2 * Routines for the Internet Security Association and Key Management Protocol
3 * (ISAKMP) (RFC 2408) and the Internet IP Security Domain of Interpretation
4 * for ISAKMP (RFC 2407)
5 * Brad Robel-Forrest <brad.robel-forrest@watchguard.com>
7 * $Id: packet-isakmp.c,v 1.79 2004/06/15 18:47:24 gerald Exp $
9 * Ethereal - Network traffic analyzer
10 * By Gerald Combs <gerald@ethereal.com>
11 * Copyright 1998 Gerald Combs
13 * This program is free software; you can redistribute it and/or
14 * modify it under the terms of the GNU General Public License
15 * as published by the Free Software Foundation; either version 2
16 * of the License, or (at your option) any later version.
18 * This program is distributed in the hope that it will be useful,
19 * but WITHOUT ANY WARRANTY; without even the implied warranty of
20 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
21 * GNU General Public License for more details.
23 * You should have received a copy of the GNU General Public License
24 * along with this program; if not, write to the Free Software
25 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
37 #ifdef NEED_SNPRINTF_H
38 # include "snprintf.h"
41 #include <epan/packet.h>
42 #include <epan/ipv6-utils.h>
45 #define isakmp_min(a, b) ((a<b) ? a : b)
47 static int proto_isakmp = -1;
49 static gint ett_isakmp = -1;
50 static gint ett_isakmp_flags = -1;
51 static gint ett_isakmp_payload = -1;
53 #define UDP_PORT_ISAKMP 500
54 #define TCP_PORT_ISAKMP 500
56 #define NUM_PROTO_TYPES 5
57 #define proto2str(t) \
58 ((t < NUM_PROTO_TYPES) ? prototypestr[t] : "UNKNOWN-PROTO-TYPE")
60 static const char *prototypestr[NUM_PROTO_TYPES] = {
68 #define NUM_P1_ATT_TYPES 17
69 #define p1_atttype2str(t) \
70 ((t < NUM_P1_ATT_TYPES) ? p1_atttypestr[t] : "UNKNOWN-ATTRIBUTE-TYPE")
72 static const char *p1_atttypestr[NUM_P1_ATT_TYPES] = {
73 "UNKNOWN-ATTRIBUTE-TYPE",
74 "Encryption-Algorithm",
76 "Authentication-Method",
80 "Group-Generator-One",
81 "Group-Generator-Two",
92 #define NUM_ATT_TYPES 11
93 #define atttype2str(t) \
94 ((t < NUM_ATT_TYPES) ? atttypestr[t] : "UNKNOWN-ATTRIBUTE-TYPE")
96 static const char *atttypestr[NUM_ATT_TYPES] = {
97 "UNKNOWN-ATTRIBUTE-TYPE",
101 "Encapsulation-Mode",
102 "Authentication-Algorithm",
105 "Compress-Dictinary-Size",
106 "Compress-Private-Algorithm",
110 #define NUM_TRANS_TYPES 2
111 #define trans2str(t) \
112 ((t < NUM_TRANS_TYPES) ? transtypestr[t] : "UNKNOWN-TRANS-TYPE")
114 static const char *transtypestr[NUM_TRANS_TYPES] = {
119 #define NUM_AH_TRANS_TYPES 8
120 #define ah_trans2str(t) \
121 ((t < NUM_AH_TRANS_TYPES) ? ah_transtypestr[t] : "UNKNOWN-AH-TRANS-TYPE")
123 static const char *ah_transtypestr[NUM_AH_TRANS_TYPES] = {
134 #define NUM_ESP_TRANS_TYPES 13
135 #define esp_trans2str(t) \
136 ((t < NUM_ESP_TRANS_TYPES) ? esp_transtypestr[t] : "UNKNOWN-ESP-TRANS-TYPE")
138 static const char *esp_transtypestr[NUM_ESP_TRANS_TYPES] = {
154 #define NUM_IPCOMP_TRANS_TYPES 5
155 #define ipcomp_trans2str(t) \
156 ((t < NUM_IPCOMP_TRANS_TYPES) ? ipcomp_transtypestr[t] : "UNKNOWN-IPCOMP-TRANS-TYPE")
158 static const char *ipcomp_transtypestr[NUM_IPCOMP_TRANS_TYPES] = {
166 #define NUM_ID_TYPES 12
168 ((t < NUM_ID_TYPES) ? idtypestr[t] : "UNKNOWN-ID-TYPE")
170 static const char *idtypestr[NUM_ID_TYPES] = {
185 #define NUM_GRPDESC_TYPES 19
186 #define grpdesc2str(t) ((t < NUM_GRPDESC_TYPES) ? grpdescstr[t] : "UNKNOWN-GROUP-DESCRIPTION")
188 static const char *grpdescstr[NUM_GRPDESC_TYPES] = {
190 "Default 768-bit MODP group",
191 "Alternate 1024-bit MODP group",
192 "EC2N group on GP[2^155] group",
193 "EC2N group on GP[2^185] group",
194 "1536 bit MODP group",
195 "EC2N group over GF[2^163]",
196 "EC2N group over GF[2^163]",
197 "EC2N group over GF[2^283]",
198 "EC2N group over GF[2^283]",
199 "EC2N group over GF[2^409]",
200 "EC2N group over GF[2^409]",
201 "EC2N group over GF[2^571]",
202 "EC2N group over GF[2^571]",
203 "2048 bit MODP group",
204 "3072 bit MODP group",
205 "4096 bit MODP group",
206 "6144 bit MODP group",
207 "8192 bit MODP group",
224 static proto_tree *dissect_payload_header(tvbuff_t *, int, int, guint8,
225 guint8 *, guint16 *, proto_tree *);
227 static void dissect_sa(tvbuff_t *, int, int, proto_tree *, int);
228 static void dissect_proposal(tvbuff_t *, int, int, proto_tree *, int);
229 static void dissect_transform(tvbuff_t *, int, int, proto_tree *, int);
230 static void dissect_key_exch(tvbuff_t *, int, int, proto_tree *, int);
231 static void dissect_id(tvbuff_t *, int, int, proto_tree *, int);
232 static void dissect_cert(tvbuff_t *, int, int, proto_tree *, int);
233 static void dissect_certreq(tvbuff_t *, int, int, proto_tree *, int);
234 static void dissect_hash(tvbuff_t *, int, int, proto_tree *, int);
235 static void dissect_sig(tvbuff_t *, int, int, proto_tree *, int);
236 static void dissect_nonce(tvbuff_t *, int, int, proto_tree *, int);
237 static void dissect_notif(tvbuff_t *, int, int, proto_tree *, int);
238 static void dissect_delete(tvbuff_t *, int, int, proto_tree *, int);
239 static void dissect_vid(tvbuff_t *, int, int, proto_tree *, int);
240 static void dissect_config(tvbuff_t *, int, int, proto_tree *, int);
241 static void dissect_nat_discovery(tvbuff_t *, int, int, proto_tree *, int);
242 static void dissect_nat_original_address(tvbuff_t *, int, int, proto_tree *, int);
244 static const char *payloadtype2str(guint8);
245 static const char *exchtype2str(guint8);
246 static const char *doitype2str(guint32);
247 static const char *msgtype2str(guint16);
248 static const char *situation2str(guint32);
249 static const char *value2str(int, guint16, guint32);
250 static const char *attrtype2str(guint8);
251 static const char *cfgattrident2str(guint16);
252 static const char *certtype2str(guint8);
254 static gboolean get_num(tvbuff_t *, int, guint16, guint32 *);
256 #define LOAD_TYPE_NONE 0 /* payload type for None */
257 #define LOAD_TYPE_PROPOSAL 2 /* payload type for Proposal */
258 #define LOAD_TYPE_TRANSFORM 3 /* payload type for Transform */
259 #define NUM_LOAD_TYPES 17
260 #define loadtype2str(t) \
261 ((t < NUM_LOAD_TYPES) ? strfuncs[t].str : "Unknown payload type")
263 static struct strfunc {
265 void (*func)(tvbuff_t *, int, int, proto_tree *, int);
