From 281e9d71408deb6e8c5046c746c2e97002b0e7fe Mon Sep 17 00:00:00 2001 From: bms Date: Wed, 31 Mar 2004 09:17:26 +0000 Subject: Import tcpdump 3.8.3, from http://www.tcpdump.org/releases/tcpdump-3.8.3.tar.gz --- contrib/tcpdump/print-isakmp.c | 697 +++++++++++++++++++++++++---------------- 1 file changed, 426 insertions(+), 271 deletions(-) (limited to 'contrib/tcpdump/print-isakmp.c') diff --git a/contrib/tcpdump/print-isakmp.c b/contrib/tcpdump/print-isakmp.c index d00d575..d5caa739 100644 --- a/contrib/tcpdump/print-isakmp.c +++ b/contrib/tcpdump/print-isakmp.c @@ -1,7 +1,7 @@ /* * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. * All rights reserved. - * + * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: @@ -13,7 +13,7 @@ * 3. Neither the name of the project nor the names of its contributors * may be used to endorse or promote products derived from this software * without specific prior written permission. - * + * * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE @@ -29,24 +29,19 @@ */ #ifndef lint -static const char rcsid[] = - "@(#) $Header: /tcpdump/master/tcpdump/print-isakmp.c,v 1.29.2.2 2003/02/26 05:58:39 fenner Exp $ (LBL)"; +static const char rcsid[] _U_ = + "@(#) $Header: /tcpdump/master/tcpdump/print-isakmp.c,v 1.36.2.11 2004/03/24 01:32:42 guy Exp $ (LBL)"; #endif #ifdef HAVE_CONFIG_H #include "config.h" #endif -#include -#include -#include -#include -#include +#include -#include +#include #include -#include #include "isakmp.h" #include "ipsec_doi.h" @@ -64,38 +59,38 @@ static const char rcsid[] = #define sockaddr_storage sockaddr #endif -static u_char *isakmp_sa_print(struct isakmp_gen *, u_char *, u_int32_t, - u_int32_t, u_int32_t); -static u_char *isakmp_p_print(struct isakmp_gen *, u_char *, u_int32_t, - u_int32_t, u_int32_t); -static u_char *isakmp_t_print(struct isakmp_gen *, u_char *, u_int32_t, - u_int32_t, u_int32_t); -static u_char *isakmp_ke_print(struct isakmp_gen *, u_char *, u_int32_t, - u_int32_t, u_int32_t); -static u_char *isakmp_id_print(struct isakmp_gen *, u_char *, u_int32_t, - u_int32_t, u_int32_t); -static u_char *isakmp_cert_print(struct isakmp_gen *, u_char *, u_int32_t, - u_int32_t, u_int32_t); -static u_char *isakmp_cr_print(struct isakmp_gen *, u_char *, u_int32_t, - u_int32_t, u_int32_t); -static u_char *isakmp_sig_print(struct isakmp_gen *, u_char *, u_int32_t, - u_int32_t, u_int32_t); -static u_char *isakmp_hash_print(struct isakmp_gen *, u_char *, - u_int32_t, u_int32_t, u_int32_t); -static u_char *isakmp_nonce_print(struct isakmp_gen *, u_char *, - u_int32_t, u_int32_t, u_int32_t); -static u_char *isakmp_n_print(struct isakmp_gen *, u_char *, u_int32_t, - u_int32_t, u_int32_t); -static u_char *isakmp_d_print(struct isakmp_gen *, u_char *, u_int32_t, - u_int32_t, u_int32_t); -static u_char *isakmp_vid_print(struct isakmp_gen *, u_char *, u_int32_t, - u_int32_t, u_int32_t); -static u_char *isakmp_sub0_print(u_char, struct isakmp_gen *, u_char *, - u_int32_t, u_int32_t, u_int32_t); -static u_char *isakmp_sub_print(u_char, struct isakmp_gen *, u_char *, - u_int32_t, u_int32_t, u_int32_t); +static const u_char *isakmp_sa_print(const struct isakmp_gen *, + u_int, const u_char *, u_int32_t, u_int32_t, u_int32_t, int); +static const u_char *isakmp_p_print(const struct isakmp_gen *, + u_int, const u_char *, u_int32_t, u_int32_t, u_int32_t, int); +static const u_char *isakmp_t_print(const struct isakmp_gen *, + u_int, const u_char *, u_int32_t, u_int32_t, u_int32_t, int); +static const u_char *isakmp_ke_print(const struct isakmp_gen *, + u_int, const u_char *, u_int32_t, u_int32_t, u_int32_t, int); +static const u_char *isakmp_id_print(const struct isakmp_gen *, + u_int, const u_char *, u_int32_t, u_int32_t, u_int32_t, int); +static const u_char *isakmp_cert_print(const struct isakmp_gen *, + u_int, const u_char *, u_int32_t, u_int32_t, u_int32_t, int); +static const u_char *isakmp_cr_print(const struct isakmp_gen *, + u_int, const u_char *, u_int32_t, u_int32_t, u_int32_t, int); +static const u_char *isakmp_sig_print(const struct isakmp_gen *, + u_int, const u_char *, u_int32_t, u_int32_t, u_int32_t, int); +static const u_char *isakmp_hash_print(const struct isakmp_gen *, + u_int, const u_char *, u_int32_t, u_int32_t, u_int32_t, int); +static const u_char *isakmp_nonce_print(const struct isakmp_gen *, + u_int, const u_char *, u_int32_t, u_int32_t, u_int32_t, int); +static