usr.sbin/snoop/snoop_ip.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 * Copyright 2012 Milan Jurik. All rights reserved.
 */

#include <stdio.h>
#include <string.h>
#include <fcntl.h>
#include <string.h>
#include <sys/types.h>
#include <sys/time.h>

#include <sys/stropts.h>
#include <sys/socket.h>
#include <net/if.h>
#include <netinet/in_systm.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <netinet/ip6.h>
#include <netinet/ip_icmp.h>
#include <netinet/icmp6.h>
#include <netinet/if_ether.h>
#include <inet/ip.h>
#include <inet/ip6.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <tsol/label.h>
#include <sys/tsol/tndb.h>
#include <sys/tsol/label_macro.h>

#include "snoop.h"


/*
 * IPv6 extension header masks.  These are used by the print_ipv6_extensions()
 * function to return information to the caller about which extension headers
 * were processed.  This can be useful if the caller wants to know if the
 * packet is an IPv6 fragment, for example.
 */
#define SNOOP_HOPOPTS   0x01U
#define SNOOP_ROUTING   0x02U
#define SNOOP_DSTOPTS   0x04U
#define SNOOP_FRAGMENT  0x08U
#define SNOOP_AH    0x10U
#define SNOOP_ESP   0x20U
#define SNOOP_IPV6  0x40U

static void prt_routing_hdr(int, const struct ip6_rthdr *);
static void prt_fragment_hdr(int, const struct ip6_frag *);
static void prt_hbh_options(int, const struct ip6_hbh *);
static void prt_dest_options(int, const struct ip6_dest *);
static void print_route(const uchar_t *);
static void print_ipoptions(const uchar_t *, int);
static void print_ripso(const uchar_t *);
static void print_cipso(const uchar_t *);

/* Keep track of how many nested IP headers we have. */
unsigned int encap_levels;
unsigned int total_encap_levels = 1;

int
interpret_ip(int flags, const struct ip *ip, int fraglen)
{
    uchar_t *data;
    char buff[24];
    boolean_t isfrag = B_FALSE;
    boolean_t morefrag;
    uint16_t fragoffset;
    int hdrlen;
    uint16_t iplen, uitmp;

    if (ip->ip_v == IPV6_VERSION) {
        iplen = interpret_ipv6(flags, (ip6_t *)ip, fraglen);
        return (iplen);
    }

    if (encap_levels == 0)
        total_encap_levels = 0;
    encap_levels++;
    total_encap_levels++;

    hdrlen = ip->ip_hl * 4;
    data = ((uchar_t *)ip) + hdrlen;
    iplen = ntohs(ip->ip_len) - hdrlen;
    fraglen -= hdrlen;
    if (fraglen > iplen)
        fraglen = iplen;
    if (fraglen < 0) {
        (void) snprintf(get_sum_line(), MAXLINE,
            "IP truncated: header missing %d bytes", -fraglen);
        encap_levels--;
        return (fraglen + iplen);
    }
    /*
     * We flag this as a fragment if the more fragments bit is set, or
     * if the fragment offset is non-zero.
     */
    morefrag = (ntohs(ip->ip_off) & IP_MF) == 0 ? B_FALSE : B_TRUE;
    fragoffset = (ntohs(ip->ip_off) & 0x1FFF) * 8;
    if (morefrag || fragoffset != 0)
        isfrag = B_TRUE;

    src_name = addrtoname(AF_INET, &ip->ip_src);
    dst_name = addrtoname(AF_INET, &ip->ip_dst);

    if (flags & F_SUM) {
        if (isfrag) {
            (void) snprintf(get_sum_line(), MAXLINE,
                "%s IP fragment ID=%d Offset=%-4d MF=%d TOS=0x%x "
                "TTL=%d",
                getproto(ip->ip_p),
                ntohs(ip->ip_id),
                fragoffset,
                morefrag,
                ip->ip_tos,
                ip->ip_ttl);
        } else {
            (void) strlcpy(buff, inet_ntoa(ip->ip_dst),
                sizeof (buff));
            uitmp = ntohs(ip->ip_len);
            (void) snprintf(get_sum_line(), MAXLINE,
                "IP  D=%s S=%s LEN=%u%s, ID=%d, TOS=0x%x, TTL=%d",
                buff,
                inet_ntoa(ip->ip_src),
                uitmp,
                iplen > fraglen ? "?" : "",
                ntohs(ip->ip_id),
                ip->ip_tos,
                ip->ip_ttl);
        }
    }

    if (flags & F_DTAIL) {
        show_header("IP:   ", "IP Header", iplen);
        show_space();
        (void) snprintf(get_line(0, 0), get_line_remain(),
            "Version = %d", ip->ip_v);
        (void) snprintf(get_line(0, 0), get_line_remain(),
            "Header length = %d bytes", hdrlen);
        (void) snprintf(get_line(0, 0), get_line_remain(),
            "Type of service = 0x%02x", ip->ip_tos);
        (void) snprintf(get_line(0, 0), get_line_remain(),
            "      xxx. .... = %d (precedence)",
            ip->ip_tos >> 5);
        (void) snprintf(get_line(0, 0), get_line_remain(),
            "      %s", getflag(ip->ip_tos, IPTOS_LOWDELAY,
            "low delay", "normal delay"));
        (void) snprintf(get_line(0, 0), get_line_remain(), "      %s",
            getflag(ip->ip_tos, IPTOS_THROUGHPUT,
            "high throughput", "normal throughput"));
        (void) snprintf(get_line(0, 0), get_line_remain(), "      %s",
            getflag(ip->ip_tos, IPTOS_RELIABILITY,
            "high reliability", "normal reliability"));
        (void) snprintf(get_line(0, 0), get_line_remain(), "      %s",
            getflag(ip->ip_tos, IPTOS_ECT,
            "ECN capable transport", "not ECN capable transport"));
        (void) snprintf(get_line(0, 0), get_line_remain(), "      %s",
            getflag(ip->ip_tos, IPTOS_CE,
            "ECN congestion experienced",
            "no ECN congestion experienced"));
        /* warning: ip_len is signed in netinet/ip.h */
        uitmp = ntohs(ip->ip_len);
        (void) snprintf(get_line(0, 0), get_line_remain(),
            "Total length = %u bytes%s", uitmp,
            iplen > fraglen ? " -- truncated" : "");
        (void) snprintf(get_line(0, 0), get_line_remain(),
            "Identification = %d", ntohs(ip->ip_id));
        /* warning: ip_off is signed in netinet/ip.h */
        uitmp = ntohs(ip->ip_off);
        (void) snprintf(get_line(0, 0), get_line_remain(),
            "Flags = 0x%x", uitmp >> 12);
        (void) snprintf(get_line(0, 0), get_line_remain(), "      %s",
            getflag(uitmp >> 8, IP_DF >> 8,
            "do not fragment", "may fragment"));
        (void) snprintf(get_line(0, 0), get_line_remain(), "      %s",
            getflag(uitmp >> 8, IP_MF >> 8,
            "more fragments", "last fragment"));
        (void) snprintf(get_line(0, 0), get_line_remain(),
            "Fragment offset = %u bytes",
            fragoffset);
        (void) snprintf(get_line(0, 0), get_line_remain(),
            "Time to live = %d seconds/hops",
            ip->ip_ttl);
        (void) snprintf(get_line(0, 0), get_line_remain(),
            "Protocol = %d (%s)", ip->ip_p,
            getproto(ip->ip_p));
        /*
         * XXX need to compute checksum and print whether it's correct
         */
        (void) snprintf(get_line(0, 0), get_line_remain(),
            "Header checksum = %04x",
            ntohs(ip->ip_sum));
        (void) snprintf(get_line(0, 0), get_line_remain(),
            "Source address = %s, %s",
            inet_ntoa(ip->ip_src), addrtoname(AF_INET, &ip->ip_src));
        (void) snprintf(get_line(0, 0), get_line_remain(),
            "Destination address = %s, %s",
            inet_ntoa(ip->ip_dst), addrtoname(AF_INET, &ip->ip_dst));

