2 * Copyright (c) 2003 Markus Friedl. All rights reserved.
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
13 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
14 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
15 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
16 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
17 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
18 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
19 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
20 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
21 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
22 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27 #include <epan/packet.h>
29 void proto_register_udpencap(void);
30 void proto_reg_handoff_udpencap(void);
32 static int proto_udpencap = -1;
33 static gint ett_udpencap = -1;
35 static dissector_handle_t esp_handle;
36 static dissector_handle_t isakmp_handle;
39 * UDP Encapsulation of IPsec Packets
40 * draft-ietf-ipsec-udp-encaps-06.txt
43 dissect_udpencap(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
46 proto_tree *udpencap_tree = NULL;
47 proto_item *ti = NULL;
50 col_set_str(pinfo->cinfo, COL_PROTOCOL, "UDPENCAP");
51 col_clear(pinfo->cinfo, COL_INFO);
54 ti = proto_tree_add_item(tree, proto_udpencap, tvb, 0, -1, ENC_NA);
55 udpencap_tree = proto_item_add_subtree(ti, ett_udpencap);
58 /* 1 byte of 0xFF indicates NAT-keepalive */
59 if ((tvb_length(tvb) == 1) && (tvb_get_guint8(tvb, 0) == 0xff)) {
60 col_set_str(pinfo->cinfo, COL_INFO, "NAT-keepalive");
62 proto_tree_add_text(udpencap_tree, tvb, 0, 1, "NAT-keepalive packet");
64 /* SPI of zero indicates IKE traffic, otherwise it's ESP */
65 tvb_memcpy(tvb, (guint8 *)&spi, 0, sizeof(spi));
67 col_set_str(pinfo->cinfo, COL_INFO, "ISAKMP");
69 proto_tree_add_text(udpencap_tree, tvb, 0, sizeof(spi),
71 proto_item_set_len(ti, sizeof(spi));
73 next_tvb = tvb_new_subset_remaining(tvb, sizeof(spi));
74 call_dissector(isakmp_handle, next_tvb, pinfo, tree);
76 col_set_str(pinfo->cinfo, COL_INFO, "ESP");
78 proto_item_set_len(ti, 0);
79 call_dissector(esp_handle, tvb, pinfo, tree);
85 proto_register_udpencap(void)
87 static gint *ett[] = {
91 proto_udpencap = proto_register_protocol(
92 "UDP Encapsulation of IPsec Packets", "UDPENCAP", "udpencap");
93 proto_register_subtree_array(ett, array_length(ett));
97 proto_reg_handoff_udpencap(void)
99 dissector_handle_t udpencap_handle;
101 esp_handle = find_dissector("esp");
102 isakmp_handle = find_dissector("isakmp");
104 udpencap_handle = create_dissector_handle(dissect_udpencap, proto_udpencap);
105 dissector_add_uint("udp.port", 4500, udpencap_handle);