const u_char *isakmp_n_print(const struct isakmp_gen *, + u_int, const u_char *, u_int32_t, u_int32_t, u_int32_t, int); +static const u_char *isakmp_d_print(const struct isakmp_gen *, + u_int, const u_char *, u_int32_t, u_int32_t, u_int32_t, int); +static const u_char *isakmp_vid_print(const struct isakmp_gen *, + u_int, const u_char *, u_int32_t, u_int32_t, u_int32_t, int); +static const u_char *isakmp_sub0_print(u_char, const struct isakmp_gen *, + const u_char *, u_int32_t, u_int32_t, u_int32_t, int); +static const u_char *isakmp_sub_print(u_char, const struct isakmp_gen *, + const u_char *, u_int32_t, u_int32_t, u_int32_t, int); static char *numstr(int); -static void safememcpy(void *, void *, size_t); +static void safememcpy(void *, const void *, size_t); #define MAXINITIATORS 20 int ninitiator = 0; @@ -106,19 +101,19 @@ struct { } cookiecache[MAXINITIATORS]; /* protocol id */ -static char *protoidstr[] = { +static const char *protoidstr[] = { NULL, "isakmp", "ipsec-ah", "ipsec-esp", "ipcomp", }; /* isakmp->np */ -static char *npstr[] = { +static const char *npstr[] = { "none", "sa", "p", "t", "ke", "id", "cert", "cr", "hash", "sig", "nonce", "n", "d", "vid" }; /* isakmp->np */ -static u_char *(*npfunc[])(struct isakmp_gen *, u_char *, u_int32_t, - u_int32_t, u_int32_t) = { +static const u_char *(*npfunc[])(const struct isakmp_gen *, u_int, + const u_char *, u_int32_t, u_int32_t, u_int32_t, int) = { NULL, isakmp_sa_print, isakmp_p_print, @@ -136,7 +131,7 @@ static u_char *(*npfunc[])(struct isakmp_gen *, u_char *, u_int32_t, }; /* isakmp->etype */ -static char *etypestr[] = { +static const char *etypestr[] = { "none", "base", "ident", "auth", "agg", "inf", NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, @@ -326,29 +321,31 @@ cookie_sidecheck(int i, const u_char *bp2, int initiator) return 0; } -static void +static int rawprint(caddr_t loc, size_t len) { static u_char *p; - int i; + size_t i; TCHECK2(*loc, len); p = (u_char *)loc; for (i = 0; i < len; i++) printf("%02x", p[i] & 0xff); + return 1; trunc: - + return 0; } struct attrmap { - char *type; - int nvalue; - char *value[30]; /*XXX*/ + const char *type; + u_int nvalue; + const char *value[30]; /*XXX*/ }; -static u_char * -isakmp_attrmap_print(u_char *p, u_char *ep, struct attrmap *map, size_t nmap) +static const u_char * +isakmp_attrmap_print(const u_char *p, const u_char *ep, + const struct attrmap *map, size_t nmap) { u_int16_t *q; int totlen; @@ -358,35 +355,35 @@ isakmp_attrmap_print(u_char *p, u_char *ep, struct attrmap *map, size_t nmap) if (p[0] & 0x80) totlen = 4; else - totlen = 4 + ntohs(q[1]); + totlen = 4 + EXTRACT_16BITS(&q[1]); if (ep < p + totlen) { printf("[|attr]"); return ep + 1; } printf("("); - t = ntohs(q[0]) & 0x7fff; + t = EXTRACT_16BITS(&q[0]) & 0x7fff; if (map && t < nmap && map[t].type) printf("type=%s ", map[t].type); else printf("type=#%d ", t); if (p[0] & 0x80) { printf("value="); - v = ntohs(q[1]); + v = EXTRACT_16BITS(&q[1]); if (map && t < nmap && v < map[t].nvalue && map[t].value[v]) printf("%s", map[t].value[v]); else rawprint((caddr_t)&q[1], 2); } else { - printf("len=%d value=", ntohs(q[1])); - rawprint((caddr_t)&p[4], ntohs(q[1])); + printf("len=%d value=", EXTRACT_16BITS(&q[1])); + rawprint((caddr_t)&p[4], EXTRACT_16BITS(&q[1])); } printf(")"); return p + totlen; } -static u_char * -isakmp_attr_print(u_char *p, u_char *ep) +static const u_char * +isakmp_attr_print(const u_char *p, const u_char *ep) { u_int16_t *q; int totlen; @@ -396,40 +393,43 @@ isakmp_attr_print(u_char *p, u_char *ep) if (p[0] & 0x80) totlen = 4; else - totlen = 4 + ntohs(q[1]); + totlen = 4 + EXTRACT_16BITS(&q[1]); if (ep < p + totlen) { printf("[|attr]"); return ep + 1; } printf("("); - t = ntohs(q[0]) & 0x7fff; + t = EXTRACT_16BITS(&q[0]) & 0x7fff; printf("type=#%d ", t); if (p[0] & 0x80) { printf("value="); t = q[1]; rawprint((caddr_t)&q[1], 2); } else { - printf("len=%d value=", ntohs(q[1])); - rawprint((caddr_t)&p[2], ntohs(q[1])); + printf("len=%d value=", EXTRACT_16BITS(&q[1])); + rawprint((caddr_t)&p[2], EXTRACT_16BITS(&q[1])); } printf(")"); return p + totlen; } -static u_char * -isakmp_sa_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, - u_int32_t doi0, u_int32_t proto0) +static const u_char * +isakmp_sa_print(const struct isakmp_gen *ext, u_int item_len, + const u_char *ep, u_int32_t phase, u_int32_t