        /* Print IP options - if any */

        print_ipoptions((const uchar_t *)(ip + 1),
            hdrlen - sizeof (struct ip));
        show_space();
    }

    /*
     * If we are in detail mode, and this is not the first fragment of
     * a fragmented packet, print out a little line stating this.
     * Otherwise, go to the next protocol layer only if this is not a
     * fragment, or we are in detail mode and this is the first fragment
     * of a fragmented packet.
     */
    if (flags & F_DTAIL && fragoffset != 0) {
        (void) snprintf(get_detail_line(0, 0), MAXLINE,
            "%s:  [%d byte(s) of data, continuation of IP ident=%d]",
            getproto(ip->ip_p),
            iplen,
            ntohs(ip->ip_id));
    } else if (!isfrag || (flags & F_DTAIL) && isfrag && fragoffset == 0) {
        /* go to the next protocol layer */

        if (fraglen > 0) {
            switch (ip->ip_p) {
            case IPPROTO_IP:
                break;
            case IPPROTO_ENCAP:
                (void) interpret_ip(flags,
                    /* LINTED: alignment */
                    (const struct ip *)data, fraglen);
                break;
            case IPPROTO_ICMP:
                (void) interpret_icmp(flags,
                    /* LINTED: alignment */
                    (struct icmp *)data, iplen, fraglen);
                break;
            case IPPROTO_IGMP:
                interpret_igmp(flags, data, iplen, fraglen);
                break;
            case IPPROTO_GGP:
                break;
            case IPPROTO_TCP:
                (void) interpret_tcp(flags,
                    (struct tcphdr *)data, iplen, fraglen);
                break;

            case IPPROTO_ESP:
                (void) interpret_esp(flags, data, iplen,
                    fraglen);
                break;
            case IPPROTO_AH:
                (void) interpret_ah(flags, data, iplen,
                    fraglen);
                break;

            case IPPROTO_OSPF:
                interpret_ospf(flags, data, iplen, fraglen);
                break;

            case IPPROTO_EGP:
            case IPPROTO_PUP:
                break;
            case IPPROTO_UDP:
                (void) interpret_udp(flags,
                    (struct udphdr *)data, iplen, fraglen);
                break;

            case IPPROTO_IDP:
            case IPPROTO_HELLO:
            case IPPROTO_ND:
            case IPPROTO_RAW:
                break;
            case IPPROTO_IPV6:  /* IPV6 encap */
                /* LINTED: alignment */
                (void) interpret_ipv6(flags, (ip6_t *)data,
                    iplen);
                break;
            case IPPROTO_SCTP:
                (void) interpret_sctp(flags,
                    (struct sctp_hdr *)data, iplen, fraglen);
                break;
            }
        }
    }

    encap_levels--;
    return (iplen);
}

int
interpret_ipv6(int flags, const ip6_t *ip6h, int fraglen)
{
    uint8_t *data;
    int hdrlen, iplen;
    int version, flow, class;
    uchar_t proto;
    boolean_t isfrag = B_FALSE;
    uint8_t extmask;
    /*
     * The print_srcname and print_dstname strings are the hostname
     * parts of the verbose IPv6 header output, including the comma
     * and the space after the litteral address strings.
     */
    char print_srcname[MAXHOSTNAMELEN + 2];
    char print_dstname[MAXHOSTNAMELEN + 2];
    char src_addrstr[INET6_ADDRSTRLEN];
    char dst_addrstr[INET6_ADDRSTRLEN];

    iplen = ntohs(ip6h->ip6_plen);
    hdrlen = IPV6_HDR_LEN;
    fraglen -= hdrlen;
    if (fraglen < 0)
        return (fraglen + hdrlen);
    data = ((uint8_t *)ip6h) + hdrlen;

    proto = ip6h->ip6_nxt;

    src_name = addrtoname(AF_INET6, &ip6h->ip6_src);
    dst_name = addrtoname(AF_INET6, &ip6h->ip6_dst);

    /*
     * Use endian-aware masks to extract traffic class and
     * flowinfo.  Also, flowinfo is now 20 bits and class 8
     * rather than 24 and 4.
     */
    class = ntohl((ip6h->ip6_vcf & IPV6_FLOWINFO_TCLASS) >> 20);
    flow = ntohl(ip6h->ip6_vcf & IPV6_FLOWINFO_FLOWLABEL);

    /*
     * NOTE: the F_SUM and F_DTAIL flags are mutually exclusive,
     * so the code within the first part of the following if statement
     * will not affect the detailed printing of the packet.
     */
    if (flags & F_SUM) {
        (void) snprintf(get_sum_line(), MAXLINE,
            "IPv6  S=%s D=%s LEN=%d HOPS=%d CLASS=0x%x FLOW=0x%x",
            src_name, dst_name, iplen, ip6h->ip6_hops, class, flow);
    } else if (flags & F_DTAIL) {

