_CHOSEN" },
1210 { 15,16, "RESERVED" },
1211 { 17,17, "INVALID_KE_PAYLOAD" },
1212 { 15,16, "RESERVED" },
1213 { 24,24, "AUTHENTICATION_FAILED" },
1214 { 25,33, "RESERVED" },
1215 { 34,34, "SINGLE_PAIR_REQUIRED" },
1216 { 35,35, "NO_ADDITIONAL_SAS" },
1217 { 36,36, "INTERNAL_ADDRESS_FAILURE" },
1218 { 37,37, "FAILED_CP_REQUIRED" },
1219 { 38,38, "TS_UNACCEPTABLE" },
1220 { 39,39, "INVALID_SELECTORS" },
1221 { 40,40, "UNACCEPTABLE_ADDRESSES" }, /* RFC4555 */
1222 { 41,41, "UNEXPECTED_NAT_DETECTED" }, /* RFC4555 */
1223 { 42,42, "USE_ASSIGNED_HoA" }, /* RFC5026 */
1224 { 43,43, "TEMPORARY_FAILURE" }, /* RFC5996 */
1225 { 44,44, "CHILD_SA_NOT_FOUND" }, /* RFC5996 */
1226 { 45,8191, "RESERVED TO IANA - Error types" },
1227 { 8192,16383, "Private Use - Errors" },
1228 { 16384,16384, "INITIAL_CONTACT" },
1229 { 16385,16385, "SET_WINDOW_SIZE" },
1230 { 16386,16386, "ADDITIONAL_TS_POSSIBLE" },
1231 { 16387,16387, "IPCOMP_SUPPORTED" },
1232 { 16388,16388, "NAT_DETECTION_SOURCE_IP" },
1233 { 16389,16389, "NAT_DETECTION_DESTINATION_IP" },
1234 { 16390,16390, "COOKIE" },
1235 { 16391,16391, "USE_TRANSPORT_MODE" },
1236 { 16392,16392, "HTTP_CERT_LOOKUP_SUPPORTED" },
1237 { 16393,16393, "REKEY_SA" },
1238 { 16394,16394, "ESP_TFC_PADDING_NOT_SUPPORTED" },
1239 { 16395,16395, "NON_FIRST_FRAGMENTS_ALSO" },
1240 { 16396,16396, "MOBIKE_SUPPORTED" }, /* RFC4555 */
1241 { 16397,16397, "ADDITIONAL_IP4_ADDRESS" }, /* RFC4555 */
1242 { 16398,16398, "ADDITIONAL_IP6_ADDRESS" }, /* RFC4555 */
1243 { 16399,16399, "NO_ADDITIONAL_ADDRESSES" }, /* RFC4555 */
1244 { 16400,16400, "UPDATE_SA_ADDRESSES" }, /* RFC4555 */
1245 { 16401,16401, "COOKIE2" }, /* RFC4555 */
1246 { 16402,16402, "NO_NATS_ALLOWED" }, /* RFC4555 */
1247 { 16403,16403, "AUTH_LIFETIME" }, /* RFC4478 */
1248 { 16404,16404, "MULTIPLE_AUTH_SUPPORTED" }, /* RFC4739 */
1249 { 16405,16405, "ANOTHER_AUTH_FOLLOWS" }, /* RFC4739 */
1250 { 16406,16406, "REDIRECT_SUPPORTED" }, /* RFC5685 */
1251 { 16407,16407, "REDIRECT" }, /* RFC5685 */
1252 { 16408,16408, "REDIRECTED_FROM" }, /* RFC5685 */
1253 { 16409,16409, "TICKET_LT_OPAQUE" }, /* RFC5723 */
1254 { 16410,16410, "TICKET_REQUEST" }, /* RFC5723 */
1255 { 16411,16411, "TICKET_ACK" }, /* RFC5723 */
1256 { 16412,16412, "TICKET_NACK" }, /* RFC5723 */
1257 { 16413,16413, "TICKET_OPAQUE" }, /* RFC5723 */
1258 { 16414,16414, "LINK_ID" }, /* RFC5739 */
1259 { 16415,16415, "USE_WESP_MODE" }, /* RFC5840 */
1260 { 16416,16416, "ROHC_SUPPORTED" }, /* RFC5857 */
1261 { 16417,16417, "EAP_ONLY_AUTHENTICATION" }, /* RFC5998 */
1262 { 16418,16418, "CHILDLESS_IKEV2_SUPPORTED" }, /* RFC6023 */
1263 { 16419,16419, "QUICK_CRASH_DETECTION" }, /* RFC6290 */
1264 { 16420,16420, "IKEV2_MESSAGE_ID_SYNC_SUPPORTED" }, /* RFC6311 */
1265 { 16421,16421, "IPSEC_REPLAY_COUNTER_SYNC_SUPPORTED" },/* RFC6311 */
1266 { 16422,16422, "IKEV2_MESSAGE_ID_SYNC" }, /* RFC6311 */
1267 { 16423,16423, "IPSEC_REPLAY_COUNTER_SYNC" }, /* RFC6311 */
1268 { 16424,16424, "SECURE_PASSWORD_METHODS" }, /* RFC6467 */
1269 { 16425,40959, "RESERVED TO IANA - STATUS TYPES" },
1270 { 40960,65535, "Private Use - STATUS TYPES" },
1271 { 0,0, NULL },
1272 };
1273
1274 static const range_string vs_v1_cfgtype[] = {
1275 { 0,0, "Reserved" },
1276 { 1,1, "ISAKMP_CFG_REQUEST" },
1277 { 2,2, "ISAKMP_CFG_REPLY" },
1278 { 3,3, "ISAKMP_CFG_SET" },
1279 { 4,4, "ISAKMP_CFG_ACK" },
1280 { 5,127, "Future use" },
1281 { 128,256, "Private Use" },
1282 { 0,0, NULL },
1283 };
1284
1285
1286 static const range_string vs_v2_cfgtype[] = {
1287 { 0,0, "RESERVED" },
1288 { 1,1, "CFG_REQUEST" },
1289 { 2,2, "CFG_REPLY" },
1290 { 3,3, "CFG_SET" },
1291 { 4,4, "CFG_ACK" },
1292 { 5,127, "Future use" },
1293 { 128,256, "Private Use" },
1294 { 0,0, NULL },
1295 };
1296
1297 static const range_string vs_v1_cfgattr[] = {
1298 { 0,0, "RESERVED" },
1299 { 1,1, "INTERNAL_IP4_ADDRESS" },
1300 { 2,2, "INTERNAL_IP4_NETMASK" },
1301 { 3,3, "INTERNAL_IP4_DNS" },
1302 { 4,4, "INTERNAL_IP4_NBNS" },
1303 { 5,5, "INTERNAL_ADDRESS_EXPIREY" },
1304 { 6,6, "INTERNAL_IP4_DHCP" },
1305 { 7,7, "APPLICATION_VERSION" },
1306 { 8,8, "INTERNAL_IP6_ADDRESS" },
1307 { 9,9, "INTERNAL_IP6_NETMASK" },
1308 { 10,10, "INTERNAL_IP6_DNS" },
1309 { 11,11, "INTERNAL_IP6_NBNS" },
1310 { 12,12, "INTERNAL_IP6_DHCP" },
1311 { 13,13, "INTERNAL_IP4_SUBNET" },
1312 { 14,14, "SUPPORTED_ATTRIBUTES" },
1313 { 15,16383, "FUTURE USE"},
1314 { 16384,16386, "PRIVATE USE"},
1315 { 16387,16387, "CHKPT_DEF_DOMAIN" },
1316 { 16388,16388, "CHKPT_MAC_ADDRESS" },
1317 { 16389,16389, "CHKPT_MARCIPAN_REASON_CODE" },
1318 { 16400,16400, "CHKPT_UNKNOWN1" },
1319 { 16401,16401, "CHKPT_UNKNOWN2" },
1320 { 16402,16402, "CHKPT_UNKNOWN3" },
1321 { 16403,16519, "PRIVATE USE"},
1322 { 16520,16520, "XAUTH_TYPE" },
1323 { 16521,16521, "XAUTH_USER_NAME" },
1324 { 16522,16522, "XAUTH_USER_PASSWORD" },
1325 { 16523,16523, "XAUTH_PASSCODE" },
1326 { 16524,16524, "XAUTH_MESSAGE" },
1327 { 16525,16525, "XAUTH_CHALLANGE" },
1328 { 16526,16526, "XAUTH_DOMAIN" },
1329 { 16527,16527, "XAUTH_STATUS" },
1330 { 16528,16528, "XAUTH_NEXT_PIN" },
1331 { 16529,16529, "XAUTH_ANSWER" },
1332 { 16530,28671, "PRIVATE USE"},
1333 { 28672,28672, "UNITY_BANNER" },
1334 { 28673,28673, "UNITY_SAVE_PASSWD" },
1335 { 28674,28674, "UNITY_DEF_DOMAIN" },
1336 { 28675,28675, "UNITY_SPLIT_DOMAIN" },
1337 { 28676,28676, "UNITY_SPLIT_INCLUDE" },
1338 { 28677,28677, "UNITY_NATT_PORT" },
1339 { 28678,28678, "UNITY_SPLIT_EXCLUDE" },
1340 { 28679,28679, "UNITY_PFS" },
1341 { 28680,28680, "UNITY_FW_TYPE" },
1342 { 28681,28681, "UNITY_BACKUP_SERVERS" },
1343 { 28682,28682, "UNITY_DDNS_HOSTNAME" },
1344 { 28683,32767, "PRIVATE USE"},
1345 { 0,0, NULL },
1346 };
1347
1348 static const range_string vs_v2_cfgattr[] = {
1349 { 0,0, "RESERVED" },
1350 { 1,1, "INTERNAL_IP4_ADDRESS" },
1351 { 2,2, "INTERNAL_IP4_NETMASK" },
1352 { 3,3, "INTERNAL_IP4_DNS" },
1353 { 4,4, "INTERNAL_IP4_NBNS" },
1354 { 5,5, "INTERNAL_ADDRESS_EXPIREY" }, /* OBSO */
1355 { 6,6, "INTERNAL_IP4_DHCP" },
1356 { 7,7, "APPLICATION_VERSION" },
1357 { 8,8, "INTERNAL_IP6_ADDRESS" },
1358 { 9,9, "RESERVED" },
1359 { 10,10, "INTERNAL_IP6_DNS" },
1360 { 11,11, "INTERNAL_IP6_NBNS" }, /* OBSO */
1361 { 12,12, "INTERNAL_IP6_DHCP" },
1362 { 13,13, "INTERNAL_IP4_SUBNET" },
1363 { 14,14, "SUPPORTED_ATTRIBUTES" },
1364 { 15,15, "INTERNAL_IP6_SUBNET" },
1365 { 16,16, "MIP6_HOME_PREFIX" },
1366 { 17,17, "INTERNAL_IP6_LINK" },
1367 { 18,18, "INTERNAL_IP6_PREFIX" },
1368 { 19,19, "HOME_AGENT_ADDRESS" }, /* 3GPP TS 24.302 http://www.3gpp.org/ftp/Specs/html-info/24302.htm */
1369 { 20,16383, "RESERVED TO IANA"},
1370 { 16384,32767, "PRIVATE USE"},
1371 { 0,0, NULL },
1372 };
1373
1374 static const range_string cfgattr_xauth_type[] = {
1375 { 0,0, "Generic" },
1376 { 1,1, "RADIUS-CHAP" },
1377 { 2,2, "OTP" },
1378 { 3,3, "S/KEY" },
1379 { 4,32767, "Future use" },
1380 { 32768,65535, "Private use" },
1381 { 0,0, NULL },
1382 };
1383
1384
1385 static const value_string cfgattr_xauth_status[] = {
1386 { 0, "Fail" },
1387 { 1, "Success" },
1388 { 0, NULL },
1389 };
1390
1391 static const value_string cp_product[] = {
1392 { 1, "Firewall-1" },
1393 { 2, "SecuRemote/SecureClient" },
1394 { 0, NULL },
1395 };
1396
1397 static const value_string cp_version[] = {
1398 { 2,"4.1" },
1399 { 3,"4.1 SP-1" },
1400 { 4002,"4.1 (SP-2 or above)" },
1401 { 5000,"NG" },
1402 { 5001,"NG Feature Pack 1" },
1403 { 5002,"NG Feature Pack 2" },
1404 { 5003,"NG Feature Pack 3" },
1405 { 5004,"NG with Application Intelligence" },
1406 { 5005,"NG with Application Intelligence R55" },
1407 { 5006,"NG with Application Intelligence R56" },
1408 { 0, NULL },
1409 };
1410 static const range_string traffic_selector_type[] = {
1411 { 0,6, "Reserved" },
1412 { 7,7, "TS_IPV4_ADDR_RANGE" },
1413 { 8,8, "TS_IPV6_ADDR_RANGE" },
1414 { 9,9, "TS_FC_ADDR_RANGE" },
1415 { 10,240, "Future use" },
1416 { 241,255, "Private use" },
1417 { 0,0, NULL },
1418 };
1419 static const value_string ms_nt5_isakmpoakley_type[] = {
1420 { 2, "Windows 2000" },
1421 { 3, "Windows XP SP1" },
1422 { 4, "Windows 2003 and Windows XP SP2" },
1423 { 5, "Windows Vista" },
1424 { 0, NULL }
1425 };
1426 static const range_string vs_v1_id_type[] = {
1427 { 0,0, "RESERVED" },
1428 { IKE_ID_IPV4_ADDR,IKE_ID_IPV4_ADDR, "IPV4_ADDR" },
1429 { IKE_ID_FQDN,IKE_ID_FQDN, "FQDN" },
1430 { IKE_ID_USER_FQDN,IKE_ID_USER_FQDN, "USER_FQDN" },
1431 { IKE_ID_IPV4_ADDR_SUBNET,IKE_ID_IPV4_ADDR_SUBNET, "IPV4_ADDR_SUBNET" },
1432 { IKE_ID_IPV6_ADDR,IKE_ID_IPV6_ADDR, "IPV6_ADDR" },
1433 { IKE_ID_IPV6_ADDR_SUBNET,IKE_ID_IPV6_ADDR_SUBNET, "IPV6_ADDR_SUBNET" },
1434 { IKE_ID_IPV4_ADDR_RANGE,IKE_ID_IPV4_ADDR_RANGE, "IPV4_ADDR_RANGE" },
1435 { IKE_ID_IPV6_ADDR_RANGE,IKE_ID_IPV6_ADDR_RANGE, "IPV6_ADDR_RANGE" },
1436 { IKE_ID_DER_ASN1_DN,IKE_ID_DER_ASN1_DN, "DER_ASN1_DN" },
1437 { IKE_ID_DER_ASN1_GN,IKE_ID_DER_ASN1_GN, "DER_ASN1_GN" },
1438 { IKE_ID_KEY_ID,IKE_ID_KEY_ID, "KEY_ID" },
1439 { IKE_ID_LIST,IKE_ID_LIST, "KEY_LIST" },
1440 { 13,248, "Future use" },
1441 { 249,255, "Private Use" },
1442 { 0,0, NULL },
1443 };
1444 static const range_string vs_v2_id_type[] = {
1445 { 0,0, "RESERVED" },
1446 { IKE_ID_IPV4_ADDR,IKE_ID_IPV4_ADDR, "IPV4_ADDR" },
1447 { IKE_ID_FQDN,IKE_ID_FQDN, "FQDN" },
1448 { IKE_ID_RFC822_ADDR,IKE_ID_RFC822_ADDR, "ID_RFC822_ADDR" },
1449 { 4,4, "Unassigned" },
1450 { IKE_ID_IPV6_ADDR,IKE_ID_IPV6_ADDR, "IPV6_ADDR" },
1451 { 6,8, "Unassigned" },
1452 { IKE_ID_DER_ASN1_DN,IKE_ID_DER_ASN1_DN, "DER_ASN1_DN" },
1453 { IKE_ID_DER_ASN1_GN,IKE_ID_DER_ASN1_GN, "DER_ASN1_GN" },
1454 { IKE_ID_KEY_ID,IKE_ID_KEY_ID, "KEY_ID" },
1455 { IKE_ID_FC_NAME,IKE_ID_FC_NAME, "KEY_LIST" },
1456 { 13,200, "Future use" },
1457 { 201,255, "Private Use" },
1458 { 0,0, NULL },
1459 };
1460 #define COOKIE_SIZE 8
1461
1462 typedef struct isakmp_hdr {
1463 guint8 next_payload;
1464 guint8 version;
1465 guint8 exch_type;
1466 guint8 flags;
1467 #define E_FLAG 0x01
1468 #define C_FLAG 0x02
1469 #define A_FLAG 0x04
1470 #define I_FLAG 0x08
1471 #define V_FLAG 0x10
1472 #define R_FLAG 0x20
1473 guint32 message_id;
1474 guint32 length;
1475 } isakmp_hdr_t;
1476
1477 static const true_false_string criticalpayload = {
1478 "Critical",
1479 "Not Critical"
1480 };
1481 static const true_false_string attribute_format = {
1482 "Type/Value (TV)",
1483 "Type/Length/Value (TLV)"
1484 };
1485 static const true_false_string flag_e = {
1486 "Encrypted",
1487 "Not encrypted"
1488 };
1489 static const true_false_string flag_c = {
1490 "Commit",
1491 "No commit"
1492 };
1493 static const true_false_string flag_a = {
1494 "Authentication",
1495 "No authentication"
1496 };
1497 static const true_false_string flag_i = {
1498 "Initiator",
1499 "Responder"
1500 };
1501 static const true_false_string flag_v = {
1502 "A higher version enabled",
1503 "No higher version"
1504 };
1505 static const true_false_string flag_r = {
1506 "Response",
1507 "Request"
1508 };
1509
1510 /* ROHC Attribute Type RFC5857 */
1511
1512 #define ROHC_MAX_CID 1
1513 #define ROHC_PROFILE 2
1514 #define ROHC_INTEG 3
1515 #define ROHC_ICV_LEN 4
1516 #define ROHC_MRRU 5
1517
1518 static const value_string rohc_attr_type[] = {
1519 { ROHC_MAX_CID, "Maximum Context Identifier (MAX_CID)" },
1520 { ROHC_PROFILE, "ROHC Profile (ROHC_PROFILE)" },
1521 { ROHC_INTEG, "ROHC Integrity Algorithm (ROHC_INTEG)" },
1522 { ROHC_ICV_LEN, "ROHC ICV Length in bytes (ROHC_ICV_LEN)" },
1523 { ROHC_MRRU, "Maximum Reconstructed Reception Unit (MRRU)" },
1524 { 0, NULL },
1525 };
1526
1527 #define ISAKMP_HDR_SIZE ((int)sizeof(struct isakmp_hdr) + (2 * COOKIE_SIZE))
1528
1529
1530 #ifdef HAVE_LIBGCRYPT
1531
1532 #define MAX_KEY_SIZE 256
1533 #define MAX_DIGEST_SIZE 64
1534 #define MAX_OAKLEY_KEY_LEN 32
1535
1536 typedef struct _ikev1_uat_data_key {
1537 guchar *icookie;
1538 guint icookie_len;
1539 guchar *key;
1540 guint key_len;
1541 } ikev1_uat_data_key_t;
1542
1543 typedef struct iv_data {
1544 guchar iv[MAX_DIGEST_SIZE];
1545 guint iv_len;
1546 guint32 frame_num;
1547 } iv_data_t;
1548
1549 typedef struct decrypt_data {
1550 gboolean is_psk;
1551 address initiator;
1552 guint encr_alg;
1553 guint hash_alg;
1554 guint group;
1555 gchar *gi;
1556 guint gi_len;
1557 gchar *gr;
1558 guint gr_len;
1559 guchar secret[MAX_KEY_SIZE];
1560 guint secret_len;
1561 GList *iv_list;
1562 gchar last_cbc[MAX_DIGEST_SIZE];
1563 guint last_cbc_len;
1564 gchar last_p1_cbc[MAX_DIGEST_SIZE];
1565 guint last_p1_cbc_len;
1566 guint32 last_message_id;
1567 } decrypt_data_t;
1568
1569 static GHashTable *isakmp_hash = NULL;
1570
1571 static ikev1_uat_data_key_t* ikev1_uat_data = NULL;
1572 static uat_t * ikev1_uat = NULL;
1573 static guint num_ikev1_uat_data = 0;
1574
1575 /* Specifications of encryption algorithms for IKEv2 decryption */
1576 typedef struct _ikev2_encr_alg_spec {
1577 guint number;
1578 /* Length of encryption key */
1579 guint key_len;
1580 /* Block size of the cipher */
1581 guint block_len;
1582 /* Length of initialization vector */
1583 guint iv_len;
1584 /* Encryption algorithm ID to be passed to gcry_cipher_open() */
1585 gint gcry_alg;
1586 /* Cipher mode to be passed to gcry_cipher_open() */
1587 gint gcry_mode;
1588 } ikev2_encr_alg_spec_t;
1589
1590 #define IKEV2_ENCR_NULL 1
1591 #define IKEV2_ENCR_3DES 2
1592 #define IKEV2_ENCR_AES_CBC_128 3
1593 #define IKEV2_ENCR_AES_CBC_192 4
1594 #define IKEV2_ENCR_AES_CBC_256 5
1595
1596 static ikev2_encr_alg_spec_t ikev2_encr_algs[] = {
1597 {IKEV2_ENCR_NULL, 0, 1, 0, GCRY_CIPHER_NONE, GCRY_CIPHER_MODE_NONE},
1598 {IKEV2_ENCR_3DES, 24, 8, 8, GCRY_CIPHER_3DES, GCRY_CIPHER_MODE_CBC},
1599 {IKEV2_ENCR_AES_CBC_128, 16, 16, 16, GCRY_CIPHER_AES128, GCRY_CIPHER_MODE_CBC},
1600 {IKEV2_ENCR_AES_CBC_192, 24, 16, 16, GCRY_CIPHER_AES192, GCRY_CIPHER_MODE_CBC},
1601 {IKEV2_ENCR_AES_CBC_256, 32, 16, 16, GCRY_CIPHER_AES256, GCRY_CIPHER_MODE_CBC},
1602 {0, 0, 0, 0, 0, 0}
1603 };
1604
1605 /*
1606 * Specifications of authentication algorithms for
1607 * decryption and/or ICD (Integrity Checksum Data) checking of IKEv2
1608 */
1609 typedef struct _ikev2_auth_alg_spec {
1610 guint number;
1611 /* Output length of the hash algorithm */
1612 guint output_len;
1613 /* Length of the hash key */
1614 guint key_len;
1615 /* Actual ICD length after truncation */
1616 guint trunc_len;
1617 /* Hash algorithm ID to be passed to gcry_md_open() */
1618 gint gcry_alg;
1619 /* Flags to be passed to gcry_md_open() */
1620 guint gcry_flag;
1621 } ikev2_auth_alg_spec_t;
1622
1623 #define IKEV2_AUTH_NONE 1
1624 #define IKEV2_AUTH_HMAC_MD5_96 2
1625 #define IKEV2_AUTH_HMAC_SHA1_96 3
1626 #define IKEV2_AUTH_HMAC_SHA2_256_96 4
1627 #define IKEV2_AUTH_HMAC_SHA2_256_128 5
1628 #define IKEV2_AUTH_HMAC_SHA2_384_192 6
1629 #define IKEV2_AUTH_HMAC_SHA2_512_256 7
1630 #define IKEV2_AUTH_ANY_96BITS 8
1631 #define IKEV2_AUTH_ANY_128BITS 9
1632 #define IKEV2_AUTH_ANY_160BITS 10
1633 #define IKEV2_AUTH_ANY_192BITS 11
1634 #define IKEV2_AUTH_ANY_256BITS 12
1635
1636 static ikev2_auth_alg_spec_t ikev2_auth_algs[] = {
1637 /*{number, output_len, key_len, trunc_len, gcry_alg, gcry_flag}*/
1638 {IKEV2_AUTH_NONE, 0, 0, 0, GCRY_MD_NONE, 0},
1639 {IKEV2_AUTH_HMAC_MD5_96, 16, 16, 12, GCRY_MD_MD5, GCRY_MD_FLAG_HMAC},
1640 {IKEV2_AUTH_HMAC_SHA1_96, 20, 20, 12, GCRY_MD_SHA1, GCRY_MD_FLAG_HMAC},
1641 {IKEV2_AUTH_HMAC_SHA2_256_96, 32, 32, 12, GCRY_MD_SHA256, GCRY_MD_FLAG_HMAC},
1642 {IKEV2_AUTH_HMAC_SHA2_256_128, 32, 32, 16, GCRY_MD_SHA256, GCRY_MD_FLAG_HMAC},
1643 {IKEV2_AUTH_HMAC_SHA2_384_192, 48, 48, 24, GCRY_MD_SHA256, GCRY_MD_FLAG_HMAC},
1644 {IKEV2_AUTH_HMAC_SHA2_512_256, 64, 64, 32, GCRY_MD_SHA256, GCRY_MD_FLAG_HMAC},
1645 {IKEV2_AUTH_ANY_96BITS, 0, 0, 12, 0, 0},
1646 {IKEV2_AUTH_ANY_128BITS, 0, 0, 16, 0, 0},
1647 {IKEV2_AUTH_ANY_160BITS, 0, 0, 20, 0, 0},
1648 {IKEV2_AUTH_ANY_192BITS, 0, 0, 24, 0, 0},
1649 {IKEV2_AUTH_ANY_256BITS, 0, 0, 32, 0, 0},
1650 {0, 0, 0, 0, 0, 0}
1651 };
1652
1653 typedef struct _ikev2_decrypt_data {
1654 guchar *encr_key;
1655 guchar *auth_key;
1656 ikev2_encr_alg_spec_t *encr_spec;
1657 ikev2_auth_alg_spec_t *auth_spec;
1658 } ikev2_decrypt_data_t;
1659
1660 typedef struct _ikev2_uat_data_key {
1661 guchar *spii;
1662 guint spii_len;
1663 guchar *spir;
1664 guint spir_len;
1665 } ikev2_uat_data_key_t;
1666
1667 typedef struct _ikev2_uat_data {
1668 ikev2_uat_data_key_t key;
1669 guint encr_alg;
1670 guint auth_alg;
1671 guchar *sk_ei;
1672 guint sk_ei_len;
1673 guchar *sk_er;
1674 guint sk_er_len;
1675 guchar *sk_ai;
1676 guint sk_ai_len;
1677 guchar *sk_ar;
1678 guint sk_ar_len;
1679 ikev2_encr_alg_spec_t *encr_spec;
1680 ikev2_auth_alg_spec_t *auth_spec;
1681 } ikev2_uat_data_t;
1682
1683 static ikev2_uat_data_t* ikev2_uat_data = NULL;
1684 static guint num_ikev2_uat_data = 0;
1685 static uat_t* ikev2_uat;
1686
1687 static GHashTable *ikev2_key_hash = NULL;
1688
1689 #define IKEV2_ENCR_3DES_STR "3DES [RFC2451]"
1690 static const value_string vs_ikev2_encr_algs[] = {
1691 {IKEV2_ENCR_3DES, IKEV2_ENCR_3DES_STR},
1692 {IKEV2_ENCR_AES_CBC_128, "AES-CBC-128 [RFC3602]"},
1693 {IKEV2_ENCR_AES_CBC_192, "AES-CBC-192 [RFC3602]"},
1694 {IKEV2_ENCR_AES_CBC_256, "AES-CBC-256 [RFC3602]"},
1695 {IKEV2_ENCR_NULL, "NULL [RFC2410]"},
1696 {0, NULL}
1697 };
1698
1699 #define IKEV2_AUTH_HMAC_SHA1_96_STR "HMAC_SHA1_96 [RFC2404]"
1700 static const value_string vs_ikev2_auth_algs[] = {
1701 {IKEV2_AUTH_HMAC_MD5_96, "HMAC_MD5_96 [RFC2403]"},
1702 {IKEV2_AUTH_HMAC_SHA1_96, IKEV2_AUTH_HMAC_SHA1_96_STR},
1703 {IKEV2_AUTH_HMAC_SHA2_256_96, "HMAC_SHA2_256_96 [draft-ietf-ipsec-ciph-sha-256-00]"},
1704 {IKEV2_AUTH_HMAC_SHA2_256_128, "HMAC_SHA2_256_128 [RFC4868]"},
1705 {IKEV2_AUTH_HMAC_SHA2_384_192, "HMAC_SHA2_384_192 [RFC4868]"},
1706 {IKEV2_AUTH_HMAC_SHA2_512_256, "HMAC_SHA2_512_256 [RFC4868]"},
1707 {IKEV2_AUTH_NONE, "NONE [RFC4306]"},
1708 {IKEV2_AUTH_ANY_96BITS, "ANY 96-bits of Authentication [No Checking]"},
1709 {IKEV2_AUTH_ANY_128BITS, "ANY 128-bits of Authentication [No Checking]"},
1710 {IKEV2_AUTH_ANY_160BITS, "ANY 160-bits of Authentication [No Checking]"},
1711 {IKEV2_AUTH_ANY_192BITS, "ANY 192-bits of Authentication [No Checking]"},
1712 {IKEV2_AUTH_ANY_256BITS, "ANY 256-bits of Authentication [No Checking]"},
1713 {0, NULL}
1714 };
1715
1716 static ikev2_encr_alg_spec_t* ikev2_decrypt_find_encr_spec(guint num) {
1717 ikev2_encr_alg_spec_t *e;
1718
1719 for (e = ikev2_encr_algs; e->number != 0; e++) {
1720 if (e->number == num) {
1721 return e;
1722 }
1723 }
1724 return NULL;
1725 }
1726
1727 static ikev2_auth_alg_spec_t* ikev2_decrypt_find_auth_spec(guint num) {
1728 ikev2_auth_alg_spec_t *a;
1729
1730 for (a = ikev2_auth_algs; a->number != 0; a++) {
1731 if (a->number == num) {
1732 return a;
1733 }
1734 }
1735 return NULL;
1736 }
1737
1738 static tvbuff_t *
1739 decrypt_payload(tvbuff_t *tvb, packet_info *pinfo, const guint8 *buf, guint buf_len, isakmp_hdr_t *hdr, decrypt_data_t *decr) {
1740 guint8 *decrypted_data = NULL;
1741 gint gcry_md_algo, gcry_cipher_algo;
1742 gcry_md_hd_t md_ctx;
1743 gcry_cipher_hd_t decr_ctx;
1744 tvbuff_t *encr_tvb;
1745 iv_data_t *ivd = NULL;
1746 GList *ivl;
1747 guchar iv[MAX_DIGEST_SIZE];
1748 guint iv_len = 0;
1749 guint32 message_id, cbc_block_size, digest_size;
1750
1751 if (!decr ||
1752 decr->is_psk == FALSE ||
1753 decr->gi_len == 0 ||
1754 decr->gr_len == 0)
1755 return NULL;
1756
1757 switch(decr->encr_alg) {
1758 case ENC_3DES_CBC:
1759 gcry_cipher_algo = GCRY_CIPHER_3DES;
1760 break;
1761 case ENC_DES_CBC:
1762 gcry_cipher_algo = GCRY_CIPHER_DES;
1763 break;
1764 default:
1765 return NULL;
1766 break;
1767 }
1768 if (decr->secret_len < gcry_cipher_get_algo_keylen(gcry_cipher_algo))
1769 return NULL;
1770 cbc_block_size = (guint32) gcry_cipher_get_algo_blklen(gcry_cipher_algo);
1771 if (cbc_block_size > MAX_DIGEST_SIZE) {
1772 /* This shouldn't happen but we pass cbc_block_size to memcpy size below. */
1773 return NULL;
1774 }
1775
1776 switch(decr->hash_alg) {
1777 case HMAC_MD5:
1778 gcry_md_algo = GCRY_MD_MD5;
1779 break;
1780 case HMAC_SHA:
1781 gcry_md_algo = GCRY_MD_SHA1;
1782 break;
1783 default:
1784 return NULL;
1785 break;
1786 }
1787 digest_size = gcry_md_get_algo_dlen(gcry_md_algo);
1788
1789 for (ivl = g_list_first(decr->iv_list); ivl != NULL; ivl = g_list_next(ivl)) {
1790 ivd = (iv_data_t *) ivl->data;
1791 if (ivd->frame_num == pinfo->fd->num) {
1792 iv_len = ivd->iv_len;
1793 memcpy(iv, ivd->iv, iv_len);
1794 }
1795 }
1796
1797 /*
1798 * Set our initialization vector as follows:
1799 * - If the IV list is empty, assume we have the first packet in a phase 1
1800 * exchange. The IV is built from DH values.
1801 * - If our message ID changes, assume we're entering a new mode. The IV
1802 * is built from the message ID and the last phase 1 CBC.
1803 * - Otherwise, use the last CBC.