doi0 _U_, + u_int32_t proto0, int depth) { - struct isakmp_pl_sa *p, sa; - u_int32_t *q; + const struct isakmp_pl_sa *p; + struct isakmp_pl_sa sa; + const u_int32_t *q; u_int32_t doi, sit, ident; - u_char *cp, *np; + const u_char *cp, *np; int t; printf("%s:", NPSTR(ISAKMP_NPTYPE_SA)); p = (struct isakmp_pl_sa *)ext; + TCHECK(*p); safememcpy(&sa, ext, sizeof(sa)); doi = ntohl(sa.doi); sit = ntohl(sa.sit); @@ -456,78 +456,92 @@ isakmp_sa_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, np = (u_char *)ext + sizeof(sa); if (sit != 0x01) { + TCHECK2(*(ext + 1), sizeof(ident)); safememcpy(&ident, ext + 1, sizeof(ident)); printf(" ident=%u", (u_int32_t)ntohl(ident)); np += sizeof(ident); } ext = (struct isakmp_gen *)np; + TCHECK(*ext); - cp = isakmp_sub_print(ISAKMP_NPTYPE_P, ext, ep, phase, doi, proto0); + cp = isakmp_sub_print(ISAKMP_NPTYPE_P, ext, ep, phase, doi, proto0, + depth); return cp; +trunc: + printf(" [|%s]", NPSTR(ISAKMP_NPTYPE_SA)); + return NULL; } -static u_char * -isakmp_p_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, - u_int32_t doi0, u_int32_t proto0) +static const u_char * +isakmp_p_print(const struct isakmp_gen *ext, u_int item_len, + const u_char *ep, u_int32_t phase, u_int32_t doi0, + u_int32_t proto0 _U_, int depth) { - struct isakmp_pl_p *p, prop; - u_char *cp; + const struct isakmp_pl_p *p; + struct isakmp_pl_p prop; + const u_char *cp; printf("%s:", NPSTR(ISAKMP_NPTYPE_P)); p = (struct isakmp_pl_p *)ext; + TCHECK(*p); safememcpy(&prop, ext, sizeof(prop)); printf(" #%d protoid=%s transform=%d", prop.p_no, PROTOIDSTR(prop.prot_id), prop.num_t); if (prop.spi_size) { printf(" spi="); - rawprint((caddr_t)(p + 1), prop.spi_size); + if (!rawprint((caddr_t)(p + 1), prop.spi_size)) + goto trunc; } ext = (struct isakmp_gen *)((u_char *)(p + 1) + prop.spi_size); + TCHECK(*ext); cp = isakmp_sub_print(ISAKMP_NPTYPE_T, ext, ep, phase, doi0, - prop.prot_id); + prop.prot_id, depth); return cp; +trunc: + printf(" [|%s]", NPSTR(ISAKMP_NPTYPE_P)); + return NULL; } -static char *isakmp_p_map[] = { +static const char *isakmp_p_map[] = { NULL, "ike", }; -static char *ah_p_map[] = { +static const char *ah_p_map[] = { NULL, "(reserved)", "md5", "sha", "1des", "sha2-256", "sha2-384", "sha2-512", }; -static char *esp_p_map[] = { +static const char *esp_p_map[] = { NULL, "1des-iv64", "1des", "3des", "rc5", "idea", "cast", "blowfish", "3idea", "1des-iv32", "rc4", "null", "aes" }; -static char *ipcomp_p_map[] = { +static const char *ipcomp_p_map[] = { NULL, "oui", "deflate", "lzs", }; -struct attrmap ipsec_t_map[] = { - { NULL, 0, }, +const struct attrmap ipsec_t_map[] = { + { NULL, 0, { NULL } }, { "lifetype", 3, { NULL, "sec", "kb", }, }, - { "life", 0, }, + { "life", 0, { NULL } }, { "group desc", 5, { NULL, "modp768", "modp1024", "EC2N 2^155", "EC2N 2^185", }, }, { "enc mode", 3, { NULL, "tunnel", "transport", }, }, { "auth", 5, { NULL, "hmac-md5", "hmac-sha1", "1des-mac", "keyed", }, }, - { "keylen", 0, }, - { "rounds", 0, }, - { "dictsize", 0, }, - { "privalg", 0, }, + { "keylen", 0, { NULL } }, + { "rounds", 0, { NULL } }, + { "dictsize", 0, { NULL } }, + { "privalg", 0, { NULL } }, }; -struct attrmap oakley_t_map[] = { - { NULL, 0 }, +const struct attrmap oakley_t_map[] = { + { NULL, 0, { NULL } }, { "enc", 8, { NULL, "1des", "idea", "blowfish", "rc5", "3des", "cast", "aes", }, }, { "hash", 7, { NULL, "md5", "sha1", "tiger", @@ -537,33 +551,36 @@ struct attrmap oakley_t_map[] = { { "group desc", 5, { NULL, "modp768", "modp1024", "EC2N 2^155", "EC2N 2^185", }, }, { "group type", 4, { NULL, "MODP", "ECP", "EC2N", }, }, - { "group prime", 0, }, - { "group gen1", 0, }, - { "group gen2", 0, }, - { "group curve A", 0, }, - { "group curve B", 0, }, + { "group prime", 0, { NULL } }, + { "group gen1", 0, { NULL } }, + { "group gen2", 0, { NULL } }, + { "group curve A", 0, { NULL } }, + { "group curve B", 0, { NULL } }, { "lifetype", 3, { NULL, "sec", "kb", }, }, - { "lifeduration", 0, }, - { "prf", 0, }, - { "keylen", 0, }, - { "field", 0, }, - { "order", 0, }, + { "lifeduration", 0, { NULL } }, + { "prf", 0, { NULL } }, + { "keylen", 0, { NULL } }, + { "field", 0, { NULL } }, + { "order", 0, { NULL } }, }; -static u_char * -isakmp_t_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, - u_int32_t doi, u_int32_t proto) +static const u_char * +isakmp_t_print(const struct isakmp_gen *ext, u_int