        (void) inet_ntop(AF_INET6, &ip6h->ip6_src, src_addrstr,
            INET6_ADDRSTRLEN);
        (void) inet_ntop(AF_INET6, &ip6h->ip6_dst, dst_addrstr,
            INET6_ADDRSTRLEN);

        version = ntohl(ip6h->ip6_vcf) >> 28;

        if (strcmp(src_name, src_addrstr) == 0) {
            print_srcname[0] = '\0';
        } else {
            snprintf(print_srcname, sizeof (print_srcname),
                ", %s", src_name);
        }

        if (strcmp(dst_name, dst_addrstr) == 0) {
            print_dstname[0] = '\0';
        } else {
            snprintf(print_dstname, sizeof (print_dstname),
                ", %s", dst_name);
        }

        show_header("IPv6:   ", "IPv6 Header", iplen);
        show_space();

        (void) snprintf(get_line(0, 0), get_line_remain(),
            "Version = %d", version);
        (void) snprintf(get_line(0, 0), get_line_remain(),
            "Traffic Class = %d", class);
        (void) snprintf(get_line(0, 0), get_line_remain(),
            "Flow label = 0x%x", flow);
        (void) snprintf(get_line(0, 0), get_line_remain(),
            "Payload length = %d", iplen);
        (void) snprintf(get_line(0, 0), get_line_remain(),
            "Next Header = %d (%s)", proto,
            getproto(proto));
        (void) snprintf(get_line(0, 0), get_line_remain(),
            "Hop Limit = %d", ip6h->ip6_hops);
        (void) snprintf(get_line(0, 0), get_line_remain(),
            "Source address = %s%s", src_addrstr, print_srcname);
        (void) snprintf(get_line(0, 0), get_line_remain(),
            "Destination address = %s%s", dst_addrstr, print_dstname);

        show_space();
    }

    /*
     * Print IPv6 Extension Headers, or skip them in the summary case.
     * Set isfrag to true if one of the extension headers encounterred
     * was a fragment header.
     */
    if (proto == IPPROTO_HOPOPTS || proto == IPPROTO_DSTOPTS ||
        proto == IPPROTO_ROUTING || proto == IPPROTO_FRAGMENT) {
        extmask = print_ipv6_extensions(flags, &data, &proto, &iplen,
            &fraglen);
        if ((extmask & SNOOP_FRAGMENT) != 0) {
            isfrag = B_TRUE;
        }
    }

    /*
     * We only want to print upper layer information if this is not
     * a fragment, or if we're printing in detail.  Note that the
     * proto variable will be set to IPPROTO_NONE if this is a fragment
     * with a non-zero fragment offset.
     */
    if (!isfrag || flags & F_DTAIL) {
        /* go to the next protocol layer */

        switch (proto) {
        case IPPROTO_IP:
            break;
        case IPPROTO_ENCAP:
            /* LINTED: alignment */
            (void) interpret_ip(flags, (const struct ip *)data,
                fraglen);
            break;
        case IPPROTO_ICMPV6:
            /* LINTED: alignment */
            (void) interpret_icmpv6(flags, (icmp6_t *)data, iplen,
                fraglen);
            break;
        case IPPROTO_IGMP:
            interpret_igmp(flags, data, iplen, fraglen);
            break;
        case IPPROTO_GGP:
            break;
        case IPPROTO_TCP:
            (void) interpret_tcp(flags, (struct tcphdr *)data,
                iplen, fraglen);
            break;
        case IPPROTO_ESP:
            (void) interpret_esp(flags, data, iplen, fraglen);
            break;
        case IPPROTO_AH:
            (void) interpret_ah(flags, data, iplen, fraglen);
            break;
        case IPPROTO_EGP:
        case IPPROTO_PUP:
            break;
        case IPPROTO_UDP:
            (void) interpret_udp(flags, (struct udphdr *)data,
                iplen, fraglen);
            break;
        case IPPROTO_IDP:
        case IPPROTO_HELLO:
        case IPPROTO_ND:
        case IPPROTO_RAW:
            break;
        case IPPROTO_IPV6:
            /* LINTED: alignment */
            (void) interpret_ipv6(flags, (const ip6_t *)data,
                iplen);
            break;
        case IPPROTO_SCTP:
            (void) interpret_sctp(flags, (struct sctp_hdr *)data,
                iplen, fraglen);
            break;
        case IPPROTO_OSPF:
            interpret_ospf6(flags, data, iplen, fraglen);
            break;
        }
    }

    return (iplen);
}

/*
 * ip_ext: data including the extension header.
 * iplen: length of the data remaining in the packet.
 * Returns a mask of IPv6 extension headers it processed.
 */
uint8_t
print_ipv6_extensions(int flags, uint8_t **hdr, uint8_t *next, int *iplen,
    int *fraglen)
{
    uint8_t *data_ptr;
    uchar_t proto = *next;
    boolean_t is_extension_header;
    struct ip6_hbh *ipv6ext_hbh;
    struct ip6_dest *ipv6ext_dest;
    struct ip6_rthdr *ipv6ext_rthdr;
    struct ip6_frag *ipv6ext_frag;
    uint32_t exthdrlen;
    uint8_t extmask = 0;

    if ((hdr == NULL) || (*hdr == NULL) || (next == NULL) || (iplen == 0))
        return (0);

    data_ptr = *hdr;
    is_extension_header = B_TRUE;
    while (is_extension_header) {

