/epan/dissectors/packet-isakmp.c
C | 6199 lines | 5379 code | 582 blank | 238 comment | 348 complexity | 8e8e73ee6b27b4299323a4cf5d832ef8 MD5 | raw file
Possible License(s): GPL-2.0, BSD-3-Clause
Large files files are truncated, but you can click here to view the full file
- /* packet-isakmp.c
- * Routines for the Internet Security Association and Key Management Protocol
- * (ISAKMP) (RFC 2408) and the Internet IP Security Domain of Interpretation
- * for ISAKMP (RFC 2407)
- * Brad Robel-Forrest <brad.robel-forrest@watchguard.com>
- *
- * Added routines for the Internet Key Exchange (IKEv2) Protocol
- * (draft-ietf-ipsec-ikev2-17.txt)
- * Shoichi Sakane <sakane@tanu.org>
- *
- * Added routines for RFC3947 Negotiation of NAT-Traversal in the IKE
- * ronnie sahlberg
- *
- * 04/2009 Added routines for decryption of IKEv2 Encrypted Payload
- * Naoyoshi Ueda <piyomaru3141@gmail.com>
- *
- * $Id$
- *
- * Wireshark - Network traffic analyzer
- * By Gerald Combs <gerald@wireshark.org>
- * Copyright 1998 Gerald Combs
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version 2
- * of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
- * References:
- * IKEv2 http://www.ietf.org/rfc/rfc4306.txt?number=4306
- * IKEv2bis http://www.ietf.org/rfc/rfc5996.txt?number=5996
- *
- * http://www.iana.org/assignments/isakmp-registry (last updated 2011-11-07)
- * http://www.iana.org/assignments/ipsec-registry (last updated 2011-03-14)
- * http://www.iana.org/assignments/ikev2-parameters (last updated 2011-12-19)
- */
- #include "config.h"
- #include <glib.h>
- #include <epan/packet.h>
- #include <epan/ipproto.h>
- #include <epan/asn1.h>
- #include <epan/reassemble.h>
- #include <epan/dissectors/packet-x509if.h>
- #include <epan/dissectors/packet-x509af.h>
- #include <epan/dissectors/packet-isakmp.h>
- #include <epan/prefs.h>
- #include <epan/expert.h>
- #ifdef HAVE_LIBGCRYPT
- #include <wsutil/wsgcrypt.h>
- #include <epan/strutil.h>
- #include <epan/uat.h>
- #endif
- /* Struct for the byte_to_str, match_bytestr_idx, and match_bytestr functions */
- typedef struct _byte_string {
- const gchar *value;
- const guint16 len;
- const gchar *strptr;
- } byte_string;
- static int proto_isakmp = -1;
- static int hf_isakmp_nat_keepalive = -1;
- static int hf_isakmp_nat_hash = -1;
- static int hf_isakmp_nat_original_address_ipv6 = -1;
- static int hf_isakmp_nat_original_address_ipv4 = -1;
- static int hf_isakmp_ispi = -1;
- static int hf_isakmp_rspi = -1;
- static int hf_isakmp_typepayload = -1;
- static int hf_isakmp_nextpayload = -1;
- static int hf_isakmp_criticalpayload = -1;
- static int hf_isakmp_datapayload = -1;
- static int hf_isakmp_extradata = -1;
- static int hf_isakmp_version = -1;
- static int hf_isakmp_mjver = -1;
- static int hf_isakmp_mnver = -1;
- static int hf_isakmp_exchangetype_v1 = -1;
- static int hf_isakmp_exchangetype_v2 = -1;
- static int hf_isakmp_flags = -1;
- static int hf_isakmp_flag_e = -1;
- static int hf_isakmp_flag_c = -1;
- static int hf_isakmp_flag_a = -1;
- static int hf_isakmp_flag_i = -1;
- static int hf_isakmp_flag_v = -1;
- static int hf_isakmp_flag_r = -1;
- static int hf_isakmp_messageid = -1;
- static int hf_isakmp_length = -1;
- static int hf_isakmp_payloadlen = -1;
- static int hf_isakmp_sa_doi = -1;
