1 /* $OpenBSD: ike.h,v 1.26 2016/03/07 19:33:26 mmcc Exp $ */ 2 3 /* 4 * Copyright (c) 2001 H�kan Olsson. All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 3. The name of the author may not be used to endorse or promote products 15 * derived from this software without specific prior written permission. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 18 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 19 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 20 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 21 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 22 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 23 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 24 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 25 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 26 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 27 */ 28 29 #define ISAKMP_DOI 0 30 #define IPSEC_DOI 1 31 32 #define PROTO_ISAKMP 1 33 #define PROTO_IPSEC_AH 2 34 #define PROTO_IPSEC_ESP 3 35 #define PROTO_IPCOMP 4 36 37 #define IKE_VERSION_2 (2 << 4) 38 39 #define IKE_ATTR_ENCRYPTION_ALGORITHM 1 40 #define IKE_ATTR_HASH_ALGORITHM 2 41 #define IKE_ATTR_AUTHENTICATION_METHOD 3 42 #define IKE_ATTR_GROUP_DESC 4 43 #define IKE_ATTR_GROUP_TYPE 5 44 #define IKE_ATTR_LIFE_TYPE 11 45 46 #define IKE_PROTO_INITIALIZER \ 47 { "RESERVED", "ISAKMP", "IPSEC_AH", "IPSEC_ESP", "IPCOMP", \ 48 } 49 50 #define IKE_ATTR_ENCRYPT_INITIALIZER \ 51 { "NONE", "DES_CBC", "IDEA_CBC", "BLOWFISH_CBC", \ 52 "RC5_R16_B64_CBC", "3DES_CBC", "CAST_CBC", "AES_CBC", \ 53 "AES_128_CTR" \ 54 } 55 #define IKE_ATTR_HASH_INITIALIZER \ 56 { "NONE", "MD5", "SHA", "TIGER", \ 57 "SHA2_256", "SHA2_384", "SHA2_512", \ 58 } 59 #define IKE_ATTR_AUTH_INITIALIZER \ 60 { "NONE", "PRE_SHARED", "DSS", "RSA_SIG", \ 61 "RSA_ENC", "RSA_ENC_REV", \ 62 } 63 #define IKE_ATTR_GROUP_DESC_INITIALIZER \ 64 { "NONE", "MODP_768", "MODP_1024", \ 65 "E2CN_155", "E2CN_185", "MODP_1536", "NONE", "NONE", "NONE", \ 66 "NONE", "NONE", "NONE", "NONE", "NONE", "MODP_2048", \ 67 "MODP_3072", "MODP_4096", "MODP_6144", "MODP_8192", "ECP256", \ 68 "ECP384", "ECP512", "MODP_1024-160", "MODP_2048-224", \ 69 "MODP_2048-256", "ECP192", "ECP224," \ 70 } 71 #define IKE_ATTR_GROUP_INITIALIZER \ 72 { "NONE", "MODP", "ECP", "E2CN", \ 73 } 74 #define IKE_ATTR_SA_DURATION_INITIALIZER \ 75 { "NONE", "SECONDS", "KILOBYTES", \ 76 } 77 78 #define IKE_ATTR_INITIALIZER \ 79 { "NONE", /* 0 (not in RFC) */ \ 80 "ENCRYPTION_ALGORITHM", /* 1 */ \ 81 "HASH_ALGORITHM", /* 2 */ \ 82 "AUTHENTICATION_METHOD", /* 3 */ \ 83 "GROUP_DESCRIPTION", /* 4 */ \ 84 "GROUP_TYPE", /* 5 */ \ 85 "GROUP_PRIME", /* 6 */ \ 86 "GROUP_GENERATOR_1", /* 7 */ \ 87 "GROUP_GENERATOR_2", /* 8 */ \ 88 "GROUP_CURVE_1", /* 9 */ \ 89 "GROUP_CURVE_2", /* 10 */ \ 90 "LIFE_TYPE", /* 11 */ \ 91 "LIFE_DURATION", /* 12 */ \ 92 "PRF", /* 13 */ \ 93 "KEY_LENGTH", /* 14 */ \ 94 "FIELD_SIZE", /* 15 */ \ 95 "GROUP_ORDER", /* 16 */ \ 96 } 97 98 #define IKE_SITUATION_IDENTITY_ONLY 1 99 #define IKE_SITUATION_SECRECY 2 100 #define IKE_SITUATION_INTEGRITY 4 101 /* Mask is all the above, i.e 1+2+4 = 7 */ 102 #define IKE_SITUATION_MASK 7 103 104 #define PAYLOAD_NONE 0 105 #define PAYLOAD_SA 1 106 #define PAYLOAD_PROPOSAL 2 107 #define PAYLOAD_TRANSFORM 3 108 #define PAYLOAD_KE 4 109 #define PAYLOAD_ID 5 110 #define PAYLOAD_CERT 6 111 #define PAYLOAD_CERTREQUEST 7 112 #define PAYLOAD_HASH 8 113 #define PAYLOAD_SIG 9 114 #define PAYLOAD_NONCE 10 115 #define PAYLOAD_NOTIFICATION 11 116 #define PAYLOAD_DELETE 12 117 #define PAYLOAD_VENDOR 13 118 #define PAYLOAD_ATTRIBUTE 14 119 #define PAYLOAD_SAK 15 120 #define PAYLOAD_SAT 16 121 #define PAYLOAD_KD 17 122 #define PAYLOAD_SEQ 18 123 #define PAYLOAD_POP 19 124 #define PAYLOAD_NAT_D 20 125 #define PAYLOAD_NAT_OA 21 126 #define PAYLOAD_RESERVED_MIN 22 127 #define PAYLOAD_PRIVATE_MIN 128 128 #define PAYLOAD_NAT_D_DRAFT 130 129 #define PAYLOAD_NAT_OA_DRAFT 131 130 #define PAYLOAD_PRIVATE_MAX 132 131 132 #define PAYLOAD_IKEV2_NONE 0 133 #define PAYLOAD_IKEV2_SA 33 134 #define PAYLOAD_IKEV2_KE 34 135 #define PAYLOAD_IKEV2_IDI 35 136 #define PAYLOAD_IKEV2_IDR 36 137 #define PAYLOAD_IKEV2_CERT 37 138 #define PAYLOAD_IKEV2_CERTREQ 38 139 #define PAYLOAD_IKEV2_AUTH 39 140 #define PAYLOAD_IKEV2_NONCE 40 141 #define PAYLOAD_IKEV2_N 41 142 #define PAYLOAD_IKEV2_D 42 143 #define PAYLOAD_IKEV2_V 43 144 #define PAYLOAD_IKEV2_TSI 44 145 #define PAYLOAD_IKEV2_TSR 45 