1804 */
1805 if (iv_len == 0) {
1806 if (gcry_md_open(&md_ctx, gcry_md_algo, 0) != GPG_ERR_NO_ERROR)
1807 return NULL;
1808 if (decr->iv_list == NULL) {
1809 /* First packet */
1810 ivd = (iv_data_t *)g_malloc(sizeof(iv_data_t));
1811 ivd->frame_num = pinfo->fd->num;
1812 ivd->iv_len = digest_size;
1813 decr->last_message_id = hdr->message_id;
1814 gcry_md_reset(md_ctx);
1815 gcry_md_write(md_ctx, decr->gi, decr->gi_len);
1816 gcry_md_write(md_ctx, decr->gr, decr->gr_len);
1817 gcry_md_final(md_ctx);
1818 memcpy(ivd->iv, gcry_md_read(md_ctx, gcry_md_algo), digest_size);
1819 decr->iv_list = g_list_append(decr->iv_list, ivd);
1820 iv_len = ivd->iv_len;
1821 memcpy(iv, ivd->iv, iv_len);
1822 } else if (decr->last_cbc_len >= cbc_block_size) {
1823 ivd = (iv_data_t *)g_malloc(sizeof(iv_data_t));
1824 ivd->frame_num = pinfo->fd->num;
1825 if (hdr->message_id != decr->last_message_id) {
1826 if (decr->last_p1_cbc_len == 0) {
1827 memcpy(decr->last_p1_cbc, decr->last_cbc, cbc_block_size);
1828 decr->last_p1_cbc_len = cbc_block_size;
1829 }
1830 ivd->iv_len = digest_size;
1831 decr->last_message_id = hdr->message_id;
1832 message_id = g_htonl(decr->last_message_id);
1833 gcry_md_reset(md_ctx);
1834 gcry_md_write(md_ctx, decr->last_p1_cbc, cbc_block_size);
1835 gcry_md_write(md_ctx, &message_id, sizeof(message_id));
1836 memcpy(ivd->iv, gcry_md_read(md_ctx, gcry_md_algo), digest_size);
1837 } else {
1838 ivd->iv_len = cbc_block_size;
1839 memcpy(ivd->iv, decr->last_cbc, ivd->iv_len);
1840 }
1841 decr->iv_list = g_list_append(decr->iv_list, ivd);
1842 iv_len = ivd->iv_len;
1843 memcpy(iv, ivd->iv, iv_len);
1844 }
1845 gcry_md_close(md_ctx);
1846 }
1847
1848 if (ivd == NULL) return NULL;
1849
1850 if (gcry_cipher_open(&decr_ctx, gcry_cipher_algo, GCRY_CIPHER_MODE_CBC, 0) != GPG_ERR_NO_ERROR)
1851 return NULL;
1852 if (iv_len > cbc_block_size)
1853 iv_len = cbc_block_size; /* gcry warns otherwise */
1854 if (gcry_cipher_setiv(decr_ctx, iv, iv_len))
1855 return NULL;
1856 if (gcry_cipher_setkey(decr_ctx, decr->secret, decr->secret_len))
1857 return NULL;
1858
1859 decrypted_data = (guint8 *)g_malloc(buf_len);
1860
1861 if (gcry_cipher_decrypt(decr_ctx, decrypted_data, buf_len, buf, buf_len) != GPG_ERR_NO_ERROR) {
1862 g_free(decrypted_data);
1863 return NULL;
1864 }
1865 gcry_cipher_close(decr_ctx);
1866
1867 encr_tvb = tvb_new_child_real_data(tvb, decrypted_data, buf_len, buf_len);
1868 tvb_set_free_cb(encr_tvb, g_free);
1869
1870 /* Add the decrypted data to the data source list. */
1871 add_new_data_source(pinfo, encr_tvb, "Decrypted IKE");
1872
1873 /* Fill in the next IV */
1874 if (tvb_length(tvb) > cbc_block_size) {
1875 decr->last_cbc_len = cbc_block_size;
1876 memcpy(decr->last_cbc, buf + buf_len - cbc_block_size, cbc_block_size);
1877 } else {
1878 decr->last_cbc_len = 0;
1879 }
1880
1881 return encr_tvb;
1882 }
1883
1884 #endif /* HAVE_LIBGCRYPT */
1885
1886 static proto_tree *dissect_payload_header(tvbuff_t *, int, int, int, guint8,
1887 guint8 *, guint16 *, proto_tree *);
1888
1889 static void dissect_sa(tvbuff_t *, int, int, proto_tree *, int, packet_info *, void*);
1890 static void dissect_proposal(tvbuff_t *, int, int, proto_tree *, int, void*);
1891 static void dissect_transform(tvbuff_t *, int, int, proto_tree *, int, int, void*);
1892 static void dissect_key_exch(tvbuff_t *, int, int, proto_tree *, int, packet_info *, void*);
1893 static void dissect_id(tvbuff_t *, int, int, proto_tree *, int, packet_info *);
1894 static void dissect_cert(tvbuff_t *, int, int, proto_tree *, int, packet_info *);
1895 static void dissect_certreq(tvbuff_t *, int, int, proto_tree *, int, packet_info *);
1896 static void dissect_auth(tvbuff_t *, int, int, proto_tree *);
1897 static void dissect_hash(tvbuff_t *, int, int, proto_tree *);
1898 static void dissect_sig(tvbuff_t *, int, int, proto_tree *);
1899 static void dissect_nonce(tvbuff_t *, int, int, proto_tree *);
1900 static void dissect_notif(tvbuff_t *, int, int, proto_tree *, int);
1901 static void dissect_delete(tvbuff_t *, int, int, proto_tree *, int);
1902 static int dissect_vid(tvbuff_t *, int, int, proto_tree *);
1903 static void dissect_config(tvbuff_t *, int, int, proto_tree *, int);
1904 static void dissect_nat_discovery(tvbuff_t *, int, int, proto_tree * );
1905 static void dissect_nat_original_address(tvbuff_t *, int, int, proto_tree *, int );
1906 static void dissect_ts(tvbuff_t *, int, int, proto_tree *);
1907 static void dissect_enc(tvbuff_t *, int, int, proto_tree *, packet_info *, guint8, void*);
1908 static void dissect_eap(tvbuff_t *, int, int, proto_tree *, packet_info *);
1909 static void dissect_gspm(tvbuff_t *, int, int, proto_tree *);
1910 static void dissect_cisco_fragmentation(tvbuff_t *, int, int, proto_tree *, packet_info *);
1911
1912 static const guint8 VID_SSH_IPSEC_EXPRESS_1_1_0[] = { /* Ssh Communications Security IPSEC Express version 1.1.0 */
1913 0xfB, 0xF4, 0x76, 0x14, 0x98, 0x40, 0x31, 0xFA,
1914 0x8E, 0x3B, 0xB6, 0x19, 0x80, 0x89, 0xB2, 0x23
1915 };
1916
1917 static const guint8 VID_SSH_IPSEC_EXPRESS_1_1_1[] = { /* Ssh Communications Security IPSEC Express version 1.1.1 */
1918 0x19, 0x52, 0xDC, 0x91, 0xAC, 0x20, 0xF6, 0x46,
1919 0xFB, 0x01, 0xCF, 0x42, 0xA3, 0x3A, 0xEE, 0x30
1920 };
1921
1922 static const guint8 VID_SSH_IPSEC_EXPRESS_1_1_2[] = { /* Ssh Communications Security IPSEC Express version 1.1.2 */
1923 0xE8, 0xBF, 0xFA, 0x64, 0x3E, 0x5C, 0x8F, 0x2C,
1924 0xD1, 0x0F, 0xDA, 0x73, 0x70, 0xB6, 0xEB, 0xE5
1925 };
1926
1927 static const guint8 VID_SSH_IPSEC_EXPRESS_1_2_1[] = { /* Ssh Communications Security IPSEC Express version 1.2.1 */
1928 0xC1, 0x11, 0x1B, 0x2D, 0xEE, 0x8C, 0xBC, 0x3D,
1929 0x62, 0x05, 0x73, 0xEC, 0x57, 0xAA, 0xB9, 0xCB
1930 };
1931
1932 static const guint8 VID_SSH_IPSEC_EXPRESS_1_2_2[] = { /* Ssh Communications Security IPSEC Express version 1.2.2 */
1933 0x09, 0xEC, 0x27, 0xBF, 0xBC, 0x09, 0xC7, 0x58,
1934 0x23, 0xCF, 0xEC, 0xBF, 0xFE, 0x56, 0x5A, 0x2E
1935 };
1936
1937 static const guint8 VID_SSH_IPSEC_EXPRESS_2_0_0[] = { /* SSH Communications Security IPSEC Express version 2.0.0 */
1938 0x7F, 0x21, 0xA5, 0x96, 0xE4, 0xE3, 0x18, 0xF0,
1939 0xB2, 0xF4, 0x94, 0x4C, 0x23, 0x84, 0xCB, 0x84
1940 };
1941
1942 static const guint8 VID_SSH_IPSEC_EXPRESS_2_1_0[] = { /* SSH Communications Security IPSEC Express version 2.1.0 */
1943 0x28, 0x36, 0xD1, 0xFD, 0x28, 0x07, 0xBC, 0x9E,
1944 0x5A, 0xE3, 0x07, 0x86, 0x32, 0x04, 0x51, 0xEC
1945 };
1946
1947 static const guint8 VID_SSH_IPSEC_EXPRESS_2_1_1[] = { /* SSH Communications Security IPSEC Express version 2.1.1 */
1948 0xA6, 0x8D, 0xE7, 0x56, 0xA9, 0xC5, 0x22, 0x9B,
1949 0xAE, 0x66, 0x49, 0x80, 0x40, 0x95, 0x1A, 0xD5
1950 };
1951
1952 static const guint8 VID_SSH_IPSEC_EXPRESS_2_1_2[] = { /* SSH Communications Security IPSEC Express version 2.1.2 */
1953 0x3F, 0x23, 0x72, 0x86, 0x7E, 0x23, 0x7C, 0x1C,
1954 0xD8, 0x25, 0x0A, 0x75, 0x55, 0x9C, 0xAE, 0x20
1955 };
1956
1957 static const guint8 VID_SSH_IPSEC_EXPRESS_3_0_0[] = { /* SSH Communications Security IPSEC Express version 3.0.0 */
1958 0x0E, 0x58, 0xD5, 0x77, 0x4D, 0xF6, 0x02, 0x00,
1959 0x7D, 0x0B, 0x02, 0x44, 0x36, 0x60, 0xF7, 0xEB
1960 };
1961
1962 static const guint8 VID_SSH_IPSEC_EXPRESS_3_0_1[] = { /* SSH Communications Security IPSEC Express version 3.0.1 */
1963 0xF5, 0xCE, 0x31, 0xEB, 0xC2, 0x10, 0xF4, 0x43,
1964 0x50, 0xCF, 0x71, 0x26, 0x5B, 0x57, 0x38, 0x0F
1965 };
1966
1967 static const guint8 VID_SSH_IPSEC_EXPRESS_4_0_0[] = { /* SSH Communications Security IPSEC Express version 4.0.0 */
1968 0xF6, 0x42, 0x60, 0xAF, 0x2E, 0x27, 0x42, 0xDA,
1969 0xDD, 0xD5, 0x69, 0x87, 0x06, 0x8A, 0x99, 0xA0
1970 };
1971
1972 static const guint8 VID_SSH_IPSEC_EXPRESS_4_0_1[] = { /* SSH Communications Security IPSEC Express version 4.0.1 */
1973 0x7A, 0x54, 0xD3, 0xBD, 0xB3, 0xB1, 0xE6, 0xD9,
1974 0x23, 0x89, 0x20, 0x64, 0xBE, 0x2D, 0x98, 0x1C
1975 };
1976
1977 static const guint8 VID_SSH_IPSEC_EXPRESS_4_1_0[] = { /* SSH Communications Security IPSEC Express version 4.1.0 */
1978 0x9A, 0xA1, 0xF3, 0xB4, 0x34, 0x72, 0xA4, 0x5D,
1979 0x5F, 0x50, 0x6A, 0xEB, 0x26, 0x0C, 0xF2, 0x14
1980 };
1981
1982 static const guint8 VID_SSH_IPSEC_EXPRESS_4_1_1[] = { /* SSH Communications Security IPSEC Express version 4.1.1 */
1983 0x89, 0xF7, 0xB7, 0x60, 0xD8, 0x6B, 0x01, 0x2A,
1984 0xCF, 0x26, 0x33, 0x82, 0x39, 0x4D, 0x96, 0x2F
1985 };
1986
1987 static const guint8 VID_SSH_IPSEC_EXPRESS_4_2_0[] = { /* SSH Communications Security IPSEC Express version 4.2.0 */
1988 0x68, 0x80, 0xC7, 0xD0, 0x26, 0x09, 0x91, 0x14,
1989 0xE4, 0x86, 0xC5, 0x54, 0x30, 0xE7, 0xAB, 0xEE
1990 };
1991
1992 static const guint8 VID_SSH_IPSEC_EXPRESS_5_0[] = { /* SSH Communications Security IPSEC Express version 5.0 */
1993 0xB0, 0x37, 0xA2, 0x1A, 0xCE, 0xCC, 0xB5, 0x57,
1994 0x0F, 0x60, 0x25, 0x46, 0xF9, 0x7B, 0xDE, 0x8C
1995 };
1996
1997 static const guint8 VID_SSH_IPSEC_EXPRESS_5_0_0[] = { /* SSH Communications Security IPSEC Express version 5.0.0 */
1998 0x2B, 0x2D, 0xAD, 0x97, 0xC4, 0xD1, 0x40, 0x93,
1999 0x00, 0x53, 0x28, 0x7F, 0x99, 0x68, 0x50, 0xB0
2000 };
2001
2002 static const guint8 VID_SSH_IPSEC_EXPRESS_5_1_0[] = { /* SSH Communications Security IPSEC Express version 5.1.0 */
2003 0x45, 0xE1, 0x7F, 0x3A, 0xBE, 0x93, 0x94, 0x4C,
2004 0xB2, 0x02, 0x91, 0x0C, 0x59, 0xEF, 0x80, 0x6B
2005 };
2006
2007 static const guint8 VID_SSH_IPSEC_EXPRESS_5_1_1[] = { /* SSH Communications Security IPSEC Express version 5.1.1 */
2008 0x59, 0x25, 0x85, 0x9F, 0x73, 0x77, 0xED, 0x78,
2009 0x16, 0xD2, 0xFB, 0x81, 0xC0, 0x1F, 0xA5, 0x51
2010 };
2011
2012 static const guint8 VID_SSH_SENTINEL[] = { /* SSH Sentinel */
2013 0x05, 0x41, 0x82, 0xA0, 0x7C, 0x7A, 0xE2, 0x06,
2014 0xF9, 0xD2, 0xCF, 0x9D, 0x24, 0x32, 0xC4, 0x82
2015 };
2016
2017 static const guint8 VID_SSH_SENTINEL_1_1[] = { /* SSH Sentinel 1.1 */
2018 0xB9, 0x16, 0x23, 0xE6, 0x93, 0xCA, 0x18, 0xA5,
2019 0x4C, 0x6A, 0x27, 0x78, 0x55, 0x23, 0x05, 0xE8
2020 };
2021
2022 static const guint8 VID_SSH_SENTINEL_1_2[] = { /* SSH Sentinel 1.2 */
2023 0x54, 0x30, 0x88, 0x8D, 0xE0, 0x1A, 0x31, 0xA6,
2024 0xFA, 0x8F, 0x60, 0x22, 0x4E, 0x44, 0x99, 0x58
2025 };
2026
2027 static const guint8 VID_SSH_SENTINEL_1_3[] = { /* SSH Sentinel 1.3 */
2028 0x7E, 0xE5, 0xCB, 0x85, 0xF7, 0x1C, 0xE2, 0x59,
2029 0xC9, 0x4A, 0x5C, 0x73, 0x1E, 0xE4, 0xE7, 0x52
2030 };
2031
2032 static const guint8 VID_SSH_SENTINEL_1_4[] = { /* SSH Sentinel 1.4 */
2033 0x63, 0xD9, 0xA1, 0xA7, 0x00, 0x94, 0x91, 0xB5,
2034 0xA0, 0xA6, 0xFD, 0xEB, 0x2A, 0x82, 0x84, 0xF0
2035 };
2036
2037 static const guint8 VID_SSH_SENTINEL_1_4_1[] = { /* SSH Sentinel 1.4.1 */
2038 0xEB, 0x4B, 0x0D, 0x96, 0x27, 0x6B, 0x4E, 0x22,
2039 0x0A, 0xD1, 0x62, 0x21, 0xA7, 0xB2, 0xA5, 0xE6
2040 };
2041
2042 static const guint8 VID_SSH_QUICKSEC_0_9_0[] = { /* SSH Communications Security QuickSec 0.9.0 */
2043 0x37, 0xEB, 0xA0, 0xC4, 0x13, 0x61, 0x84, 0xE7,
2044 0xDA, 0xF8, 0x56, 0x2A, 0x77, 0x06, 0x0B, 0x4A
2045 };
2046
2047 static const guint8 VID_SSH_QUICKSEC_1_1_0[] = { /* SSH Communications Security QuickSec 1.1.0 */
2048 0x5D, 0x72, 0x92, 0x5E, 0x55, 0x94, 0x8A, 0x96,
2049 0x61, 0xA7, 0xFC, 0x48, 0xFD, 0xEC, 0x7F, 0xF9
2050 };
2051
2052 static const guint8 VID_SSH_QUICKSEC_1_1_1[] = { /* SSH Communications Security QuickSec 1.1.1 */
2053 0x77, 0x7F, 0xBF, 0x4C, 0x5A, 0xF6, 0xD1, 0xCD,
2054 0xD4, 0xB8, 0x95, 0xA0, 0x5B, 0xF8, 0x25, 0x94
2055 };
2056
2057 static const guint8 VID_SSH_QUICKSEC_1_1_2[] = { /* SSH Communications Security QuickSec 1.1.2 */
2058 0x2C, 0xDF, 0x08, 0xE7, 0x12, 0xED, 0xE8, 0xA5,
2059 0x97, 0x87, 0x61, 0x26, 0x7C, 0xD1, 0x9B, 0x91
2060 };
2061
2062 static const guint8 VID_SSH_QUICKSEC_1_1_3[] = { /* SSH Communications Security QuickSec 1.1.3 */
2063 0x59, 0xE4, 0x54, 0xA8, 0xC2, 0xCF, 0x02, 0xA3,
2064 0x49, 0x59, 0x12, 0x1F, 0x18, 0x90, 0xBC, 0x87
2065 };
2066
2067 static const guint8 VID_draft_huttunen_ipsec_esp_in_udp_00[] = { /* draft-huttunen-ipsec-esp-in-udp-00.txt */
2068 0x6A, 0x74, 0x34, 0xC1, 0x9D, 0x7E, 0x36, 0x34,
2069 0x80, 0x90, 0xA0, 0x23, 0x34, 0xC9, 0xC8, 0x05
2070 };
2071
2072 static const guint8 VID_draft_huttunen_ipsec_esp_in_udp_01[] = { /* draft-huttunen-ipsec-esp-in-udp-01.txt */
2073 0x50, 0x76, 0x0F, 0x62, 0x4C, 0x63, 0xE5, 0xC5,
2074 0x3E, 0xEA, 0x38, 0x6C, 0x68, 0x5C, 0xA0, 0x83
2075 };
2076
2077 static const guint8 VID_draft_stenberg_ipsec_nat_traversal_01[] = { /* draft-stenberg-ipsec-nat-traversal-01 */
2078 0x27, 0xBA, 0xB5, 0xDC, 0x01, 0xEA, 0x07, 0x60,
2079 0xEA, 0x4E, 0x31, 0x90, 0xAC, 0x27, 0xC0, 0xD0
2080 };
2081
2082 static const guint8 VID_draft_stenberg_ipsec_nat_traversal_02[]= { /* draft-stenberg-ipsec-nat-traversal-02 */
2083 0x61, 0x05, 0xC4, 0x22, 0xE7, 0x68, 0x47, 0xE4,
2084 0x3F, 0x96, 0x84, 0x80, 0x12, 0x92, 0xAE, 0xCD
2085 };
2086
2087 static const guint8 VID_draft_ietf_ipsec_nat_t_ike[]= { /* draft-ietf-ipsec-nat-t-ike */
2088 0x4D, 0xF3, 0x79, 0x28, 0xE9, 0xFC, 0x4F, 0xD1,
2089 0xB3, 0x26, 0x21, 0x70, 0xD5, 0x15, 0xC6, 0x62
2090 };
2091
2092 static const guint8 VID_draft_ietf_ipsec_nat_t_ike_00[]= { /* draft-ietf-ipsec-nat-t-ike-00 */
2093 0x44, 0x85, 0x15, 0x2D, 0x18, 0xB6, 0xBB, 0xCD,
2094 0x0B, 0xE8, 0xA8, 0x46, 0x95, 0x79, 0xDD, 0xCC
2095 };
2096
2097 static const guint8 VID_draft_ietf_ipsec_nat_t_ike_01[]= { /* "draft-ietf-ipsec-nat-t-ike-01" */
2098 0x16, 0xF6, 0xCA, 0x16, 0xE4, 0xA4, 0x06, 0x6D,
2099 0x83, 0x82, 0x1A, 0x0F, 0x0A, 0xEA, 0xA8, 0x62
2100 };
2101
2102 static const guint8 VID_draft_ietf_ipsec_nat_t_ike_02[]= { /* draft-ietf-ipsec-nat-t-ike-02 */
2103 0xCD, 0x60, 0x46, 0x43, 0x35, 0xDF, 0x21, 0xF8,
2104 0x7C, 0xFD, 0xB2, 0xFC, 0x68, 0xB6, 0xA4, 0x48
2105 };
2106
2107 static const guint8 VID_draft_ietf_ipsec_nat_t_ike_02n[]= { /* draft-ietf-ipsec-nat-t-ike-02\n */
2108 0x90, 0xCB, 0x80, 0x91, 0x3E, 0xBB, 0x69, 0x6E,
2109 0x08, 0x63, 0x81, 0xB5, 0xEC, 0x42, 0x7B, 0x1F
2110 };
2111
2112 static const guint8 VID_draft_ietf_ipsec_nat_t_ike_03[] = { /* draft-ietf-ipsec-nat-t-ike-03 */
2113 0x7D, 0x94, 0x19, 0xA6, 0x53, 0x10, 0xCA, 0x6F,
2114 0x2C, 0x17, 0x9D, 0x92, 0x15, 0x52, 0x9d, 0x56
2115 };
2116
2117 static const guint8 VID_draft_ietf_ipsec_nat_t_ike_04[] = { /* draft-ietf-ipsec-nat-t-ike-04 */
2118 0x99, 0x09, 0xb6, 0x4e, 0xed, 0x93, 0x7c, 0x65,
2119 0x73, 0xde, 0x52, 0xac, 0xe9, 0x52, 0xfa, 0x6b
2120 };
2121 static const guint8 VID_draft_ietf_ipsec_nat_t_ike_05[] = { /* draft-ietf-ipsec-nat-t-ike-05 */
2122 0x80, 0xd0, 0xbb, 0x3d, 0xef, 0x54, 0x56, 0x5e,
2123 0xe8, 0x46, 0x45, 0xd4, 0xc8, 0x5c, 0xe3, 0xee
2124 };
2125 static const guint8 VID_draft_ietf_ipsec_nat_t_ike_06[] = { /* draft-ietf-ipsec-nat-t-ike-06 */
2126 0x4d, 0x1e, 0x0e, 0x13, 0x6d, 0xea, 0xfa, 0x34,
2127 0xc4, 0xf3, 0xea, 0x9f, 0x02, 0xec, 0x72, 0x85
2128 };
2129 static const guint8 VID_draft_ietf_ipsec_nat_t_ike_07[] = { /* draft-ietf-ipsec-nat-t-ike-07 */
2130 0x43, 0x9b, 0x59, 0xf8, 0xba, 0x67, 0x6c, 0x4c,
2131 0x77, 0x37, 0xae, 0x22, 0xea, 0xb8, 0xf5, 0x82
2132 };
2133 static const guint8 VID_draft_ietf_ipsec_nat_t_ike_08[] = { /* draft-ietf-ipsec-nat-t-ike-08 */
2134 0x8f, 0x8d, 0x83, 0x82, 0x6d, 0x24, 0x6b, 0x6f,
2135 0xc7, 0xa8, 0xa6, 0xa4, 0x28, 0xc1, 0x1d, 0xe8
2136 };
2137 static const guint8 VID_draft_ietf_ipsec_nat_t_ike_09[] = { /* draft-ietf-ipsec-nat-t-ike-09 */
2138 0x42, 0xea, 0x5b, 0x6f, 0x89, 0x8d, 0x97, 0x73,
2139 0xa5, 0x75, 0xdf, 0x26, 0xe7, 0xdd, 0x19, 0xe1
2140 };
2141 static const guint8 VID_testing_nat_t_rfc[] = { /* Testing NAT-T RFC */
2142 0xc4, 0x0f, 0xee, 0x00, 0xd5, 0xd3, 0x9d, 0xdb,
2143 0x1f, 0xc7, 0x62, 0xe0, 0x9b, 0x7c, 0xfe, 0xa7
2144 };
2145
2146 static const guint8 VID_rfc3947_nat_t[] = { /* RFC 3947 Negotiation of NAT-Traversal in the IKE */
2147 0x4a, 0x13, 0x1c, 0x81, 0x07, 0x03, 0x58, 0x45,
2148 0x5c, 0x57, 0x28, 0xf2, 0x0e, 0x95, 0x45, 0x2f
2149 };
2150 static const guint8 VID_draft_beaulieu_ike_xauth_02[]= { /* draft-beaulieu-ike-xauth-02.txt 02 or 06 ??*/
2151 0x09, 0x00, 0x26, 0x89, 0xDF, 0xD6, 0xB7, 0x12,
2152 0x80, 0xA2, 0x24, 0xDE, 0xC3, 0x3B, 0x81, 0xE5
2153 };
2154
2155 static const guint8 VID_xauth[]= { /* XAUTH (truncated MD5 hash of "draft-ietf-ipsra-isakmp-xauth-06.txt") */
2156 0x09, 0x00, 0x26, 0x89, 0xDF, 0xD6, 0xB7, 0x12
2157 };
2158
2159 static const guint8 VID_rfc3706_dpd[]= { /* RFC 3706 */
2160 0xAF, 0xCA, 0xD7, 0x13, 0x68, 0xA1, 0xF1, 0xC9,
2161 0x6B, 0x86, 0x96, 0xFC, 0x77, 0x57, 0x01, 0x00
2162 };
2163 static const guint8 VID_draft_ietf_ipsec_antireplay_00[]= { /* draft-ietf-ipsec-antireplay-00.txt */
2164 0x32, 0x5D, 0xF2, 0x9A, 0x23, 0x19, 0xF2, 0xDD
2165 };
2166
2167 static const guint8 VID_draft_ietf_ipsec_heartbeats_00[]= { /* draft-ietf-ipsec-heartbeats-00.txt */
2168 0x8D, 0xB7, 0xA4, 0x18, 0x11, 0x22, 0x16, 0x60
2169 };
2170 static const guint8 VID_IKE_CHALLENGE_RESPONSE_1[]= { /* IKE Challenge/Response for Authenticated Cryptographic Keys */
2171 0xBA, 0x29, 0x04, 0x99, 0xC2, 0x4E, 0x84, 0xE5,
2172 0x3A, 0x1D, 0x83, 0xA0, 0x5E, 0x5F, 0x00, 0xC9
2173 };
2174
2175 static const guint8 VID_IKE_CHALLENGE_RESPONSE_2[]= { /* IKE Challenge/Response for Authenticated Cryptographic Keys */
2176 0x0D, 0x33, 0x61, 0x1A, 0x5D, 0x52, 0x1B, 0x5E,
2177 0x3C, 0x9C, 0x03, 0xD2, 0xFC, 0x10, 0x7E, 0x12
2178 };
2179
2180 static const guint8 VID_IKE_CHALLENGE_RESPONSE_REV_1[]= { /* IKE Challenge/Response for Authenticated Cryptographic Keys (Revised) */
2181
2182 0xAD, 0x32, 0x51, 0x04, 0x2C, 0xDC, 0x46, 0x52,
2183 0xC9, 0xE0, 0x73, 0x4C, 0xE5, 0xDE, 0x4C, 0x7D
2184 };
2185
2186 static const guint8 VID_IKE_CHALLENGE_RESPONSE_REV_2[]= { /* IKE Challenge/Response for Authenticated Cryptographic Keys (Revised) */
2187 0x01, 0x3F, 0x11, 0x82, 0x3F, 0x96, 0x6F, 0xA9,
2188 0x19, 0x00, 0xF0, 0x24, 0xBA, 0x66, 0xA8, 0x6B
2189 };
2190
2191 static const guint8 VID_MS_L2TP_IPSEC_VPN_CLIENT[]= { /* Microsoft L2TP/IPSec VPN Client */
2192 0x40, 0x48, 0xB7, 0xD5, 0x6E, 0xBC, 0xE8, 0x85,
2193 0x25, 0xE7, 0xDE, 0x7F, 0x00, 0xD6, 0xC2, 0xD3
2194 };
2195
2196 static const guint8 VID_MS_VID_INITIAL_CONTACT[]= { /* Microsoft Vid-Initial-Contact */
2197 0x26, 0x24, 0x4d, 0x38, 0xed, 0xdb, 0x61, 0xb3,
2198 0x17, 0x2a, 0x36, 0xe3, 0xd0, 0xcf, 0xb8, 0x19
2199 };
2200
2201 static const guint8 VID_GSS_API_1[]= { /* A GSS-API Authentication Method for IKE */
2202 0xB4, 0x6D, 0x89, 0x14, 0xF3, 0xAA, 0xA3, 0xF2,
2203 0xFE, 0xDE, 0xB7, 0xC7, 0xDB, 0x29, 0x43, 0xCA
2204 };
2205
2206 static const guint8 VID_GSS_API_2[]= { /* A GSS-API Authentication Method for IKE */
2207 0xAD, 0x2C, 0x0D, 0xD0, 0xB9, 0xC3, 0x20, 0x83,
2208 0xCC, 0xBA, 0x25, 0xB8, 0x86, 0x1E, 0xC4, 0x55
2209 };
2210
2211 static const guint8 VID_GSSAPI[]= { /* GSSAPI */
2212 0x62, 0x1B, 0x04, 0xBB, 0x09, 0x88, 0x2A, 0xC1,
2213 0xE1, 0x59, 0x35, 0xFE, 0xFA, 0x24, 0xAE, 0xEE
2214 };
2215
2216 static const guint8 VID_MS_NT5_ISAKMPOAKLEY[]= { /* MS NT5 ISAKMPOAKLEY */
2217 0x1E, 0x2B, 0x51, 0x69, 0x05, 0x99, 0x1C, 0x7D,
2218 0x7C, 0x96, 0xFC, 0xBF, 0xB5, 0x87, 0xE4, 0x61
2219 };
2220
2221 static const guint8 VID_CISCO_UNITY[]= { /* CISCO-UNITY */
2222 0x12, 0xF5, 0xF2, 0x8C, 0x45, 0x71, 0x68, 0xA9,
2223 0x70, 0x2D, 0x9F, 0xE2, 0x74, 0xCC
2224 };
2225
2226
2227 static const guint8 VID_CISCO_CONCENTRATOR[]= { /* CISCO-CONCENTRATOR */
2228 0x1F, 0x07, 0xF7, 0x0E, 0xAA, 0x65, 0x14, 0xD3,
2229 0xB0, 0xFA, 0x96, 0x54, 0x2A, 0x50, 0x01, 0x00
2230 };
2231 static const guint8 VID_CISCO_FRAG[] = { /* Cisco Fragmentation */
2232 0x40, 0x48, 0xB7, 0xD5, 0x6E, 0xBC, 0xE8, 0x85,
2233 0x25, 0xE7, 0xDE, 0x7F, 0x00, 0xD6, 0xC2, 0xD3,
2234 0x80, 0x00, 0x00, 0x00
2235 };
2236
2237 static const guint8 VID_CP_01_R65[] = { /* CryptoPro/GOST 0.1 / Check Point R65 */
2238 0xF4, 0xED, 0x19, 0xE0, 0xC1, 0x14, 0xEB, 0x51,
2239 0x6F, 0xAA, 0xAC, 0x0E, 0xE3, 0x7D, 0xAF, 0x28,
2240 0x7, 0xB4, 0x38, 0x1F
2241 };
2242
2243 static const guint8 VID_CP_10_R71[] = { /* CryptoPro/GOST 1.0 / Check Point R71 */
2244 0x03, 0x10, 0x17, 0xE0, 0x7F, 0x7A, 0x82, 0xE3,
2245 0xAA, 0x69, 0x50, 0xC9, 0x99, 0x99, 0x01, 0x00
2246 };
2247
2248 static const guint8 VID_CP_11[] = { /* CryptoPro/GOST 1.1 */
2249 0x03, 0x10, 0x17, 0xE0, 0x7F, 0x7A, 0x82, 0xE3,
2250 0xAA, 0x69, 0x50, 0xC9, 0x99, 0x99, 0x01, 0x01
2251 };
2252
2253 static const guint8 VID_CYBERGUARD[] = { /* CyberGuard */
2254 0x9A, 0xA1, 0xF3, 0xB4, 0x34, 0x72, 0xA4, 0x5D,
2255 0x5F, 0x50, 0x6A, 0xEB, 0x26, 0xC0, 0xF2, 0x14
2256 };
2257
2258 static const guint8 VID_SHREWSOFT[] = { /* Shrew Soft */
2259 0xf1, 0x4b, 0x94, 0xb7, 0xbf, 0xf1, 0xfe, 0xf0,
2260 0x27, 0x73, 0xb8, 0xc4, 0x9f, 0xed, 0xed, 0x26
2261 };
2262 static const guint8 VID_STRONGSWAN[] = { /* strongSwan */
2263 0x88, 0x2f, 0xe5, 0x6d, 0x6f, 0xd2, 0x0d, 0xbc,
2264 0x22, 0x51, 0x61, 0x3b, 0x2e, 0xbe, 0x5b, 0xeb
2265 };
2266 static const guint8 VID_KAME_RACOON[] = { /* KAME/racoon */
2267 0x70, 0x03, 0xcb, 0xc1, 0x09, 0x7d, 0xbe, 0x9c,
2268 0x26, 0x00, 0xba, 0x69, 0x83, 0xbc, 0x8b, 0x35
2269 };
2270
2271 static const guint8 VID_IPSEC_TOOLS[] = { /* IPsec-Tools */
2272 0x20, 0xa3, 0x62, 0x2c, 0x1c, 0xea, 0x7c, 0xe3,
2273 0x7b, 0xee, 0x3c, 0xa4, 0x84, 0x42, 0x52, 0x76
2274 };
2275
2276 static const guint8 VID_NETSCREEN_1[] = { /* Netscreen-1 */
2277 0x29, 0x9e, 0xe8, 0x28, 0x9f, 0x40, 0xa8, 0x97,
2278 0x3b, 0xc7, 0x86, 0x87, 0xe2, 0xe7, 0x22, 0x6b,
2279 0x53, 0x2c, 0x3b, 0x76
2280 };
2281
2282 static const guint8 VID_NETSCREEN_2[] = { /* Netscreen-2 */
2283 0x3a, 0x15, 0xe1, 0xf3, 0xcf, 0x2a, 0x63, 0x58,
2284 0x2e, 0x3a, 0xc8, 0x2d, 0x1c, 0x64, 0xcb, 0xe3,
2285 0xb6, 0xd7, 0x79, 0xe7
2286 };
2287
2288 static const guint8 VID_NETSCREEN_3[] = { /* Netscreen-3 */
2289 0x47, 0xd2, 0xb1, 0x26, 0xbf, 0xcd, 0x83, 0x48,
2290 0x97, 0x60, 0xe2, 0xcf, 0x8c, 0x5d, 0x4d, 0x5a,
2291 0x03, 0x49, 0x7c, 0x15
2292 };
2293
2294 static const guint8 VID_NETSCREEN_4[] = { /* Netscreen-4 */
2295 0x4a, 0x43, 0x40, 0xb5, 0x43, 0xe0, 0x2b, 0x84,
2296 0xc8, 0x8a, 0x8b, 0x96, 0xa8, 0xaf, 0x9e, 0xbe,
2297 0x77, 0xd9, 0xac, 0xcc
2298 };
2299
2300 static const guint8 VID_NETSCREEN_5[] = { /* Netscreen-5 */
2301 0x64, 0x40, 0x5f, 0x46, 0xf0, 0x3b, 0x76, 0x60,
2302 0xa2, 0x3b, 0xe1, 0x16, 0xa1, 0x97, 0x50, 0x58,
2303 0xe6, 0x9e, 0x83, 0x87
2304 };
2305
2306 static const guint8 VID_NETSCREEN_6[] = { /* Netscreen-6 */
2307 0x69, 0x93, 0x69, 0x22, 0x87, 0x41, 0xc6, 0xd4,
2308 0xca, 0x09, 0x4c, 0x93, 0xe2, 0x42, 0xc9, 0xde,
2309 0x19, 0xe7, 0xb7, 0xc6
2310 };
2311
2312 static const guint8 VID_NETSCREEN_7[] = { /* Netscreen-7 */
2313 0x8c, 0x0d, 0xc6, 0xcf, 0x62, 0xa0, 0xef, 0x1b,
2314 0x5c, 0x6e, 0xab, 0xd1, 0xb6, 0x7b, 0xa6, 0x98,
2315 0x66, 0xad, 0xf1, 0x6a
2316 };
2317
2318 static const guint8 VID_NETSCREEN_8[] = { /* Netscreen-8 */
2319 0x92, 0xd2, 0x7a, 0x9e, 0xcb, 0x31, 0xd9, 0x92,
2320 0x46, 0x98, 0x6d, 0x34, 0x53, 0xd0, 0xc3, 0xd5,
2321 0x7a, 0x22, 0x2a, 0x61
2322 };
2323
2324 static const guint8 VID_NETSCREEN_9[] = { /* Netscreen-9 */
2325 0x9b, 0x09, 0x6d, 0x9a, 0xc3, 0x27, 0x5a, 0x7d,