266 } strfuncs[NUM_LOAD_TYPES] = {
268 {"Security Association", dissect_sa },
269 {"Proposal", dissect_proposal },
270 {"Transform", dissect_transform },
271 {"Key Exchange", dissect_key_exch },
272 {"Identification", dissect_id },
273 {"Certificate", dissect_cert },
274 {"Certificate Request", dissect_certreq },
275 {"Hash", dissect_hash },
276 {"Signature", dissect_sig },
277 {"Nonce", dissect_nonce },
278 {"Notification", dissect_notif },
279 {"Delete", dissect_delete },
280 {"Vendor ID", dissect_vid },
281 {"Attrib", dissect_config },
282 {"NAT-Discovery", dissect_nat_discovery }, /* draft-ietf-ipsec-nat-t-ike */
283 {"NAT-Original Address", dissect_nat_original_address } /* draft-ietf-ipsec-nat-t-ike */
287 #define VID_MS_LEN 20
288 static const guint8 VID_MS_W2K_WXP[VID_MS_LEN] = {0x1E, 0x2B, 0x51, 0x69, 0x5, 0x99, 0x1C, 0x7D, 0x7C, 0x96, 0xFC, 0xBF, 0xB5, 0x87, 0xE4, 0x61, 0x0, 0x0, 0x0, 0x2}; /* according to http://www.microsoft.com/technet/treeview/default.asp?url=/technet/columns/cableguy/cg0602.asp */
290 #define VID_CP_LEN 20
291 static const guint8 VID_CP[VID_CP_LEN] = {0xF4, 0xED, 0x19, 0xE0, 0xC1, 0x14, 0xEB, 0x51, 0x6F, 0xAA, 0xAC, 0x0E, 0xE3, 0x7D, 0xAF, 0x28, 0x7, 0xB4, 0x38, 0x1F};
293 static const guint8 VID_CYBERGUARD[VID_LEN] = {0x9A, 0xA1, 0xF3, 0xB4, 0x34, 0x72, 0xA4, 0x5D, 0x5F, 0x50, 0x6A, 0xEB, 0x26, 0xC, 0xF2, 0x14};
295 static const guint8 VID_draft_ietf_ipsec_nat_t_ike_03[VID_LEN] = {0x7D, 0x94, 0x19, 0xA6, 0x53, 0x10, 0xCA, 0x6F, 0x2C, 0x17, 0x9D, 0x92, 0x15, 0x52, 0x9d, 0x56}; /* according to http://www.ietf.org/internet-drafts/draft-ietf-ipsec-nat-t-ike-03.txt */
297 static const guint8 VID_SSH_IPSEC_EXPRESS_1_1_0[VID_LEN] = {0xfB, 0xF4, 0x76, 0x14, 0x98, 0x40, 0x31, 0xFA, 0x8E, 0x3B, 0xB6, 0x19, 0x80, 0x89, 0xB2, 0x23}; /* Ssh Communications Security IPSEC Express version 1.1.0 */
299 static const guint8 VID_SSH_IPSEC_EXPRESS_1_1_1[VID_LEN] = {0x19, 0x52, 0xDC, 0x91, 0xAC, 0x20, 0xF6, 0x46, 0xFB, 0x01, 0xCF, 0x42, 0xA3, 0x3A, 0xEE, 0x30}; /* Ssh Communications Security IPSEC Express version 1.1.1 */
301 static const guint8 VID_SSH_IPSEC_EXPRESS_1_1_2[VID_LEN] = {0xE8, 0xBF, 0xFA, 0x64, 0x3E, 0x5C, 0x8F, 0x2C, 0xD1, 0x0F, 0xDA, 0x73, 0x70, 0xB6, 0xEB, 0xE5}; /* Ssh Communications Security IPSEC Express version 1.1.2 */
303 static const guint8 VID_SSH_IPSEC_EXPRESS_1_2_1[VID_LEN] = {0xC1, 0x11, 0x1B, 0x2D, 0xEE, 0x8C, 0xBC, 0x3D, 0x62, 0x05, 0x73, 0xEC, 0x57, 0xAA, 0xB9, 0xCB}; /* Ssh Communications Security IPSEC Express version 1.2.1 */
305 static const guint8 VID_SSH_IPSEC_EXPRESS_1_2_2[VID_LEN] = {0x09, 0xEC, 0x27, 0xBF, 0xBC, 0x09, 0xC7, 0x58, 0x23, 0xCF, 0xEC, 0xBF, 0xFE, 0x56, 0x5A, 0x2E}; /* Ssh Communications Security IPSEC Express version 1.2.2 */
307 static const guint8 VID_SSH_IPSEC_EXPRESS_2_0_0[VID_LEN] = {0x7F, 0x21, 0xA5, 0x96, 0xE4, 0xE3, 0x18, 0xF0, 0xB2, 0xF4, 0x94, 0x4C, 0x23, 0x84, 0xCB, 0x84}; /* SSH Communications Security IPSEC Express version 2.0.0 */
309 static const guint8 VID_SSH_IPSEC_EXPRESS_2_1_0[VID_LEN] = {0x28, 0x36, 0xD1, 0xFD, 0x28, 0x07, 0xBC, 0x9E, 0x5A, 0xE3, 0x07, 0x86, 0x32, 0x04, 0x51, 0xEC}; /* SSH Communications Security IPSEC Express version 2.1.0 */
311 static const guint8 VID_SSH_IPSEC_EXPRESS_2_1_1[VID_LEN] = {0xA6, 0x8D, 0xE7, 0x56, 0xA9, 0xC5, 0x22, 0x9B, 0xAE, 0x66, 0x49, 0x80, 0x40, 0x95, 0x1A, 0xD5}; /* SSH Communications Security IPSEC Express version 2.1.1 */
313 static const guint8 VID_SSH_IPSEC_EXPRESS_2_1_2[VID_LEN] = {0x3F, 0x23, 0x72, 0x86, 0x7E, 0x23, 0x7C, 0x1C, 0xD8, 0x25, 0x0A, 0x75, 0x55, 0x9C, 0xAE, 0x20}; /* SSH Communications Security IPSEC Express version 2.1.2 */
315 static const guint8 VID_SSH_IPSEC_EXPRESS_3_0_0[VID_LEN] = {0x0E, 0x58, 0xD5, 0x77, 0x4D, 0xF6, 0x02, 0x00, 0x7D, 0x0B, 0x02, 0x44, 0x36, 0x60, 0xF7, 0xEB}; /* SSH Communications Security IPSEC Express version 3.0.0 */
317 static const guint8 VID_SSH_IPSEC_EXPRESS_3_0_1[VID_LEN] = {0xF5, 0xCE, 0x31, 0xEB, 0xC2, 0x10, 0xF4, 0x43, 0x50, 0xCF, 0x71, 0x26, 0x5B, 0x57, 0x38, 0x0F}; /* SSH Communications Security IPSEC Express version 3.0.1 */
319 static const guint8 VID_SSH_IPSEC_EXPRESS_4_0_0[VID_LEN] = {0xF6, 0x42, 0x60, 0xAF, 0x2E, 0x27, 0x42, 0xDA, 0xDD, 0xD5, 0x69, 0x87, 0x06, 0x8A, 0x99, 0xA0}; /* SSH Communications Security IPSEC Express version 4.0.0 */
321 static const guint8 VID_SSH_IPSEC_EXPRESS_4_0_1[VID_LEN] = {0x7A, 0x54, 0xD3, 0xBD, 0xB3, 0xB1, 0xE6, 0xD9, 0x23, 0x89, 0x20, 0x64, 0xBE, 0x2D, 0x98, 0x1C}; /* SSH Communications Security IPSEC Express version 4.0.1 */
323 static const guint8 VID_SSH_IPSEC_EXPRESS_4_1_0[VID_LEN] = {0x9A, 0xA1, 0xF3, 0xB4, 0x34, 0x72, 0xA4, 0x5D, 0x5F, 0x50, 0x6A, 0xEB, 0x26, 0x0C, 0xF2, 0x14}; /* SSH Communications Security IPSEC Express version 4.1.0 */
325 static const guint8 VID_SSH_IPSEC_EXPRESS_4_1_1[VID_LEN] = {0x89, 0xF7, 0xB7, 0x60, 0xD8, 0x6B, 0x01, 0x2A, 0xCF, 0x26, 0x33, 0x82, 0x39, 0x4D, 0x96, 0x2F}; /* SSH Communications Security IPSEC Express version 4.1.1 */
327 static const guint8 VID_SSH_IPSEC_EXPRESS_5_0[VID_LEN] = {0xB0, 0x37, 0xA2, 0x1A, 0xCE, 0xCC, 0xB5, 0x57, 0x0F, 0x60, 0x25, 0x46, 0xF9, 0x7B, 0xDE, 0x8C}; /* SSH Communications Security IPSEC Express version 5.0 */
329 static const guint8 VID_SSH_IPSEC_EXPRESS_5_0_0[VID_LEN] = {0x2B, 0x2D, 0xAD, 0x97, 0xC4, 0xD1, 0x40, 0x93, 0x00, 0x53, 0x28, 0x7F, 0x99, 0x68, 0x50, 0xB0}; /* SSH Communications Security IPSEC Express version 5.0.0 */
331 static const guint8 VID_SSH_IPSEC_EXPRESS_5_1_0[VID_LEN] = {0x45, 0xE1, 0x7F, 0x3A, 0xBE, 0x93, 0x94, 0x4C, 0xB2, 0x02, 0x91, 0x0C, 0x59, 0xEF, 0x80, 0x6B}; /* SSH Communications Security IPSEC Express version 5.1.0 */
333 static const guint8 VID_SSH_IPSEC_EXPRESS_5_1_1[VID_LEN] = {0x59, 0x25, 0x85, 0x9F, 0x73, 0x77, 0xED, 0x78, 0x16, 0xD2, 0xFB, 0x81, 0xC0, 0x1F, 0xA5, 0x51}; /* SSH Communications Security IPSEC Express version 5.1.1 */
335 static const guint8 VID_SSH_SENTINEL[VID_LEN] = {0x05, 0x41, 0x82, 0xA0, 0x7C, 0x7A, 0xE2, 0x06, 0xF9, 0xD2, 0xCF, 0x9D, 0x24, 0x32, 0xC4, 0x82}; /* SSH Sentinel */
337 static const guint8 VID_SSH_SENTINEL_1_1[VID_LEN] = {0xB9, 0x16, 0x23, 0xE6, 0x93, 0xCA, 0x18, 0xA5, 0x4C, 0x6A, 0x27, 0x78, 0x55, 0x23, 0x05, 0xE8}; /* SSH Sentinel 1.1 */