        /*
         * There must be at least enough data left to read the
         * next header and header length fields from the next
         * header.
         */
        if (*fraglen < 2) {
            return (extmask);
        }

        switch (proto) {
        case IPPROTO_HOPOPTS:
            ipv6ext_hbh = (struct ip6_hbh *)data_ptr;
            exthdrlen = 8 + ipv6ext_hbh->ip6h_len * 8;
            if (*fraglen <= exthdrlen) {
                return (extmask);
            }
            prt_hbh_options(flags, ipv6ext_hbh);
            extmask |= SNOOP_HOPOPTS;
            proto = ipv6ext_hbh->ip6h_nxt;
            break;
        case IPPROTO_DSTOPTS:
            ipv6ext_dest = (struct ip6_dest *)data_ptr;
            exthdrlen = 8 + ipv6ext_dest->ip6d_len * 8;
            if (*fraglen <= exthdrlen) {
                return (extmask);
            }
            prt_dest_options(flags, ipv6ext_dest);
            extmask |= SNOOP_DSTOPTS;
            proto = ipv6ext_dest->ip6d_nxt;
            break;
        case IPPROTO_ROUTING:
            ipv6ext_rthdr = (struct ip6_rthdr *)data_ptr;
            exthdrlen = 8 + ipv6ext_rthdr->ip6r_len * 8;
            if (*fraglen <= exthdrlen) {
                return (extmask);
            }
            prt_routing_hdr(flags, ipv6ext_rthdr);
            extmask |= SNOOP_ROUTING;
            proto = ipv6ext_rthdr->ip6r_nxt;
            break;
        case IPPROTO_FRAGMENT:
            /* LINTED: alignment */
            ipv6ext_frag = (struct ip6_frag *)data_ptr;
            exthdrlen = sizeof (struct ip6_frag);
            if (*fraglen <= exthdrlen) {
                return (extmask);
            }
            prt_fragment_hdr(flags, ipv6ext_frag);
            extmask |= SNOOP_FRAGMENT;
            /*
             * If this is not the first fragment, forget about
             * the rest of the packet, snoop decoding is
             * stateless.
             */
            if ((ipv6ext_frag->ip6f_offlg & IP6F_OFF_MASK) != 0)
                proto = IPPROTO_NONE;
            else
                proto = ipv6ext_frag->ip6f_nxt;
            break;
        default:
            is_extension_header = B_FALSE;
            break;
        }

        if (is_extension_header) {
            *iplen -= exthdrlen;
            *fraglen -= exthdrlen;
            data_ptr += exthdrlen;
        }
    }

    *next = proto;
    *hdr = data_ptr;
    return (extmask);
}

static void
print_ipoptions(const uchar_t *opt, int optlen)
{
    int len;
    int remain;
    char *line;
    const char *truncstr;

    if (optlen <= 0) {
        (void) snprintf(get_line(0, 0), get_line_remain(),
            "No options");
        return;
    }

    (void) snprintf(get_line(0, 0), get_line_remain(),
        "Options: (%d bytes)", optlen);

    while (optlen > 0) {
        line = get_line(0, 0);
        remain = get_line_remain();
        len = opt[1];
        truncstr = len > optlen ? "?" : "";
        switch (opt[0]) {
        case IPOPT_EOL:
            (void) strlcpy(line, "  - End of option list", remain);
            return;
        case IPOPT_NOP:
            (void) strlcpy(line, "  - No op", remain);
            len = 1;
            break;
        case IPOPT_RR:
            (void) snprintf(line, remain,
                "  - Record route (%d bytes%s)", len, truncstr);
            print_route(opt);
            break;
        case IPOPT_TS:
            (void) snprintf(line, remain,
                "  - Time stamp (%d bytes%s)", len, truncstr);
            break;
        case IPOPT_SECURITY:
            (void) snprintf(line, remain, "  - RIPSO (%d bytes%s)",
                len, truncstr);
            print_ripso(opt);
            break;
        case IPOPT_COMSEC:
            (void) snprintf(line, remain, "  - CIPSO (%d bytes%s)",
                len, truncstr);
            print_cipso(opt);
            break;
        case IPOPT_LSRR:
            (void) snprintf(line, remain,
                "  - Loose source route (%d bytes%s)", len,
                truncstr);
            print_route(opt);
            break;
        case IPOPT_SATID:
            (void) snprintf(line, remain,
                "  - SATNET Stream id (%d bytes%s)",
                len, truncstr);
            break;
        case IPOPT_SSRR:
            (void) snprintf(line, remain,
                "  - Strict source route, (%d bytes%s)", len,
                truncstr);
            print_route(opt);
            break;
        default:
            (void) snprintf(line, remain,
                "  - Option %d (unknown - %d bytes%s) %s",
                opt[0], len, truncstr,
                tohex((char *)&opt[2], len - 2));
            break;
        }
        if (len <= 0) {
            (void) snprintf(line, remain,
                "  - Incomplete option len %d", len);
            break;
        }
        opt += len;
        optlen -= len;
    }
}

static void
print_route(const uchar_t *opt)
{
    int len, pointer, remain;
    struct in_addr addr;
    char *line;

    len = opt[1];
    pointer = opt[2];

    (void) snprintf(get_line(0, 0), get_line_remain(),
        "    Pointer = %d", pointer);

    pointer -= IPOPT_MINOFF;
    opt += (IPOPT_OFFSET + 1);
    len -= (IPOPT_OFFSET + 1);

    while (len > 0) {
        line = get_line(0, 0);
        remain = get_line_remain();
        memcpy((char *)&addr, opt, sizeof (addr));
        if (addr.s_addr == INADDR_ANY)
            (void) strlcpy(line, "      -", remain);
        else
            (void) snprintf(line, remain, "      %s",
                addrtoname(AF_INET, &addr));
        if (pointer == 0)
            (void) strlcat(line, "  <-- (current)", remain);

        opt += sizeof (addr);
        len -= sizeof (addr);
        pointer -= sizeof (addr);
    }
}

char *
getproto(int p)
{
    switch (p) {
    case IPPROTO_HOPOPTS:   return ("IPv6-HopOpts");
    case IPPROTO_IPV6:  return ("IPv6");
    case IPPROTO_ROUTING:   return ("IPv6-Route");
    case IPPROTO_FRAGMENT:  return ("IPv6-Frag");
    case IPPROTO_RSVP:  return ("RSVP");
    case IPPROTO_ENCAP: return ("IP-in-IP");
    case IPPROTO_AH:    return ("AH");
    case IPPROTO_ESP:   return ("ESP");
    case IPPROTO_ICMP:  return ("ICMP");
    case IPPROTO_ICMPV6:    return ("ICMPv6");
    case IPPROTO_DSTOPTS:   return ("IPv6-DstOpts");
    case IPPROTO_IGMP:  return ("IGMP");
    case IPPROTO_GGP:   return ("GGP");
    case IPPROTO_TCP:   return ("TCP");
    case IPPROTO_EGP:   return ("EGP");
    case IPPROTO_PUP:   return ("PUP");
    case IPPROTO_UDP:   return ("UDP");
    case IPPROTO_IDP:   return ("IDP");
    case IPPROTO_HELLO: return ("HELLO");
    case IPPROTO_ND:    return ("ND");
    case IPPROTO_EON:   return ("EON");
    case IPPROTO_RAW:   return ("RAW");
    case IPPROTO_OSPF:  return ("OSPF");
    default:        return ("");
    }
}

static void
prt_routing_hdr(int flags, const struct ip6_rthdr *ipv6ext_rthdr)
{
    uint8_t nxt_hdr;
    uint8_t type;
    uint32_t len;
    uint8_t segleft;
    uint32_t numaddrs;
    int i;
    struct ip6_rthdr0 *ipv6ext_rthdr0;
    struct in6_addr *addrs;
    char addr[INET6_ADDRSTRLEN];

