1 /* $OpenBSD: ike.h,v 1.23 2010/06/07 16:20:58 jsg Exp $ */ 2 3 /* 4 * Copyright (c) 2001 H�kan Olsson. All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 3. The name of the author may not be used to endorse or promote products 15 * derived from this software without specific prior written permission. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 18 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 19 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 20 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 21 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 22 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 23 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 24 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 25 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 26 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 27 */ 28 29 #define ISAKMP_DOI 0 30 #define IPSEC_DOI 1 31 32 #define PROTO_ISAKMP 1 33 #define PROTO_IPSEC_AH 2 34 #define PROTO_IPSEC_ESP 3 35 #define PROTO_IPCOMP 4 36 37 #define IKE_VERSION_2 (2 << 4) 38 39 #define IKE_ATTR_ENCRYPTION_ALGORITHM 1 40 #define IKE_ATTR_HASH_ALGORITHM 2 41 #define IKE_ATTR_AUTHENTICATION_METHOD 3 42 #define IKE_ATTR_GROUP_DESC 4 43 #define IKE_ATTR_GROUP_TYPE 5 44 #define IKE_ATTR_LIFE_TYPE 11 45 46 #define IKE_PROTO_INITIALIZER \ 47 { "RESERVED", "ISAKMP", "IPSEC_AH", "IPSEC_ESP", "IPCOMP", \ 48 } 49 50 #define IKE_ATTR_ENCRYPT_INITIALIZER \ 51 { "NONE", "DES_CBC", "IDEA_CBC", "BLOWFISH_CBC", \ 52 "RC5_R16_B64_CBC", "3DES_CBC", "CAST_CBC", "AES_CBC", \ 53 "AES_128_CTR" \ 54 } 55 #define IKE_ATTR_HASH_INITIALIZER \ 56 { "NONE", "MD5", "SHA", "TIGER", \ 57 "SHA2_256", "SHA2_384", "SHA2_512", \ 58 } 59 #define IKE_ATTR_AUTH_INITIALIZER \ 60 { "NONE", "PRE_SHARED", "DSS", "RSA_SIG", \ 61 "RSA_ENC", "RSA_ENC_REV", \ 62 } 63 #define IKE_ATTR_GROUP_DESC_INITIALIZER \ 64 { "NONE", "MODP_768", "MODP_1024", \ 65 "E2CN_155", "E2CN_185", "MODP_1536", "NONE", "NONE", "NONE", \ 66 "NONE", "NONE", "NONE", "NONE", "NONE", "MODP_2048", \ 67 "MODP_3072", \ 68 } 69 #define IKE_ATTR_GROUP_INITIALIZER \ 70 { "NONE", "MODP", "ECP", "E2CN", \ 71 } 72 #define IKE_ATTR_SA_DURATION_INITIALIZER \ 73 { "NONE", "SECONDS", "KILOBYTES", \ 74 } 75 76 #define IKE_ATTR_INITIALIZER \ 77 { "NONE", /* 0 (not in RFC) */ \ 78 "ENCRYPTION_ALGORITHM", /* 1 */ \ 79 "HASH_ALGORITHM", /* 2 */ \ 80 "AUTHENTICATION_METHOD", /* 3 */ \ 81 "GROUP_DESCRIPTION", /* 4 */ \ 82 "GROUP_TYPE", /* 5 */ \ 83 "GROUP_PRIME", /* 6 */ \ 84 "GROUP_GENERATOR_1", /* 7 */ \ 85 "GROUP_GENERATOR_2", /* 8 */ \ 86 "GROUP_CURVE_1", /* 9 */ \ 87 "GROUP_CURVE_2", /* 10 */ \ 88 "LIFE_TYPE", /* 11 */ \ 89 "LIFE_DURATION", /* 12 */ \ 90 "PRF", /* 13 */ \ 91 "KEY_LENGTH", /* 14 */ \ 92 "FIELD_SIZE", /* 15 */ \ 93 "GROUP_ORDER", /* 16 */ \ 94 } 95 96 #define IKE_SITUATION_IDENTITY_ONLY 1 97 #define IKE_SITUATION_SECRECY 2 98 #define IKE_SITUATION_INTEGRITY 4 99 /* Mask is all the above, i.e 1+2+4 = 7 */ 100 #define IKE_SITUATION_MASK 7 101 102 #define PAYLOAD_NONE 0 103 #define PAYLOAD_SA 1 104 #define PAYLOAD_PROPOSAL 2 105 #define PAYLOAD_TRANSFORM 3 106 #define PAYLOAD_KE 4 107 #define PAYLOAD_ID 5 108 #define PAYLOAD_CERT 6 109 #define PAYLOAD_CERTREQUEST 7 110 #define PAYLOAD_HASH 8 111 #define PAYLOAD_SIG 9 112 #define PAYLOAD_NONCE 10 113 #define PAYLOAD_NOTIFICATION 11 114 #define PAYLOAD_DELETE 12 115 #define PAYLOAD_VENDOR 13 116 #define PAYLOAD_ATTRIBUTE 14 117 #define PAYLOAD_SAK 15 118 #define PAYLOAD_SAT 16 119 #define PAYLOAD_KD 17 120 #define PAYLOAD_SEQ 18 121 #define PAYLOAD_POP 19 122 #define PAYLOAD_NAT_D 20 123 #define PAYLOAD_NAT_OA 21 124 #define PAYLOAD_RESERVED_MIN 22 125 #define PAYLOAD_PRIVATE_MIN 128 126 #define PAYLOAD_NAT_D_DRAFT 130 127 #define PAYLOAD_NAT_OA_DRAFT 131 128 #define PAYLOAD_PRIVATE_MAX 132 129 130 #define PAYLOAD_IKEV2_NONE 0 131 #define PAYLOAD_IKEV2_SA 33 132 #define PAYLOAD_IKEV2_KE 34 133 #define PAYLOAD_IKEV2_IDI 35 134 #define PAYLOAD_IKEV2_IDR 36 135 #define PAYLOAD_IKEV2_CERT 37 136 #define PAYLOAD_IKEV2_CERTREQ 38 137 #define PAYLOAD_IKEV2_AUTH 39 138 #define PAYLOAD_IKEV2_NONCE 40 139 #define PAYLOAD_IKEV2_N 41 140 #define PAYLOAD_IKEV2_D 42 141 #define PAYLOAD_IKEV2_V 43 142 #define PAYLOAD_IKEV2_TSI 44 143 #define PAYLOAD_IKEV2_TSR 45 144 #define PAYLOAD_IKEV2_E 46 145 #define PAYLOAD_IKEV2_CP 47 146 #define PAYLOAD_IKEV2_EAP 48 147 #define PAYLOAD_IKEV2_PRIV_MIN 128 148 #define PAYLOAD_IKEv2_PRIV_MAX 255 149 150 /* see http://www.iana.org/assignments/isakmp-registry */ 151 #define IKE_PAYLOAD_TYPES_INITIALIZER \ 152 { "NONE", /* 0 */ \ 153 "SA", /* 1 */ \ 154 "PROPOSAL", /* 2 */ \ 155 "TRANSFORM", /* 3 */ \ 156 "KEY_EXCH", /* 4 */ \ 157 "ID", /* 5 */ \ 158 "CERT", /* 6 */ \ 159 "CERTREQUEST", /* 7 */ \ 160 "HASH", /* 8 */ \ 161 "SIG", /* 9 */ \ 162 "NONCE", /* 10 */ \ 163 "NOTIFICATION", /* 11 */ \ 164 "DELETE", /* 12 */ \ 165 "VENDOR", /* 13 */ \ 166 "ATTRIBUTE", /* 14 (ikecfg) */ \ 167 "SAK", /* 15 */ \ 168 "SAT", /* 16 */ \ 169 "KD", /* 17 */ \ 170 "SEQ", /* 18 */ \ 171 "POP", /* 19 */ \ 172 "NAT-D", /* 20 */ \ 173 "NAT-OA", /* 21 */ \ 174 } 175 176 #define IKE_PRIVATE_PAYLOAD_TYPES_INITIALIZER \ 177 { "NONE", /* 128 */ \ 178 "<unknown 129>", /* 129 */ \ 179 "NAT-D-DRAFT", /* 130 (draft-ietf-ipsec-nat-t-ike-03) */ \ 180 "NAT-OA-DRAFT", /* 131 (draft-ietf-ipsec-nat-t-ike-03) */ \ 181 } 182 183 /* see http://www.iana.org/assignments/ikev2-parameters */ 184 #define IKEV2_PAYLOAD_TYPES_INITIALIZER \ 185 { "SA", /* 33 */ \ 186 "KE", /* 34 */ \ 187 "IDi", /* 35 */ \ 188 "IDr", /* 36 */ \ 189 "CERT", /* 37 */ \ 190 "CERTREQ", /* 38 */ \ 191 "AUTH", /* 39 */ \ 192 "NONCE", /* 40 */ \ 193 "N", /* 41 */ \ 194 "D", /* 42 */ \ 195 "V", /* 43 */ \ 196 "TSi", /* 44 */ \ 197 "TSr", /* 45 */ \ 198 "E", /* 46 */ \ 199 "CP", /* 47 */ \ 200 "EAP", /* 48 */ \ 201 } 202 203 204 /* Exchange types */ 205 #define EXCHANGE_NONE 0 206 #define EXCHANGE_BASE 1 207 #define EXCHANGE_ID_PROT 2 208 #define EXCHANGE_AUTH_ONLY 3 209 #define EXCHANGE_AGGRESSIVE 4 210 #define EXCHANGE_INFO 5 211 #define EXCHANGE_TRANSACTION 6 212 #define EXCHANGE_QUICK_MODE 32 213 #define EXCHANGE_NEW_GROUP_MODE 33 214 #define EXCHANGE_IKE_SA_INIT 34 215 #define EXCHANGE_IKE_AUTH 35 216 #define EXCHANGE_CREATE_CHILD_SA 36 217 #define EXCHANGE_INFORMATIONAL 37 218 #define EXCHANGE_IKE_SESSION_RESUME 38 219 220 /* Exchange types */ 221 #define IKE_EXCHANGE_TYPES_INITIALIZER \ 222 { "NONE", /* 0 */ \ 223 "BASE", /* 1 */ \ 224 "ID_PROT", /* 2 */ \ 225 "AUTH_ONLY", /* 3 */ \ 226 "AGGRESSIVE", /* 4 */ \ 227 "INFO", /* 5 */ \ 228 "TRANSACTION", /* 6 (ikecfg) */ \ 229 /* step up to type 32 with unknowns */ \ 230 "unknown", "unknown", "unknown", "unknown", \ 231 "unknown", "unknown", "unknown", "unknown", \ 232 "unknown", "unknown", "unknown", "unknown", \ 233 "unknown", "unknown", "unknown", "unknown", \ 234 "unknown", "unknown", "unknown", "unknown", \ 235 "unknown", "unknown", "unknown", "unknown", \ 236 "unknown", \ 237 "QUICK_MODE", /* 32 */ \ 238 "NEW_GROUP_MODE", /* 33 */ \ 239 "IKE_SA_INIT", /* 34 */ \ 240 "IKE_AUTH", /* 35 */ \ 241 "CREATE_CHILD_SA", /* 36 */ \ 242 "INFORMATIONAL", /* 37 */ \ 243 "IKE_SESSION_RESUME", /* 38 */ \ 244 } 245 246 #define FLAGS_ENCRYPTION 1 247 #define FLAGS_COMMIT 2 248 #define FLAGS_AUTH_ONLY 4 249 250 #define CERT_NONE 0 251 #define CERT_PKCS 1 252 #define CERT_PGP 2 253 #define CERT_DNS 3 254 #define CERT_X509_SIG 4 255 #define CERT_X509_KE 5 256 #define CERT_KERBEROS 