339 static const guint8 VID_SSH_SENTINEL_1_2[VID_LEN] = {0x54, 0x30, 0x88, 0x8D, 0xE0, 0x1A, 0x31, 0xA6, 0xFA, 0x8F, 0x60, 0x22, 0x4E, 0x44, 0x99, 0x58}; /* SSH Sentinel 1.2 */
341 static const guint8 VID_SSH_SENTINEL_1_3[VID_LEN] = {0x7E, 0xE5, 0xCB, 0x85, 0xF7, 0x1C, 0xE2, 0x59, 0xC9, 0x4A, 0x5C, 0x73, 0x1E, 0xE4, 0xE7, 0x52}; /* SSH Sentinel 1.3 */
343 static const guint8 VID_SSH_QUICKSEC_0_9_0[VID_LEN] = {0x37, 0xEB, 0xA0, 0xC4, 0x13, 0x61, 0x84, 0xE7, 0xDA, 0xF8, 0x56, 0x2A, 0x77, 0x06, 0x0B, 0x4A}; /* SSH Communications Security QuickSec 0.9.0 */
345 static const guint8 VID_SSH_QUICKSEC_1_1_0[VID_LEN] = {0x5D, 0x72, 0x92, 0x5E, 0x55, 0x94, 0x8A, 0x96, 0x61, 0xA7, 0xFC, 0x48, 0xFD, 0xEC, 0x7F, 0xF9}; /* SSH Communications Security QuickSec 1.1.0 */
347 static const guint8 VID_SSH_QUICKSEC_1_1_1[VID_LEN] = {0x77, 0x7F, 0xBF, 0x4C, 0x5A, 0xF6, 0xD1, 0xCD, 0xD4, 0xB8, 0x95, 0xA0, 0x5B, 0xF8, 0x25, 0x94}; /* SSH Communications Security QuickSec 1.1.1 */
349 static const guint8 VID_SSH_QUICKSEC_1_1_2[VID_LEN] = {0x2C, 0xDF, 0x08, 0xE7, 0x12, 0xED, 0xE8, 0xA5, 0x97, 0x87, 0x61, 0x26, 0x7C, 0xD1, 0x9B, 0x91}; /* SSH Communications Security QuickSec 1.1.2 */
351 static const guint8 VID_SSH_QUICKSEC_1_1_3[VID_LEN] = {0x59, 0xE4, 0x54, 0xA8, 0xC2, 0xCF, 0x02, 0xA3, 0x49, 0x59, 0x12, 0x1F, 0x18, 0x90, 0xBC, 0x87}; /* SSH Communications Security QuickSec 1.1.3 */
353 static const guint8 VID_draft_huttunen_ipsec_esp_in_udp_01[VID_LEN] = {0x50, 0x76, 0x0F, 0x62, 0x4C, 0x63, 0xE5, 0xC5, 0x3E, 0xEA, 0x38, 0x6C, 0x68, 0x5C, 0xA0, 0x83}; /* draft-huttunen-ipsec-esp-in-udp-01.txt */
355 static const guint8 VID_draft_stenberg_ipsec_nat_traversal_01[VID_LEN] = {0x27, 0xBA, 0xB5, 0xDC, 0x01, 0xEA, 0x07, 0x60, 0xEA, 0x4E, 0x31, 0x90, 0xAC, 0x27, 0xC0, 0xD0}; /* draft-stenberg-ipsec-nat-traversal-01 */
357 static const guint8 VID_draft_stenberg_ipsec_nat_traversal_02[VID_LEN]= {0x61, 0x05, 0xC4, 0x22, 0xE7, 0x68, 0x47, 0xE4, 0x3F, 0x96, 0x84, 0x80, 0x12, 0x92, 0xAE, 0xCD}; /* draft-stenberg-ipsec-nat-traversal-02 */
359 static const guint8 VID_draft_ietf_ipsec_nat_t_ike_00[VID_LEN]= {0x44, 0x85, 0x15, 0x2D, 0x18, 0xB6, 0xBB, 0xCD, 0x0B, 0xE8, 0xA8, 0x46, 0x95, 0x79, 0xDD, 0xCC}; /* draft-ietf-ipsec-nat-t-ike-00 */
361 static const guint8 VID_draft_ietf_ipsec_nat_t_ike_02a[VID_LEN]= {0xCD, 0x60, 0x46, 0x43, 0x35, 0xDF, 0x21, 0xF8, 0x7C, 0xFD, 0xB2, 0xFC, 0x68, 0xB6, 0xA4, 0x48}; /* draft-ietf-ipsec-nat-t-ike-02 */
363 static const guint8 VID_draft_ietf_ipsec_nat_t_ike_02b[VID_LEN]= {0x90, 0xCB, 0x80, 0x91, 0x3E, 0xBB, 0x69, 0x6E, 0x08, 0x63, 0x81, 0xB5, 0xEC, 0x42, 0x7B, 0x1F}; /* draft-ietf-ipsec-nat-t-ike-02 */
365 static const guint8 VID_draft_beaulieu_ike_xauth_02[VID_LEN]= {0x09, 0x00, 0x26, 0x89, 0xDF, 0xD6, 0xB7, 0x12, 0x80, 0xA2, 0x24, 0xDE, 0xC3, 0x3B, 0x81, 0xE5}; /* draft-beaulieu-ike-xauth-02.txt */
368 static const guint8 VID_rfc3706_dpd[VID_LEN]= {0xAF, 0xCA,0xD7, 0x13, 0x68, 0xA1, 0xF1, 0xC9, 0x6B, 0x86, 0x96, 0xFC, 0x77, 0x57, 0x01, 0x00}; /* RFC 3706 */
370 static const guint8 VID_IKE_CHALLENGE_RESPONSE_1[VID_LEN]= {0xBA, 0x29, 0x04, 0x99, 0xC2, 0x4E, 0x84, 0xE5, 0x3A, 0x1D, 0x83, 0xA0, 0x5E, 0x5F, 0x00, 0xC9}; /* IKE Challenge/Response for Authenticated Cryptographic Keys */
372 static const guint8 VID_IKE_CHALLENGE_RESPONSE_2[VID_LEN]= {0x0D, 0x33, 0x61, 0x1A, 0x5D, 0x52, 0x1B, 0x5E, 0x3C, 0x9C, 0x03, 0xD2, 0xFC, 0x10, 0x7E, 0x12}; /* IKE Challenge/Response for Authenticated Cryptographic Keys */
374 static const guint8 VID_IKE_CHALLENGE_RESPONSE_REV_1[VID_LEN]= {0xAD, 0x32, 0x51, 0x04, 0x2C, 0xDC, 0x46, 0x52, 0xC9, 0xE0, 0x73, 0x4C, 0xE5, 0xDE, 0x4C, 0x7D}; /* IKE Challenge/Response for Authenticated Cryptographic Keys (Revised) */
376 static const guint8 VID_IKE_CHALLENGE_RESPONSE_REV_2[VID_LEN]= {0x01, 0x3F, 0x11, 0x82, 0x3F, 0x96, 0x6F, 0xA9, 0x19, 0x00, 0xF0, 0x24, 0xBA, 0x66, 0xA8, 0x6B}; /* IKE Challenge/Response for Authenticated Cryptographic Keys (Revised) */
378 static const guint8 VID_MS_L2TP_IPSEC_VPN_CLIENT[VID_LEN]= {0x40, 0x48, 0xB7, 0xD5, 0x6E, 0xBC, 0xE8, 0x85, 0x25, 0xE7, 0xDE, 0x7F, 0x00, 0xD6, 0xC2, 0xD3}; /* Microsoft L2TP/IPSec VPN Client */
380 static const guint8 VID_GSS_API_1[VID_LEN]= {0xB4, 0x6D, 0x89, 0x14, 0xF3, 0xAA, 0xA3, 0xF2, 0xFE, 0xDE, 0xB7, 0xC7, 0xDB, 0x29, 0x43, 0xCA}; /* A GSS-API Authentication Method for IKE */
382 static const guint8 VID_GSS_API_2[VID_LEN]= {0xAD, 0x2C, 0x0D, 0xD0, 0xB9, 0xC3, 0x20, 0x83, 0xCC, 0xBA, 0x25, 0xB8, 0x86, 0x1E, 0xC4, 0x55}; /* A GSS-API Authentication Method for IKE */
384 static const guint8 VID_GSSAPI[VID_LEN]= {0x62, 0x1B, 0x04, 0xBB, 0x09, 0x88, 0x2A, 0xC1, 0xE1, 0x59, 0x35, 0xFE, 0xFA, 0x24, 0xAE, 0xEE}; /* GSSAPI */
386 static const guint8 VID_MS_NT5_ISAKMPOAKLEY[VID_LEN]= {0x1E, 0x2B, 0x51, 0x69, 0x05, 0x99, 0x1C, 0x7D, 0x7C, 0x96, 0xFC, 0xBF, 0xB5, 0x87, 0xE4, 0x61}; /* MS NT5 ISAKMPOAKLEY */
388 static const guint8 VID_CISCO_UNITY[VID_LEN]= {0x12, 0xF5, 0xF2, 0x8C, 0x45, 0x71, 0x68, 0xA9, 0x70, 0x2D, 0x9F, 0xE2, 0x74, 0xCC, 0x02, 0xD4}; /* CISCO-UNITY */
391 static const guint8 VID_draft_ietf_ipsec_antireplay_00[VID_LEN_8]= {0x32, 0x5D, 0xF2, 0x9A, 0x23, 0x19, 0xF2, 0xDD}; /* draft-ietf-ipsec-antireplay-00.txt */
393 static const guint8 VID_draft_ietf_ipsec_heartbeats_00[VID_LEN_8]= {0x8D, 0xB7, 0xA4, 0x18, 0x11, 0x22, 0x16, 0x60}; /* draft-ietf-ipsec-heartbeats-00.txt */
396 * Seen in Netscreen. Suppose to be ASCII HeartBeat_Notify - but I don't know the rest yet. I suspect it then proceeds with
397 * 8k10, which means every 8K (?), and version 1.0 of the protocol (?). I won't add it to the code, until I know what it really
398 * means. ykaul-at-netvision.net.il
400 static const guint8 VID_HeartBeat_Notify[VID_LEN] = {0x48, 0x65, 0x61, 0x72, 0x74, 0x42, 0x65, 0x61, 0x74, 0x5f, 0x4e, 0x6f, 0x74, 0x69, 0x66, 0x79};
403 dissect_payloads(tvbuff_t *tvb, proto_tree *tree, guint8 initial_payload,
404 int offset, int length)
406 guint8 payload, next_payload;
407 guint16 payload_length;
410 for (payload = initial_payload; length != 0; payload = next_payload) {
411 if (payload == LOAD_TYPE_NONE) {
413 * What? There's more stuff in this chunk of data, but the
414 * previous payload had a "next payload" type of None?