2326 0x6f, 0xe8, 0xb9, 0x1c, 0x58, 0x31, 0x11, 0xb0,
2327 0x9e, 0xfe, 0xd1, 0xa0
2328 };
2329
2330 static const guint8 VID_NETSCREEN_10[] = { /* Netscreen-10 */
2331 0xbf, 0x03, 0x74, 0x61, 0x08, 0xd7, 0x46, 0xc9,
2332 0x04, 0xf1, 0xf3, 0x54, 0x7d, 0xe2, 0x4f, 0x78,
2333 0x47, 0x9f, 0xed, 0x12
2334 };
2335
2336 static const guint8 VID_NETSCREEN_11[] = { /* Netscreen-11 */
2337 0xc2, 0xe8, 0x05, 0x00, 0xf4, 0xcc, 0x5f, 0xbf,
2338 0x5d, 0xaa, 0xee, 0xd3, 0xbb, 0x59, 0xab, 0xae,
2339 0xee, 0x56, 0xc6, 0x52
2340 };
2341
2342 static const guint8 VID_NETSCREEN_12[] = { /* Netscreen-12 */
2343 0xc8, 0x66, 0x0a, 0x62, 0xb0, 0x3b, 0x1b, 0x61,
2344 0x30, 0xbf, 0x78, 0x16, 0x08, 0xd3, 0x2a, 0x6a,
2345 0x8d, 0x0f, 0xb8, 0x9f
2346 };
2347
2348 static const guint8 VID_NETSCREEN_13[] = { /* Netscreen-13 */
2349 0xf8, 0x85, 0xda, 0x40, 0xb1, 0xe7, 0xa9, 0xab,
2350 0xd1, 0x76, 0x55, 0xec, 0x5b, 0xbe, 0xc0, 0xf2,
2351 0x1f, 0x0e, 0xd5, 0x2e
2352 };
2353
2354 static const guint8 VID_NETSCREEN_14[] = { /* Netscreen-14 */
2355 0x2a, 0x2b, 0xca, 0xc1, 0x9b, 0x8e, 0x91, 0xb4,
2356 0x26, 0x10, 0x78, 0x07, 0xe0, 0x2e, 0x72, 0x49,
2357 0x56, 0x9d, 0x6f, 0xd3
2358 };
2359 static const guint8 VID_NETSCREEN_15[] = { /* Netscreen-15 */
2360 0x16, 0x6f, 0x93, 0x2d, 0x55, 0xeb, 0x64, 0xd8,
2361 0xe4, 0xdf, 0x4f, 0xd3, 0x7e, 0x23, 0x13, 0xf0,
2362 0xd0, 0xfd, 0x84, 0x51
2363 };
2364
2365 static const guint8 VID_NETSCREEN_16[] = { /* Netscreen-16 */
2366 0xa3, 0x5b, 0xfd, 0x05, 0xca, 0x1a, 0xc0, 0xb3,
2367 0xd2, 0xf2, 0x4e, 0x9e, 0x82, 0xbf, 0xcb, 0xff,
2368 0x9c, 0x9e, 0x52, 0xb5
2369 };
2370
2371 static const guint8 VID_ZYWALL[] = { /* ZYWALL */
2372 0x62, 0x50, 0x27, 0x74, 0x9d, 0x5a, 0xb9, 0x7f,
2373 0x56, 0x16, 0xc1, 0x60, 0x27, 0x65, 0xcf, 0x48,
2374 0x0a, 0x3b, 0x7d, 0x0b
2375 };
2376
2377 static const guint8 VID_SIDEWINDER[] = { /* SIDEWINDER */
2378 0x84, 0x04, 0xad, 0xf9, 0xcd, 0xa0, 0x57, 0x60,
2379 0xb2, 0xca, 0x29, 0x2e, 0x4b, 0xff, 0x53, 0x7b
2380 };
2381
2382 static const guint8 VID_SONICWALL[] = { /* SonicWALL */
2383 0x40, 0x4B, 0xF4, 0x39, 0x52, 0x2C, 0xA3, 0xF6
2384 };
2385
2386 static const guint8 VID_HEARTBEAT_NOTIFY[] = { /* Heartbeat Notify */
2387 0x48 ,0x65, 0x61, 0x72, 0x74, 0x42, 0x65, 0x61,
2388 0x74, 0x5f, 0x4e, 0x6f, 0x74, 0x69, 0x66, 0x79
2389 };
2390
2391 static const guint8 VID_DWR[] = { /* DWR: Delete with reason */
2392 0x2D, 0x79, 0x22, 0xC6, 0xB3, 0x01, 0xD9, 0xB0,
2393 0xE1, 0x34, 0x27, 0x39, 0xE9, 0xCF, 0xBB, 0xD5
2394 };
2395
2396 static const guint8 VID_ARUBA_RAP[] = { /* Remote AP (Aruba Networks) */
2397 0xca, 0x3e, 0x2b, 0x85, 0x4b, 0xa8, 0x03, 0x00,
2398 0x17, 0xdc, 0x10, 0x23, 0xa4, 0xfd, 0xe2, 0x04,
2399 0x1f, 0x9f, 0x74, 0x63
2400 };
2401
2402 static const guint8 VID_ARUBA_CONTROLLER[] = { /* Controller (Aruba Networks) */
2403 0x3c, 0x8e, 0x70, 0xbd, 0xf9, 0xc7, 0xd7, 0x4a,
2404 0xdd, 0x53, 0xe4, 0x10, 0x09, 0x15, 0xdc, 0x2e,
2405 0x4b, 0xb5, 0x12, 0x74
2406 };
2407
2408 static const guint8 VID_ARUBA_VIA_CLIENT[] = { /* VIA Client (Aruba Networks) */
2409 0x88, 0xf0, 0xe3, 0x14, 0x9b, 0x3f, 0xa4, 0x8b,
2410 0x05, 0xaa, 0x7f, 0x68, 0x5f, 0x0b, 0x76, 0x6b,
2411 0xe1, 0x86, 0xcc, 0xb8
2412 };
2413
2414 static const guint8 VID_ARUBA_VIA_AUTH_PROFILE[] = { /* VIA Auth Profile (Aruba Networks) */
2415 0x56, 0x49, 0x41, 0x20, 0x41, 0x75, 0x74, 0x68,
2416 0x20, 0x50, 0x72, 0x6f, 0x66, 0x69, 0x6c, 0x65,
2417 0x20, 0x3a, 0x20
2418 };
2419
2420 /*
2421 * MS-IKEE Internet Key Exchange Protocol Extensions (v20080212).pdf
2422 * Windows Vista and Windows Server 2008
2423 */
2424 static const guint8 VID_MS_IKEE_20080212_CGA1[] = { /* IKE CGA Version 1 */
2425 0xe3, 0xa5, 0x96, 0x6a, 0x76, 0x37, 0x9f, 0xe7,
2426 0x07, 0x22, 0x82, 0x31, 0xe5, 0xce, 0x86, 0x52
2427 };
2428
2429 static const guint8 VID_MS_IKEE_20080212_MS_NDC[] = { /* MS-Negotiation Discovery Capable */
2430 0xfb, 0x1d, 0xe3, 0xcd, 0xf3, 0x41, 0xb7, 0xea,
2431 0x16, 0xb7, 0xe5, 0xbe, 0x08, 0x55, 0xf1, 0x20
2432 };
2433
2434 /* Based from value_string.c/h */
2435 static const byte_string vendor_id[] = {
2436 { VID_SSH_IPSEC_EXPRESS_1_1_0, sizeof(VID_SSH_IPSEC_EXPRESS_1_1_0), "Ssh Communications Security IPSEC Express version 1.1.0" },
2437 { VID_SSH_IPSEC_EXPRESS_1_1_1, sizeof(VID_SSH_IPSEC_EXPRESS_1_1_1), "Ssh Communications Security IPSEC Express version 1.1.1" },
2438 { VID_SSH_IPSEC_EXPRESS_1_1_2, sizeof(VID_SSH_IPSEC_EXPRESS_1_1_2), "Ssh Communications Security IPSEC Express version 1.1.2" },
2439 { VID_SSH_IPSEC_EXPRESS_1_2_1, sizeof(VID_SSH_IPSEC_EXPRESS_1_2_1), "Ssh Communications Security IPSEC Express version 1.2.1" },
2440 { VID_SSH_IPSEC_EXPRESS_1_2_2, sizeof(VID_SSH_IPSEC_EXPRESS_1_2_2), "Ssh Communications Security IPSEC Express version 1.2.2" },
2441 { VID_SSH_IPSEC_EXPRESS_2_0_0, sizeof(VID_SSH_IPSEC_EXPRESS_2_0_0), "SSH Communications Security IPSEC Express version 2.0.0" },
2442 { VID_SSH_IPSEC_EXPRESS_2_1_0, sizeof(VID_SSH_IPSEC_EXPRESS_2_1_0), "SSH Communications Security IPSEC Express version 2.1.0" },
2443 { VID_SSH_IPSEC_EXPRESS_2_1_1, sizeof(VID_SSH_IPSEC_EXPRESS_2_1_1), "SSH Communications Security IPSEC Express version 2.1.1" },
2444 { VID_SSH_IPSEC_EXPRESS_2_1_2, sizeof(VID_SSH_IPSEC_EXPRESS_2_1_2), "SSH Communications Security IPSEC Express version 2.1.2" },
2445 { VID_SSH_IPSEC_EXPRESS_3_0_0, sizeof(VID_SSH_IPSEC_EXPRESS_3_0_0), "SSH Communications Security IPSEC Express version 3.0.0" },
2446 { VID_SSH_IPSEC_EXPRESS_3_0_1, sizeof(VID_SSH_IPSEC_EXPRESS_3_0_1), "SSH Communications Security IPSEC Express version 3.0.1" },
2447 { VID_SSH_IPSEC_EXPRESS_4_0_0, sizeof(VID_SSH_IPSEC_EXPRESS_4_0_0), "SSH Communications Security IPSEC Express version 4.0.0" },
2448 { VID_SSH_IPSEC_EXPRESS_4_0_1, sizeof(VID_SSH_IPSEC_EXPRESS_4_0_1), "SSH Communications Security IPSEC Express version 4.0.1" },
2449 { VID_SSH_IPSEC_EXPRESS_4_1_0, sizeof(VID_SSH_IPSEC_EXPRESS_4_1_0), "SSH Communications Security IPSEC Express version 4.1.0" },
2450 { VID_SSH_IPSEC_EXPRESS_4_1_1, sizeof(VID_SSH_IPSEC_EXPRESS_4_1_1), "SSH Communications Security IPSEC Express version 4.1.1" },
2451 { VID_SSH_IPSEC_EXPRESS_4_2_0, sizeof(VID_SSH_IPSEC_EXPRESS_4_2_0), "SSH Communications Security IPSEC Express version 4.2.0" },
2452 { VID_SSH_IPSEC_EXPRESS_5_0, sizeof(VID_SSH_IPSEC_EXPRESS_5_0), "SSH Communications Security IPSEC Express version 5.0" },
2453 { VID_SSH_IPSEC_EXPRESS_5_0_0, sizeof(VID_SSH_IPSEC_EXPRESS_5_0_0), "SSH Communications Security IPSEC Express version 5.0.0" },
2454 { VID_SSH_IPSEC_EXPRESS_5_1_0, sizeof(VID_SSH_IPSEC_EXPRESS_5_1_0), "SSH Communications Security IPSEC Express version 5.1.0" },
2455 { VID_SSH_IPSEC_EXPRESS_5_1_1, sizeof(VID_SSH_IPSEC_EXPRESS_5_1_1), "SSH Communications Security IPSEC Express version 5.1.1" },
2456 { VID_SSH_SENTINEL, sizeof(VID_SSH_SENTINEL), "SSH Sentinel" },
2457 { VID_SSH_SENTINEL_1_1, sizeof(VID_SSH_SENTINEL_1_1), "SSH Sentinel 1.1" },
2458 { VID_SSH_SENTINEL_1_2, sizeof(VID_SSH_SENTINEL_1_2), "SSH Sentinel 1.2" },
2459 { VID_SSH_SENTINEL_1_3, sizeof(VID_SSH_SENTINEL_1_3), "SSH Sentinel 1.3" },
2460 { VID_SSH_SENTINEL_1_4, sizeof(VID_SSH_SENTINEL_1_4), "SSH Sentinel 1.4" },
2461 { VID_SSH_SENTINEL_1_4_1, sizeof(VID_SSH_SENTINEL_1_4_1), "SSH Sentinel 1.4.1" },
2462 { VID_SSH_QUICKSEC_0_9_0, sizeof(VID_SSH_QUICKSEC_0_9_0), "SSH Communications Security QuickSec 0.9.0" },
2463 { VID_SSH_QUICKSEC_1_1_0, sizeof(VID_SSH_QUICKSEC_1_1_0), "SSH Communications Security QuickSec 1.1.0" },
2464 { VID_SSH_QUICKSEC_1_1_1, sizeof(VID_SSH_QUICKSEC_1_1_1), "SSH Communications Security QuickSec 1.1.1" },
2465 { VID_SSH_QUICKSEC_1_1_2, sizeof(VID_SSH_QUICKSEC_1_1_2), "SSH Communications Security QuickSec 1.1.2" },
2466 { VID_SSH_QUICKSEC_1_1_3, sizeof(VID_SSH_QUICKSEC_1_1_3), "SSH Communications Security QuickSec 1.1.3" },
2467 { VID_draft_huttunen_ipsec_esp_in_udp_00, sizeof(VID_draft_huttunen_ipsec_esp_in_udp_00), "draft-huttunen-ipsec-esp-in-udp-00.txt" },
2468 { VID_draft_huttunen_ipsec_esp_in_udp_01, sizeof(VID_draft_huttunen_ipsec_esp_in_udp_01), "draft-huttunen-ipsec-esp-in-udp-01.txt (ESPThruNAT)" },
2469 { VID_draft_stenberg_ipsec_nat_traversal_01, sizeof(VID_draft_stenberg_ipsec_nat_traversal_01), "draft-stenberg-ipsec-nat-traversal-01" },
2470 { VID_draft_stenberg_ipsec_nat_traversal_02, sizeof(VID_draft_stenberg_ipsec_nat_traversal_02), "draft-stenberg-ipsec-nat-traversal-02" },
2471 { VID_draft_ietf_ipsec_nat_t_ike, sizeof(VID_draft_ietf_ipsec_nat_t_ike), "draft-ietf-ipsec-nat-t-ike" },
2472 { VID_draft_ietf_ipsec_nat_t_ike_00, sizeof(VID_draft_ietf_ipsec_nat_t_ike_00), "draft-ietf-ipsec-nat-t-ike-00" },
2473 { VID_draft_ietf_ipsec_nat_t_ike_01, sizeof(VID_draft_ietf_ipsec_nat_t_ike_01), "draft-ietf-ipsec-nat-t-ike-01" },
2474 { VID_draft_ietf_ipsec_nat_t_ike_02, sizeof(VID_draft_ietf_ipsec_nat_t_ike_02), "draft-ietf-ipsec-nat-t-ike-02" },
2475 { VID_draft_ietf_ipsec_nat_t_ike_02n, sizeof(VID_draft_ietf_ipsec_nat_t_ike_02n), "draft-ietf-ipsec-nat-t-ike-02\\n" },
2476 { VID_draft_ietf_ipsec_nat_t_ike_03, sizeof(VID_draft_ietf_ipsec_nat_t_ike_03), "draft-ietf-ipsec-nat-t-ike-03" },
2477 { VID_draft_ietf_ipsec_nat_t_ike_04, sizeof(VID_draft_ietf_ipsec_nat_t_ike_04), "draft-ietf-ipsec-nat-t-ike-04" },
2478 { VID_draft_ietf_ipsec_nat_t_ike_05, sizeof(VID_draft_ietf_ipsec_nat_t_ike_05), "draft-ietf-ipsec-nat-t-ike-05" },
2479 { VID_draft_ietf_ipsec_nat_t_ike_06, sizeof(VID_draft_ietf_ipsec_nat_t_ike_06), "draft-ietf-ipsec-nat-t-ike-06" },
2480 { VID_draft_ietf_ipsec_nat_t_ike_07, sizeof(VID_draft_ietf_ipsec_nat_t_ike_07), "draft-ietf-ipsec-nat-t-ike-07" },
2481 { VID_draft_ietf_ipsec_nat_t_ike_08, sizeof(VID_draft_ietf_ipsec_nat_t_ike_08), "draft-ietf-ipsec-nat-t-ike-08" },
2482 { VID_draft_ietf_ipsec_nat_t_ike_09, sizeof(VID_draft_ietf_ipsec_nat_t_ike_09), "draft-ietf-ipsec-nat-t-ike-09" },
2483 { VID_testing_nat_t_rfc, sizeof(VID_testing_nat_t_rfc), "Testing NAT-T RFC" },
2484 { VID_rfc3947_nat_t, sizeof(VID_rfc3947_nat_t), "RFC 3947 Negotiation of NAT-Traversal in the IKE" },
2485 { VID_draft_beaulieu_ike_xauth_02, sizeof(VID_draft_beaulieu_ike_xauth_02), "draft-beaulieu-ike-xauth-02.txt" },
2486 { VID_xauth, sizeof(VID_xauth), "XAUTH" },
2487 { VID_rfc3706_dpd, sizeof(VID_rfc3706_dpd), "RFC 3706 DPD (Dead Peer Detection)" },
2488 { VID_draft_ietf_ipsec_antireplay_00, sizeof(VID_draft_ietf_ipsec_antireplay_00), "draft-ietf-ipsec-antireplay-00.txt" },
2489 { VID_draft_ietf_ipsec_heartbeats_00, sizeof(VID_draft_ietf_ipsec_heartbeats_00), "draft-ietf-ipsec-heartbeats-00.txt" },
2490 { VID_IKE_CHALLENGE_RESPONSE_1, sizeof(VID_IKE_CHALLENGE_RESPONSE_1), "IKE Challenge/Response for Authenticated Cryptographic Keys" },
2491 { VID_IKE_CHALLENGE_RESPONSE_2, sizeof(VID_IKE_CHALLENGE_RESPONSE_2), "IKE Challenge/Response for Authenticated Cryptographic Keys" },
2492 { VID_IKE_CHALLENGE_RESPONSE_REV_1, sizeof(VID_IKE_CHALLENGE_RESPONSE_REV_1), "IKE Challenge/Response for Authenticated Cryptographic Keys (Revised)" },
2493 { VID_IKE_CHALLENGE_RESPONSE_REV_2, sizeof(VID_IKE_CHALLENGE_RESPONSE_REV_2), "IKE Challenge/Response for Authenticated Cryptographic Keys (Revised)" },
2494 { VID_MS_L2TP_IPSEC_VPN_CLIENT, sizeof(VID_MS_L2TP_IPSEC_VPN_CLIENT), "Microsoft L2TP/IPSec VPN Client" },
2495 { VID_MS_VID_INITIAL_CONTACT, sizeof(VID_MS_VID_INITIAL_CONTACT), "Microsoft Vid-Initial-Contact" },
2496 { VID_GSS_API_1, sizeof(VID_GSS_API_1), "A GSS-API Authentication Method for IKE" },
2497 { VID_GSS_API_2, sizeof(VID_GSS_API_2), "A GSS-API Authentication Method for IKE" },
2498 { VID_GSSAPI, sizeof(VID_GSSAPI), "GSSAPI" },
2499 { VID_MS_NT5_ISAKMPOAKLEY, sizeof(VID_MS_NT5_ISAKMPOAKLEY), "MS NT5 ISAKMPOAKLEY" },
2500 { VID_CISCO_UNITY, sizeof(VID_CISCO_UNITY), "CISCO-UNITY" },
2501 { VID_CISCO_CONCENTRATOR, sizeof(VID_CISCO_CONCENTRATOR), "CISCO-CONCENTRATOR" },
2502 { VID_CISCO_FRAG, sizeof(VID_CISCO_FRAG), "Cisco Fragmentation" },
2503 { VID_CP_01_R65, sizeof(VID_CP_01_R65), "CryptoPro/GOST 0.1 / Check Point R65" },
2504 { VID_CP_10_R71, sizeof(VID_CP_10_R71), "CryptoPro/GOST 1.0 / Check Point R71" },
2505 { VID_CP_11, sizeof(VID_CP_11), "CryptoPro/GOST 1.1" },
2506 { VID_CYBERGUARD, sizeof(VID_CYBERGUARD), "CyberGuard" },
2507 { VID_SHREWSOFT, sizeof(VID_SHREWSOFT), "Shrew Soft" },
2508 { VID_STRONGSWAN, sizeof(VID_STRONGSWAN), "strongSwan" },
2509 { VID_KAME_RACOON, sizeof(VID_KAME_RACOON), "KAME/racoon" },
2510 { VID_IPSEC_TOOLS, sizeof(VID_IPSEC_TOOLS), "IPSec-Tools" },
2511 { VID_NETSCREEN_1, sizeof(VID_NETSCREEN_1), "Netscreen-1" },
2512 { VID_NETSCREEN_2, sizeof(VID_NETSCREEN_2), "Netscreen-2" },
2513 { VID_NETSCREEN_3, sizeof(VID_NETSCREEN_3), "Netscreen-3" },
2514 { VID_NETSCREEN_4, sizeof(VID_NETSCREEN_4), "Netscreen-4" },
2515 { VID_NETSCREEN_5, sizeof(VID_NETSCREEN_5), "Netscreen-5" },
2516 { VID_NETSCREEN_6, sizeof(VID_NETSCREEN_6), "Netscreen-6" },
2517 { VID_NETSCREEN_7, sizeof(VID_NETSCREEN_7), "Netscreen-7" },
2518 { VID_NETSCREEN_8, sizeof(VID_NETSCREEN_8), "Netscreen-8" },
2519 { VID_NETSCREEN_9, sizeof(VID_NETSCREEN_9), "Netscreen-9" },
2520 { VID_NETSCREEN_10, sizeof(VID_NETSCREEN_10), "Netscreen-10" },
2521 { VID_NETSCREEN_11, sizeof(VID_NETSCREEN_11), "Netscreen-11" },
2522 { VID_NETSCREEN_12, sizeof(VID_NETSCREEN_12), "Netscreen-12" },
2523 { VID_NETSCREEN_13, sizeof(VID_NETSCREEN_13), "Netscreen-13" },
2524 { VID_NETSCREEN_14, sizeof(VID_NETSCREEN_14), "Netscreen-14" },
2525 { VID_NETSCREEN_15, sizeof(VID_NETSCREEN_15), "Netscreen-15" },
2526 { VID_NETSCREEN_16, sizeof(VID_NETSCREEN_16), "Netscreen-16" },
2527 { VID_ZYWALL, sizeof(VID_ZYWALL), "ZYWALL" },
2528 { VID_SIDEWINDER, sizeof(VID_SIDEWINDER), "SIDEWINDER" },
2529 { VID_SONICWALL, sizeof(VID_SONICWALL), "SonicWALL" },
2530 { VID_HEARTBEAT_NOTIFY, sizeof(VID_HEARTBEAT_NOTIFY), "Heartbeat Notify" },
2531 { VID_DWR, sizeof(VID_DWR), "DWR: Delete with reason" },
2532 { VID_ARUBA_RAP, sizeof(VID_ARUBA_RAP), "Remote AP (Aruba Networks)" },
2533 { VID_ARUBA_CONTROLLER, sizeof(VID_ARUBA_CONTROLLER), "Controller (Aruba Networks)" },
2534 { VID_ARUBA_VIA_CLIENT, sizeof(VID_ARUBA_VIA_CLIENT), "VIA Client (Aruba Networks)" },
2535 { VID_ARUBA_VIA_AUTH_PROFILE, sizeof(VID_ARUBA_VIA_AUTH_PROFILE), "VIA Auth Profile (Aruba Networks)" },
2536 { VID_MS_IKEE_20080212_CGA1, sizeof(VID_MS_IKEE_20080212_CGA1), "IKE CGA Version 1" },
2537 { VID_MS_IKEE_20080212_MS_NDC, sizeof(VID_MS_IKEE_20080212_MS_NDC), "MS-Negotiation Discovery Capable" },
2538 { 0, 0, NULL }
2539 };
2540
2541
2542 /* Tries to match val against each element in the value_string array vs.
2543 Returns the associated string ptr, and sets "*idx" to the index in
2544 that table, on a match, and returns NULL, and sets "*idx" to -1,
2545 on failure. */
2546 static const gchar*
2547 match_strbyte_idx(const guint8 *val, const gint val_len, const byte_string *vs, gint *idx) {
2548 gint i = 0;
2549
2550 if (vs) {
2551 while (vs[i].strptr) {
2552 if (val_len >= vs[i].len && !memcmp(vs[i].value, val, vs[i].len)) {
2553 *idx = i;
2554 return(vs[i].strptr);
2555 }
2556 i++;
2557 }
2558 }
2559
2560 *idx = -1;
2561 return NULL;
2562 }
2563 /* Like match_strbyte_idx(), but doesn't return the index. */
2564 static const gchar*
2565 match_strbyte(const guint8 *val,const gint val_len, const byte_string *vs) {
2566 gint ignore_me;
2567 return match_strbyte_idx(val, val_len, vs, &ignore_me);
2568 }
2569
2570 /* Tries to match val against each element in the value_string array vs.
2571 Returns the associated string ptr on a match.
2572 Formats val with fmt, and returns the resulting string, on failure. */
2573 static const gchar*
2574 byte_to_str(const guint8 *val,const gint val_len, const byte_string *vs, const char *fmt) {
2575 const gchar *ret;
2576
2577 DISSECTOR_ASSERT(fmt != NULL);
2578 ret = match_strbyte(val, val_len, vs);
2579 if (ret != NULL)
2580 return ret;
2581
2582 return wmem_strdup_printf(wmem_packet_scope(), fmt, val);
2583 }
2584
2585
2586
2587
2588 static void
2589 dissect_payloads(tvbuff_t *tvb, proto_tree *tree, proto_tree *parent_tree _U_,
2590 int isakmp_version, guint8 initial_payload, int offset, int length,
2591 packet_info *pinfo, void* decr_data)
2592 {
2593 guint8 payload, next_payload;
2594 guint16 payload_length;
2595 proto_tree * ntree;
2596
2597 for (payload = initial_payload; length > 0; payload = next_payload) {
2598 if (payload == PLOAD_IKE_NONE) {
2599 /*
2600 * What? There's more stuff in this chunk of data, but the
2601 * previous payload had a "next payload" type of None?
2602 */
2603 proto_tree_add_item(tree, hf_isakmp_extradata, tvb, offset, length, ENC_NA);
2604 break;
2605 }
2606
2607 ntree = dissect_payload_header(tvb, offset, length, isakmp_version, payload, &next_payload, &payload_length, tree);
2608 if (ntree == NULL)
2609 break;
2610 if (payload_length >= 4) { /* XXX = > 4? */
2611 tvb_ensure_bytes_exist(tvb, offset + 4, payload_length - 4);
2612 switch(payload){
2613 case PLOAD_IKE_SA:
2614 case PLOAD_IKE2_SA:
2615 dissect_sa(tvb, offset + 4, payload_length - 4, ntree, isakmp_version, pinfo, decr_data);
2616 break;
2617 case PLOAD_IKE_P:
2618 dissect_proposal(tvb, offset + 4, payload_length - 4, ntree, isakmp_version, decr_data );
2619 break;
2620 case PLOAD_IKE_KE:
2621 case PLOAD_IKE2_KE:
2622 dissect_key_exch(tvb, offset + 4, payload_length - 4, ntree, isakmp_version, pinfo, decr_data );
2623 break;
2624 case PLOAD_IKE_ID:
2625 case PLOAD_IKE2_IDI:
2626 case PLOAD_IKE2_IDR:
2627 dissect_id(tvb, offset + 4, payload_length - 4, ntree, isakmp_version, pinfo );
2628 break;
2629 case PLOAD_IKE_CERT:
2630 case PLOAD_IKE2_CERT:
2631 dissect_cert(tvb, offset + 4, payload_length - 4, ntree, isakmp_version, pinfo );
2632 break;
2633 case PLOAD_IKE_CR:
2634 case PLOAD_IKE2_CERTREQ:
2635 dissect_certreq(tvb, offset + 4, payload_length - 4, ntree, isakmp_version, pinfo );
2636 break;
2637 case PLOAD_IKE_HASH:
2638 dissect_hash(tvb, offset + 4, payload_length - 4, ntree);
2639 break;
2640 case PLOAD_IKE_SIG:
2641 dissect_sig(tvb, offset + 4, payload_length - 4, ntree);
2642 break;
2643 case PLOAD_IKE_NONCE:
2644 case PLOAD_IKE2_NONCE:
2645 dissect_nonce(tvb, offset + 4, payload_length - 4, ntree);
2646 break;
2647 case PLOAD_IKE_N:
2648 case PLOAD_IKE2_N:
2649 dissect_notif(tvb, offset + 4, payload_length - 4, ntree, isakmp_version);
2650 break;
2651 case PLOAD_IKE_D:
2652 case PLOAD_IKE2_D:
2653 dissect_delete(tvb, offset + 4, payload_length - 4, ntree, isakmp_version);
2654 break;
2655 case PLOAD_IKE_VID:
2656 case PLOAD_IKE2_V:
2657 dissect_vid(tvb, offset + 4, payload_length - 4, ntree);
2658 break;
2659 case PLOAD_IKE_A:
2660 case PLOAD_IKE2_CP:
2661 dissect_config(tvb, offset + 4, payload_length - 4, ntree, isakmp_version);
2662 break;
2663 case PLOAD_IKE2_AUTH:
2664 dissect_auth(tvb, offset + 4, payload_length - 4, ntree);
2665 break;
2666 case PLOAD_IKE2_TSI:
2667 case PLOAD_IKE2_TSR:
2668 dissect_ts(tvb, offset + 4, payload_length - 4, ntree);
2669 break;
2670 case PLOAD_IKE2_SK:
2671 if(isakmp_version == 2)
2672 dissect_enc(tvb, offset + 4, payload_length - 4, ntree, pinfo, next_payload, decr_data);
2673 break;
2674 case PLOAD_IKE2_EAP:
2675 dissect_eap(tvb, offset + 4, payload_length - 4, ntree, pinfo );
2676 break;
2677 case PLOAD_IKE2_GSPM:
2678 dissect_gspm(tvb, offset + 4, payload_length - 4, ntree);
2679 break;
2680 case PLOAD_IKE_NAT_D:
2681 case PLOAD_IKE_NAT_D13:
2682 case PLOAD_IKE_NAT_D48:
2683 dissect_nat_discovery(tvb, offset + 4, payload_length - 4, ntree );
2684 break;
2685 case PLOAD_IKE_NAT_OA:
2686 case PLOAD_IKE_NAT_OA14:
2687 case PLOAD_IKE_NAT_OA58:
2688 dissect_nat_original_address(tvb, offset + 4, payload_length - 4, ntree, isakmp_version );
2689 break;
2690 case PLOAD_IKE_CISCO_FRAG:
2691 dissect_cisco_fragmentation(tvb, offset + 4, payload_length - 4, ntree, pinfo );
2692 break;
2693 default:
2694 proto_tree_add_item(ntree, hf_isakmp_datapayload, tvb, offset + 4, payload_length-4, ENC_NA);
2695 break;
2696 }
2697
2698 }
2699 else if (payload_length > length) {
2700 proto_tree_add_text(ntree, tvb, 0, 0,
2701 "Payload (bogus, length is %u, greater than remaining length %d",
2702 payload_length, length);
2703 return;
2704 }
2705 else {
2706 proto_tree_add_text(ntree, tvb, 0, 0,
2707 "Payload (bogus, length is %u, must be at least 4)",
2708 payload_length);
2709 payload_length = 4;
2710 }
2711
2712 offset += payload_length;
2713 length -= payload_length;
2714 }
2715 }
2716
2717 void
2718 isakmp_dissect_payloads(tvbuff_t *tvb, proto_tree *tree, int isakmp_version,
2719 guint8 initial_payload, int offset, int length,
2720 packet_info *pinfo)
2721 {
2722 dissect_payloads(tvb, tree, tree, isakmp_version, initial_payload, offset, length,
2723 pinfo, NULL);
2724 }
2725
2726 static void
2727 dissect_isakmp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
2728 {
2729 int offset = 0, len;
2730 isakmp_hdr_t hdr;
2731 proto_item * ti, *vers_item;
2732 proto_tree * isakmp_tree = NULL, *vers_tree;
2733 int isakmp_version;
2734 void* decr_data = NULL;
2735 #ifdef HAVE_LIBGCRYPT
2736 guint8 i_cookie[COOKIE_SIZE], *ic_key;
2737 decrypt_data_t *decr = NULL;
2738 tvbuff_t *decr_tvb;
2739 proto_tree *decr_tree;
2740 address null_addr;
2741 #endif /* HAVE_LIBGCRYPT */
2742
2743 col_set_str(pinfo->cinfo, COL_PROTOCOL, "ISAKMP");
2744 col_clear(pinfo->cinfo, COL_INFO);
2745
2746 if (tree) {
2747 ti = proto_tree_add_item(tree, proto_isakmp, tvb, offset, -1, ENC_NA);
2748 isakmp_tree = proto_item_add_subtree(ti, ett_isakmp);
2749 }
2750
2751 /* RFC3948 2.3 NAT Keepalive packet:
2752 * 1 byte payload with the value 0xff.
2753 */
2754 if ( (tvb_length(tvb)==1) && (tvb_get_guint8(tvb, offset)==0xff) ){
2755 col_set_str(pinfo->cinfo, COL_INFO, "NAT Keepalive");
2756 proto_tree_add_item(isakmp_tree, hf_isakmp_nat_keepalive, tvb, offset, 1, ENC_NA);
2757 return;
2758 }
2759
2760 hdr.length = tvb_get_ntohl(tvb, offset + ISAKMP_HDR_SIZE - 4);
2761 hdr.exch_type = tvb_get_guint8(tvb, COOKIE_SIZE + COOKIE_SIZE + 1 + 1);
2762 hdr.version = tvb_get_guint8(tvb, COOKIE_SIZE + COOKIE_SIZE + 1);
2763 isakmp_version = hi_nibble(hdr.version); /* save the version */
2764 hdr.flags = tvb_get_guint8(tvb, COOKIE_SIZE + COOKIE_SIZE + 1 + 1 + 1);
2765
2766 #ifdef HAVE_LIBGCRYPT
2767 if (isakmp_version == 1) {
2768 SET_ADDRESS(&null_addr, AT_NONE, 0, NULL);
2769
2770 tvb_memcpy(tvb, i_cookie, offset, COOKIE_SIZE);
2771 decr = (decrypt_data_t*) g_hash_table_lookup(isakmp_hash, i_cookie);
2772
2773 if (! decr) {
2774 ic_key = (guint8 *)g_slice_alloc(COOKIE_SIZE);
2775 decr = (decrypt_data_t *)g_slice_alloc(sizeof(decrypt_data_t));
2776 memcpy(ic_key, i_cookie, COOKIE_SIZE);
2777 memset(decr, 0, sizeof(decrypt_data_t));
2778 SET_ADDRESS(&decr->initiator, AT_NONE, 0, NULL);
2779
2780 g_hash_table_insert(isakmp_hash, ic_key, decr);
2781 }
2782
2783 if (ADDRESSES_EQUAL(&decr->initiator, &null_addr)) {
2784 /* XXX - We assume that we're seeing the second packet in an exchange here.