6 257 #define CERT_CRL 7 258 #define CERT_ARL 8 259 #define CERT_SPKI 9 260 #define CERT_X509_ATTR 10 261 262 #define NOTIFY_INVALID_PAYLOAD_TYPE 1 263 #define NOTIFY_DOI_NOT_SUPPORTED 2 264 #define NOTIFY_SITUATION_NOT_SUPPORTED 3 265 #define NOTIFY_INVALID_COOKIE 4 266 #define NOTIFY_INVALID_MAJOR_VERSION 5 267 #define NOTIFY_INVALID_MINOR_VERSION 6 268 #define NOTIFY_INVALID_EXCHANGE_TYPE 7 269 #define NOTIFY_INVALID_FLAGS 8 270 #define NOTIFY_INVALID_MESSAGE_ID 9 271 #define NOTIFY_INVALID_PROTOCOL_ID 10 272 #define NOTIFY_INVALID_SPI 11 273 #define NOTIFY_INVALID_TRANSFORM_ID 12 274 #define NOTIFY_ATTRIBUTES_NOT_SUPPORTED 13 275 #define NOTIFY_NO_PROPOSAL_CHOSEN 14 276 #define NOTIFY_BAD_PROPOSAL_SYNTAX 15 277 #define NOTIFY_PAYLOAD_MALFORMED 16 278 #define NOTIFY_INVALID_KEY_INFORMATION 17 279 #define NOTIFY_INVALID_ID_INFORMATION 18 280 #define NOTIFY_INVALID_CERT_ENCODING 19 281 #define NOTIFY_INVALID_CERTIFICATE 20 282 #define NOTIFY_CERT_TYPE_UNSUPPORTED 21 283 #define NOTIFY_INVALID_CERT_AUTHORITY 22 284 #define NOTIFY_INVALID_HASH_INFORMATION 23 285 #define NOTIFY_AUTHENTICATION_FAILED 24 286 #define NOTIFY_INVALID_SIGNATURE 25 287 #define NOTIFY_ADDRESS_NOTIFICATION 26 288 #define NOTIFY_NOTIFY_SA_LIFETIME 27 289 #define NOTIFY_CERTIFICATE_UNAVAILABLE 28 290 #define NOTIFY_UNSUPPORTED_EXCHANGE_TYPE 29 291 #define NOTIFY_UNEQUAL_PAYLOAD_LENGTHS 30 292 293 #define IKE_NOTIFY_TYPES_INITIALIZER \ 294 { "", \ 295 "INVALID PAYLOAD TYPE", \ 296 "DOI NOT SUPPORTED", \ 297 "SITUATION NOT SUPPORTED", \ 298 "INVALID COOKIE", \ 299 "INVALID MAJOR VERSION", \ 300 "INVALID MINOR VERSION", \ 301 "INVALID EXCHANGE TYPE", \ 302 "INVALID FLAGS", \ 303 "INVALID MESSAGE ID", \ 304 "INVALID PROTOCOL ID", \ 305 "INVALID SPI", \ 306 "INVALID TRANSFORM ID", \ 307 "ATTRIBUTES NOT SUPPORTED", \ 308 "NO PROPOSAL CHOSEN", \ 309 "BAD PROPOSAL SYNTAX", \ 310 "PAYLOAD MALFORMED", \ 311 "INVALID KEY INFORMATION", \ 312 "INVALID ID INFORMATION", \ 313 "INVALID CERT ENCODING", \ 314 "INVALID CERTIFICATE", \ 315 "CERT TYPE UNSUPPORTED", \ 316 "INVALID CERT AUTHORITY", \ 317 "INVALID HASH INFORMATION", \ 318 "AUTHENTICATION FAILED", \ 319 "INVALID SIGNATURE", \ 320 "ADDRESS NOTIFICATION", \ 321 "NOTIFY SA LIFETIME", \ 322 "CERTIFICATE UNAVAILABLE", \ 323 "UNSUPPORTED EXCHANGE TYPE", \ 324 "UNEQUAL PAYLOAD LENGTHS", \ 325 } 326 327 /* RFC 2407, 4.6.3 */ 328 #define NOTIFY_IPSEC_RESPONDER_LIFETIME 24576 329 #define NOTIFY_IPSEC_REPLAY_STATUS 24577 330 #define