    /* in summary mode, we don't do anything. */
    if (flags & F_SUM) {
        return;
    }

    nxt_hdr = ipv6ext_rthdr->ip6r_nxt;
    type = ipv6ext_rthdr->ip6r_type;
    len = 8 * (ipv6ext_rthdr->ip6r_len + 1);
    segleft = ipv6ext_rthdr->ip6r_segleft;

    show_header("IPv6-Route:  ", "IPv6 Routing Header", 0);
    show_space();

    (void) snprintf(get_line(0, 0), get_line_remain(),
        "Next header = %d (%s)", nxt_hdr, getproto(nxt_hdr));
    (void) snprintf(get_line(0, 0), get_line_remain(),
        "Header length = %d", len);
    (void) snprintf(get_line(0, 0), get_line_remain(),
        "Routing type = %d", type);
    (void) snprintf(get_line(0, 0), get_line_remain(),
        "Segments left = %d", segleft);

    if (type == IPV6_RTHDR_TYPE_0) {
        /*
         * XXX This loop will print all addresses in the routing header,
         * XXX not just the segments left.
         * XXX (The header length field is twice the number of
         * XXX addresses)
         * XXX At some future time, we may want to change this
         * XXX to differentiate between the hops yet to do
         * XXX and the hops already taken.
         */
        /* LINTED: alignment */
        ipv6ext_rthdr0 = (struct ip6_rthdr0 *)ipv6ext_rthdr;
        numaddrs = ipv6ext_rthdr0->ip6r0_len / 2;
        addrs = (struct in6_addr *)(ipv6ext_rthdr0 + 1);
        for (i = 0; i < numaddrs; i++) {
            (void) inet_ntop(AF_INET6, &addrs[i], addr,
                INET6_ADDRSTRLEN);
            (void) snprintf(get_line(0, 0), get_line_remain(),
                "address[%d]=%s", i, addr);
        }
    }

    show_space();
}

static void
prt_fragment_hdr(int flags, const struct ip6_frag *ipv6ext_frag)
{
    boolean_t morefrag;
    uint16_t fragoffset;
    uint8_t nxt_hdr;
    uint32_t fragident;

    /* extract the various fields from the fragment header */
    nxt_hdr = ipv6ext_frag->ip6f_nxt;
    morefrag = (ipv6ext_frag->ip6f_offlg & IP6F_MORE_FRAG) == 0
        ? B_FALSE : B_TRUE;
    fragoffset = ntohs(ipv6ext_frag->ip6f_offlg & IP6F_OFF_MASK);
    fragident = ntohl(ipv6ext_frag->ip6f_ident);

    if (flags & F_SUM) {
        (void) snprintf(get_sum_line(), MAXLINE,
            "IPv6 fragment ID=%u Offset=%-4d MF=%d",
            fragident,
            fragoffset,
            morefrag);
    } else { /* F_DTAIL */
        show_header("IPv6-Frag:  ", "IPv6 Fragment Header", 0);
        show_space();

        (void) snprintf(get_line(0, 0), get_line_remain(),
            "Next Header = %d (%s)", nxt_hdr, getproto(nxt_hdr));
        (void) snprintf(get_line(0, 0), get_line_remain(),
            "Fragment Offset = %d", fragoffset);
        (void) snprintf(get_line(0, 0), get_line_remain(),
            "More Fragments Flag = %s", morefrag ? "true" : "false");
        (void) snprintf(get_line(0, 0), get_line_remain(),
            "Identification = %u", fragident);

        show_space();
    }
}

static void
print_ip6opt_ls(const uchar_t *data, unsigned int op_len)
{
    uint32_t doi;
    uint8_t sotype, solen;
    uint16_t value, value2;
    char *cp;
    int remlen;
    boolean_t printed;

    (void) snprintf(get_line(0, 0), get_line_remain(),
        "Labeled Security Option len = %u bytes%s", op_len,
        op_len < sizeof (uint32_t) || (op_len & 1) != 0 ? "?" : "");
    if (op_len < sizeof (uint32_t))
        return;
    GETINT32(doi, data);
    (void) snprintf(get_line(0, 0), get_line_remain(),
        "    DOI = %d (%s)", doi, doi == IP6LS_DOI_V4 ? "IPv4" : "???");
    op_len -= sizeof (uint32_t);
    while (op_len > 0) {
        GETINT8(sotype, data);
        if (op_len < 2) {
            (void) snprintf(get_line(0, 0), get_line_remain(),
                "    truncated %u suboption (no len)", sotype);
            break;
        }
        GETINT8(solen, data);
        if (solen < 2 || solen > op_len) {
            (void) snprintf(get_line(0, 0), get_line_remain(),
                "    bad %u suboption (len 2 <= %u <= %u)",
                sotype, solen, op_len);
            if (solen < 2)
                solen = 2;
            if (solen > op_len)
                solen = op_len;
        }
        op_len -= solen;
        solen -= 2;
        cp = get_line(0, 0);
        remlen = get_line_remain();
        (void) strlcpy(cp, "    ", remlen);
        cp += 4;
        remlen -= 4;
        printed = B_TRUE;
        switch (sotype) {
        case IP6LS_TT_LEVEL:
            if (solen != 2) {
                printed = B_FALSE;
                break;
            }
            GETINT16(value, data);
            (void) snprintf(cp, remlen, "Level %u", value);
            solen = 0;
            break;
        case IP6LS_TT_VECTOR:
            (void) strlcpy(cp, "Bit-Vector: ", remlen);
            remlen -= strlen(cp);
            cp += strlen(cp);
            while (solen > 1) {
                GETINT16(value, data);
                solen -= 2;
                (void) snprintf(cp, remlen, "%04x", value);
                remlen -= strlen(cp);
                cp += strlen(cp);
            }
            break;
        case IP6LS_TT_ENUM:
            (void) strlcpy(cp, "Enumeration:", remlen);
            remlen -= strlen(cp);
            cp += strlen(cp);
            while (solen > 1) {
                GETINT16(value, data);
                solen -= 2;
                (void) snprintf(cp, remlen, " %u", value);
                remlen -= strlen(cp);
                cp += strlen(cp);
            }
            break;
        case IP6LS_TT_RANGES:
            (void) strlcpy(cp, "Ranges:", remlen);
            remlen -= strlen(cp);
            cp += strlen(cp);
            while (solen > 3) {
                GETINT16(value, data);
                GETINT16(value2, data);
                solen -= 4;
                (void) snprintf(cp, remlen, " %u-%u", value,
                    value2);
                remlen -= strlen(cp);
                cp += strlen(cp);
            }
            break;
        case IP6LS_TT_V4:
            (void) strlcpy(cp, "IPv4 Option", remlen);
            print_ipoptions(data, solen);
            solen = 0;
            break;
        case IP6LS_TT_DEST:
            (void) snprintf(cp, remlen,
                "Destination-Only Data length %u", solen);
            solen = 0;
            break;
        default:
            (void) snprintf(cp, remlen,
                "    unknown %u suboption (len %u)", sotype, solen);
            solen = 0;
            break;
        }
        if (solen != 0) {
            if (printed) {
                cp = get_line(0, 0);
                remlen = get_line_remain();
            }
            (void) snprintf(cp, remlen,
                "    malformed %u suboption (remaining %u)",
                sotype, solen);
            data += solen;
        }
    }
}