2785 * Is there a way to verify this? */
2786 SE_COPY_ADDRESS(&decr->initiator, &pinfo->src);
2787 }
2788
2789 decr_data = decr;
2790 } else if (isakmp_version == 2) {
2791 ikev2_uat_data_key_t hash_key;
2792 ikev2_uat_data_t *ike_sa_data = NULL;
2793 ikev2_decrypt_data_t *ikev2_dec_data;
2794 guchar spii[COOKIE_SIZE], spir[COOKIE_SIZE];
2795
2796 tvb_memcpy(tvb, spii, offset, COOKIE_SIZE);
2797 tvb_memcpy(tvb, spir, offset + COOKIE_SIZE, COOKIE_SIZE);
2798 hash_key.spii = spii;
2799 hash_key.spir = spir;
2800 hash_key.spii_len = COOKIE_SIZE;
2801 hash_key.spir_len = COOKIE_SIZE;
2802
2803 ike_sa_data = (ikev2_uat_data_t *)g_hash_table_lookup(ikev2_key_hash, &hash_key);
2804 if (ike_sa_data) {
2805 guint8 initiator_flag;
2806 initiator_flag = hdr.flags & I_FLAG;
2807 ikev2_dec_data = wmem_new(wmem_packet_scope(), ikev2_decrypt_data_t);
2808 ikev2_dec_data->encr_key = initiator_flag ? ike_sa_data->sk_ei : ike_sa_data->sk_er;
2809 ikev2_dec_data->auth_key = initiator_flag ? ike_sa_data->sk_ai : ike_sa_data->sk_ar;
2810 ikev2_dec_data->encr_spec = ike_sa_data->encr_spec;
2811 ikev2_dec_data->auth_spec = ike_sa_data->auth_spec;
2812
2813 decr_data = ikev2_dec_data;
2814 }
2815 }
2816 #endif /* HAVE_LIBGCRYPT */
2817
2818 if (tree) {
2819 proto_tree_add_item(isakmp_tree, hf_isakmp_ispi, tvb, offset, COOKIE_SIZE, ENC_NA);
2820 offset += COOKIE_SIZE;
2821
2822 proto_tree_add_item(isakmp_tree, hf_isakmp_rspi, tvb, offset, COOKIE_SIZE, ENC_NA);
2823 offset += COOKIE_SIZE;
2824
2825 hdr.next_payload = tvb_get_guint8(tvb, offset);
2826 proto_tree_add_item(isakmp_tree, hf_isakmp_nextpayload, tvb, offset, 1, ENC_BIG_ENDIAN);
2827
2828 offset += 1;
2829
2830 vers_item = proto_tree_add_uint_format_value(isakmp_tree, hf_isakmp_version, tvb, offset,
2831 1, hdr.version, "%u.%u",
2832 hi_nibble(hdr.version), lo_nibble(hdr.version));
2833 vers_tree = proto_item_add_subtree(vers_item, ett_isakmp_version);
2834 proto_tree_add_item(vers_tree, hf_isakmp_mjver, tvb, offset, 1, ENC_BIG_ENDIAN);
2835 proto_tree_add_item(vers_tree, hf_isakmp_mnver, tvb, offset, 1, ENC_BIG_ENDIAN);
2836 offset += 1;
2837
2838 if(isakmp_version == 1) {
2839 proto_tree_add_item(isakmp_tree, hf_isakmp_exchangetype_v1, tvb, offset, 1, ENC_BIG_ENDIAN);
2840 col_add_str(pinfo->cinfo, COL_INFO,val_to_str(hdr.exch_type, exchange_v1_type, "Unknown %d"));
2841 } else if (isakmp_version == 2){
2842 proto_tree_add_item(isakmp_tree, hf_isakmp_exchangetype_v2, tvb, offset, 1, ENC_BIG_ENDIAN);
2843 col_add_str(pinfo->cinfo, COL_INFO,val_to_str(hdr.exch_type, exchange_v2_type, "Unknown %d"));
2844 }
2845 offset += 1;
2846
2847 {
2848 proto_item * fti;
2849 proto_tree * ftree;
2850
2851 fti = proto_tree_add_item(isakmp_tree, hf_isakmp_flags, tvb, offset, 1, ENC_BIG_ENDIAN);
2852 ftree = proto_item_add_subtree(fti, ett_isakmp_flags);
2853
2854 if (isakmp_version == 1) {
2855 proto_tree_add_item(ftree, hf_isakmp_flag_e, tvb, offset, 1, ENC_BIG_ENDIAN);
2856
2857 proto_tree_add_item(ftree, hf_isakmp_flag_c, tvb, offset, 1, ENC_BIG_ENDIAN);
2858
2859 proto_tree_add_item(ftree, hf_isakmp_flag_a, tvb, offset, 1, ENC_BIG_ENDIAN);
2860
2861 } else if (isakmp_version == 2) {
2862 proto_tree_add_item(ftree, hf_isakmp_flag_i, tvb, offset, 1, ENC_BIG_ENDIAN);
2863
2864 proto_tree_add_item(ftree, hf_isakmp_flag_v, tvb, offset, 1, ENC_BIG_ENDIAN);
2865
2866 proto_tree_add_item(ftree, hf_isakmp_flag_r, tvb, offset, 1, ENC_BIG_ENDIAN);
2867
2868 }
2869 offset += 1;
2870 }
2871
2872 hdr.message_id = tvb_get_ntohl(tvb, offset);
2873 proto_tree_add_item(isakmp_tree, hf_isakmp_messageid, tvb, offset, 4, ENC_BIG_ENDIAN);
2874 offset += 4;
2875
2876 if (hdr.length < ISAKMP_HDR_SIZE) {
2877 proto_tree_add_uint_format_value(isakmp_tree, hf_isakmp_length, tvb, offset, 4,
2878 hdr.length, "(bogus, length is %u, should be at least %lu)",
2879 hdr.length, (unsigned long)ISAKMP_HDR_SIZE);
2880 return;
2881 }
2882
2883 len = hdr.length - ISAKMP_HDR_SIZE;
2884
2885 if (len < 0) {
2886 proto_tree_add_uint_format_value(isakmp_tree, hf_isakmp_length, tvb, offset, 4,
2887 hdr.length, "(bogus, length is %u, which is too large)",
2888 hdr.length);
2889 return;
2890 }
2891 tvb_ensure_bytes_exist(tvb, offset, len);
2892 proto_tree_add_item(isakmp_tree, hf_isakmp_length, tvb, offset, 4, ENC_BIG_ENDIAN);
2893 offset += 4;
2894
2895 if (hdr.flags & E_FLAG) {
2896 if (len && isakmp_tree) {
2897 ti = proto_tree_add_item(isakmp_tree, hf_isakmp_enc_data, tvb, offset, len, ENC_NA);
2898 proto_item_append_text(ti, " (%d byte%s)", len, plurality(len, "", "s"));
2899
2900 #ifdef HAVE_LIBGCRYPT
2901
2902 if (decr) {
2903 decr_tvb = decrypt_payload(tvb, pinfo, tvb_get_ptr(tvb, offset, len), len, &hdr, decr);
2904 if (decr_tvb) {
2905 decr_tree = proto_item_add_subtree(ti, ett_isakmp);
2906 dissect_payloads(decr_tvb, decr_tree, tree, isakmp_version,
2907 hdr.next_payload, 0, tvb_length(decr_tvb), pinfo, decr_data);
2908
2909 }
2910 }
2911 #endif /* HAVE_LIBGCRYPT */
2912 }
2913 } else {
2914 dissect_payloads(tvb, isakmp_tree, tree, isakmp_version, hdr.next_payload,
2915 offset, len, pinfo, decr_data);
2916 }
2917 }
2918 }
2919
2920
2921 static proto_tree *
2922 dissect_payload_header(tvbuff_t *tvb, int offset, int length,
2923 int isakmp_version, guint8 payload _U_, guint8 *next_payload_p,
2924 guint16 *payload_length_p, proto_tree *tree)
2925 {
2926 guint8 next_payload;
2927 guint16 payload_length;
2928 proto_item * ti;
2929 proto_tree * ntree;
2930
2931 if (length < 4) {
2932 proto_tree_add_text(tree, tvb, offset, length,
2933 "Not enough room in payload for all transforms");
2934 return NULL;
2935 }
2936 next_payload = tvb_get_guint8(tvb, offset);
2937 payload_length = tvb_get_ntohs(tvb, offset + 2);
2938
2939 ti = proto_tree_add_uint(tree, hf_isakmp_typepayload, tvb, offset, payload_length, payload);
2940
2941 ntree = proto_item_add_subtree(ti, ett_isakmp_payload);
2942
2943 proto_tree_add_item(ntree, hf_isakmp_nextpayload, tvb, offset, 1, ENC_BIG_ENDIAN);
2944
2945 if (isakmp_version == 2) {
2946 proto_tree_add_item(ntree, hf_isakmp_criticalpayload, tvb, offset+1, 1, ENC_BIG_ENDIAN);
2947 }
2948 proto_tree_add_item(ntree, hf_isakmp_payloadlen, tvb, offset + 2, 2, ENC_BIG_ENDIAN);
2949
2950 *next_payload_p = next_payload;
2951 *payload_length_p = payload_length;
2952 return ntree;
2953 }
2954
2955 static void
2956 dissect_sa(tvbuff_t *tvb, int offset, int length, proto_tree *tree, int isakmp_version, packet_info *pinfo, void* decr_data)
2957 {
2958 guint32 doi;
2959 proto_item *sti;
2960 proto_tree *stree;
2961
2962 if (isakmp_version == 1) {
2963 doi = tvb_get_ntohl(tvb, offset);
2964
2965 proto_tree_add_item(tree, hf_isakmp_sa_doi, tvb, offset, 4, ENC_BIG_ENDIAN);
2966
2967 offset += 4;
2968 length -= 4;
2969
2970 if (doi == 1) {
2971 /* IPSEC */
2972 if (length < 4) {
2973 proto_tree_add_bytes_format_value(tree, hf_isakmp_sa_situation, tvb, offset, length,
2974 NULL,
2975 "%s (length is %u, should be >= 4)",
2976 tvb_bytes_to_str(tvb, offset, length), length);
2977 return;
2978 }
2979 sti = proto_tree_add_item(tree, hf_isakmp_sa_situation, tvb, offset, 4, ENC_NA);
2980 stree = proto_item_add_subtree(sti, ett_isakmp_sa);
2981
2982 proto_tree_add_item(stree, hf_isakmp_sa_situation_identity_only, tvb, offset, 4, ENC_BIG_ENDIAN);
2983 proto_tree_add_item(stree, hf_isakmp_sa_situation_secrecy, tvb, offset, 4, ENC_BIG_ENDIAN);
2984 proto_tree_add_item(stree, hf_isakmp_sa_situation_integrity, tvb, offset, 4, ENC_BIG_ENDIAN);
2985
2986 offset += 4;
2987 length -= 4;
2988
2989 dissect_payloads(tvb, tree, tree, isakmp_version, PLOAD_IKE_P, offset,
2990 length, pinfo, decr_data);
2991 } else {
2992 /* Unknown */
2993 proto_tree_add_item(tree, hf_isakmp_sa_situation, tvb, offset, length, ENC_NA);
2994 }
2995 } else if (isakmp_version == 2) {
2996 dissect_payloads(tvb, tree, tree, isakmp_version, PLOAD_IKE_P, offset,
2997 length, pinfo, decr_data);
2998 }
2999 }
3000
3001 static void
3002 dissect_proposal(tvbuff_t *tvb, int offset, int length, proto_tree *tree, int isakmp_version, void* decr_data)
3003 {
3004 guint8 protocol_id;
3005 guint8 spi_size;
3006 guint8 num_transforms;
3007 guint8 next_payload;
3008 guint16 payload_length;
3009 proto_tree * ntree;
3010 guint8 proposal_num;
3011
3012 proposal_num = tvb_get_guint8(tvb, offset);
3013
3014 proto_item_append_text(tree, " # %d", proposal_num);
3015
3016 proto_tree_add_item(tree, hf_isakmp_prop_number, tvb, offset, 1, ENC_BIG_ENDIAN);
3017 offset += 1;
3018 length -= 1;
3019
3020 protocol_id = tvb_get_guint8(tvb, offset);
3021
3022 if (isakmp_version == 1)
3023 {
3024 proto_tree_add_item(tree, hf_isakmp_prop_protoid_v1, tvb, offset, 1, ENC_BIG_ENDIAN);
3025 }else if (isakmp_version == 2)
3026 {
3027 proto_tree_add_item(tree, hf_isakmp_prop_protoid_v2, tvb, offset, 1, ENC_BIG_ENDIAN);
3028 }
3029 offset += 1;
3030 length -= 1;
3031
3032 spi_size = tvb_get_guint8(tvb, offset);
3033 proto_tree_add_item(tree, hf_isakmp_spisize, tvb, offset, 1, ENC_BIG_ENDIAN);
3034 offset += 1;
3035 length -= 1;
3036
3037 num_transforms = tvb_get_guint8(tvb, offset);
3038 proto_tree_add_item(tree, hf_isakmp_prop_transforms, tvb, offset, 1, ENC_BIG_ENDIAN);
3039 offset += 1;
3040 length -= 1;
3041
3042 if (spi_size) {
3043 proto_tree_add_item(tree, hf_isakmp_spi, tvb, offset, spi_size, ENC_NA);
3044
3045 offset += spi_size;
3046 length -= spi_size;
3047 }
3048
3049 while (num_transforms > 0) {
3050 ntree = dissect_payload_header(tvb, offset, length, isakmp_version,
3051 PLOAD_IKE_T, &next_payload, &payload_length, tree);
3052 if (ntree == NULL)
3053 break;
3054 if (length < payload_length) {
3055 proto_tree_add_text(tree, tvb, offset + 4, length,
3056 "Not enough room in payload for all transforms");
3057 break;
3058 }
3059 dissect_transform(tvb, offset + 4, payload_length - 4, ntree, isakmp_version, protocol_id, decr_data);
3060
3061 offset += payload_length;
3062 length -= payload_length;
3063 num_transforms--;
3064
3065 }
3066 }
3067
3068 /* Returns the number of bytes consumed by this option. */
3069 static int
3070 dissect_rohc_supported(tvbuff_t *tvb, proto_tree *rohc_tree, int offset )
3071 {
3072 guint optlen, rohc, len = 0;
3073 proto_item *rohc_item = NULL;
3074 proto_tree *sub_rohc_tree = NULL;
3075
3076 rohc = tvb_get_ntohs(tvb, offset);
3077 optlen = tvb_get_ntohs(tvb, offset+2);
3078 len = 2;
3079
3080 /* is TV ? (Type/Value) ? */
3081 if (rohc & 0x8000) {
3082 rohc = rohc & 0x7fff;
3083 len = 0;
3084 optlen = 2;
3085 }
3086
3087
3088 rohc_item = proto_tree_add_item(rohc_tree, hf_isakmp_notify_data_rohc_attr, tvb, offset, 2+len+optlen, ENC_NA);
3089 proto_item_append_text(rohc_item," (t=%d,l=%d) %s",rohc, optlen, val_to_str(rohc, rohc_attr_type, "Unknown Attribute Type (%02d)") );
3090 sub_rohc_tree = proto_item_add_subtree(rohc_item, ett_isakmp_rohc_attr);
3091 proto_tree_add_item(sub_rohc_tree, hf_isakmp_notify_data_rohc_attr_format, tvb, offset, 2, ENC_BIG_ENDIAN);
3092 proto_tree_add_uint(sub_rohc_tree, hf_isakmp_notify_data_rohc_attr_type, tvb, offset, 2, rohc);
3093
3094 offset += 2;
3095 if (len)
3096 {
3097 proto_tree_add_item(sub_rohc_tree, hf_isakmp_notify_data_rohc_attr_length, tvb, offset, 2, ENC_BIG_ENDIAN);
3098 offset += 2;
3099 }
3100 if (optlen==0)
3101 {
3102 proto_tree_add_text(sub_rohc_tree, tvb, offset, 0,"Attribut value is empty");
3103 return 2+len;
3104 }
3105 proto_tree_add_item(sub_rohc_tree, hf_isakmp_notify_data_rohc_attr_value, tvb, offset, optlen, ENC_NA);
3106 switch(rohc) {
3107 case ROHC_MAX_CID:
3108 proto_tree_add_item(sub_rohc_tree, hf_isakmp_notify_data_rohc_attr_max_cid, tvb, offset, optlen, ENC_BIG_ENDIAN);
3109 break;
3110 case ROHC_PROFILE:
3111 proto_tree_add_item(sub_rohc_tree, hf_isakmp_notify_data_rohc_attr_profile, tvb, offset, optlen, ENC_BIG_ENDIAN);
3112 break;
3113 case ROHC_INTEG:
3114 proto_tree_add_item(sub_rohc_tree, hf_isakmp_notify_data_rohc_attr_integ, tvb, offset, optlen, ENC_BIG_ENDIAN);
3115 break;
3116 case ROHC_ICV_LEN:
3117 proto_tree_add_item(sub_rohc_tree, hf_isakmp_notify_data_rohc_attr_icv_len, tvb, offset, optlen, ENC_BIG_ENDIAN);
3118 break;
3119 case ROHC_MRRU:
3120 proto_tree_add_item(sub_rohc_tree, hf_isakmp_notify_data_rohc_attr_mrru, tvb, offset, optlen, ENC_BIG_ENDIAN);
3121 break;
3122
3123 default:
3124 /* No Default Action */
3125 break;
3126 }
3127
3128 return 2+len+optlen;
3129 }
3130
3131 /* Dissect life duration, which is variable-length. Note that this function
3132 * handles both/either the security association life duration as defined in
3133 * section 4.5 of RFC2407 (http://tools.ietf.org/html/rfc2407), as well as the
3134 * life duration according to the attribute classes table in Appendix A of
3135 * RFC2409: http://tools.ietf.org/html/rfc2409#page-33 */
3136 static void
3137 dissect_life_duration(tvbuff_t *tvb, proto_tree *tree, proto_item *ti, int hf_uint32, int hf_uint64, int hf_bytes, int offset, guint len)
3138 {
3139 switch (len) {
3140 case 0:
3141 break;
3142 case 1: {
3143 guint8 val;
3144 val = tvb_get_guint8(tvb, offset);
3145
3146 proto_tree_add_uint_format_value(tree, hf_uint32, tvb, offset, len, val, "%u", val);
3147 proto_item_append_text(ti, " : %u", val);
3148 break;
3149 }
3150 case 2: {
3151 guint16 val;
3152 val = tvb_get_ntohs(tvb, offset);
3153
3154 proto_tree_add_uint_format_value(tree, hf_uint32, tvb, offset, len, val, "%u", val);
3155 proto_item_append_text(ti, " : %u", val);
3156 break;
3157 }
3158 case 3: {
3159 guint32 val;
3160 val = tvb_get_ntoh24(tvb, offset);
3161
3162 proto_tree_add_uint_format_value(tree, hf_uint32, tvb, offset, len, val, "%u", val);
3163 proto_item_append_text(ti, " : %u", val);
3164 break;
3165 }
3166 case 4: {
3167 guint32 val;
3168 val = tvb_get_ntohl(tvb, offset);
3169
3170 proto_tree_add_uint_format_value(tree, hf_uint32, tvb, offset, len, val, "%u", val);
3171 proto_item_append_text(ti, " : %u", val);
3172 break;
3173 }
3174 case 5: {
3175 guint64 val;
3176 val = tvb_get_ntoh40(tvb, offset);
3177
3178 proto_tree_add_uint64_format_value(tree, hf_uint64, tvb, offset, len, val, "%" G_GINT64_MODIFIER "u", val);
3179 proto_item_append_text(ti, " : %" G_GINT64_MODIFIER "u", val);
3180 break;
3181 }
3182 case 6: {
3183 guint64 val;
3184 val = tvb_get_ntoh48(tvb, offset);
3185
3186 proto_tree_add_uint64_format_value(tree, hf_uint64, tvb, offset, len, val, "%" G_GINT64_MODIFIER "u", val);
3187 proto_item_append_text(ti, " : %" G_GINT64_MODIFIER "u", val);
3188 break;
3189 }
3190 case 7: {
3191 guint64 val;
3192 val = tvb_get_ntoh56(tvb, offset);
3193
3194 proto_tree_add_uint64_format_value(tree, hf_uint64, tvb, offset, len, val, "%" G_GINT64_MODIFIER "u", val);
3195 proto_item_append_text(ti, " : %" G_GINT64_MODIFIER "u", val);
3196 break;
3197 }
3198 case 8: {
3199 guint64 val;
3200 val = tvb_get_ntoh64(tvb, offset);
3201
3202 proto_tree_add_uint64_format_value(tree, hf_uint64, tvb, offset, len, val, "%" G_GINT64_MODIFIER "u", val);
3203 proto_item_append_text(ti, " : %" G_GINT64_MODIFIER "u", val);
3204 break;
3205 }
3206 default:
3207 proto_tree_add_item(tree, hf_bytes, tvb, offset, len, ENC_NA);
3208 proto_item_append_text(ti, " : %" G_GINT64_MODIFIER "x ...", tvb_get_ntoh64(tvb, offset));
3209 break;
3210 }
3211 }
3212
3213 /* Returns the number of bytes consumed by this option. */
3214 static int
3215 dissect_transform_attribute(tvbuff_t *tvb, proto_tree *transform_attr_type_tree, int offset )
3216 {
3217 guint optlen, transform_attr_type, len = 0;
3218 proto_item *transform_attr_type_item = NULL;
3219 proto_tree *sub_transform_attr_type_tree = NULL;
3220
3221 transform_attr_type = tvb_get_ntohs(tvb, offset);
3222 optlen = tvb_get_ntohs(tvb, offset+2);
3223 len = 2;
3224
3225 /* is TV ? (Type/Value) ? */
3226 if (transform_attr_type & 0x8000) {
3227 transform_attr_type = transform_attr_type & 0x7fff;
3228 len = 0;
3229 optlen = 2;
3230 }
3231
3232
3233 transform_attr_type_item = proto_tree_add_item(transform_attr_type_tree, hf_isakmp_tf_attr, tvb, offset, 2+len+optlen, ENC_NA);
3234 proto_item_append_text(transform_attr_type_item, " (t=%d,l=%d) %s",transform_attr_type, optlen, val_to_str(transform_attr_type, transform_isakmp_attr_type, "Unknown Attribute Type (%02d)") );
3235 sub_transform_attr_type_tree = proto_item_add_subtree(transform_attr_type_item, ett_isakmp_tf_attr);
3236 proto_tree_add_item(sub_transform_attr_type_tree, hf_isakmp_tf_attr_format, tvb, offset, 2, ENC_BIG_ENDIAN);
3237 proto_tree_add_uint(sub_transform_attr_type_tree, hf_isakmp_tf_attr_type_v1, tvb, offset, 2, transform_attr_type);
3238
3239 offset += 2;
3240 if (len)
3241 {
3242 proto_tree_add_item(sub_transform_attr_type_tree, hf_isakmp_tf_attr_length, tvb, offset, 2, ENC_BIG_ENDIAN);
3243 offset += 2;
3244 }
3245 if (optlen==0)
3246 {
3247 proto_tree_add_text(sub_transform_attr_type_tree, tvb, offset, 0,"Attribute value is empty");
3248 return 2+len;
3249 }
3250 proto_tree_add_item(sub_transform_attr_type_tree, hf_isakmp_tf_attr_value, tvb, offset, optlen, ENC_NA);
3251 switch(transform_attr_type) {
3252 case ISAKMP_ATTR_LIFE_TYPE:
3253 proto_tree_add_item(sub_transform_attr_type_tree, hf_isakmp_tf_attr_life_type, tvb, offset, optlen, ENC_BIG_ENDIAN);
3254 proto_item_append_text(transform_attr_type_item," : %s", val_to_str(tvb_get_ntohs(tvb, offset), transform_attr_sa_life_type, "Unknown %d"));
3255 break;
3256 case ISAKMP_ATTR_LIFE_DURATION:
3257 dissect_life_duration(tvb, sub_transform_attr_type_tree, transform_attr_type_item, hf_isakmp_tf_attr_life_duration_uint32, hf_isakmp_tf_attr_life_duration_uint64, hf_isakmp_tf_attr_life_duration_bytes , offset, optlen);
3258 break;
3259 case ISAKMP_ATTR_GROUP_DESC:
3260 proto_tree_add_item(sub_transform_attr_type_tree, hf_isakmp_tf_attr_group_description, tvb, offset, optlen, ENC_BIG_ENDIAN);
3261 proto_item_append_text(transform_attr_type_item," : %s", val_to_str(tvb_get_ntohs(tvb, offset), transform_dh_group_type, "Unknown %d"));
3262 break;
3263 case ISAKMP_ATTR_ENCAP_MODE:
3264 proto_tree_add_item(sub_transform_attr_type_tree, hf_isakmp_tf_attr_encap_mode, tvb, offset, optlen, ENC_BIG_ENDIAN);
3265 proto_item_append_text(transform_attr_type_item," : %s", val_to_str(tvb_get_ntohs(tvb, offset), transform_attr_encap_type, "Unknown %d"));
3266 break;
3267 case ISAKMP_ATTR_AUTH_ALGORITHM:
3268 proto_tree_add_item(sub_transform_attr_type_tree, hf_isakmp_tf_attr_auth_algorithm, tvb, offset, optlen, ENC_BIG_ENDIAN);
3269 proto_item_append_text(transform_attr_type_item," : %s", val_to_str(tvb_get_ntohs(tvb, offset), transform_attr_auth_type, "Unknown %d"));
3270 break;
3271 case ISAKMP_ATTR_KEY_LENGTH:
3272 proto_tree_add_item(sub_transform_attr_type_tree, hf_isakmp_tf_attr_key_length, tvb, offset, optlen, ENC_BIG_ENDIAN);
3273 proto_item_append_text(transform_attr_type_item," : %d", tvb_get_ntohs(tvb, offset));
3274 break;
3275 case ISAKMP_ATTR_KEY_ROUNDS:
3276 proto_tree_add_item(sub_transform_attr_type_tree, hf_isakmp_tf_attr_key_rounds, tvb, offset, optlen, ENC_BIG_ENDIAN);
3277 proto_item_append_text(transform_attr_type_item," : %d", tvb_get_ntohs(tvb, offset));
3278 break;
3279 case ISAKMP_ATTR_CMPR_DICT_SIZE:
3280 proto_tree_add_item(sub_transform_attr_type_tree, hf_isakmp_tf_attr_cmpr_dict_size, tvb, offset, optlen, ENC_BIG_ENDIAN);
3281 break;
3282 case ISAKMP_ATTR_CMPR_ALGORITHM:
3283 proto_tree_add_item(sub_transform_attr_type_tree, hf_isakmp_tf_attr_cmpr_algorithm, tvb, offset, optlen, ENC_NA);
3284 break;
3285 case ISAKMP_ATTR_ECN_TUNNEL:
3286 proto_tree_add_item(sub_transform_attr_type_tree, hf_isakmp_tf_attr_ecn_tunnel, tvb, offset, optlen, ENC_BIG_ENDIAN);
3287 proto_item_append_text(transform_attr_type_item," : %s", val_to_str(tvb_get_ntohs(tvb, offset), transform_attr_ecn_type, "Unknown %d"));
3288 break;
3289 case ISAKMP_ATTR_EXT_SEQ_NBR:
3290 proto_tree_add_item(sub_transform_attr_type_tree, hf_isakmp_tf_attr_ext_seq_nbr, tvb, offset, optlen, ENC_BIG_ENDIAN);
3291 proto_item_append_text(transform_attr_type_item," : %s", val_to_str(tvb_get_ntohs(tvb, offset), transform_attr_ext_seq_nbr_type, "Unknown %d"));
3292 case ISAKMP_ATTR_AUTH_KEY_LENGTH:
3293 proto_tree_add_item(sub_transform_attr_type_tree, hf_isakmp_tf_attr_auth_key_length, tvb, offset, optlen, ENC_BIG_ENDIAN);
3294 proto_item_append_text(transform_attr_type_item," : %d", tvb_get_ntohs(tvb, offset));
3295 break;
3296 case ISAKMP_ATTR_SIG_ENCO_ALGORITHM:
3297 proto_tree_add_item(sub_transform_attr_type_tree, hf_isakmp_tf_attr_sig_enco_algorithm, tvb, offset, optlen, ENC_NA);
3298 break;
3299
3300 case ISAKMP_ATTR_ADDR_PRESERVATION:
3301 proto_tree_add_item(sub_transform_attr_type_tree, hf_isakmp_tf_attr_addr_preservation, tvb, offset, optlen, ENC_BIG_ENDIAN);
3302 proto_item_append_text(transform_attr_type_item," : %s", val_to_str(tvb_get_ntohs(tvb, offset), transform_attr_addr_preservation_type, "Unknown %d"));
3303 break;
3304
3305 case ISAKMP_ATTR_SA_DIRECTION:
3306 proto_tree_add_item(sub_transform_attr_type_tree, hf_isakmp_tf_attr_sa_direction, tvb, offset, optlen, ENC_BIG_ENDIAN);
3307 proto_item_append_text(transform_attr_type_item," : %s", val_to_str(tvb_get_ntohs(tvb, offset), transform_attr_sa_direction_type, "Unknown %d"));
3308 default:
3309 /* No Default Action */
3310 break;
3311 }
3312
3313 return 2+len+optlen;
3314 }
3315
3316
3317 /* Returns the number of bytes consumed by this option. */
3318 static int
3319 dissect_transform_ike_attribute(tvbuff_t *tvb, proto_tree *transform_attr_type_tree, int offset
3320 #ifdef HAVE_LIBGCRYPT
3321 , decrypt_data_t *decr
3322 #endif
3323 )
3324 {
3325 guint optlen, transform_attr_type, len = 0;
3326 proto_item *transform_attr_type_item = NULL;
3327 proto_tree *sub_transform_attr_type_tree = NULL;
3328
3329 transform_attr_type = tvb_get_ntohs(tvb, offset);
3330 optlen = tvb_get_ntohs(tvb, offset+2);
3331 len = 2;
3332
3333 /* is TV ? (Type/Value) ? */
3334 if (transform_attr_type & 0x8000) {
3335 transform_attr_type = transform_attr_type & 0x7fff;
3336 len = 0;
3337 optlen = 2;
3338 }
3339
3340
3341 transform_attr_type_item = proto_tree_add_item(transform_attr_type_tree, hf_isakmp_ike_attr, tvb, offset, 2+len+optlen, ENC_NA);
3342 proto_item_append_text(transform_attr_type_item," (t=%d,l=%d) %s",transform_attr_type, optlen, val_to_str(transform_attr_type,transform_ike_attr_type,"Unknown Attribute Type (%02d)") );
3343 sub_transform_attr_type_tree = proto_item_add_subtree(transform_attr_type_item, ett_isakmp_tf_ike_attr);
3344 proto_tree_add_item(sub_transform_attr_type_tree, hf_isakmp_ike_attr_format, tvb, offset, 2, ENC_BIG_ENDIAN);
3345 proto_tree_add_uint(sub_transform_attr_type_tree, hf_isakmp_ike_attr_type, tvb, offset, 2, transform_attr_type);
3346
3347 offset += 2;
3348 if (len)
3349 {
3350 proto_tree_add_item(sub_transform_attr_type_tree, hf_isakmp_ike_attr_length, tvb, offset, 2, ENC_BIG_ENDIAN);
3351 offset += 2;
3352 }
3353 if (optlen==0)
3354 {
3355 proto_tree_add_text(sub_transform_attr_type_tree, tvb, offset, 0,"Attribut value is empty");
3356 return 2+len;
3357 }
3358 proto_tree_add_item(sub_transform_attr_type_tree, hf_isakmp_ike_attr_value, tvb, offset, optlen, ENC_NA);
3359 switch(transform_attr_type) {
3360
3361 case IKE_ATTR_ENCRYPTION_ALGORITHM:
3362 proto_tree_add_item(sub_transform_attr_type_tree, hf_isakmp_ike_attr_encryption_algorithm, tvb, offset, optlen, ENC_BIG_ENDIAN);
3363 proto_item_append_text(transform_attr_type_item," : %s", val_to_str(tvb_get_ntohs(tvb, offset), transform_attr_enc_type, "Unknown %d"));
3364 #ifdef HAVE_LIBGCRYPT
3365 decr->encr_alg = tvb_get_ntohs(tvb, offset);
3366 #endif
3367 break;
3368 case IKE_ATTR_HASH_ALGORITHM:
3369 proto_tree_add_item(sub_transform_attr_type_tree, hf_isakmp_ike_attr_hash_algorithm, tvb, offset, optlen, ENC_BIG_ENDIAN);
3370 proto_item_append_text(transform_attr_type_item," : %s", val_to_str(tvb_get_ntohs(tvb, offset), transform_attr_hash_type, "Unknown %d"));
3371 #ifdef HAVE_LIBGCRYPT
3372 decr->hash_alg = tvb_get_ntohs(tvb, offset);
3373 #endif
3374 break;
3375 case IKE_ATTR_AUTHENTICATION_METHOD:
3376 proto_tree_add_item(sub_transform_attr_type_tree, hf_isakmp_ike_attr_authentication_method, tvb, offset, optlen, ENC_BIG_ENDIAN);
3377 proto_item_append_text(transform_attr_type_item," : %s", val_to_str(tvb_get_ntohs(tvb, offset), transform_attr_authmeth_type, "Unknown %d"));
3378 #ifdef HAVE_LIBGCRYPT
3379 decr->is_psk = tvb_get_ntohs(tvb, offset) == 0x01 ? TRUE : FALSE;
3380 #endif
3381 break;
3382 case IKE_ATTR_GROUP_DESCRIPTION:
3383 proto_tree_add_item(sub_transform_attr_type_tree, hf_isakmp_ike_attr_group_description, tvb, offset, optlen, ENC_BIG_ENDIAN);
3384 proto_item_append_text(transform_attr_type_item," : %s", val_to_str(tvb_get_ntohs(tvb, offset), transform_dh_group_type, "Unknown %d"));
3385 #ifdef HAVE_LIBGCRYPT
3386 decr->group = tvb_get_ntohs(tvb, offset);
3387 #endif
3388 break;
3389 case IKE_ATTR_GROUP_TYPE:
3390 proto_tree_add_item(sub_transform_attr_type_tree, hf_isakmp_ike_attr_group_type, tvb, offset, optlen, ENC_BIG_ENDIAN);
3391 proto_item_append_text(transform_attr_type_item," : %s", val_to_str(tvb_get_ntohs(tvb, offset), transform_attr_grp_type, "Unknown %d"));
3392 break;
3393 case IKE_ATTR_GROUP_PRIME:
3394 proto_tree_add_item(sub_transform_attr_type_tree, hf_isakmp_ike_attr_group_prime, tvb, offset, optlen, ENC_NA);
3395 break;
3396 case IKE_ATTR_GROUP_GENERATOR_ONE:
3397 proto_tree_add_item(sub_transform_attr_type_tree, hf_isakmp_ike_attr_group_generator_one, tvb, offset, optlen, ENC_NA);
3398 break;
3399 case IKE_ATTR_GROUP_GENERATOR_TWO:
3400 proto_tree_add_item(sub_transform_attr_type_tree, hf_isakmp_ike_attr_group_generator_two, tvb, offset, optlen, ENC_NA);
3401 break;
3402 case IKE_ATTR_GROUP_CURVE_A:
3403 proto_tree_add_item(sub_transform_attr_type_tree, hf_isakmp_ike_attr_group_curve_a, tvb, offset, optlen, ENC_NA);
3404 break;
3405 case IKE_ATTR_GROUP_CURVE_B:
3406 proto_tree_add_item(sub_transform_attr_type_tree, hf_isakmp_ike_attr_group_curve_b, tvb, offset, optlen, ENC_NA);
3407 break;
3408 case IKE_ATTR_LIFE_TYPE:
3409 proto_tree_add_item(sub_transform_attr_type_tree, hf_isakmp_ike_attr_life_type, tvb, offset, optlen, ENC_BIG_ENDIAN);
3410 proto_item_append_text(transform_attr_type_item," : %s", val_to_str(tvb_get_ntohs(tvb, offset), transform_attr_sa_life_type, "Unknown %d"));
3411 break;
3412 case IKE_ATTR_LIFE_DURATION:
3413 dissect_life_duration(tvb, sub_transform_attr_type_tree, transform_attr_type_item, hf_isakmp_ike_attr_life_duration_uint32, hf_isakmp_ike_attr_life_duration_uint64, hf_isakmp_ike_attr_life_duration_bytes, offset, optlen);
3414 break;
3415 case IKE_ATTR_PRF:
3416 proto_tree_add_item(sub_transform_attr_type_tree, hf_isakmp_ike_attr_prf, tvb, offset, optlen, ENC_NA);
3417 break;
3418 case IKE_ATTR_KEY_LENGTH:
3419 proto_tree_add_item(sub_transform_attr_type_tree, hf_isakmp_ike_attr_key_length, tvb, offset, optlen, ENC_BIG_ENDIAN);
3420 proto_item_append_text(transform_attr_type_item," : %d", tvb_get_ntohs(tvb, offset));
3421 break;
3422 case IKE_ATTR_FIELD_SIZE:
3423 proto_tree_add_item(sub_transform_attr_type_tree, hf_isakmp_ike_attr_field_size, tvb, offset, optlen, ENC_NA);
3424 break;
3425 case IKE_ATTR_GROUP_ORDER:
3426 proto_tree_add_item(sub_transform_attr_type_tree, hf_isakmp_ike_attr_group_order, tvb, offset, optlen, ENC_NA);
3427 break;
3428 default:
3429 /* No Default Action */
3430 break;
3431 }
3432
3433 return 2+len+optlen;
3434 }
3435 /* Returns the number of bytes consumed by this option. */
3436 static int
3437 dissect_transform_ike2_attribute(tvbuff_t *tvb, proto_tree *transform_attr_type_tree, int offset )
3438 {
3439 guint optlen, transform_attr_type, len = 0;
3440 proto_item *transform_attr_type_item = NULL;
3441 proto_tree *sub_transform_attr_type_tree = NULL;
3442
3443 transform_attr_type = tvb_get_ntohs(tvb, offset);
3444 optlen = tvb_get_ntohs(tvb, offset+2);
3445 len = 2;
3446
3447 /* is TV ? (Type/Value) ? */
3448 if (transform_attr_type & 0x8000) {
3449 transform_attr_type = transform_attr_type & 0x7fff;
3450 len = 0;
3451 optlen = 2;
3452 }
3453
3454
3455 transform_attr_type_item = proto_tree_add_item(transform_attr_type_tree, hf_isakmp_ike2_attr, tvb, offset, 2+len+optlen, ENC_NA);
3456 proto_item_append_text(transform_attr_type_item," (t=%d,l=%d) %s",transform_attr_type, optlen, val_to_str(transform_attr_type,transform_ike2_attr_type,"Unknown Attribute Type (%02d)") );
3457 sub_transform_attr_type_tree = proto_item_add_subtree(transform_attr_type_item, ett_isakmp_tf_ike2_attr);
3458 proto_tree_add_item(sub_transform_attr_type_tree, hf_isakmp_ike2_attr_format, tvb, offset, 2, ENC_BIG_ENDIAN);
3459 proto_tree_add_uint(sub_transform_attr_type_tree, hf_isakmp_ike2_attr_type, tvb, offset, 2, transform_attr_type);
3460
3461 offset += 2;
3462 if (len)
3463 {
3464 proto_tree_add_item(sub_transform_attr_type_tree, hf_isakmp_ike2_attr_length, tvb, offset, 2, ENC_BIG_ENDIAN);
3465 offset += 2;
3466 }
3467 if (optlen==0)
3468 {
3469 proto_tree_add_text(sub_transform_attr_type_tree, tvb, offset, 0,"Attribut value is empty");
3470 return 2+len;
3471 }
3472 proto_tree_add_item(sub_transform_attr_type_tree, hf_isakmp_ike2_attr_value, tvb, offset, optlen, ENC_NA);
3473 switch(transform_attr_type) {
3474 case IKE2_ATTR_KEY_LENGTH:
3475 proto_tree_add_item(sub_transform_attr_type_tree, hf_isakmp_ike2_attr_key_length, tvb, offset, optlen, ENC_BIG_ENDIAN);
3476 proto_item_append_text(transform_attr_type_item," : %d", tvb_get_ntohs(tvb, offset));
3477 break;
3478 default:
3479 /* No Default Action */
3480 break;
3481 }
3482
3483 return 2+len+optlen;
3484 }
3485 static void
3486 dissect_transform(tvbuff_t *tvb, int offset, int length, proto_tree *tree, int isakmp_version, int protocol_id, void* decr_data
3487 #ifndef HAVE_LIBGCRYPT
3488 _U_
3489 #endif
3490 )
3491 {
3492 if (isakmp_version == 1)
3493 {
3494 guint8 transform_id;
3495 guint8 transform_num;
3496 #ifdef HAVE_LIBGCRYPT
3497 decrypt_data_t *decr = (decrypt_data_t *)decr_data;
3498 #endif /* HAVE_LIBGCRYPT */
3499 int offset_end = 0;
3500 offset_end = offset + length;
3501
3502 transform_num = tvb_get_guint8(tvb, offset);
3503 proto_item_append_text(tree," # %d",transform_num);
3504
3505 proto_tree_add_item(tree, hf_isakmp_trans_number, tvb, offset, 1, ENC_BIG_ENDIAN);
3506 offset += 1;
3507
3508 transform_id = tvb_get_guint8(tvb, offset);
3509 switch (protocol_id) {
3510 case 1: /* ISAKMP */
3511 proto_tree_add_uint_format_value(tree, hf_isakmp_trans_id, tvb, offset, 1,
3512 transform_id, "%s (%u)",
3513 val_to_str_const(transform_id, vs_v1_trans_isakmp, "UNKNOWN-TRANS-TYPE"), transform_id);
3514 break;
3515 case 2: /* AH */
3516 proto_tree_add_uint_format_value(tree, hf_isakmp_trans_id, tvb, offset, 1,
3517 transform_id, "%s (%u)",
3518 val_to_str_const(transform_id, vs_v1_trans_ah, "UNKNOWN-AH-TRANS-TYPE"), transform_id);
3519 break;
3520 case 3: /* ESP */
3521 proto_tree_add_uint_format_value(tree, hf_isakmp_trans_id, tvb, offset, 1,
3522 transform_id, "%s (%u)",
3523 val_to_str_const(transform_id, vs_v1_trans_esp, "UNKNOWN-ESP-TRANS-TYPE"), transform_id);
3524 break;
3525 case 4: /* IPCOMP */
3526 proto_tree_add_uint_format_value(tree, hf_isakmp_trans_id, tvb, offset, 1,
3527 transform_id, "%s (%u)",
3528 val_to_str_const(transform_id, transform_id_ipcomp, "UNKNOWN-IPCOMP-TRANS-TYPE"), transform_id);
3529 break;
3530 default:
3531 proto_tree_add_item(tree, hf_isakmp_trans_id, tvb, offset, 1, ENC_BIG_ENDIAN);
3532 break;
3533 }
3534 offset += 3;
3535
3536 if (protocol_id == 1 && transform_id == 1) {
3537 while (offset < offset_end) {
3538 offset += dissect_transform_ike_attribute(tvb, tree, offset
3539 #ifdef HAVE_LIBGCRYPT
3540 , decr
3541 #endif
3542 );
3543 }
3544 }
3545 else {
3546 while (offset < offset_end) {
3547 offset += dissect_transform_attribute(tvb, tree, offset);
3548 }
3549 }
3550 }
3551 else if(isakmp_version == 2)
3552 {
3553 guint8 transform_type;
3554 int offset_end = 0;
3555 offset_end = offset + length;
3556
3557 transform_type = tvb_get_guint8(tvb, offset);
3558 proto_tree_add_item(tree, hf_isakmp_trans_type, tvb, offset, 1, ENC_BIG_ENDIAN);
3559 offset += 1;
3560
3561 offset += 1; /* Reserved */
3562
3563 switch(transform_type){
3564 case TF_IKE2_ENCR:
3565 proto_tree_add_item(tree, hf_isakmp_trans_encr, tvb, offset, 2, ENC_BIG_ENDIAN);
3566 break;
3567 case TF_IKE2_PRF:
3568 proto_tree_add_item(tree, hf_isakmp_trans_prf, tvb, offset, 2, ENC_BIG_ENDIAN);
3569 break;
3570 case TF_IKE2_INTEG:
3571 proto_tree_add_item(tree, hf_isakmp_trans_integ, tvb, offset, 2, ENC_BIG_ENDIAN);
3572 break;
3573 case TF_IKE2_DH:
3574 proto_tree_add_item(tree, hf_isakmp_trans_dh, tvb, offset, 2, ENC_BIG_ENDIAN);
3575 break;
3576 case TF_IKE2_ESN:
3577 proto_tree_add_item(tree, hf_isakmp_trans_esn, tvb, offset, 2, ENC_BIG_ENDIAN);
3578 break;
3579 default:
3580 proto_tree_add_item(tree, hf_isakmp_trans_id_v2, tvb, offset, 2, ENC_BIG_ENDIAN);
3581 break;
3582 }
3583 offset += 2;
3584
3585 while (offset < offset_end) {
3586 offset += dissect_transform_ike2_attribute(tvb, tree, offset);
3587 }
3588 }
3589 }
3590
3591 static void
3592 dissect_key_exch(tvbuff_t *tvb, int offset, int length, proto_tree *tree, int isakmp_version,
3593 #ifdef HAVE_LIBGCRYPT
3594 packet_info* pinfo,
3595 void* decr_data
3596 #else
3597 packet_info* pinfo _U_,
3598 void* decr_data _U_
3599 #endif
3600 )
3601 {
3602 #ifdef HAVE_LIBGCRYPT
3603 decrypt_data_t *decr = (decrypt_data_t *)decr_data;
3604 #endif /* HAVE_LIBGCRYPT */
3605
3606 if (isakmp_version == 2) {
3607 proto_tree_add_item(tree, hf_isakmp_key_exch_dh_group, tvb, offset, 2, ENC_BIG_ENDIAN);
3608 offset += 4;
3609 length -= 4;
3610 }
3611
3612 proto_tree_add_item(tree, hf_isakmp_key_exch_data, tvb, offset, length, ENC_NA);
3613
3614 #ifdef HAVE_LIBGCRYPT
3615 if (decr && decr->gi_len == 0 && ADDRESSES_EQUAL(&decr->initiator, &pinfo->src)) {
3616 decr->gi = (gchar *)g_malloc(length);
3617 tvb_memcpy(tvb, decr->gi, offset, length);
3618 decr->gi_len = length;
3619 } else if (decr && decr->gr_len == 0 && !ADDRESSES_EQUAL(&decr->initiator, &pinfo->src)) {
3620 decr->gr = (gchar *)g_malloc(length);
3621 tvb_memcpy(tvb, decr->gr, offset, length);
3622 decr->gr_len = length;
3623 }
3624 #endif /* HAVE_LIBGCRYPT */
3625 }
3626
3627 static void
3628 dissect_id(tvbuff_t *tvb, int offset, int length, proto_tree *tree, int isakmp_version, packet_info *pinfo )
3629 {
3630 guint8 id_type;
3631 guint8 protocol_id;
3632 guint16 port;
3633 proto_item *idit;
3634 proto_tree *idtree;
3635 asn1_ctx_t asn1_ctx;
3636 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, TRUE, pinfo);
3637
3638 id_type = tvb_get_guint8(tvb, offset);
3639 if (isakmp_version == 1)
3640 {
3641 proto_tree_add_item(tree, hf_isakmp_id_type_v1, tvb, offset, 1, ENC_BIG_ENDIAN);
3642 }else if (isakmp_version == 2)
3643 {
3644 proto_tree_add_item(tree, hf_isakmp_id_type_v2, tvb, offset, 1, ENC_BIG_ENDIAN);
3645 }
3646 offset += 1;
3647 length -= 1;
3648
3649 protocol_id= tvb_get_guint8(tvb, offset);
3650 if (protocol_id == 0)
3651 proto_tree_add_uint_format_value(tree, hf_isakmp_id_protoid, tvb, offset,1,
3652 protocol_id, "Unused");
3653 else
3654 proto_tree_add_item(tree, hf_isakmp_id_protoid, tvb, offset, 1, ENC_BIG_ENDIAN);
3655
3656 offset += 1;
3657 length -= 1;
3658
3659 port = tvb_get_ntohs(tvb, offset);
3660 if (port == 0)
3661 proto_tree_add_uint_format_value(tree, hf_isakmp_id_port, tvb, offset, 2,
3662 port, "Unused");
3663 else
3664 proto_tree_add_item(tree, hf_isakmp_id_port, tvb, offset, 2, ENC_BIG_ENDIAN);
3665
3666 offset += 2;
3667 length -= 2;
3668
3669
3670 /*
3671 * It shows strings of all types though some of types are not
3672 * supported in IKEv2 specification actually.