NOTIFY_IPSEC_INITIAL_CONTACT 24578 331 332 /* RFC 3706, Dead Peer Detection */ 333 #define NOTIFY_STATUS_DPD_R_U_THERE 36136 334 #define NOTIFY_STATUS_DPD_R_U_THERE_ACK 36137 335 336 #define IPSEC_ID_RESERVED 0 337 #define IPSEC_ID_IPV4_ADDR 1 338 #define IPSEC_ID_FQDN 2 339 #define IPSEC_ID_USER_FQDN 3 340 #define IPSEC_ID_IPV4_ADDR_SUBNET 4 341 #define IPSEC_ID_IPV6_ADDR 5 342 #define IPSEC_ID_IPV6_ADDR_SUBNET 6 343 #define IPSEC_ID_IPV4_ADDR_RANGE 7 344 #define IPSEC_ID_IPV6_ADDR_RANGE 8 345 #define IPSEC_ID_DER_ASN1_DN 9 346 #define IPSEC_ID_DER_ASN1_GN 10 347 #define IPSEC_ID_KEY_ID 11 348 349 #define IPSEC_ID_TYPE_INITIALIZER \ 350 { "RESERVED", \ 351 "IPV4_ADDR", \ 352 "FQDN", \ 353 "USER_FQDN", \ 354 "IPV4_ADDR_SUBNET", \ 355 "IPV6_ADDR", \ 356 "IPV6_ADDR_SUBNET", \ 357 "IPV4_ADDR_RANGE", \ 358 "IPV6_ADDR_RANGE", \ 359 "DER_ASN1_DN", \ 360 "DER_ASN1_GN", \ 361 "KEY_ID", \ 362 } 363 364 #define IPSEC_ATTR_SA_LIFE_TYPE 1 365 #define IPSEC_ATTR_SA_LIFE_DURATION 2 366 #define IPSEC_ATTR_GROUP_DESCRIPTION 3 367 #define IPSEC_ATTR_ENCAPSULATION_MODE 4 368 #define IPSEC_ATTR_AUTHENTICATION_ALGORITHM 5 369 #define IPSEC_ATTR_KEY_LENGTH 6 370 #define IPSEC_ATTR_KEY_ROUNDS 7 371 #define IPSEC_ATTR_COMPRESS_DICTIONARY_SIZE 8 372 #define IPSEC_ATTR_COMPRESS_PRIVATE_ALGORITHM 9 373 374 #define IPSEC_ATTR_INITIALIZER \ 375 { "NONE", "LIFE_TYPE", "LIFE_DURATION", \ 376 "GROUP_DESCRIPTION", "ENCAPSULATION_MODE", \ 377 "AUTHENTICATION_ALGORITHM", "KEY_LENGTH", \ 378 "KEY_ROUNDS", "COMPRESS_DICTIONARY_SIZE", \ 379 "COMPRESS_PRIVATE_ALGORITHM", \ 380 } 381 382 #define IPSEC_ATTR_DURATION_INITIALIZER \ 383 { "NONE", "SECONDS", "KILOBYTES", \ 384 } 385 #define IPSEC_ATTR_ENCAP_INITIALIZER \ 386 { "NONE", "TUNNEL", "TRANSPORT", "UDP_ENCAP_TUNNEL", \ 387 "UDP_ENCAP_TRANSPORT" \ 388 } 389 #define IPSEC_ATTR_AUTH_INITIALIZER \ 390 { "NONE", "HMAC_MD5", "HMAC_SHA", "DES_MAC", "KPDK", \ 391 "HMAC_SHA2_256", "HMAC_SHA2_384", "HMAC_SHA2_512", \ 392 "HMAC_RIPEMD", \ 393 } 394 #define IPSEC_AH_INITIALIZER \ 395 { "NONE", "MD5", "SHA", "DES", "SHA2_256", "SHA2_384", \ 396 "SHA2_512", "RIPEMD", \ 397 } 398 #define IPSEC_ESP_INITIALIZER \ 399 { "NONE", "DEV_IV64", "DES", "3DES", "RC5", "IDEA", \ 400 "CAST", "BLOWFISH", "3IDEA", "DES_IV32", "RC4", \ 401 "NULL", "AES", "AESCTR" \ 402 } 403 #define IPCOMP_INITIALIZER \ 404 { "NONE", "OUI", "DEFLATE", "LZS", "V42BIS", \ 405 } 406 407 /* 408 * IKE mode config. 