416 proto_tree_add_text(tree, tvb, offset, length,
418 tvb_bytes_to_str(tvb, offset, length));
421 ntree = dissect_payload_header(tvb, offset, length, payload,
422 &next_payload, &payload_length, tree);
425 if (payload_length >= 4) { /* XXX = > 4? */
426 if (payload < NUM_LOAD_TYPES && strfuncs[payload].func != NULL) {
427 (*strfuncs[payload].func)(tvb, offset + 4, payload_length - 4, ntree,
431 proto_tree_add_text(ntree, tvb, offset + 4, payload_length - 4,
436 proto_tree_add_text(ntree, tvb, offset + 4, 0,
437 "Payload (bogus, length is %u, must be at least 4)",
441 offset += payload_length;
442 length -= payload_length;
447 dissect_isakmp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
450 struct isakmp_hdr hdr;
452 proto_tree * isakmp_tree = NULL;
455 if (check_col(pinfo->cinfo, COL_PROTOCOL))
456 col_set_str(pinfo->cinfo, COL_PROTOCOL, "ISAKMP");
457 if (check_col(pinfo->cinfo, COL_INFO))
458 col_clear(pinfo->cinfo, COL_INFO);
461 ti = proto_tree_add_item(tree, proto_isakmp, tvb, offset, -1, FALSE);
462 isakmp_tree = proto_item_add_subtree(ti, ett_isakmp);
465 hdr.length = tvb_get_ntohl(tvb, offset + sizeof(hdr) - sizeof(hdr.length));
466 hdr.exch_type = tvb_get_guint8(tvb, sizeof(hdr.icookie) + sizeof(hdr.rcookie) + sizeof(hdr.next_payload) + sizeof(hdr.version));
467 if (check_col(pinfo->cinfo, COL_INFO))
468 col_add_str(pinfo->cinfo, COL_INFO, exchtype2str(hdr.exch_type));
471 tvb_memcpy(tvb, (guint8 *)&hdr.icookie, offset, sizeof(hdr.icookie));
472 proto_tree_add_text(isakmp_tree, tvb, offset, sizeof(hdr.icookie),
473 "Initiator cookie: 0x%s", tvb_bytes_to_str(tvb, offset, sizeof(hdr.icookie)));
474 offset += sizeof(hdr.icookie);
476 tvb_memcpy(tvb, (guint8 *)&hdr.rcookie, offset, sizeof(hdr.rcookie));
477 proto_tree_add_text(isakmp_tree, tvb, offset, sizeof(hdr.rcookie),
478 "Responder cookie: 0x%s", tvb_bytes_to_str(tvb, offset, sizeof(hdr.rcookie)));
479 offset += sizeof(hdr.rcookie);
481 hdr.next_payload = tvb_get_guint8(tvb, offset);
482 proto_tree_add_text(isakmp_tree, tvb, offset, sizeof(hdr.next_payload),
483 "Next payload: %s (%u)",
484 payloadtype2str(hdr.next_payload), hdr.next_payload);
485 offset += sizeof(hdr.next_payload);
487 hdr.version = tvb_get_guint8(tvb, offset);
488 proto_tree_add_text(isakmp_tree, tvb, offset, sizeof(hdr.version),
490 hi_nibble(hdr.version), lo_nibble(hdr.version));
491 offset += sizeof(hdr.version);
493 hdr.exch_type = tvb_get_guint8(tvb, offset);
494 proto_tree_add_text(isakmp_tree, tvb, offset, sizeof(hdr.exch_type),
495 "Exchange type: %s (%u)",
496 exchtype2str(hdr.exch_type), hdr.exch_type);
497 offset += sizeof(hdr.exch_type);
503 hdr.flags = tvb_get_guint8(tvb, offset);
504 fti = proto_tree_add_text(isakmp_tree, tvb, offset, sizeof(hdr.flags), "Flags");
505 ftree = proto_item_add_subtree(fti, ett_isakmp_flags);
507 proto_tree_add_text(ftree, tvb, offset, 1, "%s",
508 decode_boolean_bitfield(hdr.flags, E_FLAG, sizeof(hdr.flags)*8,
509 "Encryption", "No encryption"));
510 proto_tree_add_text(ftree, tvb, offset, 1, "%s",
511 decode_boolean_bitfield(hdr.flags, C_FLAG, sizeof(hdr.flags)*8,
512 "Commit", "No commit"));
513 proto_tree_add_text(ftree, tvb, offset, 1, "%s",
514 decode_boolean_bitfield(hdr.flags, A_FLAG, sizeof(hdr.flags)*8,
515 "Authentication", "No authentication"));
516 offset += sizeof(hdr.flags);
519 proto_tree_add_text(isakmp_tree, tvb, offset, sizeof(hdr.message_id),
520 "Message ID: 0x%s", tvb_bytes_to_str(tvb, offset, sizeof(hdr.message_id)));
521 offset += sizeof(hdr.message_id);
523 if (hdr.length < sizeof(hdr)) {
524 proto_tree_add_text(isakmp_tree, tvb, offset, sizeof(hdr.length),
525 "Length: (bogus, length is %u, should be at least %lu)",
526 hdr.length, (unsigned long)sizeof(hdr));
530 proto_tree_add_text(isakmp_tree, tvb, offset, sizeof(hdr.length),
531 "Length: %u", hdr.length);
532 offset += sizeof(hdr.length);
534 len = hdr.length - sizeof(hdr);
536 if (hdr.flags & E_FLAG) {
537 if (len && isakmp_tree) {
538 proto_tree_add_text(isakmp_tree, tvb, offset, len,
539 "Encrypted payload (%d byte%s)",
540 len, plurality(len, "", "s"));
543 dissect_payloads(tvb, isakmp_tree, hdr.next_payload, offset, len);
548 dissect_payload_header(tvbuff_t *tvb, int offset, int length, guint8 payload,
549 guint8 *next_payload_p, guint16 *payload_length_p, proto_tree *tree)
552 guint16 payload_length;
557 proto_tree_add_text(tree, tvb, offset, length,
558 "Not enough room in payload for all transforms");
561 next_payload = tvb_get_guint8(tvb, offset);
562 payload_length = tvb_get_ntohs(tvb, offset + 2);
564 ti = proto_tree_add_text(tree, tvb, offset, payload_length,
565 "%s payload", loadtype2str(payload));
566 ntree = proto_item_add_subtree(ti, ett_isakmp_payload);
568 proto_tree_add_text(ntree, tvb, offset, 1,
569 "Next payload: %s (%u)",
570 payloadtype2str(next_payload), next_payload);
571 proto_tree_add_text(ntree, tvb, offset+2, 2, "Length: %u", payload_length);
573 *next_payload_p = next_payload;
574 *payload_length_p = payload_length;
579 dissect_sa(tvbuff_t *tvb, int offset, int length, proto_tree *tree,
586 proto_tree_add_text(tree, tvb, offset, length,
587 "DOI %s (length is %u, should be >= 4)",
588 tvb_bytes_to_str(tvb, offset, length), length);
591 doi = tvb_get_ntohl(tvb, offset);
592 proto_tree_add_text(tree, tvb, offset, 4,
593 "Domain of interpretation: %s (%u)",
594 doitype2str(doi), doi);
601 proto_tree_add_text(tree, tvb, offset, length,
602 "Situation: %s (length is %u, should be >= 4)",
603 tvb_bytes_to_str(tvb, offset, length), length);
606 situation = tvb_get_ntohl(tvb, offset);
607 proto_tree_add_text(tree, tvb, offset, 4,
608 "Situation: %s (%u)",
609 situation2str(situation), situation);
613 dissect_payloads(tvb, tree, LOAD_TYPE_PROPOSAL, offset, length);
616 proto_tree_add_text(tree, tvb, offset, length,
618 tvb_bytes_to_str(tvb, offset, length));
623 dissect_proposal(tvbuff_t *tvb, int offset, int length, proto_tree *tree,
628 guint8 num_transforms;
630 guint16 payload_length;
634 proposal_num = tvb_get_guint8(tvb, offset);
636 proto_item_append_text(tree, " # %d",proposal_num);
637 proto_tree_add_text(tree, tvb, offset, 1,
638 "Proposal number: %u", proposal_num);
642 protocol_id = tvb_get_guint8(tvb, offset);
643 proto_tree_add_text(tree, tvb, offset, 1,
644 "Protocol ID: %s (%u)",
645 proto2str(protocol_id), protocol_id);
649 spi_size = tvb_get_guint8(tvb, offset);
650 proto_tree_add_text(tree, tvb, offset, 1,
651 "SPI size: %u", spi_size);
655 num_transforms = tvb_get_guint8(tvb, offset);
656 proto_tree_add_text(tree, tvb, offset, 1,
657 "Number of transforms: %u", num_transforms);
662 proto_tree_add_text(tree, tvb, offset, spi_size, "SPI: %s",
663 tvb_bytes_to_str(tvb, offset, spi_size));
668 while (num_transforms > 0) {