item_len, + const u_char *ep, u_int32_t phase _U_, u_int32_t doi _U_, + u_int32_t proto, int depth _U_) { - struct isakmp_pl_t *p, t; - u_char *cp; - char *idstr; - struct attrmap *map; + const struct isakmp_pl_t *p; + struct isakmp_pl_t t; + const u_char *cp; + const char *idstr; + const struct attrmap *map; size_t nmap; - u_char *ep2; + const u_char *ep2; printf("%s:", NPSTR(ISAKMP_NPTYPE_T)); p = (struct isakmp_pl_t *)ext; + TCHECK(*p); safememcpy(&t, ext, sizeof(t)); switch (proto) { @@ -599,7 +616,7 @@ isakmp_t_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, else printf(" #%d id=%d ", t.t_no, t.t_id); cp = (u_char *)(p + 1); - ep2 = (u_char *)p + ntohs(t.h.len); + ep2 = (u_char *)p + item_len; while (cp < ep && cp < ep2) { if (map && nmap) { cp = isakmp_attrmap_print(cp, (ep < ep2) ? ep : ep2, @@ -610,51 +627,65 @@ isakmp_t_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, if (ep < ep2) printf("..."); return cp; +trunc: + printf(" [|%s]", NPSTR(ISAKMP_NPTYPE_T)); + return NULL; } -static u_char * -isakmp_ke_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, - u_int32_t doi, u_int32_t proto) +static const u_char * +isakmp_ke_print(const struct isakmp_gen *ext, u_int item_len, + const u_char *ep, u_int32_t phase _U_, u_int32_t doi _U_, + u_int32_t proto _U_, int depth _U_) { struct isakmp_gen e; printf("%s:", NPSTR(ISAKMP_NPTYPE_KE)); + TCHECK(*ext); safememcpy(&e, ext, sizeof(e)); printf(" key len=%d", ntohs(e.len) - 4); if (2 < vflag && 4 < ntohs(e.len)) { printf(" "); - rawprint((caddr_t)(ext + 1), ntohs(e.len) - 4); + if (!rawprint((caddr_t)(ext + 1), ntohs(e.len) - 4)) + goto trunc; } return (u_char *)ext + ntohs(e.len); +trunc: + printf(" [|%s]", NPSTR(ISAKMP_NPTYPE_KE)); + return NULL; } -static u_char * -isakmp_id_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, - u_int32_t doi, u_int32_t proto) +static const u_char * +isakmp_id_print(const struct isakmp_gen *ext, u_int item_len, + const u_char *ep, u_int32_t phase, u_int32_t doi _U_, + u_int32_t proto _U_, int depth _U_) { #define USE_IPSECDOI_IN_PHASE1 1 - struct isakmp_pl_id *p, id; - static char *idtypestr[] = { + const struct isakmp_pl_id *p; + struct isakmp_pl_id id; + static const char *idtypestr[] = { "IPv4", "IPv4net", "IPv6", "IPv6net", }; - static char *ipsecidtypestr[] = { + static const char *ipsecidtypestr[] = { NULL, "IPv4", "FQDN", "user FQDN", "IPv4net", "IPv6", "IPv6net", "IPv4range", "IPv6range", "ASN1 DN", "ASN1 GN", "keyid", }; int len; - u_char *data; + const u_char *data; printf("%s:", NPSTR(ISAKMP_NPTYPE_ID)); p = (struct isakmp_pl_id *)ext; + TCHECK(*p); safememcpy(&id, ext, sizeof(id)); - if (sizeof(*p) < id.h.len) + if (sizeof(*p) < item_len) { data = (u_char *)(p + 1); - else + len = item_len - sizeof(*p); + } else { data = NULL; - len = ntohs(id.h.len) - sizeof(*p); + len = 0; + } #if 0 /*debug*/ printf(" [phase=%d doi=%d proto=%d]", phase, doi, proto); @@ -674,18 +705,24 @@ isakmp_id_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, #endif case 2: { - struct ipsecdoi_id *p, id; + const struct ipsecdoi_id *p; + struct ipsecdoi_id id; struct protoent *pe; p = (struct ipsecdoi_id *)ext; + TCHECK(*p); safememcpy(&id, ext, sizeof(id)); printf(" idtype=%s", STR_OR_ID(id.type, ipsecidtypestr)); if (id.proto_id) { +#ifndef WIN32 setprotoent(1); +#endif /* WIN32 */ pe = getprotobynumber(id.proto_id); if (pe) printf(" protoid=%s", pe->p_name); +#ifndef WIN32 endprotoent(); +#endif /* WIN32 */ } else { /* it DOES NOT mean IPPROTO_IP! */ printf(" protoid=%s", "0"); @@ -693,9 +730,15 @@ isakmp_id_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, printf(" port=%d", ntohs(id.port)); if (!len) break; + if (data == NULL) + goto trunc; + TCHECK2(*data, len); switch (id.type) { case IPSECDOI_ID_IPV4_ADDR: - printf(" len=%d %s", len, ipaddr_string(data)); + if (len < 4) + printf(" len=%d [bad: < 4]", len); + else + printf(" len=%d %s", len, ipaddr_string(data)); len = 0; break; case IPSECDOI_ID_FQDN: @@ -710,40 +753,61 @@ isakmp_id_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, } case IPSECDOI_ID_IPV4_ADDR_SUBNET: { - u_char *mask; - mask = data + sizeof(struct in_addr); - printf(" len=%d %s/%u.%u.%u.%u", len, - ipaddr_string(data), - mask[0], mask[1], mask[2], mask[3]); + const u_char *mask; + if (len < 8) + printf(" len=%d [bad: < 8]", len); + else { + mask = data + sizeof(struct in_addr); + printf(" len=%d %s/%u.