409 */ 410 411 #define IKE_CFG_ATTRIBUTE_TYPE_INITIALIZER \ 412 { "RESERVED", "CFG_REQUEST", "CFG_REPLY", \ 413 "CFG_SET", "CFG_ACK", \ 414 } 415 416 #define IKE_CFG_ATTR_INTERNAL_IP4_ADDRESS 1 417 #define IKE_CFG_ATTR_INTERNAL_IP4_NETMASK 2 418 #define IKE_CFG_ATTR_INTERNAL_IP4_DNS 3 419 #define IKE_CFG_ATTR_INTERNAL_IP4_NBNS 4 420 #define IKE_CFG_ATTR_INTERNAL_ADDRESS_EXPIRY 5 421 #define IKE_CFG_ATTR_INTERNAL_IP4_DHCP 6 422 #define IKE_CFG_ATTR_APPLICATION_VERSION 7 423 #define IKE_CFG_ATTR_INTERNAL_IP6_ADDRESS 8 424 #define IKE_CFG_ATTR_INTERNAL_IP6_NETMASK 9 425 #define IKE_CFG_ATTR_INTERNAL_IP6_DNS 10 426 #define IKE_CFG_ATTR_INTERNAL_IP6_NBNS 11 427 #define IKE_CFG_ATTR_INTERNAL_IP6_DHCP 12 428 #define IKE_CFG_ATTR_INTERNAL_IP4_SUBNET 13 429 #define IKE_CFG_ATTR_SUPPORTED_ATTRIBUTES 14 430 #define IKE_CFG_ATTR_INTERNAL_IP6_SUBNET 15 431 432 #define IKE_CFG_ATTRIBUTE_INITIALIZER \ 433 { "RESERVED", "INTERNAL_IP4_ADDRESS", \ 434 "INTERNAL_IP4_NETMASK", "INTERNAL_IP4_DNS", \ 435 "INTERNAL_IP4_NBNS", "INTERNAL_ADDRESS_EXPIRY", \ 436 "INTERNAL_IP4_DHCP", "APPLICATION_VERSION", \ 437 "INTERNAL_IP6_ADDRESS", "INTERNAL_IP6_NETMASK", \ 438 "INTERNAL_IP6_DNS", "INTERNAL_IP6_NBNS", \ 439 "INTERNAL_IP6_DHCP", "INTERNAL_IP4_SUBNET", \ 440 "SUPPORTED_ATTRIBUTES", "INTERNAL_IP6_SUBNET", \ 441 } 442 443 #define ISAKMP_SA_SZ 8 444 #define ISAKMP_PROP_SZ 8 445 #define ISAKMP_TRANSFORM_SZ 8 446 #define ISAKMP_KE_SZ 4 447 #define ISAKMP_ID_SZ 8 448 #define ISAKMP_CERT_SZ 5 449 #define ISAKMP_CERTREQ_SZ 5 450 #define ISAKMP_HASH_SZ 4 451 #define ISAKMP_SIG_SZ 4 452 #define ISAKMP_NONCE_SZ 4 453 #define ISAKMP_NOTIFY_SZ 12 454 #define ISAKMP_DELETE_SZ 12 455 #define ISAKMP_VENDOR_SZ 4 456 #define ISAKMP_ATTRIBUTE_SZ 8 457 #define ISAKMP_NAT_D_SZ 4 458 #define ISAKMP_NAT_OA_SZ 8 459 460 static u_int16_t min_payload_lengths[] = { 461 0, ISAKMP_SA_SZ, ISAKMP_PROP_SZ, ISAKMP_TRANSFORM_SZ, ISAKMP_KE_SZ, 462 ISAKMP_ID_SZ, ISAKMP_CERT_SZ, ISAKMP_CERTREQ_SZ, ISAKMP_HASH_SZ, 463 ISAKMP_SIG_SZ, ISAKMP_NONCE_SZ, ISAKMP_NOTIFY_SZ, ISAKMP_DELETE_SZ, 464 ISAKMP_VENDOR_SZ, ISAKMP_ATTRIBUTE_SZ 465 }; 466 467 static u_int16_t min_priv_payload_lengths[] = { 468 0, 0, ISAKMP_NAT_D_SZ, ISAKMP_NAT_OA_SZ 469 }; 470 471 static const struct vendor_id 472 { 473 size_t len; 474 char vid[16]; 475 char *name; 476 } vendor_ids[] = { 477 { 478 16, 479 { 480 0x44, 0x85, 0x15, 0x2d, 0x18, 0xb6, 0xbb, 0xcd, 481 0x0b, 0xe8, 0xa8, 0x46, 0x95, 0x79, 0xdd, 0xcc, 482 }, 483 "v1 NAT-T, draft-ietf-ipsec-nat-t-ike-00", 484 }, 485 { 486 16, 487 { 488 0x90, 0xcb, 0x80, 0x91, 