669 ntree = dissect_payload_header(tvb, offset, length, LOAD_TYPE_TRANSFORM,
670 &next_payload, &payload_length, tree);
673 if (length < payload_length) {
674 proto_tree_add_text(tree, tvb, offset + 4, length,
675 "Not enough room in payload for all transforms");
678 if (payload_length >= 4)
679 dissect_transform(tvb, offset + 4, payload_length - 4, ntree, protocol_id);
681 proto_tree_add_text(ntree, tvb, offset + 4, payload_length - 4, "Payload");
682 offset += payload_length;
683 length -= payload_length;
689 dissect_transform(tvbuff_t *tvb, int offset, int length, proto_tree *tree,
693 guint8 transform_num;
695 transform_num = tvb_get_guint8(tvb, offset);
696 proto_item_append_text(tree," # %d",transform_num);
697 proto_tree_add_text(tree, tvb, offset, 1,
698 "Transform number: %u", transform_num);
702 transform_id = tvb_get_guint8(tvb, offset);
703 switch (protocol_id) {
705 proto_tree_add_text(tree, tvb, offset, 1,
706 "Transform ID: %u", transform_id);
709 proto_tree_add_text(tree, tvb, offset, 1,
710 "Transform ID: %s (%u)",
711 trans2str(transform_id), transform_id);
714 proto_tree_add_text(tree, tvb, offset, 1,
715 "Transform ID: %s (%u)",
716 ah_trans2str(transform_id), transform_id);
719 proto_tree_add_text(tree, tvb, offset, 1,
720 "Transform ID: %s (%u)",
721 esp_trans2str(transform_id), transform_id);
724 proto_tree_add_text(tree, tvb, offset, 1,
725 "Transform ID: %s (%u)",
726 ipcomp_trans2str(transform_id), transform_id);
735 guint16 aft = tvb_get_ntohs(tvb, offset);
736 guint16 type = aft & 0x7fff;
741 if (protocol_id == 1 && transform_id == 1) {
743 str = p1_atttype2str(type);
746 str = atttype2str(type);
750 val = tvb_get_ntohs(tvb, offset + 2);
751 proto_tree_add_text(tree, tvb, offset, 4,
754 value2str(ike_phase1, type, val), val);
759 len = tvb_get_ntohs(tvb, offset + 2);
761 if (!get_num(tvb, offset + 4, len, &val)) {
762 proto_tree_add_text(tree, tvb, offset, pack_len,
763 "%s (%u): <too big (%u bytes)>",
766 proto_tree_add_text(tree, tvb, offset, pack_len,
769 value2str(ike_phase1, type, val), val);
778 dissect_key_exch(tvbuff_t *tvb, int offset, int length, proto_tree *tree,
781 proto_tree_add_text(tree, tvb, offset, length, "Key Exchange Data");
785 dissect_id(tvbuff_t *tvb, int offset, int length, proto_tree *tree,
792 id_type = tvb_get_guint8(tvb, offset);
793 proto_tree_add_text(tree, tvb, offset, 1,
794 "ID type: %s (%u)", id2str(id_type), id_type);
798 protocol_id = tvb_get_guint8(tvb, offset);
799 if (protocol_id == 0) {
800 proto_tree_add_text(tree, tvb, offset, 1,
801 "Protocol ID: Unused");
803 proto_tree_add_text(tree, tvb, offset, 1,
804 "Protocol ID: %s (%u)",
805 ipprotostr(protocol_id), protocol_id);
810 port = tvb_get_ntohs(tvb, offset);
812 proto_tree_add_text(tree, tvb, offset, 2, "Port: Unused");
814 proto_tree_add_text(tree, tvb, offset, 2, "Port: %u", port);
820 proto_tree_add_text(tree, tvb, offset, length,
821 "Identification data: %s",
822 ip_to_str(tvb_get_ptr(tvb, offset, 4)));
826 proto_tree_add_text(tree, tvb, offset, length,
827 "Identification data: %.*s", length,
828 tvb_get_ptr(tvb, offset, length));
831 proto_tree_add_text(tree, tvb, offset, length,
832 "Identification data: %s/%s",
833 ip_to_str(tvb_get_ptr(tvb, offset, 4)),
834 ip_to_str(tvb_get_ptr(tvb, offset+4, 4)));
837 proto_tree_add_text(tree, tvb, offset, length, "Identification Data");
843 dissect_cert(tvbuff_t *tvb, int offset, int length, proto_tree *tree,
848 cert_enc = tvb_get_guint8(tvb, offset);
849 proto_tree_add_text(tree, tvb, offset, 1,
850 "Certificate encoding: %u - %s",
851 cert_enc, certtype2str(cert_enc));
855 proto_tree_add_text(tree, tvb, offset, length, "Certificate Data");
859 dissect_certreq(tvbuff_t *tvb, int offset, int length, proto_tree *tree,
864 cert_type = tvb_get_guint8(tvb, offset);
865 proto_tree_add_text(tree, tvb, offset, 1,
866 "Certificate type: %u - %s",
867 cert_type, certtype2str(cert_type));
871 proto_tree_add_text(tree, tvb, offset, length, "Certificate Authority");
875 dissect_hash(tvbuff_t *tvb, int offset, int length, proto_tree *tree,
878 proto_tree_add_text(tree, tvb, offset, length, "Hash Data");
882 dissect_sig(tvbuff_t *tvb, int offset, int length, proto_tree *tree,
885 proto_tree_add_text(tree, tvb, offset, length, "Signature Data");
889 dissect_nonce(tvbuff_t *tvb, int offset, int length, proto_tree *tree,
892 proto_tree_add_text(tree, tvb, offset, length, "Nonce Data");
896 dissect_notif(tvbuff_t *tvb, int offset, int length, proto_tree *tree,
904 doi = tvb_get_ntohl(tvb, offset);
905 proto_tree_add_text(tree, tvb, offset, 4,
906 "Domain of Interpretation: %s (%u)",
907 doitype2str(doi), doi);
911 protocol_id = tvb_get_guint8(tvb, offset);
912 proto_tree_add_text(tree, tvb, offset, 1,
913 "Protocol ID: %s (%u)",
914 proto2str(protocol_id), protocol_id);
918 spi_size = tvb_get_guint8(tvb, offset);
919 proto_tree_add_text(tree, tvb, offset, 1,
920 "SPI size: %u", spi_size);
924 msgtype = tvb_get_ntohs(tvb, offset);
925 proto_tree_add_text(tree, tvb, offset, 2,
926 "Message type: %s (%u)", msgtype2str(msgtype), msgtype);
931 proto_tree_add_text(tree, tvb, offset, spi_size, "Security Parameter Index");
937 proto_tree_add_text(tree, tvb, offset, length, "Notification Data");
941 dissect_delete(tvbuff_t *tvb, int offset, int length, proto_tree *tree,
950 doi = tvb_get_ntohl(tvb, offset);
951 proto_tree_add_text(tree, tvb, offset, 4,
952 "Domain of Interpretation: %s (%u)",
953 doitype2str(doi), doi);
957 protocol_id = tvb_get_guint8(tvb, offset);
958 proto_tree_add_text(tree, tvb, offset, 1,
959 "Protocol ID: %s (%u)",
960 proto2str(protocol_id), protocol_id);
964 spi_size = tvb_get_guint8(tvb, offset);
965 proto_tree_add_text(tree, tvb, offset, 1,
966 "SPI size: %u", spi_size);
970 num_spis = tvb_get_ntohs(tvb, offset);
971 proto_tree_add_text(tree, tvb, offset, 2,
972 "Number of SPIs: %u", num_spis);
976 for (i = 0; i < num_spis; ++i) {
977 if (length < spi_size) {
978 proto_tree_add_text(tree, tvb, offset, length,
979 "Not enough room in payload for all SPI's");
982 proto_tree_add_text(tree, tvb, offset, spi_size,
990 dissect_vid(tvbuff_t *tvb, int offset, int length, proto_tree *tree,
993 guint32 CPproduct, CPversion;
997 pVID = tvb_get_ptr(tvb, offset, length);
998 pt = proto_tree_add_text(tree, tvb, offset, length, "Vendor ID: ");
999 if (memcmp(pVID, VID_MS_W2K_WXP, isakmp_min(VID_MS_LEN, length)) == 0)
1000 proto_item_append_text(pt, "Microsoft Win2K/WinXP");
1002 if (memcmp(pVID, VID_CP, isakmp_min(VID_CP_LEN, length)) == 0)
1004 proto_item_append_text(pt, "Check Point");
1005 offset += VID_CP_LEN;
1006 CPproduct = tvb_get_ntohl(tvb, offset);
1007 ntree = proto_item_add_subtree(pt, ett_isakmp_payload);
1008 pt = proto_tree_add_text(ntree, tvb, offset, sizeof(CPproduct), "Check Point Product: ");