- static int hf_isakmp_sa_situation = -1;
- static int hf_isakmp_sa_situation_identity_only = -1;
- static int hf_isakmp_sa_situation_secrecy = -1;
- static int hf_isakmp_sa_situation_integrity = -1;
- static int hf_isakmp_prop_protoid_v1 = -1;
- static int hf_isakmp_prop_protoid_v2 = -1;
- static int hf_isakmp_prop_number = -1;
- static int hf_isakmp_prop_transforms = -1;
- static int hf_isakmp_spisize = -1;
- static int hf_isakmp_spi = -1;
- static int hf_isakmp_trans_number = -1;
- static int hf_isakmp_trans_id = -1;
- static int hf_isakmp_id_type_v1 = -1;
- static int hf_isakmp_id_type_v2 = -1;
- static int hf_isakmp_id_protoid = -1;
- static int hf_isakmp_id_port = -1;
- static int hf_isakmp_id_data = -1;
- static int hf_isakmp_id_data_ipv4_addr = -1;
- static int hf_isakmp_id_data_fqdn = -1;
- static int hf_isakmp_id_data_user_fqdn = -1;
- static int hf_isakmp_id_data_ipv4_subnet = -1;
- static int hf_isakmp_id_data_ipv4_range_start = -1;
- static int hf_isakmp_id_data_ipv4_range_end = -1;
- static int hf_isakmp_id_data_ipv6_addr = -1;
- static int hf_isakmp_id_data_ipv6_subnet = -1;
- static int hf_isakmp_id_data_ipv6_range_start = -1;
- static int hf_isakmp_id_data_ipv6_range_end = -1;
- static int hf_isakmp_id_data_key_id = -1;
- static int hf_isakmp_id_data_cert = -1;
- static int hf_isakmp_cert_encoding_v1 = -1;
- static int hf_isakmp_cert_encoding_v2 = -1;
- static int hf_isakmp_cert_data = -1;
- static int hf_isakmp_certreq_type_v1 = -1;
- static int hf_isakmp_certreq_type_v2 = -1;
- static int hf_isakmp_certreq_authority_v1 = -1;
- static int hf_isakmp_certreq_authority_v2 = -1;
- static int hf_isakmp_certreq_authority_sig = -1;
- static int hf_isakmp_auth_meth = -1;
- static int hf_isakmp_auth_data = -1;
- static int hf_isakmp_notify_doi = -1;
- static int hf_isakmp_notify_protoid_v1 = -1;
- static int hf_isakmp_notify_protoid_v2 = -1;
- static int hf_isakmp_notify_msgtype_v1 = -1;
- static int hf_isakmp_notify_msgtype_v2 = -1;
- static int hf_isakmp_notify_data = -1;
- static int hf_isakmp_notify_data_dpd_are_you_there = -1;
- static int hf_isakmp_notify_data_dpd_are_you_there_ack = -1;
- static int hf_isakmp_notify_data_unity_load_balance = -1;
- static int hf_isakmp_notify_data_ipcomp_cpi = -1;
- static int hf_isakmp_notify_data_ipcomp_transform_id = -1;
- static int hf_isakmp_notify_data_redirect_gw_ident_type = -1;
- static int hf_isakmp_notify_data_redirect_gw_ident_len = -1;
- static int hf_isakmp_notify_data_redirect_new_resp_gw_ident_ipv4 = -1;
- static int hf_isakmp_notify_data_redirect_new_resp_gw_ident_ipv6 = -1;
- static int hf_isakmp_notify_data_redirect_new_resp_gw_ident_fqdn = -1;
- static int hf_isakmp_notify_data_redirect_new_resp_gw_ident = -1;
- static int hf_isakmp_notify_data_redirect_nonce_data = -1;
- static int hf_isakmp_notify_data_redirect_org_resp_gw_ident_ipv4 = -1;
- static int hf_isakmp_notify_data_redirect_org_resp_gw_ident_ipv6 = -1;
- static int hf_isakmp_notify_data_redirect_org_resp_gw_ident = -1;
- static int hf_isakmp_notify_data_ticket_lifetime = -1;
- static int hf_isakmp_notify_data_ticket_data = -1;
- static int hf_isakmp_notify_data_rohc_attr = -1;
- static int hf_isakmp_notify_data_rohc_attr_type = -1;
- static int hf_isakmp_notify_data_rohc_attr_format = -1;