146 #define PAYLOAD_IKEV2_E 46 147 #define PAYLOAD_IKEV2_CP 47 148 #define PAYLOAD_IKEV2_EAP 48 149 #define PAYLOAD_IKEV2_PRIV_MIN 128 150 #define PAYLOAD_IKEv2_PRIV_MAX 255 151 152 /* see https://www.iana.org/assignments/isakmp-registry */ 153 #define IKE_PAYLOAD_TYPES_INITIALIZER \ 154 { "NONE", /* 0 */ \ 155 "SA", /* 1 */ \ 156 "PROPOSAL", /* 2 */ \ 157 "TRANSFORM", /* 3 */ \ 158 "KEY_EXCH", /* 4 */ \ 159 "ID", /* 5 */ \ 160 "CERT", /* 6 */ \ 161 "CERTREQUEST", /* 7 */ \ 162 "HASH", /* 8 */ \ 163 "SIG", /* 9 */ \ 164 "NONCE", /* 10 */ \ 165 "NOTIFICATION", /* 11 */ \ 166 "DELETE", /* 12 */ \ 167 "VENDOR", /* 13 */ \ 168 "ATTRIBUTE", /* 14 (ikecfg) */ \ 169 "SAK", /* 15 */ \ 170 "SAT", /* 16 */ \ 171 "KD", /* 17 */ \ 172 "SEQ", /* 18 */ \ 173 "POP", /* 19 */ \ 174 "NAT-D", /* 20 */ \ 175 "NAT-OA", /* 21 */ \ 176 } 177 178 #define IKE_PRIVATE_PAYLOAD_TYPES_INITIALIZER \ 179 { "NONE", /* 128 */ \ 180 "<unknown 129>", /* 129 */ \ 181 "NAT-D-DRAFT", /* 130 (draft-ietf-ipsec-nat-t-ike-03) */ \ 182 "NAT-OA-DRAFT", /* 131 (draft-ietf-ipsec-nat-t-ike-03) */ \ 183 } 184 185 /* see https://www.iana.org/assignments/ikev2-parameters */ 186 #define IKEV2_PAYLOAD_TYPES_INITIALIZER \ 187 { "SA", /* 33 */ \ 188 "KE", /* 34 */ \ 189 "IDi", /* 35 */ \ 190 "IDr", /* 36 */ \ 191 "CERT", /* 37 */ \ 192 "CERTREQ", /* 38 */ \ 193 "AUTH", /* 39 */ \ 194 "NONCE", /* 40 */ \ 195 "N", /* 41 */ \ 196 "D", /* 42 */ \ 197 "V", /* 43 */ \ 198 "TSi", /* 44 */ \ 199 "TSr", /* 45 */ \ 200 "E", /* 46 */ \ 201 "CP", /* 47 */ \ 202 "EAP", /* 48 */ \ 203 } 204 205 206 /* Exchange types */ 207 #define EXCHANGE_NONE 0 208 #define EXCHANGE_BASE 1 209 #define EXCHANGE_ID_PROT 2 210 #define EXCHANGE_AUTH_ONLY 3 211 #define EXCHANGE_AGGRESSIVE 4 212 #define EXCHANGE_INFO 5 213 #define EXCHANGE_TRANSACTION 6 214 #define EXCHANGE_QUICK_MODE 32 215 #define EXCHANGE_NEW_GROUP_MODE 33 216 #define EXCHANGE_IKE_SA_INIT 34 217 #define EXCHANGE_IKE_AUTH 35 218 #define EXCHANGE_CREATE_CHILD_SA 36 219 #define EXCHANGE_INFORMATIONAL 37 220 #define EXCHANGE_IKE_SESSION_RESUME 38 221 222 /* Exchange types */ 223 #define IKE_EXCHANGE_TYPES_INITIALIZER \ 224 { "NONE", /* 0 */ \ 225 "BASE", /* 1 */ \ 226 "ID_PROT", /* 2 */ \ 227 "AUTH_ONLY", /* 