1009 switch (CPproduct) {
1010 case 1: proto_item_append_text(pt, "VPN-1");
1012 case 2: proto_item_append_text(pt, "SecuRemote/SecureClient");
1014 default: proto_item_append_text(pt, "Unknown CP product!");
1017 offset += sizeof(CPproduct);
1018 CPversion = tvb_get_ntohl(tvb, offset);
1019 pt = proto_tree_add_text(ntree, tvb, offset, length, "Version: ");
1020 switch (CPversion) {
1021 case 2: proto_item_append_text(pt, "4.1");
1023 case 3: proto_item_append_text(pt, "4.1 SP-1");
1025 case 4002: proto_item_append_text(pt, "4.1 (SP-2 or above)");
1027 case 5000: proto_item_append_text(pt, "NG");
1029 case 5001: proto_item_append_text(pt, "NG Feature Pack 1");
1031 case 5002: proto_item_append_text(pt, "NG Feature Pack 2");
1033 case 5003: proto_item_append_text(pt, "NG Feature Pack 3");
1035 case 5004: proto_item_append_text(pt, "NG with Application Intelligence");
1037 case 5005: proto_item_append_text(pt, "NG with Application Intelligence R55");
1039 default: proto_item_append_text(pt, " Unknown CP version!");
1044 if (memcmp(pVID, VID_CYBERGUARD, isakmp_min(VID_LEN, length)) == 0)
1045 proto_item_append_text(pt, "Cyber Guard");
1047 if (memcmp(pVID, VID_draft_ietf_ipsec_nat_t_ike_03, isakmp_min(VID_LEN, length)) == 0)
1048 proto_item_append_text(pt, "draft-ietf-ipsec-nat-t-ike-03");
1050 if (memcmp(pVID, VID_SSH_IPSEC_EXPRESS_1_1_0, isakmp_min(VID_LEN, length)) == 0)
1051 proto_item_append_text(pt, "Ssh Communications Security IPSEC Express version 1.1.0");
1053 if (memcmp(pVID, VID_SSH_IPSEC_EXPRESS_1_1_1, isakmp_min(VID_LEN, length)) == 0)
1054 proto_item_append_text(pt, "Ssh Communications Security IPSEC Express version 1.1.1");
1056 if (memcmp(pVID, VID_SSH_IPSEC_EXPRESS_1_1_2, isakmp_min(VID_LEN, length)) == 0)
1057 proto_item_append_text(pt, "Ssh Communications Security IPSEC Express version 1.1.2");
1059 if (memcmp(pVID, VID_SSH_IPSEC_EXPRESS_1_2_1, isakmp_min(VID_LEN, length)) == 0)
1060 proto_item_append_text(pt, "Ssh Communications Security IPSEC Express version 1.2.1");
1062 if (memcmp(pVID, VID_SSH_IPSEC_EXPRESS_1_2_2, isakmp_min(VID_LEN, length)) == 0)
1063 proto_item_append_text(pt, "Ssh Communications Security IPSEC Express version 1.2.2");
1065 if (memcmp(pVID, VID_SSH_IPSEC_EXPRESS_2_0_0, isakmp_min(VID_LEN, length)) == 0)
1066 proto_item_append_text(pt, "Ssh Communications Security IPSEC Express version 2.0.0");
1068 if (memcmp(pVID, VID_SSH_IPSEC_EXPRESS_2_1_0, isakmp_min(VID_LEN, length)) == 0)
1069 proto_item_append_text(pt, "Ssh Communications Security IPSEC Express version 2.1.0");
1071 if (memcmp(pVID, VID_SSH_IPSEC_EXPRESS_2_1_1, isakmp_min(VID_LEN, length)) == 0)
1072 proto_item_append_text(pt, "Ssh Communications Security IPSEC Express version 2.1.1");
1074 if (memcmp(pVID, VID_SSH_IPSEC_EXPRESS_2_1_2, isakmp_min(VID_LEN, length)) == 0)
1075 proto_item_append_text(pt, "Ssh Communications Security IPSEC Express version 2.1.2");
1077 if (memcmp(pVID, VID_SSH_IPSEC_EXPRESS_3_0_0, isakmp_min(VID_LEN, length)) == 0)
1078 proto_item_append_text(pt, "Ssh Communications Security IPSEC Express version 3.0.0");
1080 if (memcmp(pVID, VID_SSH_IPSEC_EXPRESS_3_0_1, isakmp_min(VID_LEN, length)) == 0)
1081 proto_item_append_text(pt, "Ssh Communications Security IPSEC Express version 3.0.1");
1083 if (memcmp(pVID, VID_SSH_IPSEC_EXPRESS_4_0_0, isakmp_min(VID_LEN, length)) == 0)
1084 proto_item_append_text(pt, "Ssh Communications Security IPSEC Express version 4.0.0");
1086 if (memcmp(pVID, VID_SSH_IPSEC_EXPRESS_4_0_1, isakmp_min(VID_LEN, length)) == 0)
1087 proto_item_append_text(pt, "Ssh Communications Security IPSEC Express version 4.0.1");
1089 if (memcmp(pVID, VID_SSH_IPSEC_EXPRESS_4_1_0, isakmp_min(VID_LEN, length)) == 0)
1090 proto_item_append_text(pt, "Ssh Communications Security IPSEC Express version 4.1.0");
1092 if (memcmp(pVID, VID_SSH_IPSEC_EXPRESS_4_1_1, isakmp_min(VID_LEN, length)) == 0)
1093 proto_item_append_text(pt, "Ssh Communications Security IPSEC Express version 4.1.1");
1095 if (memcmp(pVID, VID_SSH_IPSEC_EXPRESS_5_0, isakmp_min(VID_LEN, length)) == 0)
1096 proto_item_append_text(pt, "Ssh Communications Security IPSEC Express version 5.0");
1098 if (memcmp(pVID, VID_SSH_IPSEC_EXPRESS_5_0_0, isakmp_min(VID_LEN, length)) == 0)
1099 proto_item_append_text(pt, "Ssh Communications Security IPSEC Express version 5.0.0");
1101 if (memcmp(pVID, VID_SSH_IPSEC_EXPRESS_5_1_0, isakmp_min(VID_LEN, length)) == 0)
1102 proto_item_append_text(pt, "Ssh Communications Security IPSEC Express version 5.1.0");
1104 if (memcmp(pVID, VID_SSH_IPSEC_EXPRESS_5_1_1, isakmp_min(VID_LEN, length)) == 0)
1105 proto_item_append_text(pt, "Ssh Communications Security IPSEC Express version 5.1.1");
1107 if (memcmp(pVID, VID_SSH_SENTINEL, isakmp_min(VID_LEN, length)) == 0)
1108 proto_item_append_text(pt, "SSH Sentinel");
1110 if (memcmp(pVID, VID_SSH_SENTINEL_1_1, isakmp_min(VID_LEN, length)) == 0)
1111 proto_item_append_text(pt, "SSH Sentinel 1.1");
1113 if (memcmp(pVID, VID_SSH_SENTINEL_1_2, isakmp_min(VID_LEN, length)) == 0)
1114 proto_item_append_text(pt, "SSH Sentinel 1.2");
1116 if (memcmp(pVID, VID_SSH_SENTINEL_1_3, isakmp_min(VID_LEN, length)) == 0)
1117 proto_item_append_text(pt, "SSH Sentinel 1.3");
1119 if (memcmp(pVID, VID_SSH_QUICKSEC_0_9_0, isakmp_min(VID_LEN, length)) == 0)
1120 proto_item_append_text(pt, "SSH Communications Security QuickSec 0.9.0");
1122 if (memcmp(pVID, VID_SSH_QUICKSEC_1_1_0, isakmp_min(VID_LEN, length)) == 0)
1123 proto_item_append_text(pt, "SSH Communications Security QuickSec 1.1.0");
1125 if (memcmp(pVID, VID_SSH_QUICKSEC_1_1_1, isakmp_min(VID_LEN, length)) == 0)
1126 proto_item_append_text(pt, "SSH Communications Security QuickSec 1.1.1");
1128 if (memcmp(pVID, VID_SSH_QUICKSEC_1_1_2, isakmp_min(VID_LEN, length)) == 0)
1129 proto_item_append_text(pt, "SSH Communications Security QuickSec 1.1.2");
1131 if (memcmp(pVID, VID_SSH_QUICKSEC_1_1_3, isakmp_min(VID_LEN, length)) == 0)
1132 proto_item_append_text(pt, "SSH Communications Security QuickSec 1.1.3");
1134 if (memcmp(pVID, VID_draft_huttunen_ipsec_esp_in_udp_01, isakmp_min(VID_LEN, length)) == 0)
1135 proto_item_append_text(pt, "draft-huttunen-ipsec-esp-in-udp-01.txt");
1137 if (memcmp(pVID, VID_draft_stenberg_ipsec_nat_traversal_01, isakmp_min(VID_LEN, length)) == 0)
1138 proto_item_append_text(pt, "draft-stenberg-ipsec-nat-traversal-01");
1140 if (memcmp(pVID, VID_draft_stenberg_ipsec_nat_traversal_02, isakmp_min(VID_LEN, length)) == 0)
1141 proto_item_append_text(pt, "draft-stenberg-ipsec-nat-traversal-02");
1143 if (memcmp(pVID, VID_draft_ietf_ipsec_nat_t_ike_00, isakmp_min(VID_LEN, length)) == 0)
1144 proto_item_append_text(pt, "draft-ietf-ipsec-nat-t-ike-00");
1146 if (memcmp(pVID, VID_draft_ietf_ipsec_nat_t_ike_02a, isakmp_min(VID_LEN, length)) == 0)
