@@ -428,7 +428,7 @@ struct notify_messages {
428428 char * msg ;
429429};
430430
431- /* 3.8 Notification Payload */
431+ /* 3.8 Authentication Payload */
432432struct ikev2_auth {
433433 struct isakmp_gen h ;
434434 uint8_t auth_method ; /* Protocol-ID */
@@ -1590,15 +1590,20 @@ ikev1_nonce_print(netdissect_options *ndo, u_char tpay _U_,
15901590
15911591 ND_TCHECK (* ext );
15921592 UNALIGNED_MEMCPY (& e , ext , sizeof (e ));
1593- ND_PRINT ((ndo ," n len=%d" , ntohs (e .len ) - 4 ));
1594- if (2 < ndo -> ndo_vflag && 4 < ntohs (e .len )) {
1595- ND_PRINT ((ndo ," " ));
1596- if (!rawprint (ndo , (const uint8_t * )(ext + 1 ), ntohs (e .len ) - 4 ))
1597- goto trunc ;
1598- } else if (1 < ndo -> ndo_vflag && 4 < ntohs (e .len )) {
1599- ND_PRINT ((ndo ," " ));
1600- if (!ike_show_somedata (ndo , (const u_char * )(const uint8_t * )(ext + 1 ), ep ))
1601- goto trunc ;
1593+ /*
1594+ * Our caller has ensured that the length is >= 4.
1595+ */
1596+ ND_PRINT ((ndo ," n len=%u" , ntohs (e .len ) - 4 ));
1597+ if (ntohs (e .len ) > 4 ) {
1598+ if (ndo -> ndo_vflag > 2 ) {
1599+ ND_PRINT ((ndo , " " ));
1600+ if (!rawprint (ndo , (const uint8_t * )(ext + 1 ), ntohs (e .len ) - 4 ))
1601+ goto trunc ;
1602+ } else if (ndo -> ndo_vflag > 1 ) {
1603+ ND_PRINT ((ndo , " " ));
1604+ if (!ike_show_somedata (ndo , (const u_char * )(ext + 1 ), ep ))
1605+ goto trunc ;
1606+ }
16021607 }
16031608 return (const u_char * )ext + ntohs (e .len );
16041609trunc :
@@ -1609,8 +1614,8 @@ ikev1_nonce_print(netdissect_options *ndo, u_char tpay _U_,
16091614static const u_char *
16101615ikev1_n_print (netdissect_options * ndo , u_char tpay _U_ ,
16111616 const struct isakmp_gen * ext , u_int item_len ,
1612- const u_char * ep , uint32_t phase , uint32_t doi0 _U_ ,
1613- uint32_t proto0 _U_ , int depth )
1617+ const u_char * ep , uint32_t phase _U_ , uint32_t doi0 _U_ ,
1618+ uint32_t proto0 _U_ , int depth _U_ )
16141619{
16151620 const struct ikev1_pl_n * p ;
16161621 struct ikev1_pl_n n ;
@@ -1712,35 +1717,41 @@ ikev1_n_print(netdissect_options *ndo, u_char tpay _U_,
17121717 ep2 = (const u_char * )p + item_len ;
17131718
17141719 if (cp < ep ) {
1715- ND_PRINT ((ndo ," orig=(" ));
17161720 switch (ntohs (n .type )) {
17171721 case IPSECDOI_NTYPE_RESPONDER_LIFETIME :
17181722 {
17191723 const struct attrmap * map = oakley_t_map ;
17201724 size_t nmap = sizeof (oakley_t_map )/sizeof (oakley_t_map [0 ]);
1725+ ND_PRINT ((ndo ," attrs=(" ));
17211726 while (cp < ep && cp < ep2 ) {
17221727 cp = ikev1_attrmap_print (ndo , cp ,
17231728 (ep < ep2 ) ? ep : ep2 , map , nmap );
17241729 }
1730+ ND_PRINT ((ndo ,")" ));
17251731 break ;
17261732 }
17271733 case IPSECDOI_NTYPE_REPLAY_STATUS :
1734+ ND_PRINT ((ndo ," status=(" ));
17281735 ND_PRINT ((ndo ,"replay detection %sabled" ,
17291736 EXTRACT_32BITS (cp ) ? "en" : "dis" ));
1730- break ;
1731- case ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN :
1732- if (ikev1_sub_print (ndo , ISAKMP_NPTYPE_SA ,
1733- (const struct isakmp_gen * )cp , ep , phase , doi , proto ,
1734- depth ) == NULL )
1735- return NULL ;
1737+ ND_PRINT ((ndo ,")" ));
17361738 break ;
17371739 default :
1738- /* NULL is dummy */
1739- isakmp_print (ndo , cp ,
1740- item_len - sizeof (* p ) - n .spi_size ,
1741- NULL );
1740+ /*
1741+ * XXX - fill in more types here; see, for example,
1742+ * draft-ietf-ipsec-notifymsg-04.