3673 */
3674 idit = proto_tree_add_item(tree, hf_isakmp_id_data, tvb, offset, length, ENC_NA);
3675 idtree = proto_item_add_subtree(idit, ett_isakmp_id);
3676 switch (id_type) {
3677 case IKE_ID_IPV4_ADDR:
3678 proto_tree_add_item(idtree, hf_isakmp_id_data_ipv4_addr, tvb, offset, 4, ENC_BIG_ENDIAN);
3679 proto_item_append_text(idit, "%s", tvb_ip_to_str(tvb, offset));
3680 break;
3681 case IKE_ID_FQDN:
3682 proto_tree_add_item(idtree, hf_isakmp_id_data_fqdn, tvb, offset, length, ENC_ASCII|ENC_NA);
3683 proto_item_append_text(idit, "%s", tvb_get_string(wmem_packet_scope(), tvb, offset,length));
3684 break;
3685 case IKE_ID_USER_FQDN:
3686 proto_tree_add_item(idtree, hf_isakmp_id_data_user_fqdn, tvb, offset, length, ENC_ASCII|ENC_NA);
3687 proto_item_append_text(idit, "%s", tvb_get_string(wmem_packet_scope(), tvb, offset,length));
3688 break;
3689 case IKE_ID_IPV4_ADDR_SUBNET:
3690 proto_tree_add_item(idtree, hf_isakmp_id_data_ipv4_addr, tvb, offset, 4, ENC_BIG_ENDIAN);
3691 proto_tree_add_item(idtree, hf_isakmp_id_data_ipv4_subnet, tvb, offset+4, 4, ENC_BIG_ENDIAN);
3692 proto_item_append_text(idit, "%s/%s", tvb_ip_to_str(tvb, offset), tvb_ip_to_str(tvb, offset+4));
3693 break;
3694 case IKE_ID_IPV4_ADDR_RANGE:
3695 proto_tree_add_item(idtree, hf_isakmp_id_data_ipv4_range_start, tvb, offset, 4, ENC_BIG_ENDIAN);
3696 proto_tree_add_item(idtree, hf_isakmp_id_data_ipv4_range_end, tvb, offset+4, 4, ENC_BIG_ENDIAN);
3697 proto_item_append_text(idit, "%s/%s", tvb_ip_to_str(tvb, offset), tvb_ip_to_str(tvb, offset+4));
3698 break;
3699 case IKE_ID_IPV6_ADDR:
3700 proto_tree_add_item(idtree, hf_isakmp_id_data_ipv6_addr, tvb, offset, 16, ENC_NA);
3701 proto_item_append_text(idit, "%s", tvb_ip6_to_str(tvb, offset));
3702 break;
3703 case IKE_ID_IPV6_ADDR_SUBNET:
3704 proto_tree_add_item(idtree, hf_isakmp_id_data_ipv6_addr, tvb, offset, 16, ENC_NA);
3705 proto_tree_add_item(idtree, hf_isakmp_id_data_ipv6_subnet, tvb, offset+16, 16, ENC_NA);
3706 proto_item_append_text(idit, "%s/%s", tvb_ip6_to_str(tvb, offset), tvb_ip6_to_str(tvb, offset+16));
3707 break;
3708 case IKE_ID_IPV6_ADDR_RANGE:
3709 proto_tree_add_item(idtree, hf_isakmp_id_data_ipv6_range_start, tvb, offset, 16, ENC_NA);
3710 proto_tree_add_item(idtree, hf_isakmp_id_data_ipv6_range_end, tvb, offset+16, 16, ENC_NA);
3711 proto_item_append_text(idit, "%s/%s", tvb_ip6_to_str(tvb, offset), tvb_ip6_to_str(tvb, offset+16));
3712 break;
3713 case IKE_ID_KEY_ID:
3714 proto_tree_add_item(idtree, hf_isakmp_id_data_key_id, tvb, offset, length, ENC_NA);
3715 break;
3716 case IKE_ID_DER_ASN1_DN:
3717 dissect_x509if_Name(FALSE, tvb, offset, &asn1_ctx, tree, hf_isakmp_id_data_cert);
3718 break;
3719 default:
3720 proto_item_append_text(idit, "%s", tvb_bytes_to_str(tvb,offset,length));
3721 break;
3722 }
3723 }
3724
3725 static void
3726 dissect_cert(tvbuff_t *tvb, int offset, int length _U_, proto_tree *tree, int isakmp_version, packet_info *pinfo )
3727 {
3728 asn1_ctx_t asn1_ctx;
3729 asn1_ctx_init(&asn1_ctx, ASN1_ENC_PER, TRUE, pinfo);
3730
3731 if (isakmp_version == 1)
3732 {
3733 proto_tree_add_item(tree, hf_isakmp_cert_encoding_v1, tvb, offset, 1, ENC_BIG_ENDIAN);
3734 }else if (isakmp_version == 2)
3735 {
3736 proto_tree_add_item(tree, hf_isakmp_cert_encoding_v2, tvb, offset, 1, ENC_BIG_ENDIAN);
3737 }
3738
3739 offset += 1;
3740
3741 dissect_x509af_Certificate(FALSE, tvb, offset, &asn1_ctx, tree, hf_isakmp_cert_data);
3742 }
3743
3744 static void
3745 dissect_certreq(tvbuff_t *tvb, int offset, int length, proto_tree *tree, int isakmp_version, packet_info *pinfo )
3746 {
3747 guint8 cert_type;
3748 asn1_ctx_t asn1_ctx;
3749 asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, TRUE, pinfo);
3750 cert_type = tvb_get_guint8(tvb, offset);
3751
3752 if (isakmp_version == 1)
3753 {
3754 proto_tree_add_item(tree, hf_isakmp_certreq_type_v1, tvb, offset, 1, ENC_BIG_ENDIAN);
3755 }else if (isakmp_version == 2)
3756 {
3757 proto_tree_add_item(tree, hf_isakmp_certreq_type_v2, tvb, offset, 1, ENC_BIG_ENDIAN);
3758 }
3759
3760 offset += 1;
3761 length -= 1;
3762
3763 if (isakmp_version == 1)
3764 {
3765 switch(cert_type){
3766 case 4:
3767 dissect_x509if_Name(FALSE, tvb, offset, &asn1_ctx, tree, hf_isakmp_certreq_authority_sig);
3768 break;
3769 default:
3770 proto_tree_add_item(tree, hf_isakmp_certreq_authority_v1, tvb, offset, length, ENC_NA);
3771 break;
3772 }
3773 }else if (isakmp_version == 2)
3774 {
3775 /* this is a list of 20 byte SHA-1 hashes */
3776 while (length > 0) {
3777 proto_tree_add_item(tree, hf_isakmp_certreq_authority_v2, tvb, offset, 20, ENC_NA);
3778 offset+=20;
3779 length-=20;
3780 }
3781 }
3782 }
3783
3784
3785
3786
3787 static void
3788 dissect_auth(tvbuff_t *tvb, int offset, int length, proto_tree *tree)
3789 {
3790
3791 proto_tree_add_item(tree, hf_isakmp_auth_meth, tvb, offset, 1, ENC_BIG_ENDIAN);
3792
3793 offset += 4;
3794 length -= 4;
3795
3796 proto_tree_add_item(tree, hf_isakmp_auth_data, tvb, offset, length, ENC_NA);
3797
3798 }
3799
3800 static void
3801 dissect_hash(tvbuff_t *tvb, int offset, int length, proto_tree *ntree)
3802 {
3803 proto_tree_add_item(ntree, hf_isakmp_hash, tvb, offset, length, ENC_NA);
3804 }
3805 static void
3806 dissect_sig(tvbuff_t *tvb, int offset, int length, proto_tree *ntree)
3807 {
3808 proto_tree_add_item(ntree, hf_isakmp_sig, tvb, offset, length, ENC_NA);
3809 }
3810 static void
3811 dissect_nonce(tvbuff_t *tvb, int offset, int length, proto_tree *ntree)
3812 {
3813 proto_tree_add_item(ntree, hf_isakmp_nonce, tvb, offset, length, ENC_NA);
3814 }
3815 static void
3816 dissect_cisco_fragmentation(tvbuff_t *tvb, int offset, int length, proto_tree *tree, packet_info *pinfo)
3817 {
3818
3819 guint8 seq; /* Packet sequence number, starting from 1 */
3820 guint8 last;
3821 proto_tree *ptree = NULL;
3822 ptree = proto_tree_get_parent(tree);
3823 if (length < 4)
3824 return;
3825
3826 proto_tree_add_item(tree, hf_isakmp_cisco_frag_packetid, tvb, offset, 2, ENC_BIG_ENDIAN);
3827 offset += 2;
3828 seq = tvb_get_guint8(tvb, offset);
3829 proto_tree_add_item(tree, hf_isakmp_cisco_frag_seq, tvb, offset, 1, ENC_BIG_ENDIAN);
3830 offset += 1;
3831 last = tvb_get_guint8(tvb, offset);
3832 proto_tree_add_item(tree, hf_isakmp_cisco_frag_last, tvb, offset, 1, ENC_BIG_ENDIAN);
3833 offset += 1;
3834 /*length-=4;*/
3835
3836 /* Start Reassembly stuff for Cisco IKE fragmentation */
3837 {
3838 gboolean save_fragmented;
3839 tvbuff_t *defrag_isakmp_tvb = NULL;
3840 fragment_head *frag_msg = NULL;
3841
3842 save_fragmented = pinfo->fragmented;
3843 pinfo->fragmented = TRUE;
3844 frag_msg = fragment_add_seq_check(&isakmp_reassembly_table, tvb, offset,
3845 pinfo,
3846 12345, /*FIXME: Fragmented packet id, guint16, somehow get CKY here */
3847 NULL,
3848 seq-1, /* fragment sequence number, starting from 0 */
3849 tvb_length_remaining(tvb, offset), /* fragment length - to the end */
3850 last); /* More fragments? */
3851 defrag_isakmp_tvb = process_reassembled_data(tvb, offset, pinfo,
3852 "Reassembled ISAKMP", frag_msg, &isakmp_frag_items,
3853 NULL, ptree);
3854
3855 if (defrag_isakmp_tvb) { /* take it all */
3856 dissect_isakmp(defrag_isakmp_tvb, pinfo, ptree);
3857 }
3858 col_append_fstr(pinfo->cinfo, COL_INFO,
3859 " (%sMessage fragment %u%s)",
3860 (frag_msg ? "Reassembled + " : ""),
3861 seq, (last ? " - last" : ""));
3862 pinfo->fragmented = save_fragmented;
3863 }
3864 /* End Reassembly stuff for Cisco IKE fragmentation */
3865
3866 }
3867 static void
3868 dissect_notif(tvbuff_t *tvb, int offset, int length, proto_tree *tree, int isakmp_version)
3869 {
3870
3871 guint8 spi_size;
3872 guint16 msgtype;
3873 int offset_end = 0;
3874 offset_end = offset + length;
3875
3876 if (isakmp_version == 1) {
3877
3878 proto_tree_add_item(tree, hf_isakmp_notify_doi, tvb, offset, 1, ENC_BIG_ENDIAN);
3879 offset += 4;
3880 length -= 4;
3881 }
3882
3883 if (isakmp_version == 1)
3884 {
3885 proto_tree_add_item(tree, hf_isakmp_notify_protoid_v1, tvb, offset, 1, ENC_BIG_ENDIAN);
3886 }else if (isakmp_version == 2)
3887 {
3888 proto_tree_add_item(tree, hf_isakmp_notify_protoid_v2, tvb, offset, 1, ENC_BIG_ENDIAN);
3889 }
3890 offset += 1;
3891 length -= 1;
3892
3893 spi_size = tvb_get_guint8(tvb, offset);
3894 proto_tree_add_item(tree, hf_isakmp_spisize, tvb, offset, 1, ENC_BIG_ENDIAN);
3895 offset += 1;
3896 length -= 1;
3897
3898 msgtype = tvb_get_ntohs(tvb, offset);
3899
3900 if (isakmp_version == 1)
3901 {
3902 proto_tree_add_item(tree, hf_isakmp_notify_msgtype_v1, tvb, offset, 2, ENC_BIG_ENDIAN);
3903 }else if (isakmp_version == 2)
3904 {
3905 proto_tree_add_item(tree, hf_isakmp_notify_msgtype_v2, tvb, offset, 2, ENC_BIG_ENDIAN);
3906 }
3907 offset += 2;
3908 length -= 2;
3909
3910 if (spi_size) {
3911 proto_tree_add_item(tree, hf_isakmp_spi, tvb, offset, spi_size, ENC_NA);
3912 offset += spi_size;
3913 length -= spi_size;
3914 }
3915
3916 /* Notification Data */
3917
3918 proto_tree_add_item(tree, hf_isakmp_notify_data, tvb, offset, length, ENC_NA);
3919
3920 if (isakmp_version == 1)
3921 {
3922 switch (msgtype) {
3923 case 36136: /* DPD ARE YOU THERE */
3924 proto_tree_add_item(tree, hf_isakmp_notify_data_dpd_are_you_there, tvb, offset, length, ENC_BIG_ENDIAN);
3925 break;
3926 case 36137: /* DPD ARE YOU THERE ACK */
3927 proto_tree_add_item(tree, hf_isakmp_notify_data_dpd_are_you_there_ack, tvb, offset, length, ENC_BIG_ENDIAN);
3928 break;
3929 case 40501: /* UNITY Load Balance */
3930 proto_tree_add_item(tree, hf_isakmp_notify_data_unity_load_balance, tvb, offset, length, ENC_BIG_ENDIAN);
3931 break;
3932 default:
3933 /* No Default Action */
3934 break;
3935 }
3936
3937 } else if (isakmp_version == 2)
3938 {
3939 switch(msgtype){
3940 case 16387: /* IPCOMP_SUPPORTED */
3941 proto_tree_add_item(tree, hf_isakmp_notify_data_ipcomp_cpi, tvb, offset, 2, ENC_BIG_ENDIAN);
3942 proto_tree_add_item(tree, hf_isakmp_notify_data_ipcomp_transform_id, tvb, offset+2, 1, ENC_BIG_ENDIAN);
3943 break;
3944 case 16407: /* REDIRECT */
3945 proto_tree_add_item(tree, hf_isakmp_notify_data_redirect_gw_ident_type, tvb, offset, 1, ENC_BIG_ENDIAN);
3946 proto_tree_add_item(tree, hf_isakmp_notify_data_redirect_gw_ident_len, tvb, offset+1, 1, ENC_BIG_ENDIAN);
3947 switch(tvb_get_guint8(tvb, offset)){ /* Ident Type ? */
3948 case 1:
3949 proto_tree_add_item(tree, hf_isakmp_notify_data_redirect_new_resp_gw_ident_ipv4, tvb, offset+2, 4, ENC_BIG_ENDIAN);
3950 break;
3951 case 2:
3952 proto_tree_add_item(tree, hf_isakmp_notify_data_redirect_new_resp_gw_ident_ipv6, tvb, offset+2, 16, ENC_NA);
3953 break;
3954 case 3:
3955 proto_tree_add_item(tree, hf_isakmp_notify_data_redirect_new_resp_gw_ident_fqdn, tvb, offset+2, tvb_get_guint8(tvb,offset+1), ENC_ASCII|ENC_NA);
3956 break;
3957 default :
3958 proto_tree_add_item(tree, hf_isakmp_notify_data_redirect_new_resp_gw_ident, tvb, offset+2, tvb_get_guint8(tvb,offset+1), ENC_NA);
3959 break;
3960 }
3961 length -= tvb_get_guint8(tvb, offset+1) - 2;
3962 offset += tvb_get_guint8(tvb, offset+1) + 2;
3963 if(length)
3964 {
3965 proto_tree_add_item(tree, hf_isakmp_notify_data_redirect_nonce_data, tvb, offset, length, ENC_NA);
3966 }
3967 break;
3968 case 16408: /* REDIRECT_FROM */
3969 proto_tree_add_item(tree, hf_isakmp_notify_data_redirect_gw_ident_type, tvb, offset, 1, ENC_BIG_ENDIAN);
3970 proto_tree_add_item(tree, hf_isakmp_notify_data_redirect_gw_ident_len, tvb, offset+1, 1, ENC_BIG_ENDIAN);
3971 switch(tvb_get_guint8(tvb, offset)){ /* Ident Type ? */
3972 case 1:
3973 proto_tree_add_item(tree, hf_isakmp_notify_data_redirect_org_resp_gw_ident_ipv4, tvb, offset+2, 4, ENC_BIG_ENDIAN);
3974 break;
3975 case 2:
3976 proto_tree_add_item(tree, hf_isakmp_notify_data_redirect_org_resp_gw_ident_ipv6, tvb, offset+2, 16, ENC_NA);
3977 break;
3978 default :
3979 proto_tree_add_item(tree, hf_isakmp_notify_data_redirect_org_resp_gw_ident, tvb, offset+2, tvb_get_guint8(tvb,offset+1), ENC_NA);
3980 break;
3981 }
3982 break;
3983 case 16409: /* TICKET_LT_OPAQUE */
3984 proto_tree_add_item(tree, hf_isakmp_notify_data_ticket_lifetime, tvb, offset, 4, ENC_BIG_ENDIAN);
3985 offset += 4;
3986 length -= 4;
3987 proto_tree_add_item(tree, hf_isakmp_notify_data_ticket_data, tvb, offset, length, ENC_NA);
3988 break;
3989 case 16413: /* TICKET_OPAQUE */
3990 proto_tree_add_item(tree, hf_isakmp_notify_data_ticket_data, tvb, offset, length, ENC_NA);
3991 break;
3992 case 16416: /* ROHC_SUPPORTED */
3993 while (offset < offset_end) {
3994 offset += dissect_rohc_supported(tvb, tree, offset);
3995 }
3996 break;
3997 case 16419: /* QUICK_CRASH_DETECTION */
3998 proto_tree_add_item(tree, hf_isakmp_notify_data_qcd_token_secret_data, tvb, offset, length, ENC_NA);
3999 break;
4000 case 16422: /* IKEV2_MESSAGE_ID_SYNC */
4001 proto_tree_add_item(tree, hf_isakmp_notify_data_ha_nonce_data, tvb, offset, 4, ENC_BIG_ENDIAN);
4002 offset += 4;
4003 proto_tree_add_item(tree, hf_isakmp_notify_data_ha_expected_send_req_msg_id, tvb, offset, 4, ENC_BIG_ENDIAN);
4004 offset += 4;
4005 proto_tree_add_item(tree, hf_isakmp_notify_data_ha_expected_recv_req_msg_id, tvb, offset, 4, ENC_BIG_ENDIAN);
4006 break;
4007 case 16423: /* IPSEC_REPLAY_COUNTER_SYNC */
4008 proto_tree_add_item(tree, hf_isakmp_notify_data_ha_incoming_ipsec_sa_delta_value, tvb, offset, length, ENC_NA);
4009 break;
4010 case 16424: /* SECURE_PASSWORD_METHODS */
4011 proto_tree_add_item(tree, hf_isakmp_notify_data_secure_password_methods, tvb, offset, length, ENC_NA);
4012 break;
4013 default:
4014 /* No Default Action */
4015 break;
4016 }
4017 }
4018
4019 }
4020
4021 static void
4022 dissect_delete(tvbuff_t *tvb, int offset, int length, proto_tree *tree, int isakmp_version)
4023 {
4024 guint8 spi_size;
4025
4026 if (isakmp_version == 1) {
4027
4028 proto_tree_add_item(tree, hf_isakmp_delete_doi, tvb, offset, 1, ENC_BIG_ENDIAN);
4029 offset += 4;
4030 length -= 4;
4031 }
4032
4033
4034 if (isakmp_version == 1)
4035 {
4036 proto_tree_add_item(tree, hf_isakmp_delete_protoid_v1, tvb, offset, 1, ENC_BIG_ENDIAN);
4037 }else if (isakmp_version == 2)
4038 {
4039 proto_tree_add_item(tree, hf_isakmp_delete_protoid_v2, tvb, offset, 1, ENC_BIG_ENDIAN);
4040 }
4041
4042 offset += 1;
4043 length -= 1;
4044
4045 spi_size = tvb_get_guint8(tvb, offset);
4046 proto_tree_add_item(tree, hf_isakmp_spisize, tvb, offset, 1, ENC_BIG_ENDIAN);
4047 offset += 1;
4048 length -= 1;
4049
4050 proto_tree_add_item(tree, hf_isakmp_num_spis, tvb, offset, 2, ENC_BIG_ENDIAN);
4051 offset += 2;
4052 length -= 2;
4053
4054 if (spi_size > 0) {
4055 while (length > 0) {
4056 proto_tree_add_item(tree, hf_isakmp_delete_spi, tvb, offset, spi_size, ENC_NA);
4057 offset+=spi_size;
4058 length-=spi_size;
4059 }
4060 }
4061 }
4062
4063
4064 static int
4065 dissect_vid(tvbuff_t *tvb, int offset, int length, proto_tree *tree)
4066 {
4067 const guint8 * pVID;
4068 const char * vendorstring;
4069
4070 pVID = tvb_get_ptr(tvb, offset, length);
4071
4072 vendorstring = byte_to_str(pVID, (gint)length, vendor_id, "Unknown Vendor ID");
4073 proto_tree_add_item(tree, hf_isakmp_vid_bytes, tvb, offset, length, ENC_NA);
4074 proto_tree_add_string(tree, hf_isakmp_vid_string, tvb, offset, length, vendorstring);
4075 proto_item_append_text(tree," : %s", vendorstring);
4076
4077 /* very old CryptPro/GOST (Check Point R65) VID */
4078 if (length >= 24 && memcmp(pVID, VID_CP_01_R65, 20) == 0)
4079 {
4080 offset += 20;
4081 proto_tree_add_item(tree, hf_isakmp_vid_cp_product, tvb, offset, 4, ENC_BIG_ENDIAN);
4082 offset +=4;
4083 proto_tree_add_item(tree, hf_isakmp_vid_cp_version, tvb, offset, 4, ENC_BIG_ENDIAN);
4084 offset +=4;
4085 proto_tree_add_item(tree, hf_isakmp_vid_cp_timestamp, tvb, offset, 4, ENC_BIG_ENDIAN);
4086 offset +=4;
4087 proto_tree_add_item(tree, hf_isakmp_vid_cp_reserved, tvb, offset, 4, ENC_BIG_ENDIAN);
4088 offset +=4;
4089 proto_tree_add_item(tree, hf_isakmp_vid_cp_features, tvb, offset, 4, ENC_BIG_ENDIAN);
4090 offset +=4;
4091 }
4092
4093 /* Cisco Unity VID */
4094 if (length >= 14 && memcmp(pVID, VID_CISCO_UNITY, 14) == 0)
4095 {
4096 offset += 14;
4097 proto_tree_add_item(tree, hf_isakmp_vid_cisco_unity_major, tvb, offset, 1, ENC_BIG_ENDIAN);
4098 proto_item_append_text(tree, " %u", tvb_get_guint8(tvb,offset));
4099 offset += 1;
4100 proto_tree_add_item(tree, hf_isakmp_vid_cisco_unity_minor, tvb, offset, 1, ENC_BIG_ENDIAN);
4101 proto_item_append_text(tree, ".%u", tvb_get_guint8(tvb,offset));
4102 offset += 1;
4103 }
4104
4105 /* VID_MS_NT5_ISAKMPOAKLEY */
4106 if (length >= 16 && memcmp(pVID, VID_MS_NT5_ISAKMPOAKLEY, 16) == 0)
4107 {
4108 offset += 16;
4109 proto_tree_add_item(tree, hf_isakmp_vid_ms_nt5_isakmpoakley, tvb, offset, 4, ENC_BIG_ENDIAN);
4110 offset += 4;
4111 }
4112
4113 /* VID_ARUBA_VIA_AUTH_PROFILE */
4114 if (length >= 19 && memcmp(pVID, VID_ARUBA_VIA_AUTH_PROFILE, 19) == 0)
4115 {
4116 offset += 19;
4117 proto_tree_add_item(tree, hf_isakmp_vid_aruba_via_auth_profile, tvb, offset, length-19, ENC_ASCII|ENC_NA);
4118 offset += 4;
4119 }
4120 return offset;
4121 }
4122 /* Returns the number of bytes consumed by this option. */
4123 static int
4124 dissect_config_attribute(tvbuff_t *tvb, proto_tree *cfg_attr_type_tree, int offset, int isakmp_version)
4125 {
4126 guint optlen, cfg_attr_type, len = 0;
4127 int offset_end = 0;
4128 proto_item *cfg_attr_type_item = NULL;
4129 proto_tree *sub_cfg_attr_type_tree = NULL;
4130
4131 cfg_attr_type = tvb_get_ntohs(tvb, offset);
4132 optlen = tvb_get_ntohs(tvb, offset+2);
4133 len = 2;
4134
4135 /* No Length ? */
4136 if (cfg_attr_type & 0x8000) {
4137 cfg_attr_type = cfg_attr_type & 0x7fff;
4138 len = 0;
4139 optlen = 2;
4140 }
4141
4142 if (isakmp_version == 1) {
4143
4144 cfg_attr_type_item = proto_tree_add_none_format(cfg_attr_type_tree, hf_isakmp_cfg_attr, tvb, offset, 2+len+optlen, "Attribute Type: (t=%d,l=%d) %s", cfg_attr_type, optlen, rval_to_str(cfg_attr_type,vs_v1_cfgattr,"Unknown Attribute Type (%02d)") );
4145 sub_cfg_attr_type_tree = proto_item_add_subtree(cfg_attr_type_item, ett_isakmp_cfg_attr);
4146 proto_tree_add_uint(sub_cfg_attr_type_tree, hf_isakmp_cfg_attr_type_v1, tvb, offset, 2, cfg_attr_type);
4147 } else if (isakmp_version == 2) {
4148 cfg_attr_type_item = proto_tree_add_none_format(cfg_attr_type_tree, hf_isakmp_cfg_attr, tvb, offset, 2+len+optlen, "Attribute Type: (t=%d,l=%d) %s", cfg_attr_type, optlen, rval_to_str(cfg_attr_type,vs_v2_cfgattr,"Unknown Attribute Type (%02d)") );
4149 sub_cfg_attr_type_tree = proto_item_add_subtree(cfg_attr_type_item, ett_isakmp_cfg_attr);
4150 proto_tree_add_uint(sub_cfg_attr_type_tree, hf_isakmp_cfg_attr_type_v2, tvb, offset, 2, cfg_attr_type);
4151 }
4152 proto_tree_add_item(sub_cfg_attr_type_tree, hf_isakmp_cfg_attr_format, tvb, offset, 2, ENC_BIG_ENDIAN);
4153 offset += 2;
4154 if (len)
4155 {
4156 proto_tree_add_item(sub_cfg_attr_type_tree, hf_isakmp_cfg_attr_length, tvb, offset, 2, ENC_BIG_ENDIAN);
4157 offset += 2;
4158 }
4159 if (optlen==0)
4160 {
4161 proto_tree_add_text(sub_cfg_attr_type_tree, tvb, offset, 0,"Attribut value is empty");
4162 return 2+len;
4163 }
4164 proto_tree_add_item(sub_cfg_attr_type_tree, hf_isakmp_cfg_attr_value, tvb, offset, optlen, ENC_NA);
4165 switch (cfg_attr_type) {
4166 case INTERNAL_IP4_ADDRESS: /* 1 */
4167 offset_end = offset + optlen;
4168
4169 if (optlen%4 == 0)
4170 {
4171 while (offset_end-offset > 0)
4172 {
4173 proto_tree_add_item(sub_cfg_attr_type_tree, hf_isakmp_cfg_attr_internal_ip4_address, tvb, offset, 4, ENC_BIG_ENDIAN);
4174 offset += 4;
4175 }
4176
4177 }
4178 break;
4179 case INTERNAL_IP4_NETMASK: /* 2 */
4180 proto_tree_add_item(sub_cfg_attr_type_tree, hf_isakmp_cfg_attr_internal_ip4_netmask, tvb, offset, 4, ENC_BIG_ENDIAN);
4181 break;
4182 case INTERNAL_IP4_DNS: /* 3 */
4183 offset_end = offset + optlen;
4184
4185 if (optlen%4 == 0)
4186 {
4187 while (offset_end-offset > 0)
4188 {
4189 proto_tree_add_item(sub_cfg_attr_type_tree, hf_isakmp_cfg_attr_internal_ip4_dns, tvb, offset, 4, ENC_BIG_ENDIAN);
4190 offset += 4;
4191 }
4192
4193 }
4194 break;
4195 case INTERNAL_IP4_NBNS: /* 4 */
4196 offset_end = offset + optlen;
4197
4198 if (optlen%4 == 0)
4199 {
4200 while (offset_end-offset > 0)
4201 {
4202 proto_tree_add_item(sub_cfg_attr_type_tree, hf_isakmp_cfg_attr_internal_ip4_nbns, tvb, offset, 4, ENC_BIG_ENDIAN);
4203 offset += 4;
4204 }
4205
4206 }
4207 break;
4208 case INTERNAL_ADDRESS_EXPIRY: /* 5 */
4209 proto_tree_add_item(sub_cfg_attr_type_tree, hf_isakmp_cfg_attr_internal_address_expiry, tvb, offset, 4, ENC_BIG_ENDIAN);
4210 break;
4211 case INTERNAL_IP4_DHCP: /* 6 */
4212 offset_end = offset + optlen;
4213
4214 if (optlen%4 == 0)
4215 {
4216 while (offset_end-offset > 0)
4217 {
4218 proto_tree_add_item(sub_cfg_attr_type_tree, hf_isakmp_cfg_attr_internal_ip4_dhcp, tvb, offset, 4, ENC_BIG_ENDIAN);
4219 offset += 4;
4220 }
4221
4222 }
4223 break;
4224 case APPLICATION_VERSION: /* 7 */
4225 proto_tree_add_item(sub_cfg_attr_type_tree, hf_isakmp_cfg_attr_application_version, tvb, offset, optlen, ENC_ASCII|ENC_NA);
4226 proto_item_append_text(cfg_attr_type_item," : %s", tvb_get_string(wmem_packet_scope(), tvb, offset,optlen));
4227 break;
4228 case INTERNAL_IP6_ADDRESS: /* 8 */
4229 offset_end = offset + optlen;
4230
4231 if (optlen%16 == 0)
4232 {
4233 while (offset_end-offset > 0)
4234 {
4235 proto_tree_add_item(sub_cfg_attr_type_tree, hf_isakmp_cfg_attr_internal_ip6_address, tvb, offset, 16, ENC_BIG_ENDIAN);
4236 offset += 16;
4237 }
4238
4239 }
4240 break;
4241 case INTERNAL_IP6_NETMASK: /* 9 Only in IKEv1 */
4242 proto_tree_add_item(sub_cfg_attr_type_tree, hf_isakmp_cfg_attr_internal_ip6_netmask, tvb, offset, 18, ENC_NA);
4243 break;
4244 case INTERNAL_IP6_DNS: /* 10 */
4245 offset_end = offset + optlen;
4246
4247 if (optlen%16 == 0)
4248 {
4249 while (offset_end-offset > 0)
4250 {
4251 proto_tree_add_item(sub_cfg_attr_type_tree, hf_isakmp_cfg_attr_internal_ip6_dns, tvb, offset, 16, ENC_NA);
4252 offset += 16;
4253 }
4254
4255 }
4256 break;
4257 case INTERNAL_IP6_NBNS: /* 11 */
4258 offset_end = offset + optlen;
4259
4260 if (optlen%16 == 0)
4261 {
4262 while (offset_end-offset > 0)
4263 {
4264 proto_tree_add_item(sub_cfg_attr_type_tree, hf_isakmp_cfg_attr_internal_ip6_nbns, tvb, offset, 16, ENC_NA);
4265 offset += 16;
4266 }
4267
4268 }
4269 break;
4270 case INTERNAL_IP6_DHCP: /* 12 */
4271 offset_end = offset + optlen;
4272
4273 if (optlen%16 == 0)
4274 {
4275 while (offset_end-offset > 0)
4276 {
4277 proto_tree_add_item(sub_cfg_attr_type_tree, hf_isakmp_cfg_attr_internal_ip6_dhcp, tvb, offset, 16, ENC_NA);
4278 offset += 16;
4279 }
4280
4281 }
4282 break;
4283 case INTERNAL_IP4_SUBNET: /* 13 */
4284 offset_end = offset + optlen;
4285
4286 if (optlen%8 == 0)
4287 {
4288 while (offset_end-offset > 0)
4289 {
4290 proto_tree_add_item(sub_cfg_attr_type_tree, hf_isakmp_cfg_attr_internal_ip4_subnet_ip, tvb, offset, 4, ENC_BIG_ENDIAN);
4291 proto_tree_add_item(sub_cfg_attr_type_tree, hf_isakmp_cfg_attr_internal_ip4_subnet_netmask, tvb, offset, 4, ENC_BIG_ENDIAN);
4292 offset += 8;
4293 }
4294
4295 }
4296 break;
4297 case SUPPORTED_ATTRIBUTES: /* 14 */
4298 offset_end = offset + optlen;
4299
4300 if (optlen%2 == 0)
4301 {
4302 while (offset_end-offset > 0)
4303 {
4304 proto_tree_add_item(sub_cfg_attr_type_tree, hf_isakmp_cfg_attr_supported_attributes, tvb, offset, 2, ENC_BIG_ENDIAN);
4305 offset += 2;
4306 }
4307
4308 }
4309 break;
4310 case INTERNAL_IP6_SUBNET: /* 15 */
4311 offset_end = offset + optlen;
4312
4313 if (optlen%17 == 0)
4314 {
4315 while (offset_end-offset > 0)
4316 {
4317 proto_tree_add_item(sub_cfg_attr_type_tree, hf_isakmp_cfg_attr_internal_ip6_subnet_ip, tvb, offset, 16, ENC_NA);
4318 offset += 16;
4319 proto_tree_add_item(sub_cfg_attr_type_tree, hf_isakmp_cfg_attr_internal_ip6_subnet_prefix, tvb, offset, 1, ENC_BIG_ENDIAN);
4320 offset += 1;
4321 }
4322
4323 }
4324 break;
4325 case INTERNAL_IP6_LINK: /* 17 */
4326 proto_tree_add_item(sub_cfg_attr_type_tree, hf_isakmp_cfg_attr_internal_ip6_link_interface, tvb, offset, 8, ENC_BIG_ENDIAN);
4327 offset += 8;
4328 proto_tree_add_item(sub_cfg_attr_type_tree, hf_isakmp_cfg_attr_internal_ip6_link_id, tvb, offset, optlen-8, ENC_NA);
4329 break;
4330 case INTERNAL_IP6_PREFIX: /* 18 */
4331 offset_end = offset + optlen;
4332
4333 if (optlen%17 == 0)
4334 {
4335 while (offset_end-offset > 0)
4336 {
4337 proto_tree_add_item(sub_cfg_attr_type_tree, hf_isakmp_cfg_attr_internal_ip6_prefix_ip, tvb, offset, 16, ENC_NA);
4338 offset += 16;
4339 proto_tree_add_item(sub_cfg_attr_type_tree, hf_isakmp_cfg_attr_internal_ip6_prefix_length, tvb, offset, 1, ENC_BIG_ENDIAN);
4340 offset += 1;
4341 }
4342
4343 }
4344 break;
4345 case XAUTH_TYPE: /* 16520 */
4346 proto_tree_add_item(sub_cfg_attr_type_tree, hf_isakmp_cfg_attr_xauth_type, tvb, offset, optlen, ENC_BIG_ENDIAN);
4347 proto_item_append_text(cfg_attr_type_item," : %s", rval_to_str(tvb_get_ntohs(tvb, offset), cfgattr_xauth_type, "Unknown %d"));
4348 break;
4349 case XAUTH_USER_NAME: /* 16521 */
4350 proto_tree_add_item(sub_cfg_attr_type_tree, hf_isakmp_cfg_attr_xauth_user_name, tvb, offset, optlen, ENC_ASCII|ENC_NA);
4351 proto_item_append_text(cfg_attr_type_item," : %s", tvb_get_string(wmem_packet_scope(), tvb, offset,optlen));
4352 break;
4353 case XAUTH_USER_PASSWORD: /* 16522 */
4354 proto_tree_add_item(sub_cfg_attr_type_tree, hf_isakmp_cfg_attr_xauth_user_password, tvb, offset, optlen, ENC_ASCII|ENC_NA);
4355 proto_item_append_text(cfg_attr_type_item," : %s", tvb_get_string(wmem_packet_scope(), tvb, offset,optlen));
4356 break;
4357 case XAUTH_PASSCODE: /* 16523 */
4358 proto_tree_add_item(sub_cfg_attr_type_tree, hf_isakmp_cfg_attr_xauth_passcode, tvb, offset, optlen, ENC_ASCII|ENC_NA);
4359 proto_item_append_text(cfg_attr_type_item," : %s", tvb_get_string(wmem_packet_scope(), tvb, offset,optlen));
4360 break;
4361 case XAUTH_MESSAGE: /* 16524 */
4362 proto_tree_add_item(sub_cfg_attr_type_tree, hf_isakmp_cfg_attr_xauth_message, tvb, offset, optlen, ENC_ASCII|ENC_NA);