1147 proto_item_append_text(pt, "draft-ietf-ipsec-nat-t-ike-02");
1149 if (memcmp(pVID, VID_draft_ietf_ipsec_nat_t_ike_02b, isakmp_min(VID_LEN, length)) == 0)
1150 proto_item_append_text(pt, "draft-ietf-ipsec-nat-t-ike-02");
1152 if (memcmp(pVID, VID_draft_beaulieu_ike_xauth_02, isakmp_min(VID_LEN, length)) == 0)
1153 proto_item_append_text(pt, "draft-beaulieu-ike-xauth-02.txt");
1155 if (memcmp(pVID, VID_rfc3706_dpd, isakmp_min(VID_LEN, length)) == 0)
1156 proto_item_append_text(pt, "RFC 3706 Detecting Dead IKE Peers (DPD)");
1158 if (memcmp(pVID, VID_IKE_CHALLENGE_RESPONSE_1, isakmp_min(VID_LEN, length)) == 0)
1159 proto_item_append_text(pt, "IKE Challenge/Response for Authenticated Cryptographic Keys");
1161 if (memcmp(pVID, VID_IKE_CHALLENGE_RESPONSE_2, isakmp_min(VID_LEN, length)) == 0)
1162 proto_item_append_text(pt, "IKE Challenge/Response for Authenticated Cryptographic Keys");
1164 if (memcmp(pVID, VID_IKE_CHALLENGE_RESPONSE_REV_1, isakmp_min(VID_LEN, length)) == 0)
1165 proto_item_append_text(pt, "IKE Challenge/Response for Authenticated Cryptographic Keys (Revised)");
1167 if (memcmp(pVID, VID_IKE_CHALLENGE_RESPONSE_REV_2, isakmp_min(VID_LEN, length)) == 0)
1168 proto_item_append_text(pt, "IKE Challenge/Response for Authenticated Cryptographic Keys (Revised)");
1170 if (memcmp(pVID, VID_MS_L2TP_IPSEC_VPN_CLIENT, isakmp_min(VID_LEN, length)) == 0)
1171 proto_item_append_text(pt, "Microsoft L2TP/IPSec VPN Client");
1173 if (memcmp(pVID, VID_GSS_API_1, isakmp_min(VID_LEN, length)) == 0)
1174 proto_item_append_text(pt, "A GSS-API Authentication Method for IKE");
1176 if (memcmp(pVID, VID_GSS_API_2, isakmp_min(VID_LEN, length)) == 0)
1177 proto_item_append_text(pt, "A GSS-API Authentication Method for IKE");
1179 if (memcmp(pVID, VID_GSSAPI, isakmp_min(VID_LEN, length)) == 0)
1180 proto_item_append_text(pt, "GSSAPI");
1182 if (memcmp(pVID, VID_MS_NT5_ISAKMPOAKLEY, isakmp_min(VID_LEN, length)) == 0)
1183 proto_item_append_text(pt, "MS NT5 ISAKMPOAKLEY");
1185 if (memcmp(pVID, VID_CISCO_UNITY, isakmp_min(VID_LEN, length)) == 0)
1186 proto_item_append_text(pt, "CISCO-UNITY");
1188 if (memcmp(pVID, VID_draft_ietf_ipsec_antireplay_00, isakmp_min(VID_LEN_8, length)) == 0)
1189 proto_item_append_text(pt, "draft-ietf-ipsec-antireplay-00.txt");
1191 if (memcmp(pVID, VID_draft_ietf_ipsec_heartbeats_00, isakmp_min(VID_LEN_8, length)) == 0)
1192 proto_item_append_text(pt, "draft-ietf-ipsec-heartbeats-00.txt");
1194 proto_item_append_text(pt, "unknown vendor ID: 0x%s",tvb_bytes_to_str(tvb, offset, length));
1198 dissect_config(tvbuff_t *tvb, int offset, int length, proto_tree *tree,
1203 type = tvb_get_guint8(tvb, offset);
1204 proto_tree_add_text(tree, tvb, offset, 1,
1205 "Type %s (%u)",attrtype2str(type),type);
1210 proto_tree_add_text(tree, tvb, offset, 2,
1211 "Identifier: %u", tvb_get_ntohs(tvb, offset));
1216 guint16 aft = tvb_get_ntohs(tvb, offset);
1217 guint16 type = aft & 0x7fff;
1223 val = tvb_get_ntohs(tvb, offset + 2);
1224 proto_tree_add_text(tree, tvb, offset, 4,
1225 "%s (%u)", cfgattrident2str(type), val);
1230 len = tvb_get_ntohs(tvb, offset + 2);
1232 if (!get_num(tvb, offset + 4, len, &val)) {
1233 proto_tree_add_text(tree, tvb, offset, pack_len,
1234 "%s: <too big (%u bytes)>",
1235 cfgattrident2str(type), len);
1237 proto_tree_add_text(tree, tvb, offset, 4,
1238 "%s (%ue)", cfgattrident2str(type),
1248 dissect_nat_discovery(tvbuff_t *tvb, int offset, int length, proto_tree *tree,
1251 proto_tree_add_text(tree, tvb, offset, length,
1252 "Hash of address and port: %s",
1253 tvb_bytes_to_str(tvb, offset, length));
1257 dissect_nat_original_address(tvbuff_t *tvb, int offset, int length, proto_tree *tree,
1262 struct e_in6_addr addr_ipv6;
1264 id_type = tvb_get_guint8(tvb, offset);
1265 proto_tree_add_text(tree, tvb, offset, 1,
1266 "ID type: %s (%u)", id2str(id_type), id_type);
1270 offset += 3; /* reserved */
1275 case 1: /* ID_IPV4_ADDR */
1277 tvb_memcpy(tvb, (guint8 *)&addr_ipv4, offset, length);
1278 proto_tree_add_text(tree, tvb, offset, length,
1279 "Original address: %s",
1280 ip_to_str((guint8 *)&addr_ipv4));
1282 proto_tree_add_text(tree, tvb, offset, length,
1283 "Original address: bad length, should be 4, is %u",
1288 case 5: /* ID_IPV6_ADDR */
1290 tvb_memcpy(tvb, (guint8 *)&addr_ipv6, offset, length);
1291 proto_tree_add_text(tree, tvb, offset, length,
1292 "Original address: %s",
1293 ip6_to_str(&addr_ipv6));
1295 proto_tree_add_text(tree, tvb, offset, length,
1296 "Original address: bad length, should be 16, is %u",
1302 proto_tree_add_text(tree, tvb, offset, length,
1303 "Original address: bad address type");
1309 payloadtype2str(guint8 type) {
1311 if (type < NUM_LOAD_TYPES)
1312 return strfuncs[type].str;
1315 return "Private USE";
1319 exchtype2str(guint8 type) {
1321 #define NUM_EXCHSTRS 7
1322 static const char * exchstrs[NUM_EXCHSTRS] = {
1325 "Identity Protection (Main Mode)",
1326 "Authentication Only",
1329 "Transaction (Config Mode)"
1332 if (type < NUM_EXCHSTRS) return exchstrs[type];
1333 if (type < 32) return "ISAKMP Future Use";
1336 return "Quick Mode";
1338 return "New Group Mode";
1341 return "DOI Specific Use";
1342 return "Private Use";
1346 doitype2str(guint32 type) {
1347 if (type == 1) return "IPSEC";
1348 return "Unknown DOI Type";
1352 msgtype2str(guint16 type) {
1354 #define NUM_PREDEFINED 31
1355 static const char *msgs[NUM_PREDEFINED] = {
1357 "INVALID-PAYLOAD-TYPE",
1358 "DOI-NOT-SUPPORTED",
1359 "SITUATION-NOT-SUPPORTED",
1361 "INVALID-MAJOR-VERSION",
1362 "INVALID-MINOR-VERSION",
1363 "INVALID-EXCHANGE-TYPE",
1365 "INVALID-MESSAGE-ID",
1366 "INVALID-PROTOCOL-ID",
1368 "INVALID-TRANSFORM-ID",
1369 "ATTRIBUTES-NOT-SUPPORTED",
1370 "NO-PROPOSAL-CHOSEN",
1371 "BAD-PROPOSAL-SYNTAX",
1372 "PAYLOAD-MALFORMED",
1373 "INVALID-KEY-INFORMATION",
1374 "INVALID-ID-INFORMATION",
1375 "INVALID-CERT-ENCODING",
1376 "INVALID-CERTIFICATE",
1377 "CERT-TYPE-UNSUPPORTED",
1378 "INVALID-CERT-AUTHORITY",
1379 "INVALID-HASH-INFORMATION",
1380 "AUTHENTICATION-FAILED",
1381 "INVALID-SIGNATURE",
1382 "ADDRESS-NOTIFICATION",
1383 "NOTIFY-SA-LIFETIME",
1384 "CERTIFICATE-UNAVAILABLE",
1385 "UNSUPPORTED-EXCHANGE-TYPE",
1386 "UNEQUAL-PAYLOAD-LENGTHS"
1389 if (type < NUM_PREDEFINED) return msgs[type];
1390 if (type < 8192) return "RESERVED (Future Use)";
1391 if (type < 16384) return "Private Use";
1392 if (type < 16385) return "CONNECTED";
1393 if (type < 24576) return "RESERVED (Future Use) - status";
1394 if (type < 24577) return "RESPONDER-LIFETIME";
1395 if (type < 24578) return "REPLAY-STATUS";
1396 if (type < 24579) return "INITIAL-CONTACT";
1397 if (type < 32768) return "DOI-specific codes";
1398 if (type < 40960) return "Private Use - status";