static void
prt_hbh_options(int flags, const struct ip6_hbh *ipv6ext_hbh)
{
    const uint8_t *data, *ndata;
    uint32_t len;
    uint8_t op_type;
    uint8_t op_len;
    uint8_t nxt_hdr;

    /* in summary mode, we don't do anything. */
    if (flags & F_SUM) {
        return;
    }

    show_header("IPv6-HopOpts:  ", "IPv6 Hop-by-Hop Options Header", 0);
    show_space();

    /*
     * Store the lengh of this ext hdr in bytes.  The caller has
     * ensured that there is at least len bytes of data left.
     */
    len = ipv6ext_hbh->ip6h_len * 8 + 8;

    ndata = (const uint8_t *)ipv6ext_hbh + 2;
    len -= 2;

    nxt_hdr = ipv6ext_hbh->ip6h_nxt;
    (void) snprintf(get_line(0, 0), get_line_remain(),
        "Next Header = %u (%s)", nxt_hdr, getproto(nxt_hdr));

    while (len > 0) {
        data = ndata;
        GETINT8(op_type, data);
        /* This is the only one-octet IPv6 option */
        if (op_type == IP6OPT_PAD1) {
            (void) snprintf(get_line(0, 0), get_line_remain(),
                "pad1 option ");
            len--;
            ndata = data;
            continue;
        }
        GETINT8(op_len, data);
        if (len < 2 || op_len + 2 > len) {
            (void) snprintf(get_line(0, 0), get_line_remain(),
                "Error: option %u truncated (%u + 2 > %u)",
                op_type, op_len, len);
            op_len = len - 2;
            /*
             * Continue processing the malformed option so that we
             * can display as much as possible.
             */
        }

        /* advance pointers to the next option */
        len -= op_len + 2;
        ndata = data + op_len;

        /* process this option */
        switch (op_type) {
        case IP6OPT_PADN:
            (void) snprintf(get_line(0, 0), get_line_remain(),
                "padN option len = %u", op_len);
            break;
        case IP6OPT_JUMBO: {
            uint32_t payload_len;

            (void) snprintf(get_line(0, 0), get_line_remain(),
                "Jumbo Payload Option len = %u bytes%s", op_len,
                op_len == sizeof (uint32_t) ? "" : "?");
            if (op_len == sizeof (uint32_t)) {
                GETINT32(payload_len, data);
                (void) snprintf(get_line(0, 0),
                    get_line_remain(),
                    "Jumbo Payload Length = %u bytes",
                    payload_len);
            }
            break;
        }
        case IP6OPT_ROUTER_ALERT: {
            uint16_t value;
            const char *label[] = {"MLD", "RSVP", "AN"};

            (void) snprintf(get_line(0, 0), get_line_remain(),
                "Router Alert Option len = %u bytes%s", op_len,
                op_len == sizeof (uint16_t) ? "" : "?");
            if (op_len == sizeof (uint16_t)) {
                GETINT16(value, data);
                (void) snprintf(get_line(0, 0),
                    get_line_remain(),
                    "Alert Type = %d (%s)", value,
                    value < sizeof (label) / sizeof (label[0]) ?
                    label[value] : "???");
            }
            break;
        }
        case IP6OPT_LS:
            print_ip6opt_ls(data, op_len);
            break;
        default:
            (void) snprintf(get_line(0, 0), get_line_remain(),
                "Option type = %u, len = %u", op_type, op_len);
            break;
        }
    }

    show_space();
}

static void
prt_dest_options(int flags, const struct ip6_dest *ipv6ext_dest)
{
    const uint8_t *data, *ndata;
    uint32_t len;
    uint8_t op_type;
    uint32_t op_len;
    uint8_t nxt_hdr;
    uint8_t value;

    /* in summary mode, we don't do anything. */
    if (flags & F_SUM) {
        return;
    }

    show_header("IPv6-DstOpts:  ", "IPv6 Destination Options Header", 0);
    show_space();

    /*
     * Store the length of this ext hdr in bytes.  The caller has
     * ensured that there is at least len bytes of data left.
     */
    len = ipv6ext_dest->ip6d_len * 8 + 8;

    ndata = (const uint8_t *)ipv6ext_dest + 2; /* skip hdr/len */
    len -= 2;

    nxt_hdr = ipv6ext_dest->ip6d_nxt;
    (void) snprintf(get_line(0, 0), get_line_remain(),
        "Next Header = %u (%s)", nxt_hdr, getproto(nxt_hdr));

    while (len > 0) {
        data = ndata;
        GETINT8(op_type, data);
        if (op_type == IP6OPT_PAD1) {
            (void) snprintf(get_line(0, 0), get_line_remain(),
                "pad1 option ");
            len--;
            ndata = data;
            continue;
        }
        GETINT8(op_len, data);
        if (len < 2 || op_len + 2 > len) {
            (void) snprintf(get_line(0, 0), get_line_remain(),
                "Error: option %u truncated (%u + 2 > %u)",
                op_type, op_len, len);
            op_len = len - 2;
            /*
             * Continue processing the malformed option so that we
             * can display as much as possible.
             */
        }