- static int hf_isakmp_notify_data_rohc_attr_length = -1;
- static int hf_isakmp_notify_data_rohc_attr_value = -1;
- static int hf_isakmp_notify_data_rohc_attr_max_cid = -1;
- static int hf_isakmp_notify_data_rohc_attr_profile = -1;
- static int hf_isakmp_notify_data_rohc_attr_integ = -1;
- static int hf_isakmp_notify_data_rohc_attr_icv_len = -1;
- static int hf_isakmp_notify_data_rohc_attr_mrru = -1;
- static int hf_isakmp_notify_data_qcd_token_secret_data = -1;
- static int hf_isakmp_notify_data_ha_nonce_data = -1;
- static int hf_isakmp_notify_data_ha_expected_send_req_msg_id = -1;
- static int hf_isakmp_notify_data_ha_expected_recv_req_msg_id = -1;
- static int hf_isakmp_notify_data_ha_incoming_ipsec_sa_delta_value = -1;
- static int hf_isakmp_notify_data_secure_password_methods = -1;
- static int hf_isakmp_delete_doi = -1;
- static int hf_isakmp_delete_protoid_v1 = -1;
- static int hf_isakmp_delete_protoid_v2 = -1;
- static int hf_isakmp_delete_spi = -1;
- static int hf_isakmp_vid_bytes = -1;
- static int hf_isakmp_vid_string = -1;
- static int hf_isakmp_vid_cp_product = -1;
- static int hf_isakmp_vid_cp_version = -1;
- static int hf_isakmp_vid_cp_timestamp = -1;
- static int hf_isakmp_vid_cp_reserved = -1;
- static int hf_isakmp_vid_cp_features = -1;
- static int hf_isakmp_vid_cisco_unity_major = -1;
- static int hf_isakmp_vid_cisco_unity_minor = -1;
- static int hf_isakmp_vid_ms_nt5_isakmpoakley = -1;
- static int hf_isakmp_vid_aruba_via_auth_profile = -1;
- static int hf_isakmp_ts_number_of_ts = -1;
- static int hf_isakmp_ts_type = -1;
- static int hf_isakmp_ts_protoid = -1;
- static int hf_isakmp_ts_selector_length = -1;
- static int hf_isakmp_ts_start_port = -1;
- static int hf_isakmp_ts_end_port = -1;
- static int hf_isakmp_ts_start_addr_ipv4 = -1;
- static int hf_isakmp_ts_end_addr_ipv4 = -1;
- static int hf_isakmp_ts_start_addr_ipv6 = -1;
- static int hf_isakmp_ts_end_addr_ipv6 = -1;
- static int hf_isakmp_ts_start_addr_fc = -1;
- static int hf_isakmp_ts_end_addr_fc = -1;
- static int hf_isakmp_ts_start_r_ctl = -1;
- static int hf_isakmp_ts_end_r_ctl = -1;
- static int hf_isakmp_ts_start_type = -1;
- static int hf_isakmp_ts_end_type = -1;
- static int hf_isakmp_ts_data = -1;
- static int hf_isakmp_num_spis = -1;
- static int hf_isakmp_hash = -1;
- static int hf_isakmp_sig = -1;
- static int hf_isakmp_nonce = -1;
- static int hf_isakmp_tf_attr = -1;
- static int hf_isakmp_tf_attr_type_v1 = -1;
- static int hf_isakmp_tf_attr_format = -1;
- static int hf_isakmp_tf_attr_length = -1;
- static int hf_isakmp_tf_attr_value = -1;
- static int hf_isakmp_tf_attr_life_type = -1;
- static int hf_isakmp_tf_attr_life_duration_uint32 = -1;
- static int hf_isakmp_tf_attr_life_duration_uint64 = -1;
- static int hf_isakmp_tf_attr_life_duration_bytes = -1;
- static int hf_isakmp_tf_attr_group_description = -1;
- static int hf_isakmp_tf_attr_encap_mode = -1;
- static int hf_isakmp_tf_attr_auth_algorithm = -1;
- static int hf_isakmp_tf_attr_key_length = -1;
- static int hf_isakmp_tf_attr_key_rounds = -1;
- static int hf_isakmp_tf_attr_cmpr_dict_size = -1;
- static int hf_isakmp_tf_attr_cmpr_algorithm = -1;
- static int hf_isakmp_tf_attr_ecn_tunnel = -1;
- static int hf_isakmp_tf_attr_ext_seq_nbr = -1;
- static int hf_isakmp_tf_attr_auth_key_length = -1;