1743+ */
1744+ if (ndo -> ndo_vflag > 3 ) {
1745+ ND_PRINT ((ndo ," data=(" ));
1746+ if (!rawprint (ndo , (const uint8_t * )(cp ), ep - cp ))
1747+ goto trunc ;
1748+ ND_PRINT ((ndo ,")" ));
1749+ } else {
1750+ if (!ike_show_somedata (ndo , cp , ep ))
1751+ goto trunc ;
1752+ }
1753+ break ;
17421754 }
1743- ND_PRINT ((ndo ,")" ));
17441755 }
17451756 return (const u_char * )ext + item_len ;
17461757trunc :
@@ -2264,16 +2275,21 @@ ikev2_auth_print(netdissect_options *ndo, u_char tpay,
22642275 ikev2_pay_print (ndo , NPSTR (tpay ), a .h .critical );
22652276 len = ntohs (a .h .len );
22662277
2267- ND_PRINT ((ndo ," len=%d method=%s" , len - 4 ,
2278+ /*
2279+ * Our caller has ensured that the length is >= 4.
2280+ */
2281+ ND_PRINT ((ndo ," len=%u method=%s" , len - 4 ,
22682282 STR_OR_ID (a .auth_method , v2_auth )));
2269-
2270- if (1 < ndo -> ndo_vflag && 4 < len ) {
2271- ND_PRINT ((ndo ," authdata=(" ));
2272- if (!rawprint (ndo , (const uint8_t * )authdata , len - sizeof (a )))
2273- goto trunc ;
2274- ND_PRINT ((ndo ,") " ));
2275- } else if (ndo -> ndo_vflag && 4 < len ) {
2276- if (!ike_show_somedata (ndo , authdata , ep )) goto trunc ;
2283+ if (len > 4 ) {
2284+ if (ndo -> ndo_vflag > 1 ) {
2285+ ND_PRINT ((ndo , " authdata=(" ));
2286+ if (!rawprint (ndo , (const uint8_t * )authdata , len - sizeof (a )))
2287+ goto trunc ;
2288+ ND_PRINT ((ndo , ") " ));
2289+ } else if (ndo -> ndo_vflag ) {
2290+ if (!ike_show_somedata (ndo , authdata , ep ))
2291+ goto trunc ;
2292+ }
22772293 }
22782294
22792295 return (const u_char * )ext + len ;
@@ -2322,7 +2338,7 @@ ikev2_n_print(netdissect_options *ndo, u_char tpay _U_,
23222338 const struct ikev2_n * p ;
23232339 struct ikev2_n n ;
23242340 const u_char * cp ;
2325- u_char showspi , showdata , showsomedata ;
2341+ u_char showspi , showsomedata ;
23262342 const char * notify_name ;
23272343 uint32_t type ;
23282344
@@ -2332,7 +2348,6 @@ ikev2_n_print(netdissect_options *ndo, u_char tpay _U_,
23322348 ikev2_pay_print (ndo , NPSTR (ISAKMP_NPTYPE_N ), n .h .critical );
23332349
23342350 showspi = 1 ;
2335- showdata = 0 ;
23362351 showsomedata = 0 ;
23372352 notify_name = NULL ;
23382353
@@ -2446,7 +2461,6 @@ ikev2_n_print(netdissect_options *ndo, u_char tpay _U_,
24462461 notify_name = "cookie" ;
24472462 showspi = 1 ;
24482463 showsomedata = 1 ;
2449- showdata = 0 ;
24502464 break ;
24512465
24522466 case IV2_NOTIFY_USE_TRANSPORT_MODE :
@@ -2499,19 +2513,17 @@ ikev2_n_print(netdissect_options *ndo, u_char tpay _U_,
24992513
25002514 cp = (const u_char * )(p + 1 ) + n .spi_size ;
25012515
2502- if (3 < ndo -> ndo_vflag ) {
2503- showdata = 1 ;
2504- }
2505-
2506- if ((showdata || (showsomedata && ep - cp < 30 )) && cp < ep ) {
2507- ND_PRINT ((ndo ," data=(" ));
2508- if (!rawprint (ndo , (const uint8_t * )(cp ), ep - cp ))
2509- goto trunc ;
2510-
2511- ND_PRINT ((ndo ,")" ));
2516+ if (cp < ep ) {
2517+ if (ndo -> ndo_vflag > 3 || (showsomedata && ep - cp < 30 )) {
2518+ ND_PRINT ((ndo ," data=(" ));
2519+ if (!rawprint (ndo , (const uint8_t * )(cp ), ep - cp ))
2520+ goto trunc ;
25122521
2513- } else if (showsomedata && cp < ep ) {
2514- if (!ike_show_somedata (ndo , cp , ep )) goto trunc ;
2522+ ND_PRINT ((ndo ,")" ));
2523+ } else if (showsomedata ) {
2524+ if (!ike_show_somedata (ndo , cp , ep ))
2525+ goto trunc ;
2526+ }
25152527 }
25162528
25172529 return (const u_char * )ext + item_len ;
@@ -3091,7 +3103,3 @@ isakmp_rfc3948_print(netdissect_options *ndo,
30913103 * c-basic-offset: 8
30923104 * End:
30933105 */
3094-
3095-
3096-
3097-
0 commit comments