%u.%u.%u", len, + ipaddr_string(data), + mask[0], mask[1], mask[2], mask[3]); + } len = 0; break; } #ifdef INET6 case IPSECDOI_ID_IPV6_ADDR: - printf(" len=%d %s", len, ip6addr_string(data)); + if (len < 16) + printf(" len=%d [bad: < 16]", len); + else + printf(" len=%d %s", len, ip6addr_string(data)); len = 0; break; case IPSECDOI_ID_IPV6_ADDR_SUBNET: { - u_int32_t *mask; - mask = (u_int32_t *)(data + sizeof(struct in6_addr)); - /*XXX*/ - printf(" len=%d %s/0x%08x%08x%08x%08x", len, - ip6addr_string(data), - mask[0], mask[1], mask[2], mask[3]); + const u_int32_t *mask; + if (len < 20) + printf(" len=%d [bad: < 20]", len); + else { + mask = (u_int32_t *)(data + sizeof(struct in6_addr)); + /*XXX*/ + printf(" len=%d %s/0x%08x%08x%08x%08x", len, + ip6addr_string(data), + mask[0], mask[1], mask[2], mask[3]); + } len = 0; break; } #endif /*INET6*/ case IPSECDOI_ID_IPV4_ADDR_RANGE: - printf(" len=%d %s-%s", len, ipaddr_string(data), - ipaddr_string(data + sizeof(struct in_addr))); + if (len < 8) + printf(" len=%d [bad: < 8]", len); + else { + printf(" len=%d %s-%s", len, + ipaddr_string(data), + ipaddr_string(data + sizeof(struct in_addr))); + } len = 0; break; #ifdef INET6 case IPSECDOI_ID_IPV6_ADDR_RANGE: - printf(" len=%d %s-%s", len, ip6addr_string(data), - ip6addr_string(data + sizeof(struct in6_addr))); + if (len < 32) + printf(" len=%d [bad: < 32]", len); + else { + printf(" len=%d %s-%s", len, + ip6addr_string(data), + ip6addr_string(data + sizeof(struct in6_addr))); + } len = 0; break; #endif /*INET6*/ @@ -759,18 +823,24 @@ isakmp_id_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, printf(" len=%d", len); if (2 < vflag) { printf(" "); - rawprint((caddr_t)data, len); + if (!rawprint((caddr_t)data, len)) + goto trunc; } } - return (u_char *)ext + ntohs(id.h.len); + return (u_char *)ext + item_len; +trunc: + printf(" [|%s]", NPSTR(ISAKMP_NPTYPE_ID)); + return NULL; } -static u_char * -isakmp_cert_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, - u_int32_t doi0, u_int32_t proto0) +static const u_char * +isakmp_cert_print(const struct isakmp_gen *ext, u_int item_len, + const u_char *ep, u_int32_t phase _U_, u_int32_t doi0 _U_, + u_int32_t proto0 _U_, int depth _U_) { - struct isakmp_pl_cert *p, cert; - static char *certstr[] = { + const struct isakmp_pl_cert *p; + struct isakmp_pl_cert cert; + static const char *certstr[] = { "none", "pkcs7", "pgp", "dns", "x509sign", "x509ke", "kerberos", "crl", "arl", "spki", "x509attr", @@ -779,22 +849,29 @@ isakmp_cert_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, printf("%s:", NPSTR(ISAKMP_NPTYPE_CERT)); p = (struct isakmp_pl_cert *)ext; + TCHECK(*p); safememcpy(&cert, ext, sizeof(cert)); - printf(" len=%d", ntohs(cert.h.len) - 4); + printf(" len=%d", item_len - 4); printf(" type=%s", STR_OR_ID((cert.encode), certstr)); - if (2 < vflag && 4 < ntohs(cert.h.len)) { + if (2 < vflag && 4 < item_len) { printf(" "); - rawprint((caddr_t)(ext + 1), ntohs(cert.h.len) - 4); + if (!rawprint((caddr_t)(ext + 1), item_len - 4)) + goto trunc; } - return (u_char *)ext + ntohs(cert.h.len); + return (u_char *)ext + item_len; +trunc: + printf(" [|%s]", NPSTR(ISAKMP_NPTYPE_CERT)); + return NULL; } -static u_char * -isakmp_cr_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, - u_int32_t doi0, u_int32_t proto0) +static const u_char * +isakmp_cr_print(const struct isakmp_gen *ext, u_int item_len, + const u_char *ep, u_int32_t phase _U_, u_int32_t doi0 _U_, + u_int32_t proto0 _U_, int depth _U_) { - struct isakmp_pl_cert *p, cert; - static char *certstr[] = { + const struct isakmp_pl_cert *p; + struct isakmp_pl_cert cert; + static const char *certstr[] = { "none", "pkcs7", "pgp", "dns", "x509sign", "x509ke", "kerberos", "crl", "arl", "spki", "x509attr", @@ -803,77 +880,101 @@ isakmp_cr_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, printf("%s:", NPSTR(ISAKMP_NPTYPE_CR)); p = (struct isakmp_pl_cert *)ext; + TCHECK(*p); safememcpy(&cert, ext, sizeof(cert)); - printf(" len=%d", ntohs(cert.h.len) - 4); + printf(" len=%d", item_len - 4); printf(" type=%s", STR_OR_ID((cert.encode), certstr)); - if (2 < vflag && 4 < ntohs(cert.h.len)) { + if (2 < vflag && 4 < item_len) { printf(" "); - rawprint((caddr_t)(ext + 1), ntohs(cert.h.len) - 4); + if (!rawprint((caddr_t)(ext + 1), item_len - 4)) + goto trunc; } - return (u_char *)ext + ntohs(cert.h.len); + return (u_char *)ext + item_len; +trunc: + printf(" [|%s]", NPSTR(ISAKMP_NPTYPE_CR)); + return NULL; } -static u_char * -isakmp_hash_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, - u_int32_t doi, u_int32_t proto) +static const u_char * +isakmp_hash_print(const struct isakmp_gen *ext, u_int item_len, + const u_char *ep, u_int32_t phase _U_, u_int32_t doi _U_, + u_int32_t proto _U_, int depth _U_) { struct isakmp_gen e; printf("%s:", NPSTR(ISAKMP_NPTYPE_HASH)); + TCHECK(*ext); safememcpy(&e, ext, sizeof(e)); printf(" len=%d", ntohs(e.len) - 4); if (2 < vflag && 4 < ntohs(e.len)) { printf(" "); - rawprint((caddr_t)(ext + 1), ntohs(e.len) - 4); + if (!rawprint((caddr_t)(ext + 1), ntohs(e.len) - 4)) + goto trunc; } return (u_char *)ext + ntohs(e.len); +trunc: + printf(" [|%s]", NPSTR(ISAKMP_NPTYPE_HASH)); + return NULL; } -static u_char * -isakmp_sig_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, - u_int32_t doi, u_int32_t proto) +static const u_char * +isakmp_sig_print(const struct isakmp_gen *ext, u_int item_len, + const u_char *ep, u_int32_t phase _U_, u_int32_t doi _U_, + u_int32_t proto _U_, int depth _U_) { struct isakmp_gen e; printf("%s:", NPSTR(ISAKMP_NPTYPE_SIG)); + TCHECK(*ext); safememcpy(&e, ext, sizeof(e)); printf(" len=%d", ntohs(e.len) - 4); if (2 < vflag && 4 < ntohs(e.len)) { printf(" "); - rawprint((caddr_t)(ext + 1), ntohs(e.len) - 4); + if (!rawprint((caddr_t)(ext + 1), ntohs(e.len) - 4)) + goto trunc; } return (u_char *)ext + ntohs(e.len); +trunc: + printf(" [|%s]", NPSTR(ISAKMP_NPTYPE_SIG)); + return NULL; } -static u_char * -isakmp_nonce_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, - u_int32_t doi, u_int32_t proto) +static const u_char * +isakmp_nonce_print(const struct isakmp_gen *ext, u_int item_len, + const u_char *ep, u_int32_t phase _U_, u_int32_t doi _U_, + u_int32_t proto _U_, int depth _U_) { struct isakmp_gen e; printf("%s:", NPSTR(ISAKMP_NPTYPE_NONCE)); + TCHECK(*ext); safememcpy(&e, ext, sizeof(e)); printf(" n len=%d", ntohs(e.len) - 4); if (2 < vflag && 4 < ntohs(e.len)) { printf(" "); - rawprint((caddr_t)(ext + 1), ntohs(e.len) - 4); + if (!rawprint((caddr_t)(ext + 1), ntohs(e.len) - 4)) + goto trunc; } return (u_char *)ext + ntohs(e.len); +trunc: + printf(" [|%s]", NPSTR(ISAKMP_NPTYPE_NONCE)); + return NULL; } -static u_char * -isakmp_n_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, - u_int32_t doi0, u_int32_t proto0) +static const u_char * +isakmp_n_print(const struct isakmp_gen *ext, u_int item_len, + const u_char *ep, u_int32_t phase, u_int32_t doi0 _U_, + u_int32_t proto0 _U_, int depth) { struct isakmp_pl_n *p, n; - u_char *cp; + const u_char *cp; u_char *ep2; u_int32_t doi; u_int32_t proto; - static char *notifystr[] = { + static const char *notify_error_str[] = { NULL, "INVALID-PAYLOAD-TYPE", "DOI-NOT-SUPPORTED", "SITUATION-NOT-SUPPORTED", "INVALID-COOKIE", "INVALID-MAJOR-VERSION", @@ -891,29 +992,56 @@ isakmp_n_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, "CERTIFICATE-UNAVAILABLE", "UNSUPPORTED-EXCHANGE-TYPE", "UNEQUAL-PAYLOAD-LENGTHS", }; - static char *ipsecnotifystr[] = { + static const char *ipsec_notify_error_str[] = { + "RESERVED", + }; + static const char *notify_status_str[] = { + "CONNECTED", + }; + static const char *ipsec_notify_status_str[] = { "RESPONDER-LIFETIME", "REPLAY-STATUS", "INITIAL-CONTACT", }; /* NOTE: these macro must be called with x in proper range */ -#define NOTIFYSTR(x) \ - (((x) == 16384) ? "CONNECTED" : STR_OR_ID((x), notifystr)) -#define IPSECNOTIFYSTR(x) \ - (((x) == 8192) ? "RESERVED" : STR_OR_ID(((x) - 24576), ipsecnotifystr)) + +/* 0 - 8191 */ +#define NOTIFY_ERROR_STR(x) \ + STR_OR_ID((x), notify_error_str) + +/* 8192 - 16383 */ +#define IPSEC_NOTIFY_ERROR_STR(x) \ + STR_OR_ID((u_int)((x) - 8192), ipsec_notify_error_str) + +/* 16384 - 24575 */ +#define NOTIFY_STATUS_STR(x) \ + STR_OR_ID((u_int)((x) - 16384), notify_status_str) + +/* 24576 - 32767 */ +#define IPSEC_NOTIFY_STATUS_STR(x) \ + STR_OR_ID((u_int)((x) - 24576), ipsec_notify_status_str) printf("%s:", NPSTR(ISAKMP_NPTYPE_N)); p = (struct isakmp_pl_n *)ext; + TCHECK(*p); safememcpy(&n, ext, sizeof(n)); doi = ntohl(n.doi); proto = n.prot_id; if (doi != 1) { printf(" doi=%d", doi); printf(" proto=%d", proto); - printf(" type=%s", NOTIFYSTR(ntohs(n.type))); + if (ntohs(n.type) < 8192) + printf(" type=%s", NOTIFY_ERROR_STR(ntohs(n.type))); + else