3 */ \ 228 "AGGRESSIVE", /* 4 */ \ 229 "INFO", /* 5 */ \ 230 "TRANSACTION", /* 6 (ikecfg) */ \ 231 /* step up to type 32 with unknowns */ \ 232 "unknown", "unknown", "unknown", "unknown", \ 233 "unknown", "unknown", "unknown", "unknown", \ 234 "unknown", "unknown", "unknown", "unknown", \ 235 "unknown", "unknown", "unknown", "unknown", \ 236 "unknown", "unknown", "unknown", "unknown", \ 237 "unknown", "unknown", "unknown", "unknown", \ 238 "unknown", \ 239 "QUICK_MODE", /* 32 */ \ 240 "NEW_GROUP_MODE", /* 33 */ \ 241 "IKE_SA_INIT", /* 34 */ \ 242 "IKE_AUTH", /* 35 */ \ 243 "CREATE_CHILD_SA", /* 36 */ \ 244 "INFORMATIONAL", /* 37 */ \ 245 "IKE_SESSION_RESUME", /* 38 */ \ 246 } 247 248 #define FLAGS_ENCRYPTION 1 249 #define FLAGS_COMMIT 2 250 #define FLAGS_AUTH_ONLY 4 251 252 #define CERT_NONE 0 253 #define CERT_PKCS 1 254 #define CERT_PGP 2 255 #define CERT_DNS 3 256 #define CERT_X509_SIG 4 257 #define CERT_X509_KE 5 258 #define CERT_KERBEROS 6 259 #define CERT_CRL 7 260 #define CERT_ARL 8 261 #define CERT_SPKI 9 262 #define CERT_X509_ATTR 10 263 264 #define NOTIFY_INVALID_PAYLOAD_TYPE 1 265 #define NOTIFY_DOI_NOT_SUPPORTED 2 266 #define NOTIFY_SITUATION_NOT_SUPPORTED 3 267 #define NOTIFY_INVALID_COOKIE 4 268 #define NOTIFY_INVALID_MAJOR_VERSION 5 269 #define NOTIFY_INVALID_MINOR_VERSION 6 270 #define NOTIFY_INVALID_EXCHANGE_TYPE 7 271 #define NOTIFY_INVALID_FLAGS 8 272 #define NOTIFY_INVALID_MESSAGE_ID 9 273 #define NOTIFY_INVALID_PROTOCOL_ID 10 274 #define NOTIFY_INVALID_SPI 11 275 #define NOTIFY_INVALID_TRANSFORM_ID 12 276 #define NOTIFY_ATTRIBUTES_NOT_SUPPORTED 13 277 #define NOTIFY_NO_PROPOSAL_CHOSEN 14 278 #define NOTIFY_BAD_PROPOSAL_SYNTAX 15 279 #define NOTIFY_PAYLOAD_MALFORMED 16 280 #define NOTIFY_INVALID_KEY_INFORMATION 17 281 #define NOTIFY_INVALID_ID_INFORMATION 18 282 #define NOTIFY_INVALID_CERT_ENCODING 19 283 #define NOTIFY_INVALID_CERTIFICATE 20 284 #define NOTIFY_CERT_TYPE_UNSUPPORTED 21 285 #define NOTIFY_INVALID_CERT_AUTHORITY 22 286 #define NOTIFY_INVALID_HASH_INFORMATION 23 287 #define NOTIFY_AUTHENTICATION_FAILED 24 288 #define NOTIFY_INVALID_SIGNATURE 25 289 #define NOTIFY_ADDRESS_NOTIFICATION 26 290 #define NOTIFY_NOTIFY_SA_LIFETIME 27 291 #define