4363 proto_item_append_text(cfg_attr_type_item," : %s", tvb_get_string(wmem_packet_scope(), tvb, offset,optlen));
4364 break;
4365 case XAUTH_CHALLENGE: /* 16525 */
4366 proto_tree_add_item(sub_cfg_attr_type_tree, hf_isakmp_cfg_attr_xauth_challenge, tvb, offset, optlen, ENC_ASCII|ENC_NA);
4367 proto_item_append_text(cfg_attr_type_item," : %s", tvb_get_string(wmem_packet_scope(), tvb, offset,optlen));
4368 break;
4369 case XAUTH_DOMAIN: /* 16526 */
4370 proto_tree_add_item(sub_cfg_attr_type_tree, hf_isakmp_cfg_attr_xauth_domain, tvb, offset, optlen, ENC_ASCII|ENC_NA);
4371 proto_item_append_text(cfg_attr_type_item," : %s", tvb_get_string(wmem_packet_scope(), tvb, offset,optlen));
4372 break;
4373 case XAUTH_STATUS: /* 16527 */
4374 proto_tree_add_item(sub_cfg_attr_type_tree, hf_isakmp_cfg_attr_xauth_status, tvb, offset, optlen, ENC_BIG_ENDIAN);
4375 proto_item_append_text(cfg_attr_type_item," : %s", val_to_str(tvb_get_ntohs(tvb, offset), cfgattr_xauth_status, "Unknown %d"));
4376 break;
4377 case XAUTH_NEXT_PIN: /* 16528 */
4378 proto_tree_add_item(sub_cfg_attr_type_tree, hf_isakmp_cfg_attr_xauth_next_pin, tvb, offset, optlen, ENC_ASCII|ENC_NA);
4379 proto_item_append_text(cfg_attr_type_item," : %s", tvb_get_string(wmem_packet_scope(), tvb, offset,optlen));
4380 break;
4381 case XAUTH_ANSWER: /* 16527 */
4382 proto_tree_add_item(sub_cfg_attr_type_tree, hf_isakmp_cfg_attr_xauth_answer, tvb, offset, optlen, ENC_ASCII|ENC_NA);
4383 proto_item_append_text(cfg_attr_type_item," : %s", tvb_get_string(wmem_packet_scope(), tvb, offset,optlen));
4384 break;
4385
4386 case UNITY_BANNER: /* 28672 */
4387 proto_tree_add_item(sub_cfg_attr_type_tree, hf_isakmp_cfg_attr_unity_banner, tvb, offset, optlen, ENC_ASCII|ENC_NA);
4388 proto_item_append_text(cfg_attr_type_item," : %s", tvb_get_string(wmem_packet_scope(), tvb, offset,optlen));
4389 break;
4390 case UNITY_DEF_DOMAIN: /* 28674 */
4391 proto_tree_add_item(sub_cfg_attr_type_tree, hf_isakmp_cfg_attr_unity_def_domain, tvb, offset, optlen, ENC_ASCII|ENC_NA);
4392 proto_item_append_text(cfg_attr_type_item," : %s", tvb_get_string(wmem_packet_scope(), tvb, offset,optlen));
4393 break;
4394 /* TODO: Support other UNITY Attributes ! */
4395 default:
4396 /* No Default Action */
4397 break;
4398 }
4399
4400 return 2+len+optlen;
4401 }
4402 static void
4403 dissect_config(tvbuff_t *tvb, int offset, int length, proto_tree *tree, int isakmp_version)
4404 {
4405 int offset_end = 0;
4406 offset_end = offset + length;
4407 if (isakmp_version == 1) {
4408
4409 proto_tree_add_item(tree, hf_isakmp_cfg_type_v1,tvb, offset, 1, ENC_BIG_ENDIAN);
4410 offset += 2;
4411
4412 proto_tree_add_item(tree, hf_isakmp_cfg_identifier,tvb, offset, 1, ENC_BIG_ENDIAN);
4413 offset += 2;
4414
4415 } else if (isakmp_version == 2) {
4416
4417 proto_tree_add_item(tree, hf_isakmp_cfg_type_v2,tvb, offset, 1, ENC_BIG_ENDIAN);
4418 offset += 4;
4419
4420 }
4421
4422 while (offset < offset_end) {
4423 offset += dissect_config_attribute(tvb, tree, offset, isakmp_version);
4424 }
4425 }
4426
4427 static void
4428 dissect_nat_discovery(tvbuff_t *tvb, int offset, int length, proto_tree *tree )
4429 {
4430 proto_tree_add_item(tree, hf_isakmp_nat_hash, tvb, offset, length, ENC_NA);
4431 }
4432
4433 static void
4434 dissect_nat_original_address(tvbuff_t *tvb, int offset, int length _U_, proto_tree *tree, int isakmp_version)
4435 {
4436 guint8 id_type;
4437
4438 id_type = tvb_get_guint8(tvb, offset);
4439 if (isakmp_version == 1)
4440 {
4441 proto_tree_add_item(tree, hf_isakmp_id_type_v1, tvb, offset, 1, ENC_BIG_ENDIAN);
4442 }else if (isakmp_version == 2)
4443 {
4444 proto_tree_add_item(tree, hf_isakmp_id_type_v2, tvb, offset, 1, ENC_BIG_ENDIAN);
4445 }
4446 offset += 1;
4447
4448 offset += 3; /* reserved */
4449
4450 switch (id_type) {
4451
4452 case IKE_ID_IPV4_ADDR:
4453 proto_tree_add_item(tree, hf_isakmp_nat_original_address_ipv4, tvb, offset, 4, ENC_BIG_ENDIAN);
4454 break;
4455
4456 case IKE_ID_IPV6_ADDR:
4457 proto_tree_add_item(tree, hf_isakmp_nat_original_address_ipv6, tvb, offset, 16, ENC_NA);
4458 break;
4459
4460 default:
4461 break;
4462 }
4463 }
4464
4465 static void
4466 dissect_ts(tvbuff_t *tvb, int offset, int length, proto_tree *tree)
4467 {
4468 guint8 num, tstype, protocol_id;
4469
4470 num = tvb_get_guint8(tvb, offset);
4471 proto_item_append_text(tree," # %d", num);
4472 proto_tree_add_item(tree, hf_isakmp_ts_number_of_ts, tvb, offset, 1, ENC_BIG_ENDIAN);
4473
4474 offset += 1;
4475 length -= 1;
4476
4477 offset += 3; /* Reserved */
4478 length -= 3;
4479
4480 while (length > 0) {
4481 tstype = tvb_get_guint8(tvb, offset);
4482 proto_tree_add_item(tree, hf_isakmp_ts_type, tvb, offset, 1, ENC_BIG_ENDIAN);
4483
4484 offset += 1;
4485 length -= 1;
4486 switch (tstype) {
4487 case IKEV2_TS_IPV4_ADDR_RANGE:
4488 protocol_id = tvb_get_guint8(tvb, offset);
4489 if (protocol_id == 0)
4490 proto_tree_add_uint_format_value(tree, hf_isakmp_ts_protoid, tvb, offset,1,
4491 protocol_id, "Unused");
4492 else
4493 proto_tree_add_item(tree, hf_isakmp_ts_protoid, tvb, offset, 1, ENC_BIG_ENDIAN);
4494 offset += 1;
4495 length -= 1;
4496
4497 proto_tree_add_item(tree, hf_isakmp_ts_selector_length, tvb, offset, 2, ENC_BIG_ENDIAN);
4498 offset += 2;
4499 length -= 2;
4500
4501 proto_tree_add_item(tree, hf_isakmp_ts_start_port, tvb, offset, 2, ENC_BIG_ENDIAN);
4502 offset += 2;
4503 length -= 2;
4504
4505 proto_tree_add_item(tree, hf_isakmp_ts_end_port, tvb, offset, 2, ENC_BIG_ENDIAN);
4506 offset += 2;
4507 length -= 2;
4508
4509 proto_tree_add_item(tree, hf_isakmp_ts_start_addr_ipv4, tvb, offset, 4, ENC_BIG_ENDIAN);
4510 offset += 4;
4511 length -= 4;
4512 proto_tree_add_item(tree, hf_isakmp_ts_end_addr_ipv4, tvb, offset, 4, ENC_BIG_ENDIAN);
4513 offset += 4;
4514 length -= 4;
4515 break;
4516 case IKEV2_TS_IPV6_ADDR_RANGE:
4517 protocol_id = tvb_get_guint8(tvb, offset);
4518 if (protocol_id == 0)
4519 proto_tree_add_uint_format_value(tree, hf_isakmp_ts_protoid, tvb, offset,1,
4520 protocol_id, "Unused");
4521 else
4522 proto_tree_add_item(tree, hf_isakmp_ts_protoid, tvb, offset, 1, ENC_BIG_ENDIAN);
4523 offset += 1;
4524 length -= 1;
4525
4526 proto_tree_add_item(tree, hf_isakmp_ts_selector_length, tvb, offset, 2, ENC_BIG_ENDIAN);
4527 offset += 2;
4528 length -= 2;
4529
4530 proto_tree_add_item(tree, hf_isakmp_ts_start_port, tvb, offset, 2, ENC_BIG_ENDIAN);
4531 offset += 2;
4532 length -= 2;
4533
4534 proto_tree_add_item(tree, hf_isakmp_ts_end_port, tvb, offset, 2, ENC_BIG_ENDIAN);
4535 offset += 2;
4536 length -= 2;
4537
4538 proto_tree_add_item(tree, hf_isakmp_ts_start_addr_ipv6, tvb, offset, 16, ENC_NA);
4539 offset += 16;
4540 length -= 16;
4541
4542 proto_tree_add_item(tree, hf_isakmp_ts_end_addr_ipv6, tvb, offset, 16, ENC_NA);
4543 offset += 16;
4544 length -= 16;
4545 break;
4546 case IKEV2_TS_FC_ADDR_RANGE:
4547
4548 offset += 1; /* Reserved */
4549 length -= 1;
4550
4551 proto_tree_add_item(tree, hf_isakmp_ts_selector_length, tvb, offset, 2, ENC_BIG_ENDIAN);
4552 offset += 2;
4553 length -= 2;
4554
4555 offset += 1; /* Reserved */
4556 length -= 1;
4557
4558 proto_tree_add_item(tree, hf_isakmp_ts_start_addr_fc, tvb, offset, 3, ENC_BIG_ENDIAN);
4559 offset += 3;
4560 length -= 3;
4561
4562 offset += 1; /* Reserved */
4563 length -= 1;
4564
4565 proto_tree_add_item(tree, hf_isakmp_ts_end_addr_fc, tvb, offset, 3, ENC_BIG_ENDIAN);
4566 offset += 3;
4567 length -= 3;
4568
4569 proto_tree_add_item(tree, hf_isakmp_ts_start_r_ctl, tvb, offset, 1, ENC_BIG_ENDIAN);
4570 offset += 1;
4571 length -= 1;
4572
4573 proto_tree_add_item(tree, hf_isakmp_ts_end_r_ctl, tvb, offset, 1, ENC_BIG_ENDIAN);
4574 offset += 1;
4575 length -= 1;
4576
4577 proto_tree_add_item(tree, hf_isakmp_ts_start_type, tvb, offset, 1, ENC_BIG_ENDIAN);
4578 offset += 1;
4579 length -= 1;
4580
4581 proto_tree_add_item(tree, hf_isakmp_ts_end_type, tvb, offset, 1, ENC_BIG_ENDIAN);
4582 offset += 1;
4583 length -= 1;
4584 break;
4585 default:
4586 proto_tree_add_item(tree, hf_isakmp_ts_data, tvb, offset, length, ENC_NA);
4587 offset += length;
4588 length -= length;
4589 break;
4590
4591 }
4592 }
4593 }
4594
4595 static void
4596 dissect_enc(tvbuff_t *tvb,
4597 int offset,
4598 int length,
4599 proto_tree *tree,
4600 #ifdef HAVE_LIBGCRYPT
4601 packet_info *pinfo,
4602 guint8 inner_payload,
4603 void* decr_info)
4604 #else
4605 packet_info *pinfo _U_,
4606 guint8 inner_payload _U_,
4607 void* decr_info _U_)
4608 #endif
4609 {
4610 #ifdef HAVE_LIBGCRYPT
4611 ikev2_decrypt_data_t *key_info = NULL;
4612 gint iv_len, encr_data_len, icd_len, decr_data_len, md_len;
4613 guint8 pad_len;
4614 guchar *iv = NULL, *encr_data = NULL, *decr_data = NULL, *entire_message = NULL, *md = NULL;
4615 gcry_cipher_hd_t cipher_hd;
4616 gcry_md_hd_t md_hd;
4617 gcry_error_t err = 0;
4618 proto_item *item = NULL, *icd_item = NULL, *encr_data_item = NULL, *padlen_item = NULL, *iv_item = NULL;
4619 tvbuff_t *decr_tvb = NULL;
4620 gint payloads_len;
4621 proto_tree *decr_tree = NULL, *decr_payloads_tree = NULL;
4622
4623 if (decr_info) {
4624 key_info = (ikev2_decrypt_data_t*)(decr_info);
4625 iv_len = key_info->encr_spec->iv_len;
4626 icd_len = key_info->auth_spec->trunc_len;
4627 encr_data_len = length - iv_len - icd_len;
4628 /*
4629 * Zero or negative length of encrypted data shows that the user specified
4630 * wrong encryption algorithm and/or authentication algorithm.
4631 */
4632 if (encr_data_len <= 0) {
4633 proto_tree_add_expert(tree, pinfo, &ei_isakmp_enc_iv, tvb, offset, length);
4634 return;
4635 }
4636
4637 /*
4638 * Add the IV to the tree and store it in a packet scope buffer for later decryption
4639 * if the specified encryption algorithm uses IV.
4640 */
4641 if (iv_len) {
4642 iv_item = proto_tree_add_item(tree, hf_isakmp_enc_iv, tvb, offset, iv_len, ENC_NA);
4643 proto_item_append_text(iv_item, " (%d bytes)", iv_len);
4644 iv = (guchar *)tvb_memdup(wmem_packet_scope(), tvb, offset, iv_len);
4645
4646 offset += iv_len;
4647 }
4648
4649 /*
4650 * Add the encrypted portion to the tree and store it in a packet scope buffer for later decryption.
4651 */
4652 encr_data_item = proto_tree_add_item(tree, hf_isakmp_enc_data, tvb, offset, encr_data_len, ENC_NA);
4653 proto_item_append_text(encr_data_item, " (%d bytes)",encr_data_len);
4654 encr_data = (guchar *)tvb_memdup(wmem_packet_scope(), tvb, offset, encr_data_len);
4655 offset += encr_data_len;
4656
4657 /*
4658 * Add the ICD (Integrity Checksum Data) to the tree before decryption to ensure
4659 * the ICD be displayed even if the decryption fails.
4660 */
4661 if (icd_len) {
4662 icd_item = proto_tree_add_item(tree, hf_isakmp_enc_icd, tvb, offset, icd_len, ENC_NA);
4663 proto_item_append_text(icd_item, " (%d bytes)",icd_len);
4664
4665 /*
4666 * Recalculate ICD value if the specified authentication algorithm allows it.
4667 */
4668 if (key_info->auth_spec->gcry_alg) {
4669 err = gcry_md_open(&md_hd, key_info->auth_spec->gcry_alg, key_info->auth_spec->gcry_flag);
4670 if (err) {
4671 REPORT_DISSECTOR_BUG(wmem_strdup_printf(wmem_packet_scope(),
4672 "IKEv2 hashing error: algorithm %d: gcry_md_open failed: %s",
4673 key_info->auth_spec->gcry_alg, gcry_strerror(err)));
4674 }
4675 err = gcry_md_setkey(md_hd, key_info->auth_key, key_info->auth_spec->key_len);
4676 if (err) {
4677 REPORT_DISSECTOR_BUG(wmem_strdup_printf(wmem_packet_scope(),
4678 "IKEv2 hashing error: algorithm %s, key length %u: gcry_md_setkey failed: %s",
4679 gcry_md_algo_name(key_info->auth_spec->gcry_alg), key_info->auth_spec->key_len, gcry_strerror(err)));
4680 }
4681
4682 /* Calculate hash over the bytes from the beginning of the ISAKMP header to the right before the ICD. */
4683 entire_message = (guchar *)tvb_memdup(wmem_packet_scope(), tvb, 0, offset);
4684 gcry_md_write(md_hd, entire_message, offset);
4685 md = gcry_md_read(md_hd, 0);
4686 md_len = gcry_md_get_algo_dlen(key_info->auth_spec->gcry_alg);
4687 if (md_len < icd_len) {
4688 gcry_md_close(md_hd);
4689 REPORT_DISSECTOR_BUG(wmem_strdup_printf(wmem_packet_scope(),
4690 "IKEv2 hashing error: algorithm %s: gcry_md_get_algo_dlen returned %d which is smaller than icd length %d",
4691 gcry_md_algo_name(key_info->auth_spec->gcry_alg), md_len, icd_len));
4692 }
4693 if (tvb_memeql(tvb, offset, md, icd_len) == 0) {
4694 proto_item_append_text(icd_item, "[correct]");
4695 } else {
4696 proto_item_append_text(icd_item, "[incorrect, should be %s]", bytes_to_str(md, icd_len));
4697 expert_add_info(pinfo, icd_item, &ei_isakmp_ikev2_integrity_checksum);
4698 }
4699 gcry_md_close(md_hd);
4700 } else {
4701 proto_item_append_text(icd_item, "[not validated]");
4702 }
4703 }
4704
4705 /*
4706 * Confirm encrypted data length is multiple of block size.
4707 */
4708 if (encr_data_len % key_info->encr_spec->block_len != 0) {
4709 proto_item_append_text(encr_data_item, "[Invalid length, should be a multiple of block size (%u)]",
4710 key_info->encr_spec->block_len);
4711 expert_add_info(pinfo, encr_data_item, &ei_isakmp_enc_data_length_mult_block_size);
4712 return;
4713 }
4714
4715 /*
4716 * Allocate buffer for decrypted data.
4717 */
4718 decr_data = (guchar*)g_malloc(encr_data_len);
4719 decr_data_len = encr_data_len;
4720
4721 /*
4722 * If the cipher is NULL, just copy the encrypted data to the decrypted data buffer.
4723 * And otherwise perform decryption with libgcrypt.
4724 */
4725 if (key_info->encr_spec->number == IKEV2_ENCR_NULL) {
4726 memcpy(decr_data, encr_data, decr_data_len);
4727 } else {
4728 err = gcry_cipher_open(&cipher_hd, key_info->encr_spec->gcry_alg, key_info->encr_spec->gcry_mode, 0);
4729 if (err) {
4730 g_free(decr_data);
4731 REPORT_DISSECTOR_BUG(wmem_strdup_printf(wmem_packet_scope(),
4732 "IKEv2 decryption error: algorithm %d, mode %d: gcry_cipher_open failed: %s",
4733 key_info->encr_spec->gcry_alg, key_info->encr_spec->gcry_mode, gcry_strerror(err)));
4734 }
4735 err = gcry_cipher_setkey(cipher_hd, key_info->encr_key, key_info->encr_spec->key_len);
4736 if (err) {
4737 g_free(decr_data);
4738 REPORT_DISSECTOR_BUG(wmem_strdup_printf(wmem_packet_scope(),
4739 "IKEv2 decryption error: algorithm %d, key length %d: gcry_cipher_setkey failed: %s",
4740 key_info->encr_spec->gcry_alg, key_info->encr_spec->key_len, gcry_strerror(err)));
4741 }
4742 err = gcry_cipher_setiv(cipher_hd, iv, iv_len);
4743 if (err) {
4744 g_free(decr_data);
4745 REPORT_DISSECTOR_BUG(wmem_strdup_printf(wmem_packet_scope(),
4746 "IKEv2 decryption error: algorithm %d, iv length %d: gcry_cipher_setiv failed: %s",
4747 key_info->encr_spec->gcry_alg, iv_len, gcry_strerror(err)));
4748 }
4749 err = gcry_cipher_decrypt(cipher_hd, decr_data, decr_data_len, encr_data, encr_data_len);
4750 if (err) {
4751 g_free(decr_data);
4752 REPORT_DISSECTOR_BUG(wmem_strdup_printf(wmem_packet_scope(),
4753 "IKEv2 decryption error: algorithm %d: gcry_cipher_decrypt failed: %s",
4754 key_info->encr_spec->gcry_alg, gcry_strerror(err)));
4755 }
4756 gcry_cipher_close(cipher_hd);
4757 }
4758
4759 decr_tvb = tvb_new_child_real_data(tvb, decr_data, decr_data_len, decr_data_len);
4760 tvb_set_free_cb(decr_tvb, g_free);
4761 add_new_data_source(pinfo, decr_tvb, "Decrypted Data");
4762 item = proto_tree_add_item(tree, hf_isakmp_enc_decrypted_data, decr_tvb, 0, decr_data_len, ENC_NA);
4763 proto_item_append_text(item, " (%d byte%s)", decr_data_len, plurality(decr_data_len, "", "s"));
4764
4765 /* Move the ICD item to the bottom of the tree. */
4766 if (icd_item) {
4767 proto_tree_move_item(tree, item, icd_item);
4768 }
4769 decr_tree = proto_item_add_subtree(item, ett_isakmp_decrypted_data);
4770
4771 pad_len = tvb_get_guint8(decr_tvb, decr_data_len - 1);
4772 payloads_len = decr_data_len - 1 - pad_len;
4773
4774 if (payloads_len > 0) {
4775 item = proto_tree_add_item(decr_tree, hf_isakmp_enc_contained_data, decr_tvb, 0, payloads_len, ENC_NA);
4776 proto_item_append_text(item, " (%d byte%s)", payloads_len, plurality(payloads_len, "", "s"));
4777 decr_payloads_tree = proto_item_add_subtree(item, ett_isakmp_decrypted_payloads);
4778 }
4779
4780 padlen_item = proto_tree_add_item(decr_tree, hf_isakmp_enc_pad_length, decr_tvb, payloads_len + pad_len, 1, ENC_BIG_ENDIAN);
4781 if (pad_len > 0) {
4782 if (payloads_len < 0) {
4783 proto_item_append_text(padlen_item, " [too long]");
4784 expert_add_info(pinfo, padlen_item, &ei_isakmp_enc_pad_length_big);
4785 } else {
4786 item = proto_tree_add_item(decr_tree, hf_isakmp_enc_padding, decr_tvb, payloads_len, pad_len, ENC_NA);
4787 proto_item_append_text(item, " (%d byte%s)", pad_len, plurality(pad_len, "", "s"));
4788 proto_tree_move_item(decr_tree, item, padlen_item);
4789 }
4790 }
4791
4792 /*
4793 * We dissect the inner payloads at last in order to ensure displaying Padding, Pad Length and ICD
4794 * even if the dissection fails. This may occur when the user specify wrong encryption key.
4795 */
4796 if (decr_payloads_tree) {
4797 dissect_payloads(decr_tvb, decr_payloads_tree, decr_tree, 2, inner_payload, 0, payloads_len, pinfo, decr_info);
4798 }
4799 }else{
4800 #endif /* HAVE_LIBGCRYPT */
4801 proto_tree_add_item(tree, hf_isakmp_enc_iv, tvb, offset, 4, ENC_NA);
4802 proto_tree_add_item(tree, hf_isakmp_enc_data, tvb, offset+4 , length, ENC_NA);
4803 #ifdef HAVE_LIBGCRYPT
4804 }
4805 #endif /* HAVE_LIBGCRYPT */
4806 }
4807
4808 static void
4809 dissect_eap(tvbuff_t *tvb, int offset, int length, proto_tree *tree, packet_info *pinfo)
4810 {
4811 tvbuff_t *eap_tvb = NULL;
4812
4813 eap_tvb = tvb_new_subset(tvb, offset,length, length );
4814 if ((eap_tvb != NULL)&& eap_handle != NULL){
4815 call_dissector(eap_handle, eap_tvb, pinfo, tree);
4816 }else{
4817 proto_tree_add_item(tree, hf_isakmp_eap_data, tvb, offset, length, ENC_NA);
4818 }
4819 }
4820
4821 static void
4822 dissect_gspm(tvbuff_t *tvb, int offset, int length, proto_tree *tree)
4823 {
4824
4825 proto_tree_add_item(tree, hf_isakmp_gspm_data, tvb, offset, length, ENC_NA);
4826
4827 }
4828
4829 /*
4830 * Protocol initialization
4831 */
4832
4833 #ifdef HAVE_LIBGCRYPT
4834 static guint
4835 isakmp_hash_func(gconstpointer c) {
4836 const guint8 *i_cookie = (guint8 *) c;
4837 guint val = 0, keychunk, i;
4838
4839 /* XOR our icookie down to the size of a guint */
4840 for (i = 0; i < COOKIE_SIZE - (COOKIE_SIZE % (guint)sizeof(keychunk)); i += (guint)sizeof(keychunk)) {
4841 memcpy(&keychunk, &i_cookie[i], sizeof(keychunk));
4842 val ^= keychunk;
4843 }
4844
4845 return val;
4846 }
4847
4848 static gint
4849 isakmp_equal_func(gconstpointer ic1, gconstpointer ic2) {
4850
4851 if (memcmp(ic1, ic2, COOKIE_SIZE) == 0)
4852 return 1;
4853
4854 return 0;
4855 }
4856
4857 static guint ikev2_key_hash_func(gconstpointer k) {
4858 const ikev2_uat_data_key_t *key = (const ikev2_uat_data_key_t*)k;
4859 guint hash = 0, keychunk, i;
4860
4861 /* XOR our icookie down to the size of a guint */
4862 for (i = 0; i < key->spii_len - (key->spii_len % (guint)sizeof(keychunk)); i += (guint)sizeof(keychunk)) {
4863 memcpy(&keychunk, &key->spii[i], sizeof(keychunk));
4864 hash ^= keychunk;
4865 }
4866 for (i = 0; i < key->spir_len - (key->spir_len % (guint)sizeof(keychunk)); i += (guint)sizeof(keychunk)) {
4867 memcpy(&keychunk, &key->spir[i], sizeof(keychunk));
4868 hash ^= keychunk;
4869 }
4870
4871 return hash;
4872 }
4873
4874 static gint ikev2_key_equal_func(gconstpointer k1, gconstpointer k2) {
4875 const ikev2_uat_data_key_t *key1 = (const ikev2_uat_data_key_t *)k1;
4876 const ikev2_uat_data_key_t *key2 = (const ikev2_uat_data_key_t *)k2;
4877 if (key1->spii_len != key2->spii_len) return 0;
4878 if (key1->spir_len != key2->spir_len) return 0;
4879 if (memcmp(key1->spii, key2->spii, key1->spii_len) != 0) return 0;
4880 if (memcmp(key1->spir, key2->spir, key1->spir_len) != 0) return 0;
4881
4882 return 1;
4883 }
4884 #endif /* HAVE_LIBGCRYPT */
4885
4886 #ifdef HAVE_LIBGCRYPT
4887 static gboolean
4888 free_cookie(gpointer key_arg, gpointer value, gpointer user_data _U_)
4889 {
4890 guint8 *ic_key = (guint8 *)key_arg;
4891 decrypt_data_t *decr = (decrypt_data_t *)value;
4892
4893 g_slice_free1(COOKIE_SIZE, ic_key);
4894 g_slice_free1(sizeof(decrypt_data_t), decr);
4895 return TRUE;
4896 }
4897 #endif
4898
4899 static void
4900 isakmp_init_protocol(void) {
4901 #ifdef HAVE_LIBGCRYPT
4902 guint i;
4903 decrypt_data_t *decr;
4904 guint8 *ic_key;
4905 #endif /* HAVE_LIBGCRYPT */
4906 reassembly_table_init(&isakmp_reassembly_table,
4907 &addresses_reassembly_table_functions);
4908
4909 #ifdef HAVE_LIBGCRYPT
4910 if (isakmp_hash) {
4911 g_hash_table_foreach_remove(isakmp_hash, free_cookie, NULL);
4912 g_hash_table_destroy(isakmp_hash);
4913 }
4914 isakmp_hash = g_hash_table_new(isakmp_hash_func, isakmp_equal_func);
4915
4916 for (i = 0; i < num_ikev1_uat_data; i++) {
4917 ic_key = (guint8 *)g_slice_alloc(COOKIE_SIZE);
4918 decr = (decrypt_data_t *)g_slice_alloc(sizeof(decrypt_data_t));
4919 memcpy(ic_key, ikev1_uat_data[i].icookie, COOKIE_SIZE);
4920 memset(decr, 0, sizeof(decrypt_data_t));
4921
4922 memcpy(decr->secret, ikev1_uat_data[i].key, ikev1_uat_data[i].key_len);
4923 decr->secret_len = ikev1_uat_data[i].key_len;
4924
4925 g_hash_table_insert(isakmp_hash, ic_key, decr);
4926 }
4927
4928 if (ikev2_key_hash) {
4929 g_hash_table_destroy(ikev2_key_hash);
4930 }
4931
4932 ikev2_key_hash = g_hash_table_new(ikev2_key_hash_func, ikev2_key_equal_func);
4933 for (i = 0; i < num_ikev2_uat_data; i++) {
4934 g_hash_table_insert(ikev2_key_hash, &(ikev2_uat_data[i].key), &(ikev2_uat_data[i]));
4935 }
4936 #endif /* HAVE_LIBGCRYPT */
4937 }
4938
4939 #ifdef HAVE_LIBGCRYPT
4940 static void
4941 isakmp_prefs_apply_cb(void) {
4942 isakmp_init_protocol();
4943 }
4944 #endif /* HAVE_LIBGCRYPT */
4945
4946 #ifdef HAVE_LIBGCRYPT
4947
4948 UAT_BUFFER_CB_DEF(ikev1_users, icookie, ikev1_uat_data_key_t, icookie, icookie_len)
4949 UAT_BUFFER_CB_DEF(ikev1_users, key, ikev1_uat_data_key_t, key, key_len)
4950
4951 static void ikev1_uat_data_update_cb(void* p, const char** err) {
4952 ikev1_uat_data_key_t *ud = (ikev1_uat_data_key_t *)p;
4953
4954 if (ud->icookie_len != COOKIE_SIZE) {
4955 *err = g_strdup_printf("Length of Initiator's COOKIE must be %d octets (%d hex characters).", COOKIE_SIZE, COOKIE_SIZE * 2);
4956 return;
4957 }
4958
4959 if (ud->key_len == 0) {
4960 *err = g_strdup_printf("Must have Encryption key.");
4961 return;
4962 }
4963
4964 if (ud->key_len > MAX_KEY_SIZE) {
4965 *err = g_strdup_printf("Length of Encryption key limited to %d octets (%d hex characters).", MAX_KEY_SIZE, MAX_KEY_SIZE * 2);
4966 return;
4967 }
4968
4969 }
4970
4971 UAT_BUFFER_CB_DEF(ikev2_users, spii, ikev2_uat_data_t, key.spii, key.spii_len)
4972 UAT_BUFFER_CB_DEF(ikev2_users, spir, ikev2_uat_data_t, key.spir, key.spir_len)
4973 UAT_BUFFER_CB_DEF(ikev2_users, sk_ei, ikev2_uat_data_t, sk_ei, sk_ei_len)
4974 UAT_BUFFER_CB_DEF(ikev2_users, sk_er, ikev2_uat_data_t, sk_er, sk_er_len)
4975 UAT_VS_DEF(ikev2_users, encr_alg, ikev2_uat_data_t, guint, IKEV2_ENCR_3DES, IKEV2_ENCR_3DES_STR)
4976 UAT_BUFFER_CB_DEF(ikev2_users, sk_ai, ikev2_uat_data_t, sk_ai, sk_ai_len)
4977 UAT_BUFFER_CB_DEF(ikev2_users, sk_ar, ikev2_uat_data_t, sk_ar, sk_ar_len)
4978 UAT_VS_DEF(ikev2_users, auth_alg, ikev2_uat_data_t, guint, IKEV2_AUTH_HMAC_SHA1_96, IKEV2_AUTH_HMAC_SHA1_96_STR)
4979
4980 static void ikev2_uat_data_update_cb(void* p, const char** err) {
4981 ikev2_uat_data_t *ud = (ikev2_uat_data_t *)p;
4982
4983 if (ud->key.spii_len != COOKIE_SIZE) {
4984 *err = g_strdup_printf("Length of Initiator's SPI must be %d octets (%d hex characters).", COOKIE_SIZE, COOKIE_SIZE * 2);
4985 return;
4986 }
4987
4988 if (ud->key.spir_len != COOKIE_SIZE) {
4989 *err = g_strdup_printf("Length of Responder's SPI must be %d octets (%d hex characters).", COOKIE_SIZE, COOKIE_SIZE * 2);
4990 return;
4991 }
4992
4993 if ((ud->encr_spec = ikev2_decrypt_find_encr_spec(ud->encr_alg)) == NULL) {
4994 REPORT_DISSECTOR_BUG("Couldn't get IKEv2 encryption algorithm spec.");
4995 }
4996
4997 if ((ud->auth_spec = ikev2_decrypt_find_auth_spec(ud->auth_alg)) == NULL) {
4998 REPORT_DISSECTOR_BUG("Couldn't get IKEv2 authentication algorithm spec.");
4999 }
5000
5001 if (ud->sk_ei_len != ud->encr_spec->key_len) {
5002 *err = g_strdup_printf("Length of SK_ei (%u octets) does not match the key length (%u octets) of the selected encryption algorithm.",
5003 ud->sk_ei_len, ud->encr_spec->key_len);
5004 return;
5005 }
5006
5007 if (ud->sk_er_len != ud->encr_spec->key_len) {
5008 *err = g_strdup_printf("Length of SK_er (%u octets) does not match the key length (%u octets) of the selected encryption algorithm.",
5009 ud->sk_er_len, ud->encr_spec->key_len);
5010 return;
5011 }
5012
5013 if (ud->sk_ai_len != ud->auth_spec->key_len) {
5014 *err = g_strdup_printf("Length of SK_ai (%u octets) does not match the key length (%u octets) of the selected integrity algorithm.",
5015 ud->sk_ai_len, ud->auth_spec->key_len);
5016 return;
5017 }
5018
5019 if (ud->sk_ar_len != ud->auth_spec->key_len) {
5020 *err = g_strdup_printf("Length of SK_ar (%u octets) does not match the key length (%u octets) of the selected integrity algorithm.",
5021 ud->sk_ar_len, ud->auth_spec->key_len);
5022 return;
5023 }
5024 }
5025 #endif /* HAVE_LIBGCRYPT */
5026
5027 void
5028 proto_register_isakmp(void)
5029 {
5030 #ifdef HAVE_LIBGCRYPT
5031 module_t *isakmp_module;
5032 #endif
5033 static hf_register_info hf[] = {
5034 { &hf_isakmp_ispi,
5035 { "Initiator SPI", "isakmp.ispi",
5036 FT_BYTES, BASE_NONE, NULL, 0x0,
5037 "ISAKMP Initiator SPI", HFILL }},
5038 { &hf_isakmp_rspi,
5039 { "Responder SPI", "isakmp.rspi",
5040 FT_BYTES, BASE_NONE, NULL, 0x0,
5041 "ISAKMP Responder SPI", HFILL }},
5042 { &hf_isakmp_typepayload,
5043 { "Type Payload", "isakmp.typepayload",
5044 FT_UINT8,BASE_RANGE_STRING | BASE_DEC, RVALS(payload_type), 0x0,
5045 "ISAKMP Type Payload", HFILL }},
5046 { &hf_isakmp_nextpayload,
5047 { "Next payload", "isakmp.nextpayload",
5048 FT_UINT8, BASE_RANGE_STRING | BASE_DEC, RVALS(payload_type), 0x0,
5049 "ISAKMP Next Payload", HFILL }},