if (ntohs(n.type) < 16384) + printf(" type=%s", numstr(ntohs(n.type))); + else if (ntohs(n.type) < 24576) + printf(" type=%s", NOTIFY_STATUS_STR(ntohs(n.type))); + else + printf(" type=%s", numstr(ntohs(n.type))); if (n.spi_size) { printf(" spi="); - rawprint((caddr_t)(p + 1), n.spi_size); + if (!rawprint((caddr_t)(p + 1), n.spi_size)) + goto trunc; } return (u_char *)(p + 1) + n.spi_size; } @@ -921,29 +1049,30 @@ isakmp_n_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, printf(" doi=ipsec"); printf(" proto=%s", PROTOIDSTR(proto)); if (ntohs(n.type) < 8192) - printf(" type=%s", NOTIFYSTR(ntohs(n.type))); + printf(" type=%s", NOTIFY_ERROR_STR(ntohs(n.type))); else if (ntohs(n.type) < 16384) - printf(" type=%s", IPSECNOTIFYSTR(ntohs(n.type))); + printf(" type=%s", IPSEC_NOTIFY_ERROR_STR(ntohs(n.type))); else if (ntohs(n.type) < 24576) - printf(" type=%s", NOTIFYSTR(ntohs(n.type))); - else if (ntohs(n.type) < 40960) - printf(" type=%s", IPSECNOTIFYSTR(ntohs(n.type))); + printf(" type=%s", NOTIFY_STATUS_STR(ntohs(n.type))); + else if (ntohs(n.type) < 32768) + printf(" type=%s", IPSEC_NOTIFY_STATUS_STR(ntohs(n.type))); else - printf(" type=%s", NOTIFYSTR(ntohs(n.type))); + printf(" type=%s", numstr(ntohs(n.type))); if (n.spi_size) { printf(" spi="); - rawprint((caddr_t)(p + 1), n.spi_size); + if (!rawprint((caddr_t)(p + 1), n.spi_size)) + goto trunc; } cp = (u_char *)(p + 1) + n.spi_size; - ep2 = (u_char *)p + ntohs(n.h.len); + ep2 = (u_char *)p + item_len; if (cp < ep) { printf(" orig=("); switch (ntohs(n.type)) { case IPSECDOI_NTYPE_RESPONDER_LIFETIME: { - struct attrmap *map = oakley_t_map; + const struct attrmap *map = oakley_t_map; size_t nmap = sizeof(oakley_t_map)/sizeof(oakley_t_map[0]); while (cp < ep && cp < ep2) { cp = isakmp_attrmap_print(cp, @@ -956,26 +1085,32 @@ isakmp_n_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, (*(u_int32_t *)cp) ? "en" : "dis"); break; case ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN: - isakmp_sub_print(ISAKMP_NPTYPE_SA, - (struct isakmp_gen *)cp, ep, phase, doi, proto); + if (isakmp_sub_print(ISAKMP_NPTYPE_SA, + (struct isakmp_gen *)cp, ep, phase, doi, proto, + depth) == NULL) + return NULL; break; default: /* NULL is dummy */ - isakmp_print(cp, - ntohs(n.h.len) - sizeof(*p) - n.spi_size, + isakmp_print(cp, item_len - sizeof(*p) - n.spi_size, NULL); } printf(")"); } - return (u_char *)ext + ntohs(n.h.len); + return (u_char *)ext + item_len; +trunc: + printf(" [|%s]", NPSTR(ISAKMP_NPTYPE_N)); + return NULL; } -static u_char * -isakmp_d_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, - u_int32_t doi0, u_int32_t proto0) +static const u_char * +isakmp_d_print(const struct isakmp_gen *ext, u_int item_len, + const u_char *ep, u_int32_t phase _U_, u_int32_t doi0 _U_, + u_int32_t proto0 _U_, int depth _U_) { - struct isakmp_pl_d *p, d; - u_int8_t *q; + const struct isakmp_pl_d *p; + struct isakmp_pl_d d; + const u_int8_t *q; u_int32_t doi; u_int32_t proto; int i; @@ -983,6 +1118,7 @@ isakmp_d_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, printf("%s:", NPSTR(ISAKMP_NPTYPE_D)); p = (struct isakmp_pl_d *)ext; + TCHECK(*p); safememcpy(&d, ext, sizeof(d)); doi = ntohl(d.doi); proto = d.prot_id; @@ -1000,85 +1136,101 @@ isakmp_d_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, for (i = 0; i < ntohs(d.num_spi); i++) { if (i != 0) printf(","); - rawprint((caddr_t)q, d.spi_size); + if (!rawprint((caddr_t)q, d.spi_size)) + goto trunc; q += d.spi_size; } return q; +trunc: + printf(" [|%s]", NPSTR(ISAKMP_NPTYPE_D)); + return NULL; } -static u_char * -isakmp_vid_print(struct isakmp_gen *ext, u_char *ep, u_int32_t phase, - u_int32_t doi, u_int32_t proto) +static const u_char * +isakmp_vid_print(const struct isakmp_gen *ext, u_int item_len, + const u_char *ep, u_int32_t phase _U_, u_int32_t doi _U_, + u_int32_t proto _U_, int depth _U_) { struct isakmp_gen e; printf("%s:", NPSTR(ISAKMP_NPTYPE_VID)); + TCHECK(*ext); safememcpy(&e, ext, sizeof(e)); printf(" len=%d", ntohs(e.len) - 4); if (2 < vflag && 4 < ntohs(e.len)) { printf(" "); - rawprint((caddr_t)(ext + 1), ntohs(e.len) - 4); + if (!rawprint((caddr_t)(ext + 1), ntohs(e.len) - 4)) + goto trunc; } return (u_char *)ext + ntohs(e.len); +trunc: + printf(" [|%s]", NPSTR(ISAKMP_NPTYPE_VID)); + return NULL; } -static u_char * -isakmp_sub0_print(u_char np, struct isakmp_gen *ext, u_char *ep, - u_int32_t