NOTIFY_CERTIFICATE_UNAVAILABLE 28 292 #define NOTIFY_UNSUPPORTED_EXCHANGE_TYPE 29 293 #define NOTIFY_UNEQUAL_PAYLOAD_LENGTHS 30 294 295 #define IKE_NOTIFY_TYPES_INITIALIZER \ 296 { "", \ 297 "INVALID PAYLOAD TYPE", \ 298 "DOI NOT SUPPORTED", \ 299 "SITUATION NOT SUPPORTED", \ 300 "INVALID COOKIE", \ 301 "INVALID MAJOR VERSION", \ 302 "INVALID MINOR VERSION", \ 303 "INVALID EXCHANGE TYPE", \ 304 "INVALID FLAGS", \ 305 "INVALID MESSAGE ID", \ 306 "INVALID PROTOCOL ID", \ 307 "INVALID SPI", \ 308 "INVALID TRANSFORM ID", \ 309 "ATTRIBUTES NOT SUPPORTED", \ 310 "NO PROPOSAL CHOSEN", \ 311 "BAD PROPOSAL SYNTAX", \ 312 "PAYLOAD MALFORMED", \ 313 "INVALID KEY INFORMATION", \ 314 "INVALID ID INFORMATION", \ 315 "INVALID CERT ENCODING", \ 316 "INVALID CERTIFICATE", \ 317 "CERT TYPE UNSUPPORTED", \ 318 "INVALID CERT AUTHORITY", \ 319 "INVALID HASH INFORMATION", \ 320 "AUTHENTICATION FAILED", \ 321 "INVALID SIGNATURE", \ 322 "ADDRESS NOTIFICATION", \ 323 "NOTIFY SA LIFETIME", \ 324 "CERTIFICATE UNAVAILABLE", \ 325 "UNSUPPORTED EXCHANGE TYPE", \ 326 "UNEQUAL PAYLOAD LENGTHS", \ 327 } 328 329 /* RFC 2407, 4.6.3 */ 330 #define NOTIFY_IPSEC_RESPONDER_LIFETIME 24576 331 #define NOTIFY_IPSEC_REPLAY_STATUS 24577 332 #define NOTIFY_IPSEC_INITIAL_CONTACT 24578 333 334 /* RFC 3706, Dead Peer Detection */ 335 #define NOTIFY_STATUS_DPD_R_U_THERE 36136 336 #define NOTIFY_STATUS_DPD_R_U_THERE_ACK 36137 337 338 #define IPSEC_ID_RESERVED 0 339 #define IPSEC_ID_IPV4_ADDR 1 340 #define IPSEC_ID_FQDN 2 341 #define IPSEC_ID_USER_FQDN 3 342 #define IPSEC_ID_IPV4_ADDR_SUBNET 4 343 #define IPSEC_ID_IPV6_ADDR 5 344 #define IPSEC_ID_IPV6_ADDR_SUBNET 6 345 #define IPSEC_ID_IPV4_ADDR_RANGE 7 346 #define IPSEC_ID_IPV6_ADDR_RANGE 8 347 #define IPSEC_ID_DER_ASN1_DN 9 348 #define IPSEC_ID_DER_ASN1_GN 10 349 #define IPSEC_ID_KEY_ID 11 350 351 #define IPSEC_ID_TYPE_INITIALIZER \ 352 { "RESERVED", \ 353 "IPV4_ADDR", \ 354 "FQDN", \ 355 "USER_FQDN", \ 356 "IPV4_ADDR_SUBNET", \ 357 "IPV6_ADDR", \ 358 "IPV6_ADDR_SUBNET", \ 359 "IPV4_ADDR_RANGE", \ 360 "IPV6_ADDR_RANGE", \ 361 "DER_ASN1_DN", \ 362 "DER_ASN1_GN", \ 363 "KEY_ID", \ 364 } 365 366 #define IPSEC_ATTR_SA_LIFE_TYPE 1 367 #define IPSEC_ATTR_SA_LIFE_DURATION 2 368 #define