0x3e, 0xbb, 0x69, 0x6e, 489 0x08, 0x63, 0x81, 0xb5, 0xec, 0x42, 0x7b, 0x1f, 490 }, 491 "v2 NAT-T, draft-ietf-ipsec-nat-t-ike-02", 492 }, 493 { 494 16, 495 { 496 0xcd, 0x60, 0x46, 0x43, 0x35, 0xdf, 0x21, 0xf8, 497 0x7c, 0xfd, 0xb2, 0xfc, 0x68, 0xb6, 0xa4, 0x48, 498 }, 499 "v2 NAT-T, draft-ietf-ipsec-nat-t-ike-02\\n", 500 }, 501 { 502 16, 503 { 504 0x7d, 0x94, 0x19, 0xa6, 0x53, 0x10, 0xca, 0x6f, 505 0x2c, 0x17, 0x9d, 0x92, 0x15, 0x52, 0x9d, 0x56, 506 }, 507 "v3 NAT-T, draft-ietf-ipsec-nat-t-ike-03", 508 }, 509 { 510 16, 511 { 512 0x99,0x09,0xb6,0x4e,0xed,0x93,0x7c,0x65, 513 0x73,0xde,0x52,0xac,0xe9,0x52,0xfa,0x6b, 514 }, 515 "v4 NAT-T, draft-ietf-ipsec-nat-t-ike-04", 516 }, 517 { 518 16, 519 { 520 0x80,0xd0,0xbb,0x3d,0xef,0x54,0x56,0x5e, 521 0xe8,0x46,0x45,0xd4,0xc8,0x5c,0xe3,0xee, 522 }, 523 "v5 NAT-T, draft-ietf-ipsec-nat-t-ike-05", 524 }, 525 { 526 16, 527 { 528 0x4d,0x1e,0x0e,0x13,0x6d,0xea,0xfa,0x34, 529 0xc4,0xf3,0xea,0x9f,0x02,0xec,0x72,0x85, 530 }, 531 "v6 NAT-T, draft-ietf-ipsec-nat-t-ike-06", 532 }, 533 { 534 16, 535 { 536 0x43,0x9b,0x59,0xf8,0xba,0x67,0x6c,0x4c, 537 0x77,0x37,0xae,0x22,0xea,0xb8,0xf5,0x82, 538 }, 539 "v7 NAT-T, draft-ietf-ipsec-nat-t-ike-07", 540 }, 541 { 542 16, 543 { 544 0x8f,0x8d,0x83,0x82,0x6d,0x24,0x6b,0x6f, 545 0xc7,0xa8,0xa6,0xa4,0x28,0xc1,0x1d,0xe8, 546 }, 547 "v8 NAT-T, draft-ietf-ipsec-nat-t-ike-08", 548 }, 549 { 550 16, 551 { 552 0x42,0xea,0x5b,0x6f,0x89,0x8d,0x97,0x73, 553 0xa5,0x75,0xdf,0x26,0xe7,0xdd,0x19,0xe1, 554 }, 555 "v9 NAT-T, draft-ietf-ipsec-nat-t-ike-09", 556 }, 557 { 558 16, 559 { 560 0xc4,0x0f,0xee,0x00,0xd5,0xd3,0x9d,0xdb, 561 0x1f,0xc7,0x62,0xe0,0x9b,0x7c,0xfe,0xa7, 562 }, 563 "Testing NAT-T RFC", 564 }, 565 { 566 16, 567 { 568 0xaf, 0xca, 0xd7, 0x13, 0x68, 0xa1, 0xf1, 0xc9, 569 0x6b, 0x86, 0x96, 0xfc, 0x77, 0x57, 0x01, 0x00, 570 /* Last "0x01, 0x00" means major v1, minor v0 */ 571 }, 572 "DPD v1.0" 573 }, 574 { 575 16, 576 { 577 0x4a, 0x13, 0x1c, 0x81, 0x07, 0x03, 0x58, 0x45, 578 0x5c, 0x57, 0x28, 0xf2, 0x0e, 0x95, 0x45, 0x2f, 579 }, 580 "NAT-T, RFC 3947" 581 }, 582 { 583 16, 584 { 585 0x6c, 0x0d, 0xcd, 0x48, 0x1d, 0xea, 0xe8, 0xae, 586 0x0b, 0x0a, 0x68, 0x38, 0x4b, 0x30, 0x72, 0xf9, 587 }, 588 "OpenBSD-4.0" 589 }, 590 { 591 8, 592 { 593 0x09, 0x00, 0x26, 0x89, 0xdf, 0xd6, 0xb7, 0x12 594 }, 595 "draft-ietf-ipsra-isakmp-xauth-06.txt" 596 }, 597 { 598 16, 599 { 600 0x12,0xf5,0xf2,0x8c,0x45,0x71,0x68,0xa9, 601 0x70,0x2d,0x9f,0xe2,0x74,0xcc,0x01,0x00, 602 }, 603 "Cisco Unity", 604 } 605 }; 606