1399 if (type < 65535) return "RESERVED (Future Use) - status (2)";
1401 return "Huh? You should never see this! Shame on you!";
1405 situation2str(guint32 type) {
1407 #define SIT_MSG_NUM 1024
1408 #define SIT_IDENTITY 0x01
1409 #define SIT_SECRECY 0x02
1410 #define SIT_INTEGRITY 0x04
1412 static char msg[SIT_MSG_NUM];
1417 if (type & SIT_IDENTITY) {
1418 ret = snprintf(msg, SIT_MSG_NUM-n, "%sIDENTITY", sep);
1419 if (ret == -1 || ret >= SIT_MSG_NUM-n) {
1421 msg[SIT_MSG_NUM-1] = '\0';
1427 if (type & SIT_SECRECY) {
1428 if (n >= SIT_MSG_NUM) {
1432 ret = snprintf(msg, SIT_MSG_NUM-n, "%sSECRECY", sep);
1433 if (ret == -1 || ret >= SIT_MSG_NUM-n) {
1435 msg[SIT_MSG_NUM-1] = '\0';
1441 if (type & SIT_INTEGRITY) {
1442 if (n >= SIT_MSG_NUM) {
1446 ret = snprintf(msg, SIT_MSG_NUM-n, "%sINTEGRITY", sep);
1447 if (ret == -1 || ret >= SIT_MSG_NUM-n) {
1449 msg[SIT_MSG_NUM-1] = '\0';
1460 value2str(int ike_p1, guint16 att_type, guint32 value) {
1462 if (value == 0) return "RESERVED";
1468 case 0: return "RESERVED";
1469 case 1: return "Seconds";
1470 case 2: return "Kilobytes";
1471 default: return "UNKNOWN-SA-VALUE";
1474 return "Duration-Value";
1476 return "Group-Value";
1479 case 0: return "RESERVED";
1480 case 1: return "Tunnel";
1481 case 2: return "Transport";
1482 case 3: return "UDP-Encapsulated-Tunnel"; /* http://www.ietf.org/internet-drafts/draft-ietf-ipsec-nat-t-ike-05.txt */
1483 case 4: return "UDP-Encapsulated-Transport"; /* http://www.ietf.org/internet-drafts/draft-ietf-ipsec-nat-t-ike-05.txt */
1484 case 61440: return "Check Point IPSec UDP Encapsulation";
1485 case 61443: return "UDP-Encapsulated-Tunnel (draft)";
1486 case 61444: return "UDP-Encapsulated-Transport (draft)";
1487 default: return "UNKNOWN-ENCAPSULATION-VALUE";
1491 case 0: return "RESERVED";
1492 case 1: return "HMAC-MD5";
1493 case 2: return "HMAC-SHA";
1494 case 3: return "DES-MAC";
1495 case 4: return "KPDK";
1496 case 5: return "HMAC-SHA2-256";
1497 case 6: return "HMAC-SHA2-384";
1498 case 7: return "HMAC-SHA2-512";
1499 default: return "UNKNOWN-AUTHENTICATION-VALUE";
1502 return "Key-Length";
1504 return "Key-Rounds";
1506 return "Compress-Dictionary-size";
1508 return "Compress Private Algorithm";
1509 default: return "UNKNOWN-ATTRIBUTE-TYPE";
1516 case 1: return "DES-CBC";
1517 case 2: return "IDEA-CBC";
1518 case 3: return "BLOWFISH-CBC";
1519 case 4: return "RC5-R16-B64-CBC";
1520 case 5: return "3DES-CBC";
1521 case 6: return "CAST-CBC";
1522 case 7: return "AES-CBC";
1523 default: return "UNKNOWN-ENCRYPTION-ALG";
1527 case 1: return "MD5";
1528 case 2: return "SHA";
1529 case 3: return "TIGER";
1530 case 4: return "SHA2-256";
1531 case 5: return "SHA2-384";
1532 case 6: return "SHA2-512";
1533 default: return "UNKNOWN-HASH-ALG";
1537 case 1: return "PSK";
1538 case 2: return "DSS-SIG";
1539 case 3: return "RSA-SIG";
1540 case 4: return "RSA-ENC";
1541 case 5: return "RSA-Revised-ENC";
1542 case 6: return "Encryption with El-Gamal";
1543 case 7: return "Revised encryption with El-Gamal";
1544 case 8: return "ECDSA signatures";
1545 case 9: return "AES-XCBC-MAC";
1546 case 64221: return "HybridInitRSA";
1547 case 64222: return "HybridRespRSA";
1548 case 64223: return "HybridInitDSS";
1549 case 64224: return "HybridRespDSS";
1550 case 65001: return "XAUTHInitPreShared";
1551 case 65002: return "XAUTHRespPreShared";
1552 case 65003: return "XAUTHInitDSS";
1553 case 65004: return "XAUTHRespDSS";
1554 case 65005: return "XAUTHInitRSA";
1555 case 65006: return "XAUTHRespRSA";
1556 case 65007: return "XAUTHInitRSAEncryption";
1557 case 65008: return "XAUTHRespRSAEncryption";
1558 case 65009: return "XAUTHInitRSARevisedEncryption";
1559 case 65010: return "XAUTHRespRSARevisedEncryption";
1560 default: return "UNKNOWN-AUTH-METHOD";
1562 case 4: return grpdesc2str(value);
1569 return "Group-Value";
1572 case 1: return "MODP";
1573 case 2: return "ECP";
1574 case 3: return "EC2N";
1575 default: return "UNKNOWN-GROUPT-TYPE";
1579 case 1: return "Seconds";
1580 case 2: return "Kilobytes";
1581 default: return "UNKNOWN-SA-VALUE";
1584 return "Duration-Value";
1588 return "Key-Length";
1590 return "Field-Size";
1591 default: return "UNKNOWN-ATTRIBUTE-TYPE";
1597 attrtype2str(guint8 type) {
1599 case 0: return "Reserved";
1600 case 1: return "ISAKMP_CFG_REQUEST";
1601 case 2: return "ISAKMP_CFG_REPLY";
1602 case 3: return "ISAKMP_CFG_SET";
1603 case 4: return "ISAKMP_CFG_ACK";
1606 return "Future use";
1607 return "Private use";
1611 cfgattrident2str(guint16 ident) {
1612 #define NUM_ATTR_DEFINED 12
1613 static const char *msgs[NUM_PREDEFINED] = {
1615 "INTERNAL_IP4_ADDRESS",
1616 "INTERNAL_IP4_NETMASK",
1618 "INTERNAL_IP4_NBNS",
1619 "INTERNAL_ADDRESS_EXPIREY",
1620 "INTERNAL_IP4_DHCP",
1621 "APPLICATION_VERSION"
1622 "INTERNAL_IP6_ADDRESS",
1623 "INTERNAL_IP6_NETMASK",
1625 "INTERNAL_IP6_NBNS",
1626 "INTERNAL_IP6_DHCP",
1628 if(ident < NUM_ATTR_DEFINED)
1631 return "Future use";
1633 case 16520: return "XAUTH_TYPE";
1634 case 16521: return "XAUTH_USER_NAME";
1635 case 16522: return "XAUTH_USER_PASSWORD";
1636 case 16523: return "XAUTH_PASSCODE";
1637 case 16524: return "XAUTH_MESSAGE";
1638 case 16525: return "XAUTH_CHALLANGE";
1639 case 16526: return "XAUTH_DOMAIN";
1640 case 16527: return "XAUTH_STATUS";
1641 case 16528: return "XAUTH_NEXT_PIN";
1642 case 16529: return "XAUTH_ANSWER";
1643 default: return "Private use";
1648 certtype2str(guint8 type) {
1649 #define NUM_CERTTYPE 11
1650 static const char *msgs[NUM_CERTTYPE] = {
1652 "PKCS #7 wrapped X.509 certificate",
1655 "X.509 Certificate - Signature",
1656 "X.509 Certificate - Key Exchange",
1658 "Certificate Revocation List (CRL)",
1659 "Authority Revocation List (ARL)",
1661 "X.509 Certificate - Attribute",
1663 if(type > NUM_CERTTYPE)
1669 get_num(tvbuff_t *tvb, int offset, guint16 len, guint32 *num_p) {
1673 *num_p = tvb_get_guint8(tvb, offset);
1676 *num_p = tvb_get_ntohs(tvb, offset);
1679 *num_p = tvb_get_ntoh24(tvb, offset);
1682 *num_p = tvb_get_ntohl(tvb, offset);
1692 proto_register_isakmp(void)
1694 /* static hf_register_info hf[] = {
1696 { "Name", "isakmp.abbreviation", TYPE, VALS_POINTER }},
1698 static gint *ett[] = {
1701 &ett_isakmp_payload,
1704 proto_isakmp = proto_register_protocol("Internet Security Association and Key Management Protocol",
1705 "ISAKMP", "isakmp");
1706 /* proto_register_field_array(proto_isakmp, hf, array_length(hf));*/
1707 proto_register_subtree_array(ett, array_length(ett));
1709 register_dissector("isakmp", dissect_isakmp, proto_isakmp);
1713 proto_reg_handoff_isakmp(void)
1715 dissector_handle_t isakmp_handle;
1717 isakmp_handle = find_dissector("isakmp");
1718 dissector_add("udp.port", UDP_PORT_ISAKMP, isakmp_handle);
1719 dissector_add("tcp.port", TCP_PORT_ISAKMP, isakmp_handle);