        /* advance pointers to the next option */
        len -= op_len + 2;
        ndata = data + op_len;

        /* process this option */
        switch (op_type) {
        case IP6OPT_PADN:
            (void) snprintf(get_line(0, 0), get_line_remain(),
                "padN option len = %u", op_len);
            break;
        case IP6OPT_TUNNEL_LIMIT:
            GETINT8(value, data);
            (void) snprintf(get_line(0, 0), get_line_remain(),
                "tunnel encapsulation limit len = %d, value = %d",
                op_len, value);
            break;
        case IP6OPT_LS:
            print_ip6opt_ls(data, op_len);
            break;
        default:
            (void) snprintf(get_line(0, 0), get_line_remain(),
                "Option type = %u, len = %u", op_type, op_len);
            break;
        }
    }

    show_space();
}

#define ALABEL_MAXLEN   256

static char ascii_label[ALABEL_MAXLEN];
static char *plabel = ascii_label;

struct snoop_pair {
    int val;
    const char *name;
};

static struct snoop_pair ripso_class_tbl[] = {
    TSOL_CL_TOP_SECRET, "TOP SECRET",
    TSOL_CL_SECRET,     "SECRET",
    TSOL_CL_CONFIDENTIAL,   "CONFIDENTIAL",
    TSOL_CL_UNCLASSIFIED,   "UNCLASSIFIED",
    -1,         NULL
};

static struct snoop_pair ripso_prot_tbl[] = {
    TSOL_PA_GENSER,     "GENSER",
    TSOL_PA_SIOP_ESI,   "SIOP-ESI",
    TSOL_PA_SCI,        "SCI",
    TSOL_PA_NSA,        "NSA",
    TSOL_PA_DOE,        "DOE",
    0x04,           "UNASSIGNED",
    0x02,           "UNASSIGNED",
    -1,         NULL
};

static struct snoop_pair *
get_pair_byval(struct snoop_pair pairlist[], int val)
{
    int i;

    for (i = 0; pairlist[i].name != NULL; i++)
        if (pairlist[i].val == val)
            return (&pairlist[i]);
    return (NULL);
}

static void
print_ripso(const uchar_t *opt)
{
    struct snoop_pair *ripso_class;
    int i, index, prot_len;
    boolean_t first_prot;
    char line[100], *ptr;

    prot_len = opt[1] - 3;
    if (prot_len < 0)
        return;

    show_header("RIPSO:  ", "Revised IP Security Option", 0);
    show_space();

    (void) snprintf(get_line(0, 0), get_line_remain(),
        "Type = Basic Security Option (%d), Length = %d", opt[0], opt[1]);

    /*
     * Display Classification Level
     */
    ripso_class = get_pair_byval(ripso_class_tbl, (int)opt[2]);
    if (ripso_class == NULL)
        (void) snprintf(get_line(0, 0), get_line_remain(),
            "Classification = Unknown (0x%02x)", opt[2]);
    else
        (void) snprintf(get_line(0, 0), get_line_remain(),
            "Classification = %s (0x%02x)",
            ripso_class->name, ripso_class->val);

    /*
     * Display Protection Authority Flags
     */
    (void) snprintf(line, sizeof (line), "Protection Authority = ");
    ptr = line;
    first_prot = B_TRUE;
    for (i = 0; i < prot_len; i++) {
        index = 0;
        while (ripso_prot_tbl[index].name != NULL) {
            if (opt[3 + i] & ripso_prot_tbl[index].val) {
                ptr = strchr(ptr, 0);
                if (!first_prot) {
                    (void) strlcpy(ptr, ", ",
                        sizeof (line) - (ptr - line));
                    ptr = strchr(ptr, 0);
                }
                (void) snprintf(ptr,
                    sizeof (line) - (ptr - line),
                    "%s (0x%02x)",
                    ripso_prot_tbl[index].name,
                    ripso_prot_tbl[index].val);
            }
            index++;
        }
        if ((opt[3 + i] & 1) == 0)
            break;
    }
    if (!first_prot)
        (void) snprintf(get_line(0, 0), get_line_remain(), "%s", line);
    else
        (void) snprintf(get_line(0, 0), get_line_remain(), "%sNone",
            line);
}

#define CIPSO_GENERIC_ARRAY_LEN 200

/*
 * Return 1 if CIPSO SL and Categories are all 1's; 0 otherwise.
 *
 * Note: opt starts with "Tag Type":
 *
 * |tag_type(1)|tag_length(1)|align(1)|sl(1)|categories(variable)|
 *
 */
static boolean_t
cipso_high(const uchar_t *opt)
{
    int i;

    if (((int)opt[1] + 6) < IP_MAX_OPT_LENGTH)
        return (B_FALSE);
    for (i = 0; i < ((int)opt[1] - 3); i++)
        if (opt[3 + i] != 0xff)
            return (B_FALSE);
    return (B_TRUE);
}

/*
 * Converts CIPSO label to SL.
 *
 * Note: opt starts with "Tag Type":
 *
 * |tag_type(1)|tag_length(1)|align(1)|sl(1)|categories(variable)|
 *
 */
static void
cipso2sl(const uchar_t *opt, bslabel_t *sl, int *high)
{
    int i, taglen;
    uchar_t *q = (uchar_t *)&((_bslabel_impl_t *)sl)->compartments;

    *high = 0;
    taglen = opt[1];
    memset((caddr_t)sl, 0, sizeof (bslabel_t));

    if (cipso_high(opt)) {
        BSLHIGH(sl);
        *high = 1;
    } else {
        LCLASS_SET((_bslabel_impl_t *)sl, opt[3]);
        for (i = 0; i < taglen - TSOL_TT1_MIN_LENGTH; i++)
            q[i] = opt[TSOL_TT1_MIN_LENGTH + i];
    }
    SETBLTYPE(sl, SUN_SL_ID);
}

static int
interpret_cipso_tagtype1(const uchar_t *opt)
{
    int i, taglen, ishigh;
    bslabel_t sl;
    char line[CIPSO_GENERIC_ARRAY_LEN], *ptr;

    taglen = opt[1];
    if (taglen < TSOL_TT1_MIN_LENGTH ||
        taglen > TSOL_TT1_MAX_LENGTH)
        return (taglen);