5050 { &hf_isakmp_criticalpayload,
5051 { "Critical Bit", "isakmp.criticalpayload",
5052 FT_BOOLEAN, 8,TFS(&criticalpayload), 0x80,
5053 "ISAKMP (v2) Critical Payload", HFILL }},
5054 { &hf_isakmp_extradata,
5055 { "Extra data", "isakmp.extradata",
5056 FT_BYTES, BASE_NONE, NULL, 0x0,
5057 "Extra data ??????", HFILL }},
5058 { &hf_isakmp_datapayload,
5059 { "Data Payload", "isakmp.datapayload",
5060 FT_BYTES, BASE_NONE, NULL, 0x0,
5061 "Data Payload (not dissect)", HFILL }},
5062 { &hf_isakmp_version,
5063 { "Version", "isakmp.version",
5064 FT_UINT8, BASE_HEX, NULL, 0x0,
5065 "ISAKMP Version (major + minor)", HFILL }},
5066 { &hf_isakmp_mjver,
5067 { "MjVer", "isakmp.mjver",
5068 FT_UINT8, BASE_HEX, NULL, 0xF0,
5069 "ISAKMP MjVer", HFILL }},
5070 { &hf_isakmp_mnver,
5071 { "MnVer", "isakmp.mnver",
5072 FT_UINT8, BASE_HEX, NULL, 0x0F,
5073 "ISAKMP MnVer", HFILL }},
5074 { &hf_isakmp_exchangetype_v1,
5075 { "Exchange type", "isakmp.exchangetype",
5076 FT_UINT8, BASE_DEC, VALS(exchange_v1_type), 0x0,
5077 "ISAKMP Exchange Type", HFILL }},
5078 { &hf_isakmp_exchangetype_v2,
5079 { "Exchange type", "isakmp.exchangetype",
5080 FT_UINT8, BASE_DEC, VALS(exchange_v2_type), 0x0,
5081 "ISAKMP Exchange Type", HFILL }},
5082 { &hf_isakmp_flags,
5083 { "Flags", "isakmp.flags",
5084 FT_UINT8, BASE_HEX, NULL, 0x0,
5085 "ISAKMP Flags", HFILL }},
5086 { &hf_isakmp_flag_e,
5087 { "Encryption", "isakmp.flag_e",
5088 FT_BOOLEAN, 8, TFS(&flag_e), E_FLAG,
5089 "Encryption Bit", HFILL }},
5090 { &hf_isakmp_flag_c,
5091 { "Commit", "isakmp.flag_c",
5092 FT_BOOLEAN, 8, TFS(&flag_c), C_FLAG,
5093 "Commit Bit", HFILL }},
5094 { &hf_isakmp_flag_a,
5095 { "Authentication", "isakmp.flag_a",
5096 FT_BOOLEAN, 8, TFS(&flag_a), A_FLAG,
5097 "Authentication Bit", HFILL }},
5098 { &hf_isakmp_flag_i,
5099 { "Initiator", "isakmp.flag_i",
5100 FT_BOOLEAN, 8, TFS(&flag_i), I_FLAG,
5101 "Initiator Bit", HFILL }},
5102 { &hf_isakmp_flag_v,
5103 { "Version", "isakmp.flag_v",
5104 FT_BOOLEAN, 8, TFS(&flag_v), V_FLAG,
5105 "Version Bit", HFILL }},
5106 { &hf_isakmp_flag_r,
5107 { "Response", "isakmp.flag_r",
5108 FT_BOOLEAN, 8, TFS(&flag_r), R_FLAG,
5109 "Response Bit", HFILL }},
5110 { &hf_isakmp_messageid,
5111 { "Message ID", "isakmp.messageid",
5112 FT_UINT32, BASE_HEX, NULL, 0x0,
5113 "ISAKMP Message ID", HFILL }},
5114 { &hf_isakmp_length,
5115 { "Length", "isakmp.length",
5116 FT_UINT32, BASE_DEC, NULL, 0x0,
5117 "ISAKMP Length", HFILL }},
5118 { &hf_isakmp_payloadlen,
5119 { "Payload length", "isakmp.payloadlength",
5120 FT_UINT16, BASE_DEC, NULL, 0x0,
5121 "ISAKMP Payload Length", HFILL }},
5122 { &hf_isakmp_sa_doi,
5123 { "Domain of interpretation", "isakmp.sa.doi",
5124 FT_UINT32, BASE_DEC, VALS(doi_type), 0x0,
5125 "ISAKMP Domain of Interpretation", HFILL }},
5126 { &hf_isakmp_sa_situation,
5127 { "Situation", "isakmp.sa.situation",
5128 FT_BYTES, BASE_NONE, NULL, 0x0,
5129 "ISAKMP SA Situation", HFILL }},
5130 { &hf_isakmp_sa_situation_identity_only,
5131 { "Identity Only", "isakmp.sa.situation.identity_only",
5132 FT_BOOLEAN, 32, NULL, SIT_IDENTITY_ONLY,
5133 "The type specifies that the SA will be identified by source identity information present in an associated Identification Payload", HFILL }},
5134 { &hf_isakmp_sa_situation_secrecy,
5135 { "Secrecy", "isakmp.sa.situation.secrecy",
5136 FT_BOOLEAN, 32, NULL, SIT_SECRECY,
5137 "The type specifies that the SA is being negotiated in an environment that requires labeled secrecy.", HFILL }},
5138 { &hf_isakmp_sa_situation_integrity,
5139 { "Integrity", "isakmp.sa.situation.integrity",
5140 FT_BOOLEAN, 32, NULL, SIT_INTEGRITY,
5141 "The type specifies that the SA is being negotiated in an environment that requires labeled integrity", HFILL }},
5142 { &hf_isakmp_prop_protoid_v1,
5143 { "Protocol ID", "isakmp.prop.protoid",
5144 FT_UINT32, BASE_DEC, VALS(protoid_v1_type), 0x0,
5145 "ISAKMP Proposal Protocol ID", HFILL }},
5146 { &hf_isakmp_prop_protoid_v2,
5147 { "Protocol ID", "isakmp.prop.protoid",
5148 FT_UINT32, BASE_DEC, VALS(protoid_v2_type), 0x0,
5149 "IKEv2 Proposal Protocol ID", HFILL }},
5150 { &hf_isakmp_prop_number,
5151 { "Proposal number", "isakmp.prop.number",
5152 FT_UINT8, BASE_DEC, NULL, 0x0,
5153 "ISAKMP Proposal Number", HFILL }},
5154 { &hf_isakmp_spisize,
5155 { "SPI Size", "isakmp.spisize",
5156 FT_UINT8, BASE_DEC, NULL, 0x0,
5157 NULL, HFILL }},
5158 { &hf_isakmp_spi,
5159 { "SPI", "isakmp.spi",
5160 FT_BYTES, BASE_NONE, NULL, 0x0,
5161 NULL, HFILL }},
5162 { &hf_isakmp_prop_transforms,
5163 { "Proposal transforms", "isakmp.prop.transforms",
5164 FT_UINT8, BASE_DEC, NULL, 0x0,
5165 "ISAKMP Proposal Transforms", HFILL }},
5166 { &hf_isakmp_trans_number,
5167 { "Transform number", "isakmp.trans.number",
5168 FT_UINT8, BASE_DEC, NULL, 0x0,
5169 "ISAKMP Transform Number", HFILL }},
5170 { &hf_isakmp_trans_id,
5171 { "Transform ID", "isakmp.trans.id",
5172 FT_UINT8, BASE_DEC, NULL, 0x0,
5173 "ISAKMP Transform ID", HFILL }},
5174 { &hf_isakmp_id_type_v1,
5175 { "ID type", "isakmp.id.type",
5176 FT_UINT8, BASE_RANGE_STRING | BASE_DEC, RVALS(vs_v1_id_type), 0x0,
5177 "ISAKMP (v1) ID Type", HFILL }},
5178 { &hf_isakmp_id_type_v2,
5179 { "ID type", "isakmp.id.type",
5180 FT_UINT8, BASE_RANGE_STRING | BASE_DEC, RVALS(vs_v2_id_type), 0x0,
5181 "ISAKMP (v2) ID Type", HFILL }},
5182 { &hf_isakmp_id_protoid,
5183 { "Protocol ID", "isakmp.id.protoid",
5184 FT_UINT8, BASE_DEC|BASE_EXT_STRING, (&ipproto_val_ext), 0x0,
5185 "ISAKMP ID Protocol ID", HFILL }},
5186 { &hf_isakmp_id_port,
5187 { "Port", "isakmp.id.port",
5188 FT_UINT16, BASE_DEC, NULL, 0x0,
5189 "ISAKMP ID Port", HFILL }},
5190 { &hf_isakmp_id_data,
5191 { "Identification Data:", "isakmp.id.data",
5192 FT_NONE, BASE_NONE, NULL, 0x0,
5193 "ISAKMP ID Data", HFILL }},
5194 { &hf_isakmp_id_data_ipv4_addr,
5195 { "ID_IPV4_ADDR", "isakmp.id.data.ipv4_addr",
5196 FT_IPv4, BASE_NONE, NULL, 0x0,
5197 "The type specifies a single four (4) octet IPv4 address", HFILL }},
5198 { &hf_isakmp_id_data_fqdn,
5199 { "ID_FQDN", "isakmp.id.data.fqdn",
5200 FT_STRING, BASE_NONE, NULL, 0x0,
5201 "The type specifies a fully-qualified domain name string", HFILL }},
5202 { &hf_isakmp_id_data_user_fqdn,
5203 { "ID_FQDN", "isakmp.id.data.user_fqdn",
5204 FT_STRING, BASE_NONE, NULL, 0x0,
5205 "The type specifies a fully-qualified username string", HFILL }},
5206 { &hf_isakmp_id_data_ipv4_subnet,
5207 { "ID_IPV4_SUBNET", "isakmp.id.data.ipv4_subnet",
5208 FT_IPv4, BASE_NONE, NULL, 0x0,
5209 "The second is an IPv4 network mask", HFILL }},
5210 { &hf_isakmp_id_data_ipv4_range_start,
5211 { "ID_IPV4_SUBNET", "isakmp.id.data.ipv4_range_start",
5212 FT_IPv4, BASE_NONE, NULL, 0x0,
5213 "The first value is the beginning IPv4 address (inclusive)", HFILL }},
5214 { &hf_isakmp_id_data_ipv4_range_end,
5215 { "ID_IPV4_RANGE (End)", "isakmp.id.data.ipv4_range_end",
5216 FT_IPv4, BASE_NONE, NULL, 0x0,
5217 "The second value is the ending IPv4 address (inclusive)", HFILL }},
5218 { &hf_isakmp_id_data_ipv6_addr,
5219 { "ID_IPV6_ADDR", "isakmp.id.data.ipv6_addr",
5220 FT_IPv6, BASE_NONE, NULL, 0x0,
5221 "The type specifies a single sixteen (16) octet IPv6 address", HFILL }},
5222 { &hf_isakmp_id_data_ipv6_subnet,
5223 { "ID_IPV6A_ADDR_SUBNET", "isakmp.id.data.ipv6_subnet",
5224 FT_IPv6, BASE_NONE, NULL, 0x0,
5225 "The type specifies a range of IPv6 addresses represented by two sixteen (16) octet values", HFILL }},
5226 { &hf_isakmp_id_data_ipv6_range_start,
5227 { "ID_IPV6_ADDR_RANGE (Start)", "isakmp.id.data.ipv6_range_start",
5228 FT_IPv6, BASE_NONE, NULL, 0x0,
5229 "The first value is the beginning IPv6 address (inclusive)", HFILL }},
5230 { &hf_isakmp_id_data_ipv6_range_end,
5231 { "ID_IPV6_ADDR_RANGE (End)", "isakmp.id.data.ipv6_range_end",
5232 FT_IPv6, BASE_NONE, NULL, 0x0,
5233 "the second value is the ending IPv6 address (inclusive)", HFILL }},
5234 { &hf_isakmp_id_data_key_id,
5235 { "ID_KEY_ID", "isakmp.id.data.key_id",
5236 FT_BYTES, BASE_NONE, NULL, 0x0,
5237 "The type specifies an opaque byte stream which may be used to pass vendor-specific information necessary to identify which pre-hared key should be used to authenticate Aggressive mode negotiations", HFILL }},
5238 { &hf_isakmp_id_data_cert,
5239 { "ID_DER_ASN1_DN", "isakmp.id.data.der_asn1_dn",
5240 FT_UINT32, BASE_DEC, NULL, 0x0,
5241 NULL, HFILL } },
5242 { &hf_isakmp_cert_encoding_v1,
5243 { "Certificate Encoding", "isakmp.cert.encoding",
5244 FT_UINT8, BASE_RANGE_STRING | BASE_DEC, RVALS(cert_v1_type), 0x0,
5245 "ISAKMP Certificate Encoding", HFILL }},
5246 { &hf_isakmp_cert_encoding_v2,
5247 { "Certificate Encoding", "isakmp.cert.encoding",
5248 FT_UINT8, BASE_RANGE_STRING | BASE_DEC, RVALS(cert_v2_type), 0x0,
5249 "IKEv2 Certificate Encoding", HFILL }},
5250 { &hf_isakmp_cert_data,
5251 { "Certificate Data", "isakmp.cert.data",
5252 FT_NONE, BASE_NONE, NULL, 0x0,
5253 "ISAKMP Certificate Data", HFILL }},
5254 { &hf_isakmp_certreq_type_v1,
5255 { "Certificate Type", "isakmp.certreq.type",
5256 FT_UINT8, BASE_RANGE_STRING | BASE_DEC, RVALS(cert_v1_type), 0x0,
5257 "ISAKMP Certificate Type", HFILL }},
5258 { &hf_isakmp_certreq_type_v2,
5259 { "Certificate Type", "isakmp.certreq.type",
5260 FT_UINT8, BASE_RANGE_STRING | BASE_DEC, RVALS(cert_v2_type), 0x0,
5261 "IKEv2 Certificate Type", HFILL }},
5262 { &hf_isakmp_auth_meth,
5263 { "Authentication Method", "isakmp.auth.method",
5264 FT_UINT8, BASE_RANGE_STRING | BASE_DEC, RVALS(authmeth_v2_type), 0x0,
5265 "IKEv2 Authentication Method", HFILL }},
5266 { &hf_isakmp_auth_data,
5267 { "Authentication Data", "isakmp.auth.data",
5268 FT_BYTES, BASE_NONE, NULL, 0x0,
5269 "IKEv2 Authentication Data", HFILL }},
5270 { &hf_isakmp_notify_doi,
5271 { "Domain of interpretation", "isakmp.notify.doi",
5272 FT_UINT32, BASE_DEC, VALS(doi_type), 0x0,
5273 "ISAKMP Notify Domain of Interpretation", HFILL }},
5274 { &hf_isakmp_notify_protoid_v1,
5275 { "Protocol ID", "isakmp.notify.protoid",
5276 FT_UINT32, BASE_DEC, VALS(protoid_v1_type), 0x0,
5277 "ISAKMP Notify Protocol ID", HFILL }},
5278 { &hf_isakmp_notify_protoid_v2,
5279 { "Protocol ID", "isakmp.notify.protoid",
5280 FT_UINT32, BASE_DEC, VALS(protoid_v2_type), 0x0,
5281 "IKEv2 Notify Protocol ID", HFILL }},
5282 { &hf_isakmp_notify_msgtype_v1,
5283 { "Notify Message Type", "isakmp.notify.msgtype",
5284 FT_UINT16, BASE_RANGE_STRING | BASE_DEC, RVALS(notifmsg_v1_type), 0x0,
5285 "ISAKMP Notify Message Type", HFILL }},
5286 { &hf_isakmp_notify_msgtype_v2,
5287 { "Notify Message Type", "isakmp.notify.msgtype",
5288 FT_UINT16, BASE_RANGE_STRING | BASE_DEC, RVALS(notifmsg_v2_type), 0x0,
5289 "ISAKMP Notify Message Type", HFILL }},
5290 { &hf_isakmp_notify_data,
5291 { "Notification DATA", "isakmp.notify.data",
5292 FT_BYTES, BASE_NONE, NULL, 0x0,
5293 NULL, HFILL }},
5294 { &hf_isakmp_notify_data_dpd_are_you_there,
5295 { "DPD ARE-YOU-THERE sequence", "isakmp.notify.data.dpd.are_you_there",
5296 FT_UINT32, BASE_DEC, NULL, 0x0,
5297 NULL, HFILL }},
5298 { &hf_isakmp_notify_data_dpd_are_you_there_ack,
5299 { "DPD ARE-YOU-THERE-ACK sequence", "isakmp.notify.data.dpd.are_you_there_ack",
5300 FT_UINT32, BASE_DEC, NULL, 0x0,
5301 NULL, HFILL }},
5302 { &hf_isakmp_notify_data_unity_load_balance,
5303 { "UNITY LOAD BALANCE", "isakmp.notify.data.unity.load_balance",
5304 FT_IPv4, BASE_NONE, NULL, 0x0,
5305 NULL, HFILL }},
5306 { &hf_isakmp_notify_data_ipcomp_cpi,
5307 { "IPCOMP CPI", "isakmp.notify.data.ipcomp.cpi",
5308 FT_UINT16, BASE_DEC, NULL, 0x0,
5309 NULL, HFILL }},
5310 { &hf_isakmp_notify_data_ipcomp_transform_id,
5311 { "IPCOMP Transform ID", "isakmp.notify.data.ipcomp.transform_id",
5312 FT_UINT8, BASE_DEC, VALS(transform_id_ipcomp), 0x0,
5313 NULL, HFILL }},
5314 { &hf_isakmp_notify_data_redirect_gw_ident_type,
5315 { "Gateway Identity Type", "isakmp.notify.data.redirect.gw_ident.type",
5316 FT_UINT8, BASE_DEC, VALS(redirect_gateway_identity_type), 0x0,
5317 NULL, HFILL }},
5318 { &hf_isakmp_notify_data_redirect_gw_ident_len,
5319 { "Gateway Identity Length", "isakmp.notify.data.redirect.gw_ident.len",
5320 FT_UINT8, BASE_DEC, NULL, 0x0,
5321 NULL, HFILL }},
5322 { &hf_isakmp_notify_data_redirect_new_resp_gw_ident_ipv4,
5323 { "New Responder Gateway Identity (IPv4)", "isakmp.notify.data.redirect.new_resp_gw_ident.ipv4",
5324 FT_IPv4, BASE_NONE, NULL, 0x0,
5325 NULL, HFILL }},
5326 { &hf_isakmp_notify_data_redirect_new_resp_gw_ident_ipv6,
5327 { "New Responder Gateway Identity (IPv6)", "isakmp.notify.data.redirect.new_resp_gw_ident.ipv6",
5328 FT_IPv6, BASE_NONE, NULL, 0x0,
5329 NULL, HFILL }},
5330 { &hf_isakmp_notify_data_redirect_new_resp_gw_ident_fqdn,
5331 { "New Responder Gateway Identity (FQDN)", "isakmp.notify.data.redirect.new_resp_gw_ident.fqdn",
5332 FT_STRING, BASE_NONE, NULL, 0x0,
5333 NULL, HFILL }},
5334 { &hf_isakmp_notify_data_redirect_new_resp_gw_ident,
5335 { "New Responder Gateway Identity (DATA)", "isakmp.notify.data.redirect.new_resp_gw_ident.data",
5336 FT_BYTES, BASE_NONE, NULL, 0x0,
5337 NULL, HFILL }},
5338 { &hf_isakmp_notify_data_redirect_nonce_data,
5339 { "Redirect Nonce Data", "isakmp.notify.data.redirect.nonce_data",
5340 FT_BYTES, BASE_NONE, NULL, 0x0,
5341 NULL, HFILL }},
5342 { &hf_isakmp_notify_data_redirect_org_resp_gw_ident_ipv4,
5343 { "Original Responder Gateway Identity (IPv4)", "isakmp.notify.data.redirect.org_resp_gw_ident.ipv4",
5344 FT_IPv4, BASE_NONE, NULL, 0x0,
5345 NULL, HFILL }},
5346 { &hf_isakmp_notify_data_redirect_org_resp_gw_ident_ipv6,
5347 { "Original Responder Gateway Identity (IPv6)", "isakmp.notify.data.redirect.org_resp_gw_ident.ipv6",
5348 FT_IPv6, BASE_NONE, NULL, 0x0,
5349 NULL, HFILL }},
5350 { &hf_isakmp_notify_data_redirect_org_resp_gw_ident,
5351 { "Original Responder Gateway Identity (DATA)", "isakmp.notify.data.redirect.org_resp_gw_ident.data",
5352 FT_BYTES, BASE_NONE, NULL, 0x0,
5353 NULL, HFILL }},
5354
5355 { &hf_isakmp_notify_data_ticket_lifetime,
5356 { "TICKET OPAQUE Lifetime", "isakmp.notify.data.ticket_opaque.lifetime",
5357 FT_UINT32, BASE_DEC, NULL, 0x0,
5358 "The Lifetime field contains a relative time value, the number of seconds until the ticket expires (encoded as an unsigned integer).", HFILL }},
5359 { &hf_isakmp_notify_data_ticket_data,
5360 { "TICKET OPAQUE Data", "isakmp.notify.data.ticket_opaque.data",
5361 FT_BYTES, BASE_NONE, NULL, 0x0,
5362 NULL, HFILL }},
5363
5364 /* ROHC Attributes Type */
5365 { &hf_isakmp_notify_data_rohc_attr,
5366 { "ROHC Attribute Type", "isakmp.notify.data.rohc.attr",
5367 FT_NONE, BASE_NONE, NULL, 0x00,
5368 NULL, HFILL }},
5369 { &hf_isakmp_notify_data_rohc_attr_type,
5370 { "ROHC Attribute Type", "isakmp.notify.data.rohc.attr.type",
5371 FT_UINT16, BASE_DEC, VALS(rohc_attr_type), 0x00,
5372 NULL, HFILL }},
5373 { &hf_isakmp_notify_data_rohc_attr_format,
5374 { "ROHC Format", "isakmp.notify.data.rohc.attr.format",
5375 FT_BOOLEAN, 16, TFS(&attribute_format), 0x8000,
5376 NULL, HFILL }},
5377 { &hf_isakmp_notify_data_rohc_attr_length,
5378 { "Length", "isakmp.notify.data.rohc.attr.length",
5379 FT_UINT16, BASE_DEC, NULL, 0x00,
5380 NULL, HFILL }},
5381 { &hf_isakmp_notify_data_rohc_attr_value,
5382 { "Value", "isakmp.notify.data.rohc.attr.value",
5383 FT_BYTES, BASE_NONE, NULL, 0x00,
5384 NULL, HFILL }},
5385 { &hf_isakmp_notify_data_rohc_attr_max_cid,
5386 { "Maximum Context Identifier", "isakmp.notify.data.rohc.attr.max_cid",
5387 FT_UINT16, BASE_DEC, NULL, 0x00,
5388 NULL, HFILL }},
5389 { &hf_isakmp_notify_data_rohc_attr_profile,
5390 { "ROHC Profile", "isakmp.notify.data.rohc.attr.profile",
5391 FT_UINT16, BASE_DEC, NULL, 0x00,
5392 NULL, HFILL }},
5393 { &hf_isakmp_notify_data_rohc_attr_integ,
5394 { "ROHC Integrity Algorithm", "isakmp.notify.data.rohc.attr.integ",
5395 FT_UINT16, BASE_DEC, VALS(transform_ike2_integ_type), 0x00,
5396 NULL, HFILL }},
5397 { &hf_isakmp_notify_data_rohc_attr_icv_len,
5398 { "ROHC ICV Length in bytes", "isakmp.notify.data.rohc.attr.icv_len",
5399 FT_UINT16, BASE_DEC, NULL, 0x00,
5400 "In bytes", HFILL }},
5401 { &hf_isakmp_notify_data_rohc_attr_mrru,
5402 { "MRRU", "isakmp.notify.data.rohc.attr.mrru",
5403 FT_UINT16, BASE_DEC, NULL, 0x00,
5404 NULL, HFILL }},
5405
5406 { &hf_isakmp_notify_data_qcd_token_secret_data,
5407 { "Token Secret Data", "isakmp.notify.data.qcd.token_secret_data",
5408 FT_BYTES, BASE_NONE, NULL, 0x0,
5409 NULL, HFILL }},
5410
5411 { &hf_isakmp_notify_data_ha_nonce_data,
5412 { "Nonce Data", "isakmp.notify.data.ha.nonce_data",
5413 FT_UINT32, BASE_HEX, NULL, 0x0,
5414 "Random nonce data, the data should be identical in the synchronization request and response", HFILL }},
5415 { &hf_isakmp_notify_data_ha_expected_send_req_msg_id,
5416 { "EXPECTED SEND REQ MESSAGE ID", "isakmp.notify.data.ha.expected_send_req_message_id",
5417 FT_UINT32, BASE_HEX, NULL, 0x0,
5418 "Indicate the Message ID it will use in the next request that it will send to the other protocol peer", HFILL }},
5419 { &hf_isakmp_notify_data_ha_expected_recv_req_msg_id,
5420 { "EXPECTED RECV REQ MESSAGE ID", "isakmp.notify.data.ha.expected_recv_req_message_id",
5421 FT_UINT32, BASE_HEX, NULL, 0x0,
5422 "Indicate the Message ID it is expecting in the next request to be received from the other protocol peer", HFILL }},
5423 { &hf_isakmp_notify_data_ha_incoming_ipsec_sa_delta_value,
5424 { "Incoming IPsec SA delta value", "isakmp.notify.data.ha.incoming_ipsec_sa_delta_value",
5425 FT_BYTES, BASE_NONE, NULL, 0x0,
5426 "The sender requests that the peer should increment all the Child SA Replay Counters for the sender's incomingtraffic by this value", HFILL }},
5427 { &hf_isakmp_notify_data_secure_password_methods,
5428 { "Secure Password Methods", "isakmp.notify.data.secure_password_methods",
5429 FT_BYTES, BASE_NONE, NULL, 0x0,
5430 NULL, HFILL }},
5431
5432 { &hf_isakmp_delete_doi,
5433 { "Domain of interpretation", "isakmp.delete.doi",
5434 FT_UINT32, BASE_DEC, VALS(doi_type), 0x0,
5435 "ISAKMP Delete Domain of Interpretation", HFILL }},
5436 { &hf_isakmp_delete_protoid_v1,
5437 { "Protocol ID", "isakmp.delete.protoid",
5438 FT_UINT32, BASE_DEC, VALS(protoid_v1_type), 0x0,
5439 "ISAKMP Delete Protocol ID", HFILL }},
5440 { &hf_isakmp_delete_protoid_v2,
5441 { "Protocol ID", "isakmp.delete.protoid",
5442 FT_UINT32, BASE_DEC, VALS(protoid_v2_type), 0x0,
5443 "IKEv2 Delete Protocol ID", HFILL }},
5444 { &hf_isakmp_delete_spi,
5445 { "Delete SPI", "isakmp.delete.spi",
5446 FT_BYTES, BASE_NONE, NULL, 0x0,
5447 "Identifies the specific security association(s) to delete", HFILL }},
5448 { &hf_isakmp_vid_bytes,
5449 { "Vendor ID", "isakmp.vid_bytes",
5450 FT_BYTES, BASE_NONE, NULL, 0x0,
5451 NULL, HFILL }},
5452 { &hf_isakmp_vid_string,
5453 { "Vendor ID", "isakmp.vid_string",
5454 FT_STRING, BASE_NONE, NULL, 0x0,
5455 NULL, HFILL }},
5456 { &hf_isakmp_vid_cp_product,
5457 { "Checkpoint Product", "isakmp.vid.cp.product",
5458 FT_UINT32, BASE_DEC, VALS(cp_product), 0x0,
5459 NULL, HFILL }},
5460 { &hf_isakmp_vid_cp_version,
5461 { "Checkpoint Version", "isakmp.vid.cp.version",
5462 FT_UINT32, BASE_DEC, VALS(cp_version), 0x0,
5463 "Encoded Version number", HFILL }},
5464 { &hf_isakmp_vid_cp_timestamp,
5465 { "Checkpoint Timestamp", "isakmp.vid.cp.timestamp",
5466 FT_UINT32, BASE_DEC, NULL, 0x0,
5467 "Timestamp (NGX only; always zero in 4.1 or NG)", HFILL }},
5468 { &hf_isakmp_vid_cp_reserved,
5469 { "Checkpoint Reserved", "isakmp.vid.cp.reserved",
5470 FT_UINT32, BASE_HEX, NULL, 0x0,
5471 NULL, HFILL }},
5472 { &hf_isakmp_vid_cp_features,
5473 { "Checkpoint Features", "isakmp.vid.cp.features",
5474 FT_UINT32, BASE_HEX, NULL, 0x0,
5475 NULL, HFILL }},
5476
5477 { &hf_isakmp_vid_cisco_unity_major,
5478 { "CISCO-UNITY Major version", "isakmp.vid.cisco_unity.major",
5479 FT_UINT8, BASE_DEC, NULL, 0x0,
5480 NULL, HFILL }},
5481 { &hf_isakmp_vid_cisco_unity_minor,
5482 { "CISCO-UNITY Minor version", "isakmp.vid.cisco_unity.minor",
5483 FT_UINT8, BASE_DEC, NULL, 0x0,
5484 NULL, HFILL }},
5485
5486 { &hf_isakmp_vid_ms_nt5_isakmpoakley,
5487 { "MS NT5 ISAKMPOAKLEY", "isakmp.vid.ms_nt5_isakmpoakley",
5488 FT_UINT32, BASE_DEC, VALS(ms_nt5_isakmpoakley_type), 0x0,
5489 NULL, HFILL }},
5490
5491 { &hf_isakmp_vid_aruba_via_auth_profile,
5492 { "Auth Profile", "isakmp.vid.aruba_via_auth_profile",
5493 FT_STRING, BASE_NONE, NULL, 0x0,
5494 "Aruba Networks Auth Profile for VIA Client", HFILL }},
5495
5496 { &hf_isakmp_ts_number_of_ts,
5497 { "Number of Traffic Selector", "isakmp.ts.number",
5498 FT_UINT8, BASE_DEC, NULL, 0x0,
5499 NULL, HFILL }},
5500 { &hf_isakmp_ts_type,
5501 { "Traffic Selector Type", "isakmp.ts.type",
5502 FT_UINT8, BASE_RANGE_STRING | BASE_DEC, RVALS(traffic_selector_type), 0x0,
5503 NULL, HFILL }},
5504 { &hf_isakmp_ts_protoid,
5505 { "Protocol ID", "isakmp.ts.protoid",
5506 FT_UINT8, BASE_DEC|BASE_EXT_STRING, (&ipproto_val_ext), 0x0,
5507 "IKEv2 Traffic Selector Protocol ID", HFILL }},
5508 { &hf_isakmp_ts_selector_length,
5509 { "Selector Length", "isakmp.ts.selector_length",
5510 FT_UINT16, BASE_DEC, NULL, 0x0,
5511 NULL, HFILL }},
5512 { &hf_isakmp_ts_start_port,
5513 { "Start Port", "isakmp.ts.start_port",
5514 FT_UINT16, BASE_DEC, NULL, 0x0,
5515 NULL, HFILL }},
5516 { &hf_isakmp_ts_end_port,
5517 { "End Port", "isakmp.ts.end_port",
5518 FT_UINT16, BASE_DEC, NULL, 0x0,
5519 NULL, HFILL }},
5520 { &hf_isakmp_ts_start_addr_ipv4,
5521 { "Starting Addr", "isakmp.ts.start_ipv4",
5522 FT_IPv4, BASE_NONE, NULL, 0x0,
5523 NULL, HFILL }},
5524 { &hf_isakmp_ts_end_addr_ipv4,
5525 { "Ending Addr", "isakmp.ts.end_ipv4",
5526 FT_IPv4, BASE_NONE, NULL, 0x0,
5527 NULL, HFILL }},
5528 { &hf_isakmp_ts_start_addr_ipv6,
5529 { "Starting Addr", "isakmp.ts.start_ipv6",
5530 FT_IPv6, BASE_NONE, NULL, 0x0,
5531 NULL, HFILL }},
5532 { &hf_isakmp_ts_end_addr_ipv6,
5533 { "Ending Addr", "isakmp.ts.end_ipv6",
5534 FT_IPv6, BASE_NONE, NULL, 0x0,
5535 NULL, HFILL }},
5536 { &hf_isakmp_ts_start_addr_fc,
5537 { "Starting Addr", "isakmp.ts.start_fc",
5538 FT_UINT32, BASE_DEC, NULL, 0x0,
5539 NULL, HFILL }},
5540 { &hf_isakmp_ts_end_addr_fc,
5541 { "Ending Addr", "isakmp.ts.end_fc",
5542 FT_UINT32, BASE_DEC, NULL, 0x0,
5543 NULL, HFILL }},
5544 { &hf_isakmp_ts_start_r_ctl,
5545 { "Starting R_CTL", "isakmp.ts.start_r_ctl",
5546 FT_UINT8, BASE_DEC, NULL, 0x0,
5547 NULL, HFILL }},
5548 { &hf_isakmp_ts_end_r_ctl,
5549 { "Ending R_CTL", "isakmp.ts.end_r_ctl",
5550 FT_UINT8, BASE_DEC, NULL, 0x0,
5551 NULL, HFILL }},
5552 { &hf_isakmp_ts_start_type,
5553 { "Starting Type", "isakmp.ts.start_type",
5554 FT_UINT8, BASE_DEC, NULL, 0x0,
5555 NULL, HFILL }},
5556 { &hf_isakmp_ts_end_type,
5557 { "Ending Type", "isakmp.ts.end_type",
5558 FT_UINT8, BASE_DEC, NULL, 0x0,
5559 NULL, HFILL }},
5560 { &hf_isakmp_ts_data,
5561 { "Traffic Selector Data", "isakmp.ts.data",
5562 FT_BYTES, BASE_NONE, NULL, 0x0,
5563 NULL, HFILL }},
5564
5565 { &hf_isakmp_num_spis,
5566 { "Port", "isakmp.spinum",
5567 FT_UINT16, BASE_DEC, NULL, 0x0,
5568 "ISAKMP Number of SPIs", HFILL }},
5569 { &hf_isakmp_hash,
5570 { "Hash DATA", "isakmp.hash",
5571 FT_BYTES, BASE_NONE, NULL, 0x0,
5572 NULL, HFILL }},
5573 { &hf_isakmp_sig,
5574 { "Signature DATA", "isakmp.sig",
5575 FT_BYTES, BASE_NONE, NULL, 0x0,
5576 NULL, HFILL }},
5577 { &hf_isakmp_nonce,
5578 { "Nonce DATA", "isakmp.nonce",
5579 FT_BYTES, BASE_NONE, NULL, 0x0,
5580 NULL, HFILL }},
5581
5582 { &hf_isakmp_cisco_frag_packetid,
5583 { "Frag ID", "isakmp.frag.packetid",
5584 FT_UINT16, BASE_HEX, NULL, 0x0,
5585 "ISAKMP fragment packet-id", HFILL }},
5586 { &hf_isakmp_cisco_frag_seq,
5587 { "Frag seq", "isakmp.frag.seq",
5588 FT_UINT8, BASE_DEC, NULL, 0x0,
5589 "ISAKMP fragment number", HFILL }},
5590 { &hf_isakmp_cisco_frag_last,
5591 { "Frag last", "isakmp.frag.last",
5592 FT_UINT8, BASE_DEC, VALS(frag_last_vals), 0x0,
5593 "ISAKMP last fragment", HFILL }},
5594 { &hf_isakmp_fragments,
5595 {"Message fragments", "isakmp.fragments",
5596 FT_NONE, BASE_NONE, NULL, 0x00, NULL, HFILL } },
5597 { &hf_isakmp_fragment,
5598 {"Message fragment", "isakmp.fragment",
5599 FT_FRAMENUM, BASE_NONE, NULL, 0x00, NULL, HFILL } },
5600 { &hf_isakmp_fragment_overlap,
5601 {"Message fragment overlap", "isakmp.fragment.overlap",
5602 FT_BOOLEAN, BASE_NONE, NULL, 0x0, NULL, HFILL } },
5603 { &hf_isakmp_fragment_overlap_conflicts,
5604 {"Message fragment overlapping with conflicting data",
5605 "isakmp.fragment.overlap.conflicts",
5606 FT_BOOLEAN, BASE_NONE, NULL, 0x0, NULL, HFILL } },
5607 { &hf_isakmp_fragment_multiple_tails,
5608 {"Message has multiple tail fragments",
5609 "isakmp.fragment.multiple_tails",
5610 FT_BOOLEAN, BASE_NONE, NULL, 0x0, NULL, HFILL } },
5611 { &hf_isakmp_fragment_too_long_fragment,
5612 {"Message fragment too long", "isakmp.fragment.too_long_fragment",
5613 FT_BOOLEAN, BASE_NONE, NULL, 0x0, NULL, HFILL } },
5614 { &hf_isakmp_fragment_error,
5615 {"Message defragmentation error", "isakmp.fragment.error",
5616 FT_FRAMENUM, BASE_NONE, NULL, 0x00, NULL, HFILL } },
5617 { &hf_isakmp_fragment_count,
5618 {"Message fragment count", "isakmp.fragment.count",
5619 FT_UINT32, BASE_DEC, NULL, 0x00, NULL, HFILL } },
5620 { &hf_isakmp_reassembled_in,
5621 {"Reassembled in", "isakmp.reassembled.in",
5622 FT_FRAMENUM, BASE_NONE, NULL, 0x00, NULL, HFILL } },
5623 { &hf_isakmp_reassembled_length,
5624 {"Reassembled ISAKMP length", "isakmp.reassembled.length",
5625 FT_UINT32, BASE_DEC, NULL, 0x00, NULL, HFILL } },
5626 { &hf_isakmp_certreq_authority_sig,
5627 { "Certificate Authority Signature", "ike.certreq.authority.sig",
5628 FT_UINT32, BASE_DEC, NULL, 0x0,
5629 NULL, HFILL } },
5630 { &hf_isakmp_certreq_authority_v1,
5631 { "Certificate Authority Data", "ike.certreq.authority",
5632 FT_BYTES, BASE_NONE, NULL, 0x0,
5633 NULL, HFILL } },
5634 { &hf_isakmp_certreq_authority_v2,
5635 { "Certificate Authority Data", "ike.certreq.authority",
5636 FT_BYTES, BASE_NONE, NULL, 0x0,
5637 "SHA-1 hash of the Certificate Authority", HFILL } },
5638 { &hf_isakmp_nat_keepalive,
5639 { "NAT Keepalive", "ike.nat_keepalive",