IPSEC_ATTR_GROUP_DESCRIPTION 3 369 #define IPSEC_ATTR_ENCAPSULATION_MODE 4 370 #define IPSEC_ATTR_AUTHENTICATION_ALGORITHM 5 371 #define IPSEC_ATTR_KEY_LENGTH 6 372 #define IPSEC_ATTR_KEY_ROUNDS 7 373 #define IPSEC_ATTR_COMPRESS_DICTIONARY_SIZE 8 374 #define IPSEC_ATTR_COMPRESS_PRIVATE_ALGORITHM 9 375 376 #define IPSEC_ATTR_INITIALIZER \ 377 { "NONE", "LIFE_TYPE", "LIFE_DURATION", \ 378 "GROUP_DESCRIPTION", "ENCAPSULATION_MODE", \ 379 "AUTHENTICATION_ALGORITHM", "KEY_LENGTH", \ 380 "KEY_ROUNDS", "COMPRESS_DICTIONARY_SIZE", \ 381 "COMPRESS_PRIVATE_ALGORITHM", \ 382 } 383 384 #define IPSEC_ATTR_DURATION_INITIALIZER \ 385 { "NONE", "SECONDS", "KILOBYTES", \ 386 } 387 #define IPSEC_ATTR_AUTH_INITIALIZER \ 388 { "NONE", "HMAC_MD5", "HMAC_SHA", "DES_MAC", "KPDK", \ 389 "HMAC_SHA2_256", "HMAC_SHA2_384", "HMAC_SHA2_512", \ 390 "HMAC_RIPEMD", \ 391 } 392 #define IPSEC_AH_INITIALIZER \ 393 { "NONE", "MD5", "SHA", "DES", "SHA2_256", "SHA2_384", \ 394 "SHA2_512", "RIPEMD", \ 395 } 396 #define IPSEC_ESP_INITIALIZER \ 397 { "NONE", "DEV_IV64", "DES", "3DES", "RC5", "IDEA", \ 398 "CAST", "BLOWFISH", "3IDEA", "DES_IV32", "RC4", \ 399 "NULL", "AES", "AESCTR" \ 400 } 401 #define IPCOMP_INITIALIZER \ 402 { "NONE", "OUI", "DEFLATE", "LZS", "V42BIS", \ 403 } 404 static struct tok ipsec_attr_encap[] = { 405 { 0, "NONE" }, 406 { 1, "TUNNEL" }, 407 { 2, "TRANSPORT" }, 408 { 3, "UDP_ENCAP_TUNNEL" }, 409 { 4, "UDP_ENCAP_TRANSPORT" }, 410 { 61443, "UDP_ENCAP_TUNNEL_DRAFT" }, /* draft-ietf-ipsec-nat-t-ike */ 411 { 61444, "UDP_ENCAP_TRANSPORT_DRAFT" } /* draft-ietf-ipsec-nat-t-ike */ 412 }; 413 414 /* 415 * IKE mode config. 416 */ 417 418 #define IKE_CFG_ATTRIBUTE_TYPE_INITIALIZER \ 419 { "RESERVED", "CFG_REQUEST", "CFG_REPLY", \ 420 "CFG_SET", "CFG_ACK", \ 421 } 422 423 #define IKE_CFG_ATTR_INTERNAL_IP4_ADDRESS 1 424 #define IKE_CFG_ATTR_INTERNAL_IP4_NETMASK 2 425 #define IKE_CFG_ATTR_INTERNAL_IP4_DNS 3 426 #define IKE_CFG_ATTR_INTERNAL_IP4_NBNS 4 427 #define IKE_CFG_ATTR_INTERNAL_ADDRESS_EXPIRY 5 428 #define IKE_CFG_ATTR_INTERNAL_IP4_DHCP 6 429 #define IKE_CFG_ATTR_APPLICATION_VERSION 7 430 #define IKE_CFG_ATTR_INTERNAL_IP6_ADDRESS 8 431 #define IKE_CFG_ATTR_INTERNAL_IP6_NETMASK 9 432 #define IKE_CFG_ATTR_INTERNAL_IP6_DNS 