    (void) snprintf(get_line(0, 0), get_line_remain(),
        "Tag Type = %d, Tag Length = %d", opt[0], opt[1]);
    (void) snprintf(get_line(0, 0), get_line_remain(),
        "Sensitivity Level = 0x%02x", opt[3]);
    ptr = line;
    for (i = 0; i < taglen - TSOL_TT1_MIN_LENGTH; i++) {
        (void) snprintf(ptr, sizeof (line) - (ptr - line), "%02x",
            opt[TSOL_TT1_MIN_LENGTH + i]);
        ptr = strchr(ptr, 0);
    }
    if (i != 0) {
        (void) snprintf(get_line(0, 0), get_line_remain(),
            "Categories = ");
        (void) snprintf(get_line(0, 0), get_line_remain(), "\t%s",
            line);
    } else {
        (void) snprintf(get_line(0, 0), get_line_remain(),
            "Categories = None");
    }
    cipso2sl(opt, &sl, &ishigh);
    if (is_system_labeled()) {
        if (bsltos(&sl, &plabel, ALABEL_MAXLEN,
            LONG_CLASSIFICATION|LONG_WORDS|VIEW_INTERNAL) < 0) {
            (void) snprintf(get_line(0, 0), get_line_remain(),
                "The Sensitivity Level and Categories can't be "
                "mapped to a valid SL");
        } else {
            (void) snprintf(get_line(0, 0), get_line_remain(),
                "The Sensitivity Level and Categories are mapped "
                "to the SL:");
            (void) snprintf(get_line(0, 0), get_line_remain(),
                "\t%s", ascii_label);
        }
    }
    return (taglen);
}

/*
 * The following struct definition #define's are copied from TS1.x. They are
 * not used here (except TTYPE_3_MAX_TOKENS), but included as a reference for
 * the tag type 3 packet format.
 */
#define TTYPE_3_MAX_TOKENS  7

/*
 * Display CIPSO tag type 3 which is defined by MAXSIX.
 */
static int
interpret_cipso_tagtype3(const uchar_t *opt)
{
    uchar_t tagtype;
    int index, numtokens, taglen;
    uint16_t mask;
    uint32_t token;
    static const char *name[] = {
        "SL",
        "NCAV",
        "INTEG",
        "SID",
        "undefined",
        "undefined",
        "IL",
        "PRIVS",
        "LUID",
        "PID",
        "IDS",
        "ACL"
    };

    tagtype = *opt++;
    (void) memcpy(&mask, opt + 3, sizeof (mask));
    (void) snprintf(get_line(0, 0), get_line_remain(),
        "Tag Type = %d (MAXSIX)", tagtype);
    (void) snprintf(get_line(0, 0), get_line_remain(),
        "Generation = 0x%02x%02x%02x, Mask = 0x%04x", opt[0], opt[1],
        opt[2], mask);
    opt += 3 + sizeof (mask);

    /*
     * Display tokens
     */
    numtokens = 0;
    index = 0;
    while (mask != 0 && numtokens < TTYPE_3_MAX_TOKENS) {
        if (mask & 0x0001) {
            (void) memcpy(&token, opt, sizeof (token));
            opt += sizeof (token);
            (void) snprintf(get_line(0, 0), get_line_remain(),
                "Attribute = %s, Token = 0x%08x",
                index < sizeof (name) / sizeof (*name) ?
                name[index] : "unknown", token);
            numtokens++;
        }
        mask = mask >> 1;
        index++;
    }

    taglen = 6 + numtokens * 4;
    return (taglen);
}

static void
print_cipso(const uchar_t *opt)
{
    int optlen, taglen, tagnum;
    uint32_t doi;
    char line[CIPSO_GENERIC_ARRAY_LEN];
    char *oldnest;

    optlen = opt[1];
    if (optlen < TSOL_CIPSO_MIN_LENGTH || optlen > TSOL_CIPSO_MAX_LENGTH)
        return;

    oldnest = prot_nest_prefix;
    prot_nest_prefix = prot_prefix;
    show_header("CIPSO:  ", "Common IP Security Option", 0);
    show_space();

    /*
     * Display CIPSO Header
     */
    (void) snprintf(get_line(0, 0), get_line_remain(),
        "Type = CIPSO (%d), Length = %d", opt[0], opt[1]);
    (void) memcpy(&doi, opt + 2, sizeof (doi));
    (void) snprintf(get_line(0, 0), get_line_remain(),
        "Domain of Interpretation = %u", (unsigned)ntohl(doi));

    if (opt[1] == TSOL_CIPSO_MIN_LENGTH) {  /* no tags */
        show_space();
        prot_prefix = prot_nest_prefix;
        prot_nest_prefix = oldnest;
        return;
    }
    optlen -= TSOL_CIPSO_MIN_LENGTH;
    opt += TSOL_CIPSO_MIN_LENGTH;

    /*
     * Display Each Tag
     */
    tagnum = 1;
    while (optlen >= TSOL_TT1_MIN_LENGTH) {
        (void) snprintf(line, sizeof (line), "Tag# %d", tagnum);
        show_header("CIPSO:  ", line, 0);
        /*
         * We handle tag type 1 and 3 only. Note, tag type 3
         * is MAXSIX defined.
         */
        switch (opt[0]) {
        case 1:
            taglen = interpret_cipso_tagtype1(opt);
            break;
        case 3:
            taglen = interpret_cipso_tagtype3(opt);
            break;
        default:
            (void) snprintf(get_line(0, 0), get_line_remain(),
                "Unknown Tag Type %d", opt[0]);
            show_space();
            prot_prefix = prot_nest_prefix;
            prot_nest_prefix = oldnest;
            return;
        }

        /*
         * Move to the next tag
         */
        if (taglen <= 0)
            break;
        optlen -= taglen;
        opt += taglen;
        tagnum++;
    }
    show_space();
    prot_prefix = prot_nest_prefix;
    prot_nest_prefix = oldnest;
}