5640 FT_NONE, BASE_NONE, NULL, 0x0, "NAT Keepalive packet", HFILL } },
5641 { &hf_isakmp_nat_hash,
5642 { "HASH of the address and port", "ike.nat_hash",
5643 FT_BYTES, BASE_NONE, NULL, 0x00,
5644 NULL, HFILL }},
5645 { &hf_isakmp_nat_original_address_ipv4,
5646 { "NAT Original IPv4 Address", "ike.nat_original_address_ipv4",
5647 FT_IPv4, BASE_NONE, NULL, 0x00,
5648 NULL, HFILL }},
5649 { &hf_isakmp_nat_original_address_ipv6,
5650 { "NAT Original IPv6 Address", "ike.nat_original_address_ipv6",
5651 FT_IPv6, BASE_NONE, NULL, 0x00,
5652 NULL, HFILL }},
5653
5654 /* Transform Attributes Type */
5655 { &hf_isakmp_tf_attr,
5656 { "Transform Attribute Type", "isakmp.tf.attr",
5657 FT_NONE, BASE_NONE, NULL, 0x00,
5658 "ISAKMP Transform Attribute", HFILL }},
5659 { &hf_isakmp_tf_attr_type_v1,
5660 { "Transform Attribute Type", "isakmp.tf.attr.type_v1",
5661 FT_UINT16, BASE_DEC, VALS(transform_isakmp_attr_type), 0x00,
5662 "ISAKMP (v1) Transform Attribute type", HFILL }},
5663 { &hf_isakmp_tf_attr_format,
5664 { "Transform Format", "isakmp.tf.attr.format",
5665 FT_BOOLEAN, 16, TFS(&attribute_format), 0x8000,
5666 "ISAKMP Transform Attribute Format", HFILL }},
5667 { &hf_isakmp_tf_attr_length,
5668 { "Length", "isakmp.tf.attr.length",
5669 FT_UINT16, BASE_DEC, NULL, 0x00,
5670 "ISAKMP Tranform Attribute length", HFILL }},
5671 { &hf_isakmp_tf_attr_value,
5672 { "Value", "isakmp.tf.attr.value",
5673 FT_BYTES, BASE_NONE, NULL, 0x00,
5674 "ISAKMP Transform Attribute value", HFILL }},
5675 { &hf_isakmp_tf_attr_life_type,
5676 { "Life Type", "isakmp.tf.attr.life_type",
5677 FT_UINT16, BASE_DEC, VALS(transform_attr_sa_life_type), 0x00,
5678 NULL, HFILL }},
5679 { &hf_isakmp_tf_attr_life_duration_uint32,
5680 { "Life Duration", "isakmp.tf.attr.life_duration",
5681 FT_UINT32, BASE_DEC, NULL, 0x00,
5682 NULL, HFILL }},
5683 { &hf_isakmp_tf_attr_life_duration_uint64,
5684 { "Life Duration", "isakmp.tf.attr.life_duration",
5685 FT_UINT64, BASE_DEC, NULL, 0x00,
5686 NULL, HFILL }},
5687 { &hf_isakmp_tf_attr_life_duration_bytes,
5688 { "Life Duration", "isakmp.tf.attr.life_duration",
5689 FT_BYTES, BASE_NONE, NULL, 0x00,
5690 NULL, HFILL }},
5691 { &hf_isakmp_tf_attr_group_description,
5692 { "Group Description", "isakmp.tf.attr.group_description",
5693 FT_UINT16, BASE_DEC, VALS(transform_dh_group_type), 0x00,
5694 NULL, HFILL }},
5695 { &hf_isakmp_tf_attr_encap_mode,
5696 { "Encapsulation Mode", "isakmp.tf.attr.encap_mode",
5697 FT_UINT16, BASE_DEC, VALS(transform_attr_encap_type), 0x00,
5698 NULL, HFILL }},
5699 { &hf_isakmp_tf_attr_auth_algorithm,
5700 { "Authentication Algorithm", "isakmp.tf.attr.auth_algorithm",
5701 FT_UINT16, BASE_DEC, VALS(transform_attr_auth_type), 0x00,
5702 NULL, HFILL }},
5703 { &hf_isakmp_tf_attr_key_length,
5704 { "Key Length", "isakmp.tf.attr.key_length",
5705 FT_UINT16, BASE_DEC, NULL, 0x00,
5706 NULL, HFILL }},
5707 { &hf_isakmp_tf_attr_key_rounds,
5708 { "Key Rounds", "isakmp.tf.attr.key_rounds",
5709 FT_UINT16, BASE_DEC, NULL, 0x00,
5710 NULL, HFILL }},
5711 { &hf_isakmp_tf_attr_cmpr_dict_size,
5712 { "Compress Dictionary Size", "isakmp.tf.attr.cmpr_dict_size",
5713 FT_UINT16, BASE_DEC, NULL, 0x00,
5714 NULL, HFILL }},
5715 { &hf_isakmp_tf_attr_cmpr_algorithm,
5716 { "Compress Private Algorithm", "isakmp.tf.attr.cmpr_algorithm",
5717 FT_BYTES, BASE_NONE, NULL, 0x00,
5718 NULL, HFILL }},
5719 { &hf_isakmp_tf_attr_ecn_tunnel,
5720 { "ECN Tunnel", "isakmp.tf.attr.ecn_tunnel",
5721 FT_UINT16, BASE_DEC, VALS(transform_attr_ecn_type), 0x00,
5722 NULL, HFILL }},
5723 { &hf_isakmp_tf_attr_ext_seq_nbr,
5724 { "Extended (64-bit) Sequence Number", "isakmp.tf.attr.ext_seq_nbr",
5725 FT_UINT16, BASE_DEC, VALS(transform_attr_ext_seq_nbr_type), 0x00,
5726 NULL, HFILL }},
5727 { &hf_isakmp_tf_attr_auth_key_length,
5728 { "Authentication Key Length", "isakmp.tf.attr.auth_key_length",
5729 FT_UINT16, BASE_DEC, NULL, 0x00,
5730 NULL, HFILL }},
5731 { &hf_isakmp_tf_attr_sig_enco_algorithm,
5732 { "Signature Encoding Algorithm", "isakmp.tf.attr.sig_enco_algorithm",
5733 FT_BYTES, BASE_NONE, NULL, 0x00,
5734 NULL, HFILL }},
5735 { &hf_isakmp_tf_attr_addr_preservation,
5736 { "Address Preservation", "isakmp.tf.attr.addr_preservation",
5737 FT_UINT16, BASE_DEC, VALS(transform_attr_addr_preservation_type), 0x00,
5738 NULL, HFILL }},
5739 { &hf_isakmp_tf_attr_sa_direction,
5740 { "SA Direction", "isakmp.tf.attr.sa_direction",
5741 FT_UINT16, BASE_DEC, VALS(transform_attr_sa_direction_type), 0x00,
5742 NULL, HFILL }},
5743
5744 { &hf_isakmp_ike_attr,
5745 { "Transform IKE Attribute Type", "isakmp.ike.attr",
5746 FT_NONE, BASE_NONE, NULL, 0x00,
5747 "IKE Transform Attribute", HFILL }},
5748 { &hf_isakmp_ike_attr_type,
5749 { "Transform IKE Attribute Type", "isakmp.ike.attr.type",
5750 FT_UINT16, BASE_DEC, VALS(transform_ike_attr_type), 0x00,
5751 "IKE Transform Attribute type", HFILL }},
5752 { &hf_isakmp_ike_attr_format,
5753 { "Transform IKE Format", "isakmp.ike.attr.format",
5754 FT_BOOLEAN, 16, TFS(&attribute_format), 0x8000,
5755 "IKE Transform Attribute Format", HFILL }},
5756 { &hf_isakmp_ike_attr_length,
5757 { "Length", "isakmp.ike.attr.length",
5758 FT_UINT16, BASE_DEC, NULL, 0x00,
5759 "IKE Tranform Attribute length", HFILL }},
5760 { &hf_isakmp_ike_attr_value,
5761 { "Value", "isakmp.ike.attr.value",
5762 FT_BYTES, BASE_NONE, NULL, 0x00,
5763 "IKE Transform Attribute value", HFILL }},
5764
5765 { &hf_isakmp_ike_attr_encryption_algorithm,
5766 { "Encryption Algorithm", "isakmp.ike.attr.encryption_algorithm",
5767 FT_UINT16, BASE_DEC, VALS(transform_attr_enc_type), 0x00,
5768 NULL, HFILL }},
5769 { &hf_isakmp_ike_attr_hash_algorithm,
5770 { "HASH Algorithm", "isakmp.ike.attr.hash_algorithm",
5771 FT_UINT16, BASE_DEC, VALS(transform_attr_hash_type), 0x00,
5772 NULL, HFILL }},
5773 { &hf_isakmp_ike_attr_authentication_method,
5774 { "Authentication Method", "isakmp.ike.attr.authentication_method",
5775 FT_UINT16, BASE_DEC, VALS(transform_attr_authmeth_type), 0x00,
5776 NULL, HFILL }},
5777 { &hf_isakmp_ike_attr_group_description,
5778 { "Group Description", "isakmp.ike.attr.group_description",
5779 FT_UINT16, BASE_DEC, VALS(transform_dh_group_type), 0x00,
5780 NULL, HFILL }},
5781 { &hf_isakmp_ike_attr_group_type,
5782 { "Groupe Type", "isakmp.ike.attr.group_type",
5783 FT_UINT16, BASE_DEC, VALS(transform_attr_grp_type), 0x00,
5784 NULL, HFILL }},
5785 { &hf_isakmp_ike_attr_group_prime,
5786 { "Groupe Prime", "isakmp.ike.attr.group_prime",
5787 FT_BYTES, BASE_NONE, NULL, 0x00,
5788 NULL, HFILL }},
5789 { &hf_isakmp_ike_attr_group_generator_one,
5790 { "Groupe Generator One", "isakmp.ike.attr.group_generator_one",
5791 FT_BYTES, BASE_NONE, NULL, 0x00,
5792 NULL, HFILL }},
5793 { &hf_isakmp_ike_attr_group_generator_two,
5794 { "Groupe Generator Two", "isakmp.ike.attr.group_generator_two",
5795 FT_BYTES, BASE_NONE, NULL, 0x00,
5796 NULL, HFILL }},
5797 { &hf_isakmp_ike_attr_group_curve_a,
5798 { "Groupe Curve A", "isakmp.ike.attr.group_curve_a",
5799 FT_BYTES, BASE_NONE, NULL, 0x00,
5800 NULL, HFILL }},
5801 { &hf_isakmp_ike_attr_group_curve_b,
5802 { "Groupe Curve B", "isakmp.ike.attr.group_curve_b",
5803 FT_BYTES, BASE_NONE, NULL, 0x00,
5804 NULL, HFILL }},
5805 { &hf_isakmp_ike_attr_life_type,
5806 { "Life Type", "isakmp.ike.attr.life_type",
5807 FT_UINT16, BASE_DEC, VALS(transform_attr_sa_life_type), 0x00,
5808 NULL, HFILL }},
5809 { &hf_isakmp_ike_attr_life_duration_uint32,
5810 { "Life Duration", "isakmp.ike.attr.life_duration",
5811 FT_UINT32, BASE_DEC, NULL, 0x00,
5812 NULL, HFILL }},
5813 { &hf_isakmp_ike_attr_life_duration_uint64,
5814 { "Life Duration", "isakmp.ike.attr.life_duration",
5815 FT_UINT64, BASE_DEC, NULL, 0x00,
5816 NULL, HFILL }},
5817 { &hf_isakmp_ike_attr_life_duration_bytes,
5818 { "Life Duration", "isakmp.ike.attr.life_duration",
5819 FT_BYTES, BASE_NONE, NULL, 0x00,
5820 NULL, HFILL }},
5821 { &hf_isakmp_ike_attr_prf,
5822 { "PRF", "isakmp.ike.attr.prf",
5823 FT_BYTES, BASE_NONE, NULL, 0x00,
5824 NULL, HFILL }},
5825 { &hf_isakmp_ike_attr_key_length,
5826 { "Key Length", "isakmp.ike.attr.key_length",
5827 FT_UINT16, BASE_DEC, NULL, 0x00,
5828 NULL, HFILL }},
5829 { &hf_isakmp_ike_attr_field_size,
5830 { "Field Size", "isakmp.ike.attr.field_size",
5831 FT_BYTES, BASE_NONE, NULL, 0x00,
5832 NULL, HFILL }},
5833 { &hf_isakmp_ike_attr_group_order,
5834 { "Key Length", "isakmp.ike.attr.group_order",
5835 FT_BYTES, BASE_NONE, NULL, 0x00,
5836 NULL, HFILL }},
5837
5838 { &hf_isakmp_trans_type,
5839 { "Transform Type", "isakmp.tf.type",
5840 FT_UINT8, BASE_RANGE_STRING | BASE_DEC, RVALS(transform_ike2_type), 0x00,
5841 NULL, HFILL }},
5842
5843 { &hf_isakmp_trans_encr,
5844 { "Transform ID (ENCR)", "isakmp.tf.id.encr",
5845 FT_UINT16, BASE_DEC, VALS(transform_ike2_encr_type), 0x00,
5846 NULL, HFILL }},
5847 { &hf_isakmp_trans_prf,
5848 { "Transform ID (PRF)", "isakmp.tf.id.prf",
5849 FT_UINT16, BASE_DEC, VALS(transform_ike2_prf_type), 0x00,
5850 NULL, HFILL }},
5851 { &hf_isakmp_trans_integ,
5852 { "Transform ID (INTEG)", "isakmp.tf.id.integ",
5853 FT_UINT16, BASE_DEC, VALS(transform_ike2_integ_type), 0x00,
5854 NULL, HFILL }},
5855 { &hf_isakmp_trans_dh,
5856 { "Transform ID (D-H)", "isakmp.tf.id.dh",
5857 FT_UINT16, BASE_DEC, VALS(transform_dh_group_type), 0x00,
5858 NULL, HFILL }},
5859 { &hf_isakmp_trans_esn,
5860 { "Transform ID (ESN)", "isakmp.tf.id.esn",
5861 FT_UINT16, BASE_DEC, VALS(transform_ike2_esn_type), 0x00,
5862 NULL, HFILL }},
5863 { &hf_isakmp_trans_id_v2,
5864 { "Transform ID", "isakmp.tf.id",
5865 FT_UINT16, BASE_DEC, NULL, 0x00,
5866 NULL, HFILL }},
5867 { &hf_isakmp_ike2_attr,
5868 { "Transform IKE2 Attribute Type", "isakmp.ike2.attr",
5869 FT_NONE, BASE_NONE, NULL, 0x00,
5870 "IKE2 Transform Attribute", HFILL }},
5871 { &hf_isakmp_ike2_attr_type,
5872 { "Transform IKE2 Attribute Type", "isakmp.ike2.attr.type",
5873 FT_UINT16, BASE_DEC, VALS(transform_ike2_attr_type), 0x00,
5874 "IKE2 Transform Attribute type", HFILL }},
5875 { &hf_isakmp_ike2_attr_format,
5876 { "Transform IKE2 Format", "isakmp.ike2.attr.format",
5877 FT_BOOLEAN, 16, TFS(&attribute_format), 0x8000,
5878 "IKE2 Transform Attribute Format", HFILL }},
5879 { &hf_isakmp_ike2_attr_length,
5880 { "Length", "isakmp.ike2.attr.length",
5881 FT_UINT16, BASE_DEC, NULL, 0x00,
5882 "IKE2 Tranform Attribute length", HFILL }},
5883 { &hf_isakmp_ike2_attr_value,
5884 { "Value", "isakmp.ike2.attr.value",
5885 FT_BYTES, BASE_NONE, NULL, 0x00,
5886 "IKE2 Transform Attribute value", HFILL }},
5887 { &hf_isakmp_ike2_attr_key_length,
5888 { "Key Length", "isakmp.ike2.attr.key_length",
5889 FT_UINT16, BASE_DEC, NULL, 0x00,
5890 NULL, HFILL }},
5891
5892
5893 { &hf_isakmp_key_exch_dh_group,
5894 { "DH Group #", "isakmp.key_exchange.dh_group",
5895 FT_UINT16, BASE_DEC, VALS(transform_dh_group_type), 0x00,
5896 NULL, HFILL }},
5897 { &hf_isakmp_key_exch_data,
5898 { "Key Exchange Data", "isakmp.key_exchange.data",
5899 FT_BYTES, BASE_NONE, NULL, 0x00,
5900 NULL, HFILL }},
5901 { &hf_isakmp_eap_data,
5902 { "EAP Message", "isakmp.eap.data",
5903 FT_BYTES, BASE_NONE, NULL, 0x00,
5904 NULL, HFILL }},
5905
5906 { &hf_isakmp_gspm_data,
5907 { "GSPM", "isakmp.gspm.data",
5908 FT_BYTES, BASE_NONE, NULL, 0x00,
5909 "Generic Secure Password Method", HFILL }},
5910
5911 { &hf_isakmp_cfg_type_v1,
5912 { "Type", "isakmp.cfg.type",
5913 FT_UINT8, BASE_RANGE_STRING | BASE_DEC, RVALS(vs_v1_cfgtype), 0x0,
5914 "ISAKMP (v1) Config Type", HFILL }},
5915 { &hf_isakmp_cfg_identifier,
5916 { "Identifier", "isakmp.cfg.identifier",
5917 FT_UINT16, BASE_DEC, NULL, 0x0,
5918 "ISAKMP (v1) Config Identifier", HFILL }},
5919 { &hf_isakmp_cfg_type_v2,
5920 { "Type", "isakmp.cfg.type",
5921 FT_UINT8, BASE_RANGE_STRING | BASE_DEC, RVALS(vs_v2_cfgtype), 0x0,
5922 "ISAKMP (v2) Config Type", HFILL }},
5923 /* Config Attributes Type */
5924 { &hf_isakmp_cfg_attr,
5925 { "Config Attribute Type", "isakmp.cfg.attr",
5926 FT_NONE, BASE_NONE, NULL, 0x00,
5927 "ISAKMP Config Attribute", HFILL }},
5928 { &hf_isakmp_cfg_attr_type_v1,
5929 { "Type", "isakmp.cfg.attr.type",
5930 FT_UINT16, BASE_RANGE_STRING | BASE_DEC, RVALS(vs_v1_cfgattr), 0x00,
5931 "ISAKMP (v1) Config Attribute type", HFILL }},
5932 { &hf_isakmp_cfg_attr_type_v2,
5933 { "Type", "isakmp.cfg.attr.type",
5934 FT_UINT16, BASE_RANGE_STRING | BASE_DEC, RVALS(vs_v2_cfgattr), 0x00,
5935 "ISAKMP (v2) Config Attribute type", HFILL }},
5936 { &hf_isakmp_cfg_attr_format,
5937 { "Config Attribute Format", "isakmp.cfg.attr.format",
5938 FT_BOOLEAN, 16, TFS(&attribute_format), 0x8000,
5939 "ISAKMP Config Attribute Format", HFILL }},
5940 { &hf_isakmp_cfg_attr_length,
5941 { "Length", "isakmp.cfg.attr.length",
5942 FT_UINT16, BASE_DEC, NULL, 0x00,
5943 "ISAKMP Config Attribute length", HFILL }},
5944 { &hf_isakmp_cfg_attr_value,
5945 { "Value", "isakmp.cfg.attr.value",
5946 FT_BYTES, BASE_NONE, NULL, 0x00,
5947 "ISAKMP Config Attribute value", HFILL }},
5948 { &hf_isakmp_cfg_attr_internal_ip4_address,
5949 { "INTERNAL IP4 ADDRESS", "isakmp.cfg.attr.internal_ip4_address",
5950 FT_IPv4, BASE_NONE, NULL, 0x00,
5951 "An IPv4 address on the internal network", HFILL }},
5952 { &hf_isakmp_cfg_attr_internal_ip4_netmask,
5953 { "INTERNAL IP4 NETMASK", "isakmp.cfg.attr.internal_ip4_netmask",
5954 FT_IPv4, BASE_NONE, NULL, 0x00,
5955 "The internal network's netmask", HFILL }},
5956 { &hf_isakmp_cfg_attr_internal_ip4_dns,
5957 { "INTERNAL IP4 DNS", "isakmp.cfg.attr.internal_ip4_dns",
5958 FT_IPv4, BASE_NONE, NULL, 0x00,
5959 "An IPv4 address of a DNS server within the network", HFILL }},
5960 { &hf_isakmp_cfg_attr_internal_ip4_nbns,
5961 { "INTERNAL IP4 NBNS", "isakmp.cfg.attr.internal_ip4_nbns",
5962 FT_IPv4, BASE_NONE, NULL, 0x00,
5963 "An IPv4 address of a NetBios Name Server (WINS) within the network", HFILL }},
5964 { &hf_isakmp_cfg_attr_internal_address_expiry,
5965 { "INTERNAL ADDRESS EXPIRY (Secs)", "isakmp.cfg.attr.internal_address_expiry",
5966 FT_UINT32, BASE_DEC, NULL, 0x00,
5967 "Specifies the number of seconds that the host can use the internal IP address", HFILL }},
5968 { &hf_isakmp_cfg_attr_internal_ip4_dhcp,
5969 { "INTERNAL IP4 DHCP", "isakmp.cfg.attr.internal_ip4_dhcp",
5970 FT_IPv4, BASE_NONE, NULL, 0x00,
5971 "the host to send any internal DHCP requests to the address", HFILL }},
5972 { &hf_isakmp_cfg_attr_application_version,
5973 { "APPLICATION VERSION", "isakmp.cfg.attr.application_version",
5974 FT_STRING, BASE_NONE, NULL, 0x00,
5975 "The version or application information of the IPsec host", HFILL }},
5976 { &hf_isakmp_cfg_attr_internal_ip6_address,
5977 { "INTERNAL IP6 ADDRESS", "isakmp.cfg.attr.internal_ip6_address",
5978 FT_IPv4, BASE_NONE, NULL, 0x00,
5979 "An IPv6 address on the internal network", HFILL }},
5980 { &hf_isakmp_cfg_attr_internal_ip6_netmask,
5981 { "INTERNAL IP4 NETMASK", "isakmp.cfg.attr.internal_ip6_netmask",
5982 FT_IPv6, BASE_NONE, NULL, 0x00,
5983 "The internal network's netmask", HFILL }},
5984 { &hf_isakmp_cfg_attr_internal_ip6_dns,
5985 { "INTERNAL IP6 DNS", "isakmp.cfg.attr.internal_ip6_dns",
5986 FT_IPv6, BASE_NONE, NULL, 0x00,
5987 "An IPv6 address of a DNS server within the network", HFILL }},
5988 { &hf_isakmp_cfg_attr_internal_ip6_nbns,
5989 { "INTERNAL IP6 NBNS", "isakmp.cfg.attr.internal_ip6_nbns",
5990 FT_IPv6, BASE_NONE, NULL, 0x00,
5991 "An IPv6 address of a NetBios Name Server (WINS) within the network", HFILL }},
5992 { &hf_isakmp_cfg_attr_internal_ip6_dhcp,
5993 { "INTERNAL IP6 DHCP", "isakmp.cfg.attr.internal_ip6_dhcp",
5994 FT_IPv6, BASE_NONE, NULL, 0x00,
5995 "The host to send any internal DHCP requests to the address", HFILL }},
5996 { &hf_isakmp_cfg_attr_internal_ip4_subnet_ip,
5997 { "INTERNAL IP4 SUBNET (IP)", "isakmp.cfg.attr.internal_ip4_subnet_ip",
5998 FT_IPv4, BASE_NONE, NULL, 0x00,
5999 "The protected sub-networks that this edge-device protects (IP)", HFILL }},
6000 { &hf_isakmp_cfg_attr_internal_ip4_subnet_netmask,
6001 { "INTERNAL IP4 SUBNET (NETMASK)", "isakmp.cfg.attr.internal_ip4_subnet_netmask",
6002 FT_IPv4, BASE_NONE, NULL, 0x00,
6003 "The protected sub-networks that this edge-device protects (IP)", HFILL }},
6004 { &hf_isakmp_cfg_attr_supported_attributes,
6005 { "SUPPORTED ATTRIBUTES", "isakmp.cfg.attr.supported_attributes",
6006 FT_UINT16, BASE_DEC, NULL, 0x00,
6007 NULL, HFILL }},
6008 { &hf_isakmp_cfg_attr_internal_ip6_subnet_ip,
6009 { "INTERNAL_IP6_SUBNET (IP)", "isakmp.cfg.attr.internal_ip6_subnet_ip",
6010 FT_IPv6, BASE_NONE, NULL, 0x00,
6011 NULL, HFILL }},
6012 { &hf_isakmp_cfg_attr_internal_ip6_subnet_prefix,
6013 { "INTERNAL_IP6_SUBNET (PREFIX)", "isakmp.cfg.attr.internal_ip6_subnet_prefix",
6014 FT_UINT8, BASE_DEC, NULL, 0x00,
6015 NULL, HFILL }},
6016 { &hf_isakmp_cfg_attr_internal_ip6_link_interface,
6017 { "INTERNAL_IP6_LINK (Link-Local Interface ID)", "isakmp.cfg.attr.internal_ip6_link_interface",
6018 FT_UINT64, BASE_DEC, NULL, 0x00,
6019 "The Interface ID used for link-local address (by the party that sent this attribute)", HFILL }},
6020 { &hf_isakmp_cfg_attr_internal_ip6_link_id,
6021 { "INTERNAL_IP6_LINK (IKEv2 Link ID)", "isakmp.cfg.attr.internal_ip6_link_id",
6022 FT_BYTES, BASE_NONE, NULL, 0x00,
6023 "The Link ID is selected by the VPN gateway and is treated as an opaque octet string by the client.", HFILL }},
6024 { &hf_isakmp_cfg_attr_internal_ip6_prefix_ip,
6025 { "INTERNAL_IP6_PREFIX (IP)", "isakmp.cfg.attr.internal_ip6_prefix_ip",
6026 FT_IPv6, BASE_NONE, NULL, 0x00,
6027 "An IPv6 prefix assigned to the virtual link", HFILL }},
6028 { &hf_isakmp_cfg_attr_internal_ip6_prefix_length,
6029 { "INTERNAL_IP6_PREFIX (Length)", "isakmp.cfg.attr.internal_ip6_prefix_length",
6030 FT_UINT8, BASE_DEC, NULL, 0x00,
6031 "The length of the prefix in bits (usually 64)", HFILL }},
6032
6033 { &hf_isakmp_cfg_attr_xauth_type,
6034 { "XAUTH TYPE", "isakmp.cfg.attr.xauth.type",
6035 FT_UINT16, BASE_RANGE_STRING | BASE_DEC, RVALS(cfgattr_xauth_type), 0x00,
6036 "The type of extended authentication requested", HFILL }},
6037 { &hf_isakmp_cfg_attr_xauth_user_name,
6038 { "XAUTH USER NAME", "isakmp.cfg.attr.xauth.user_name",
6039 FT_STRING, BASE_NONE, NULL, 0x00,
6040 "The user name", HFILL }},
6041 { &hf_isakmp_cfg_attr_xauth_user_password,
6042 { "XAUTH USER PASSWORD", "isakmp.cfg.attr.xauth.user_password",
6043 FT_STRING, BASE_NONE, NULL, 0x00,
6044 "The user's password", HFILL }},
6045 { &hf_isakmp_cfg_attr_xauth_passcode,
6046 { "XAUTH PASSCODE", "isakmp.cfg.attr.xauth.passcode",
6047 FT_STRING, BASE_NONE, NULL, 0x00,
6048 "A token card's passcode", HFILL }},
6049 { &hf_isakmp_cfg_attr_xauth_message,
6050 { "XAUTH MESSAGE", "isakmp.cfg.attr.xauth.message",
6051 FT_STRING, BASE_NONE, NULL, 0x00,
6052 "A textual message from an edge device to an IPSec host", HFILL }},
6053 { &hf_isakmp_cfg_attr_xauth_challenge,
6054 { "XAUTH CHALLENGE", "isakmp.cfg.attr.xauth.challenge",
6055 FT_STRING, BASE_NONE, NULL, 0x00,
6056 "A challenge string sent from the edge device to the IPSec host for it to include in its calculation of a password", HFILL }},
6057 { &hf_isakmp_cfg_attr_xauth_domain,
6058 { "XAUTH DOMAIN", "isakmp.cfg.attr.xauth.domain",
6059 FT_STRING, BASE_NONE, NULL, 0x00,
6060 "The domain to be authenticated in", HFILL }},
6061 { &hf_isakmp_cfg_attr_xauth_status,
6062 { "XAUTH STATUS", "isakmp.cfg.attr.xauth.status",
6063 FT_UINT16, BASE_DEC, VALS(cfgattr_xauth_status), 0x00,
6064 "A variable that is used to denote authentication success or failure", HFILL }},
6065 { &hf_isakmp_cfg_attr_xauth_next_pin,
6066 { "XAUTH TYPE", "isakmp.cfg.attr.xauth.next_pin",
6067 FT_STRING, BASE_NONE, NULL, 0x00,
6068 "A variable which is used when the edge device is requesting that the user choose a new pin number", HFILL }},
6069 { &hf_isakmp_cfg_attr_xauth_answer,
6070 { "XAUTH ANSWER", "isakmp.cfg.attr.xauth.answer",
6071 FT_STRING, BASE_NONE, NULL, 0x00,
6072 "A variable length ASCII string used to send input to the edge device", HFILL }},
6073 { &hf_isakmp_cfg_attr_unity_banner,
6074 { "UNITY BANNER", "isakmp.cfg.attr.unity.banner",
6075 FT_STRING, BASE_NONE, NULL, 0x00,
6076 "Banner", HFILL }},
6077 { &hf_isakmp_cfg_attr_unity_def_domain,
6078 { "UNITY DEF DOMAIN", "isakmp.cfg.attr.unity.def_domain",
6079 FT_STRING, BASE_NONE, NULL, 0x00,
6080 NULL, HFILL }},
6081
6082 { &hf_isakmp_enc_decrypted_data,
6083 { "Decrypted Data", "isakmp.enc.decrypted",
6084 FT_NONE, BASE_NONE, NULL, 0x0,
6085 NULL, HFILL }},
6086 { &hf_isakmp_enc_contained_data,
6087 { "Contained Data", "isakmp.enc.contained",
6088 FT_NONE, BASE_NONE, NULL, 0x0,
6089 NULL, HFILL }},
6090 { &hf_isakmp_enc_padding,
6091 { "Padding", "isakmp.enc.padding",
6092 FT_NONE, BASE_NONE, NULL, 0x0,
6093 NULL, HFILL }},
6094 { &hf_isakmp_enc_pad_length,
6095 { "Pad Length", "isakmp.enc.pad_length",
6096 FT_UINT16, BASE_DEC, NULL, 0x0,
6097 NULL, HFILL }},
6098 { &hf_isakmp_enc_data,
6099 { "Encrypted Data", "isakmp.enc.data",
6100 FT_NONE, BASE_NONE, NULL, 0x0,
6101 NULL, HFILL }},
6102 { &hf_isakmp_enc_iv,
6103 { "Initialization Vector", "isakmp.enc.iv",
6104 FT_BYTES, BASE_NONE, NULL, 0x0,
6105 NULL, HFILL }},
6106 { &hf_isakmp_enc_icd,
6107 { "Integrity Checksum Data", "isakmp.enc.icd",
6108 FT_BYTES, BASE_NONE, NULL, 0x0,
6109 NULL, HFILL }},
6110 };
6111
6112
6113 static gint *ett[] = {
6114 &ett_isakmp,
6115 &ett_isakmp_version,
6116 &ett_isakmp_flags,
6117 &ett_isakmp_payload,
6118 &ett_isakmp_fragment,
6119 &ett_isakmp_fragments,
6120 &ett_isakmp_sa,
6121 &ett_isakmp_tf_attr,
6122 &ett_isakmp_tf_ike_attr,
6123 &ett_isakmp_tf_ike2_attr,
6124 &ett_isakmp_id,
6125 &ett_isakmp_cfg_attr,
6126 &ett_isakmp_rohc_attr,
6127 #ifdef HAVE_LIBGCRYPT
6128 &ett_isakmp_decrypted_data,
6129 &ett_isakmp_decrypted_payloads
6130 #endif /* HAVE_LIBGCRYPT */
6131 };
6132
6133 static ei_register_info ei[] = {
6134 { &ei_isakmp_enc_iv, { "isakmp.enc.iv.not_enough_data", PI_MALFORMED, PI_WARN, "Not enough data in IKEv2 Encrypted payload", EXPFILL }},
6135 { &ei_isakmp_ikev2_integrity_checksum, { "isakmp.ikev2.integrity_checksum", PI_CHECKSUM, PI_WARN, "IKEv2 Integrity Checksum Data is incorrect", EXPFILL }},
6136 { &ei_isakmp_enc_data_length_mult_block_size, { "isakmp.enc_data_length_mult_block_size", PI_MALFORMED, PI_WARN, "Encrypted data length isn't a multiple of block size", EXPFILL }},
6137 { &ei_isakmp_enc_pad_length_big, { "isakmp.enc.pad_length.big", PI_MALFORMED, PI_WARN, "Pad length is too big", EXPFILL }},
6138 };
6139
6140 expert_module_t* expert_isakmp;
6141
6142 #ifdef HAVE_LIBGCRYPT
6143 static uat_field_t ikev1_uat_flds[] = {
6144 UAT_FLD_BUFFER(ikev1_users, icookie, "Initiator's COOKIE", "Initiator's COOKIE"),
6145 UAT_FLD_BUFFER(ikev1_users, key, "Encryption Key", "Encryption Key"),
6146 UAT_END_FIELDS
6147 };
6148
6149 static uat_field_t ikev2_uat_flds[] = {
6150 UAT_FLD_BUFFER(ikev2_users, spii, "Initiator's SPI", "Initiator's SPI value of the IKE_SA"),
6151 UAT_FLD_BUFFER(ikev2_users, spir, "Responder's SPI", "Responder's SPI value of the IKE_SA"),
6152 UAT_FLD_BUFFER(ikev2_users, sk_ei, "SK_ei", "Key used to encrypt/decrypt IKEv2 packets from initiator to responder"),
6153 UAT_FLD_BUFFER(ikev2_users, sk_er, "SK_er", "Key used to encrypt/decrypt IKEv2 packets from responder to initiator"),
6154 UAT_FLD_VS(ikev2_users, encr_alg, "Encryption algorithm", vs_ikev2_encr_algs, "Encryption algorithm of IKE_SA"),
6155 UAT_FLD_BUFFER(ikev2_users, sk_ai, "SK_ai", "Key used to calculate Integrity Checksum Data for IKEv2 packets from initiator to responder"),
6156 UAT_FLD_BUFFER(ikev2_users, sk_ar, "SK_ar", "Key used to calculate Integrity Checksum Data for IKEv2 packets from responder to initiator"),
6157 UAT_FLD_VS(ikev2_users, auth_alg, "Integrity algorithm", vs_ikev2_auth_algs, "Integrity algorithm of IKE_SA"),
6158 UAT_END_FIELDS
6159 };
6160 #endif /* HAVE_LIBGCRYPT */
6161 proto_isakmp = proto_register_protocol("Internet Security Association and Key Management Protocol",
6162 "ISAKMP", "isakmp");
6163 proto_register_field_array(proto_isakmp, hf, array_length(hf));
6164 proto_register_subtree_array(ett, array_length(ett));
6165 expert_isakmp = expert_register_protocol(proto_isakmp);
6166 expert_register_field_array(expert_isakmp, ei, array_length(ei));
6167 register_init_routine(&isakmp_init_protocol);
6168
6169 register_dissector("isakmp", dissect_isakmp, proto_isakmp);
6170
6171 #ifdef HAVE_LIBGCRYPT
6172 isakmp_module = prefs_register_protocol(proto_isakmp, isakmp_prefs_apply_cb);
6173 ikev1_uat = uat_new("IKEv1 Decryption Table",
6174 sizeof(ikev1_uat_data_key_t),
6175 "ikev1_decryption_table",
6176 TRUE,
6177 (void**)&ikev1_uat_data,
6178 &num_ikev1_uat_data,
6179 UAT_AFFECTS_DISSECTION, /* affects dissection of packets, but not set of named fields */
6180 "ChIKEv1DecryptionSection",
6181 NULL,
6182 ikev1_uat_data_update_cb,
6183 NULL,
6184 NULL,
6185 ikev1_uat_flds);
6186
6187 prefs_register_uat_preference(isakmp_module,
6188 "ikev1_decryption_table",
6189 "IKEv1 Decryption Table",
6190 "Table of IKE_SA security parameters for decryption of IKEv1 packets",
6191 ikev1_uat);
6192
6193 ikev2_uat = uat_new("IKEv2 Decryption Table",
6194 sizeof(ikev2_uat_data_t),
6195 "ikev2_decryption_table",
6196 TRUE,
6197 (void**)&ikev2_uat_data,
6198 &num_ikev2_uat_data,
6199 UAT_AFFECTS_DISSECTION, /* affects dissection of packets, but not set of named fields */
6200 "ChIKEv2DecryptionSection",
6201 NULL,
6202 ikev2_uat_data_update_cb,
6203 NULL,
6204 NULL,
6205 ikev2_uat_flds);
6206
6207 prefs_register_uat_preference(isakmp_module,
6208 "ikev2_decryption_table",
6209 "IKEv2 Decryption Table",
6210 "Table of IKE_SA security parameters for decryption of IKEv2 packets",
6211 ikev2_uat);
6212
6213 #endif /* HAVE_LIBGCRYPT */
6214 }
6215
6216 void
6217 proto_reg_handoff_isakmp(void)
6218 {
6219 dissector_handle_t isakmp_handle;
6220
6221 isakmp_handle = find_dissector("isakmp");
6222 eap_handle = find_dissector("eap");
6223 dissector_add_uint("udp.port", UDP_PORT_ISAKMP, isakmp_handle);
6224 dissector_add_uint("tcp.port", TCP_PORT_ISAKMP, isakmp_handle);
6225 }