phase, u_int32_t doi, u_int32_t proto) +static const u_char * +isakmp_sub0_print(u_char np, const struct isakmp_gen *ext, const u_char *ep, + u_int32_t phase, u_int32_t doi, u_int32_t proto, int depth) { - u_char *cp; + const u_char *cp; struct isakmp_gen e; u_int item_len; cp = (u_char *)ext; + TCHECK(*ext); safememcpy(&e, ext, sizeof(e)); - if (NPFUNC(np)) - cp = (*NPFUNC(np))(ext, ep, phase, doi, proto); - else { + /* + * Since we can't have a payload length of less than 4 bytes, + * we need to bail out here if the generic header is nonsensical + * or truncated, otherwise we could loop forever processing + * zero-length items or otherwise misdissect the packet. + */ + item_len = ntohs(e.len); + if (item_len <= 4) + return NULL; + + if (NPFUNC(np)) { + /* + * XXX - what if item_len is too short, or too long, + * for this payload type? + */ + cp = (*NPFUNC(np))(ext, item_len, ep, phase, doi, proto, depth); + } else { printf("%s", NPSTR(np)); - item_len = ntohs(e.len); - if (item_len == 0) { - /* - * We don't want to loop forever processing this - * bogus (zero-length) item; return NULL so that - * we stop dissecting. - */ - cp = NULL; - } else - cp += item_len; + cp += item_len; } + return cp; +trunc: + printf(" [|isakmp]"); + return NULL; } -static u_char * -isakmp_sub_print(u_char np, struct isakmp_gen *ext, u_char *ep, - u_int32_t phase, u_int32_t doi, u_int32_t proto) +static const u_char * +isakmp_sub_print(u_char np, const struct isakmp_gen *ext, const u_char *ep, + u_int32_t phase, u_int32_t doi, u_int32_t proto, int depth) { - u_char *cp; - static int depth = 0; + const u_char *cp; int i; struct isakmp_gen e; - cp = (u_char *)ext; + cp = (const u_char *)ext; while (np) { - TCHECK2(*ext, sizeof(e)); + TCHECK(*ext); safememcpy(&e, ext, sizeof(e)); - if (ep < (u_char *)ext + ntohs(e.len)) { - printf(" [|%s]", NPSTR(np)); - cp = ep + 1; - break; - } + TCHECK2(*ext, ntohs(e.len)); + depth++; printf("\n"); for (i = 0; i < depth; i++) printf(" "); printf("("); - cp = isakmp_sub0_print(np, ext, ep, phase, doi, proto); + cp = isakmp_sub0_print(np, ext, ep, phase, doi, proto, depth); printf(")"); depth--; @@ -1092,6 +1244,7 @@ isakmp_sub_print(u_char np, struct isakmp_gen *ext, u_char *ep, } return cp; trunc: + printf(" [|%s]", NPSTR(np)); return NULL; } @@ -1109,7 +1262,7 @@ numstr(int x) * optimization. */ static void -safememcpy(void *p, void *q, size_t l) +safememcpy(void *p, const void *q, size_t l) { memcpy(p, q, l); } @@ -1117,15 +1270,16 @@ safememcpy(void *p, void *q, size_t l) void isakmp_print(const u_char *bp, u_int length, const u_char *bp2) { - struct isakmp *p, base; - u_char *ep; + const struct isakmp *p; + struct isakmp base; + const u_char *ep; u_char np; int i; int phase; int major, minor; - p = (struct isakmp *)bp; - ep = (u_char *)snapend; + p = (const struct isakmp *)bp; + ep = snapend; if ((struct isakmp *)ep < p + 1) { printf("[|isakmp]"); @@ -1185,40 +1339,41 @@ isakmp_print(const u_char *bp, u_int length, const u_char *bp2) printf("[%s%s]", base.flags & ISAKMP_FLAG_E ? "E" : "", base.flags & ISAKMP_FLAG_C ? "C" : ""); } - printf(":"); - { - struct isakmp_gen *ext; - int nparen; + if (vflag) { + const struct isakmp_gen *ext; + int nparen; #define CHECKLEN(p, np) \ - if (ep < (u_char *)(p)) { \ - printf(" [|%s]", NPSTR(np)); \ - goto done; \ - } + if (ep < (u_char *)(p)) { \ + printf(" [|%s]", NPSTR(np)); \ + goto done; \ + } - /* regardless of phase... */ - if (base.flags & ISAKMP_FLAG_E) { - /* - * encrypted, nothing we can do right now. - * we hope to decrypt the packet in the future... - */ - printf(" [encrypted %s]", NPSTR(base.np)); - goto done; - } + printf(":"); - nparen = 0; - CHECKLEN(p + 1, base.np) + /* regardless of phase... */ + if (base.flags & ISAKMP_FLAG_E) { + /* + * encrypted, nothing we can do right now. + * we hope to decrypt the packet in the future... + */ + printf(" [encrypted %s]", NPSTR(base.np)); + goto done; + } - np = base.np; - ext = (struct isakmp_gen *)(p + 1); - isakmp_sub_print(np, ext, ep, phase, 0, 0); - } + nparen = 0; + CHECKLEN(p + 1, base.np) + + np = base.np; + ext = (struct isakmp_gen *)(p + 1); + isakmp_sub_print(np, ext, ep, phase, 0, 0, 0); + } done: if (vflag) { if (ntohl(base.len) != length) { - printf(" (len mismatch: isakmp %u/ip %d)", + printf(" (len mismatch: isakmp %u/ip %u)", (u_int32_t)ntohl(base.len), length); } } -- cgit v1.1