- static int hf_isakmp_tf_attr_sig_enco_algorithm = -1;
- static int hf_isakmp_tf_attr_addr_preservation = -1;
- static int hf_isakmp_tf_attr_sa_direction = -1;
- static int hf_isakmp_ike_attr = -1;
- static int hf_isakmp_ike_attr_type = -1;
- static int hf_isakmp_ike_attr_format = -1;
- static int hf_isakmp_ike_attr_length = -1;
- static int hf_isakmp_ike_attr_value = -1;
- static int hf_isakmp_ike_attr_encryption_algorithm = -1;
- static int hf_isakmp_ike_attr_hash_algorithm = -1;
- static int hf_isakmp_ike_attr_authentication_method = -1;
- static int hf_isakmp_ike_attr_group_description = -1;
- static int hf_isakmp_ike_attr_group_type = -1;
- static int hf_isakmp_ike_attr_group_prime = -1;
- static int hf_isakmp_ike_attr_group_generator_one = -1;
- static int hf_isakmp_ike_attr_group_generator_two = -1;
- static int hf_isakmp_ike_attr_group_curve_a = -1;
- static int hf_isakmp_ike_attr_group_curve_b = -1;
- static int hf_isakmp_ike_attr_life_type = -1;
- static int hf_isakmp_ike_attr_life_duration_uint32 = -1;
- static int hf_isakmp_ike_attr_life_duration_uint64 = -1;
- static int hf_isakmp_ike_attr_life_duration_bytes = -1;
- static int hf_isakmp_ike_attr_prf = -1;
- static int hf_isakmp_ike_attr_key_length = -1;
- static int hf_isakmp_ike_attr_field_size = -1;
- static int hf_isakmp_ike_attr_group_order = -1;
- static int hf_isakmp_trans_type = -1;
- static int hf_isakmp_trans_encr = -1;
- static int hf_isakmp_trans_prf = -1;
- static int hf_isakmp_trans_integ = -1;
- static int hf_isakmp_trans_dh = -1;
- static int hf_isakmp_trans_esn = -1;
- static int hf_isakmp_trans_id_v2 = -1;
- static int hf_isakmp_ike2_attr = -1;
- static int hf_isakmp_ike2_attr_type = -1;
- static int hf_isakmp_ike2_attr_format = -1;
- static int hf_isakmp_ike2_attr_length = -1;
- static int hf_isakmp_ike2_attr_value = -1;
- static int hf_isakmp_ike2_attr_key_length = -1;
- static int hf_isakmp_fragments = -1;
- static int hf_isakmp_fragment = -1;
- static int hf_isakmp_fragment_overlap = -1;
- static int hf_isakmp_fragment_overlap_conflicts = -1;
- static int hf_isakmp_fragment_multiple_tails = -1;
- static int hf_isakmp_fragment_too_long_fragment = -1;
- static int hf_isakmp_fragment_error = -1;
- static int hf_isakmp_fragment_count = -1;
- static int hf_isakmp_reassembled_in = -1;
- static int hf_isakmp_reassembled_length = -1;
- static int hf_isakmp_cisco_frag_packetid = -1;
- static int hf_isakmp_cisco_frag_seq = -1;
- static int hf_isakmp_cisco_frag_last = -1;
- static int hf_isakmp_key_exch_dh_group = -1;
- static int hf_isakmp_key_exch_data = -1;
- static int hf_isakmp_eap_data = -1;
- static int hf_isakmp_gspm_data = -1;
- static int hf_isakmp_cfg_type_v1 = -1;
- static int hf_isakmp_cfg_identifier = -1;
- static int hf_isakmp_cfg_type_v2 = -1;
- static int hf_isakmp_cfg_attr = -1;
- static int hf_isakmp_cfg_attr_type_v1 = -1;
- static int hf_isakmp_cfg_attr_type_v2 = -1;
- static int hf_isakmp_cfg_attr_format = -1;
- static int hf_isakmp_cfg_attr_length = -1;
- static int hf_isakmp_cfg_attr_value = -1;
- static int hf_isakmp_cfg_attr_internal_ip4_address = -1;
- static int hf_isakmp_cfg_attr_internal_ip4_netmask = -1;
- static int hf_isakmp_cfg_attr_internal_ip4_dns = -1;
- static int hf_isakmp_cfg_attr_internal_ip4_nbns = -1;