10 433 #define IKE_CFG_ATTR_INTERNAL_IP6_NBNS 11 434 #define IKE_CFG_ATTR_INTERNAL_IP6_DHCP 12 435 #define IKE_CFG_ATTR_INTERNAL_IP4_SUBNET 13 436 #define IKE_CFG_ATTR_SUPPORTED_ATTRIBUTES 14 437 #define IKE_CFG_ATTR_INTERNAL_IP6_SUBNET 15 438 439 #define IKE_CFG_ATTRIBUTE_INITIALIZER \ 440 { "RESERVED", "INTERNAL_IP4_ADDRESS", \ 441 "INTERNAL_IP4_NETMASK", "INTERNAL_IP4_DNS", \ 442 "INTERNAL_IP4_NBNS", "INTERNAL_ADDRESS_EXPIRY", \ 443 "INTERNAL_IP4_DHCP", "APPLICATION_VERSION", \ 444 "INTERNAL_IP6_ADDRESS", "INTERNAL_IP6_NETMASK", \ 445 "INTERNAL_IP6_DNS", "INTERNAL_IP6_NBNS", \ 446 "INTERNAL_IP6_DHCP", "INTERNAL_IP4_SUBNET", \ 447 "SUPPORTED_ATTRIBUTES", "INTERNAL_IP6_SUBNET", \ 448 } 449 450 #define ISAKMP_SA_SZ 8 451 #define ISAKMP_PROP_SZ 8 452 #define ISAKMP_TRANSFORM_SZ 8 453 #define ISAKMP_KE_SZ 4 454 #define ISAKMP_ID_SZ 8 455 #define ISAKMP_CERT_SZ 5 456 #define ISAKMP_CERTREQ_SZ 5 457 #define ISAKMP_HASH_SZ 4 458 #define ISAKMP_SIG_SZ 4 459 #define ISAKMP_NONCE_SZ 4 460 #define ISAKMP_NOTIFY_SZ 12 461 #define ISAKMP_DELETE_SZ 12 462 #define ISAKMP_VENDOR_SZ 4 463 #define ISAKMP_ATTRIBUTE_SZ 8 464 #define ISAKMP_NAT_D_SZ 4 465 #define ISAKMP_NAT_OA_SZ 8 466 467 static u_int16_t min_payload_lengths[] = { 468 0, ISAKMP_SA_SZ, ISAKMP_PROP_SZ, ISAKMP_TRANSFORM_SZ, ISAKMP_KE_SZ, 469 ISAKMP_ID_SZ, ISAKMP_CERT_SZ, ISAKMP_CERTREQ_SZ, ISAKMP_HASH_SZ, 470 ISAKMP_SIG_SZ, ISAKMP_NONCE_SZ, ISAKMP_NOTIFY_SZ, ISAKMP_DELETE_SZ, 471 ISAKMP_VENDOR_SZ, ISAKMP_ATTRIBUTE_SZ 472 }; 473 474 static u_int16_t min_priv_payload_lengths[] = { 475 0, 0, ISAKMP_NAT_D_SZ, ISAKMP_NAT_OA_SZ 476 }; 477 478 static const struct vendor_id 479 { 480 size_t len; 481 char vid[16]; 482 char *name; 483 } vendor_ids[] = { 484 { 485 16, 486 { 487 0x44, 0x85, 0x15, 0x2d, 0x18, 0xb6, 0xbb, 0xcd, 488 0x0b, 0xe8, 0xa8, 0x46, 0x95, 0x79, 0xdd, 0xcc, 489 }, 490 "v1 NAT-T, draft-ietf-ipsec-nat-t-ike-00", 491 }, 492 { 493 16, 494 { 495 0x90, 0xcb, 0x80, 0x91, 0x3e, 0xbb, 0x69, 0x6e, 496 0x08, 0x63, 0x81, 0xb5, 0xec, 0x42, 0x7b, 0x1f, 497 }, 498 "v2 NAT-T, draft-ietf-ipsec-nat-t-ike-02", 499 }, 500 { 501 16, 502 { 503 0xcd, 0x60, 0x46, 0x43, 0x35, 0xdf, 0x21, 0xf8, 504 0x7c, 0xfd, 0xb2, 0xfc, 0x68, 0xb6, 0xa4, 0x48, 505 }, 506 "v2 NAT-T, draft-ietf-ipsec-nat-t-ike-02\\n", 507 }, 508 { 509 16, 510 { 511 0x7d, 0x94, 0x19, 0xa6, 0x53, 0x10, 0xca, 0x6f, 512 0x2c, 0x17, 0x9d, 0x92, 0x15, 0x52, 0x9d, 0x56, 513 }, 514 "v3 NAT-T, draft-ietf-ipsec-nat-t-ike-03", 515 }, 516 { 517 16, 518 { 519 0x99,0x09,0xb6,0x4e,0xed,0x93,0x7c,0x65, 520 0x73,0xde,0x52,0xac,0xe9,0x52,0xfa,0x6b, 521 }, 522 "v4 NAT-T, draft-ietf-ipsec-nat-t-ike-04", 523 }, 524 { 525 16, 526 { 527 0x80,0xd0,0xbb,0x3d,0xef,0x54,0x56,0x5e, 528 0xe8,0x46,0x45,0xd4,0xc8,0x5c,0xe3,0xee, 529 }, 530 "v5 NAT-T, draft-ietf-ipsec-nat-t-ike-05", 531 }, 532 { 533 16, 534 { 535 0x4d,0x1e,0x0e,0x13,0x6d,0xea,0xfa,0x34, 536 0xc4,0xf3,0xea,0x9f,0x02,0xec,0x72,0x85, 537 }, 538 "v6 NAT-T, draft-ietf-ipsec-nat-t-ike-06", 539 }, 540 { 541 16, 542 { 543 0x43,0x9b,0x59,0xf8,0xba,0x67,0x6c,0x4c, 544 0x77,0x37,0xae,0x22,0xea,0xb8,0xf5,0x82, 545 }, 546 "v7 NAT-T, draft-ietf-ipsec-nat-t-ike-07", 547 }, 548 { 549 16, 550 { 551 0x8f,0x8d,0x83,0x82,0x6d,0x24,0x6b,0x6f, 552 0xc7,0xa8,0xa6,0xa4,0x28,0xc1,0x1d,0xe8, 553 }, 554 "v8 NAT-T, draft-ietf-ipsec-nat-t-ike-08", 555 }, 556 { 557 16, 558 { 559 0x42,0xea,0x5b,0x6f,0x89,0x8d,0x97,0x73, 560 0xa5,0x75,0xdf,0x26,0xe7,0xdd,0x19,0xe1, 561 }, 562 "v9 NAT-T, draft-ietf-ipsec-nat-t-ike-09", 563 }, 564 { 565 16, 566 { 567 0xc4,0x0f,0xee,0x00,0xd5,0xd3,0x9d,0xdb, 568 0x1f,0xc7,0x62,0xe0,0x9b,0x7c,0xfe,0xa7, 569 }, 570 "Testing NAT-T RFC", 571 }, 572 { 573 16, 574 { 575 0xaf, 0xca, 0xd7, 0x13, 0x68, 0xa1, 0xf1, 0xc9, 576 0x6b, 0x86, 0x96, 0xfc, 0x77, 0x57, 0x01, 0x00, 577 /* Last "0x01, 0x00" means major v1, minor v0 */ 578 }, 579 "DPD v1.0" 580 }, 581 { 582 16, 583 { 584 0x4a, 0x13, 0x1c, 0x81, 0x07, 0x03, 0x58, 0x45, 585 0x5c, 0x57, 0x28, 0xf2, 0x0e, 0x95, 0x45, 0x2f, 586 }, 587 "NAT-T, RFC 3947" 588 }, 589 { 590 16, 591 { 592 0x6c, 0x0d, 0xcd, 0x48, 0x1d, 0xea, 0xe8, 0xae, 593 0x0b, 0x0a, 0x68, 0x38, 0x4b, 0x30, 0x72, 0xf9, 594 }, 595 "OpenBSD-4.0" 596 }, 597 { 598 8, 599 { 600 0x09, 0x00, 0x26, 0x89, 0xdf, 0xd6, 0xb7, 0x12 601 }, 602 "draft-ietf-ipsra-isakmp-xauth-06.txt" 603 }, 604 { 605 16, 606 { 607 0x12,0xf5,0xf2,0x8c,0x45,0x71,0x68,0xa9, 608 0x70,0x2d,0x9f,0xe2,0x74,0xcc,0x01,0x00, 609 }, 610 "Cisco Unity", 611 } 612 }; 613