- static int hf_isakmp_cfg_attr_internal_address_expiry = -1;
- static int hf_isakmp_cfg_attr_internal_ip4_dhcp = -1;
- static int hf_isakmp_cfg_attr_application_version = -1;
- static int hf_isakmp_cfg_attr_internal_ip6_address = -1;
- static int hf_isakmp_cfg_attr_internal_ip6_netmask = -1;
- static int hf_isakmp_cfg_attr_internal_ip6_dns = -1;
- static int hf_isakmp_cfg_attr_internal_ip6_nbns = -1;
- static int hf_isakmp_cfg_attr_internal_ip6_dhcp = -1;
- static int hf_isakmp_cfg_attr_internal_ip4_subnet_ip = -1;
- static int hf_isakmp_cfg_attr_internal_ip4_subnet_netmask = -1;
- static int hf_isakmp_cfg_attr_supported_attributes = -1;
- static int hf_isakmp_cfg_attr_internal_ip6_subnet_ip = -1;
- static int hf_isakmp_cfg_attr_internal_ip6_subnet_prefix = -1;
- static int hf_isakmp_cfg_attr_internal_ip6_link_interface = -1;
- static int hf_isakmp_cfg_attr_internal_ip6_link_id = -1;
- static int hf_isakmp_cfg_attr_internal_ip6_prefix_ip = -1;
- static int hf_isakmp_cfg_attr_internal_ip6_prefix_length = -1;
- static int hf_isakmp_cfg_attr_xauth_type = -1;
- static int hf_isakmp_cfg_attr_xauth_user_name = -1;
- static int hf_isakmp_cfg_attr_xauth_user_password = -1;
- static int hf_isakmp_cfg_attr_xauth_passcode = -1;
- static int hf_isakmp_cfg_attr_xauth_message = -1;
- static int hf_isakmp_cfg_attr_xauth_challenge = -1;
- static int hf_isakmp_cfg_attr_xauth_domain = -1;
- static int hf_isakmp_cfg_attr_xauth_status = -1;
- static int hf_isakmp_cfg_attr_xauth_next_pin = -1;
- static int hf_isakmp_cfg_attr_xauth_answer = -1;
- static int hf_isakmp_cfg_attr_unity_banner = -1;
- static int hf_isakmp_cfg_attr_unity_def_domain = -1;
- static int hf_isakmp_enc_decrypted_data = -1;
- static int hf_isakmp_enc_contained_data = -1;
- static int hf_isakmp_enc_pad_length= -1;
- static int hf_isakmp_enc_padding = -1;
- static int hf_isakmp_enc_data = -1;
- static int hf_isakmp_enc_iv = -1;
- static int hf_isakmp_enc_icd = -1;
- static gint ett_isakmp = -1;
- static gint ett_isakmp_version = -1;
- static gint ett_isakmp_flags = -1;
- static gint ett_isakmp_payload = -1;
- static gint ett_isakmp_fragment = -1;
- static gint ett_isakmp_fragments = -1;
- static gint ett_isakmp_sa = -1;
- static gint ett_isakmp_tf_attr = -1;
- static gint ett_isakmp_tf_ike_attr = -1;
- static gint ett_isakmp_tf_ike2_attr = -1;
- static gint ett_isakmp_id = -1;
- static gint ett_isakmp_cfg_attr = -1;
- static gint ett_isakmp_rohc_attr = -1;
- #ifdef HAVE_LIBGCRYPT
- /* For decrypted IKEv2 Encrypted payload*/
- static gint ett_isakmp_decrypted_data = -1;
- static gint ett_isakmp_decrypted_payloads = -1;
- #endif /* HAVE_LIBGCRYPT */
- static expert_field ei_isakmp_enc_iv = EI_INIT;
- static expert_field ei_isakmp_ikev2_integrity_checksum = EI_INIT;
- static expert_field ei_isakmp_enc_data_length_mult_block_size = EI_INIT;
- static expert_field ei_isakmp_enc_pad_length_big = EI_INIT;
- static dissector_handle_t eap_handle = NULL;
- static reassembly_table isakmp_reassembly_table;
- static const fragment_items isakmp_frag_items = {
- /* Fragment subtrees */
- &ett_isakmp_fragment,
- &ett_isakmp_fragments,
- /* Fragment fields */
- &hf_isakmp_fragments,
- &hf_isakmp_fragment,
- &hf_isakmp_fragment_overlap,
- &hf_isakmp_fragment_overlap_conflicts,
- &hf_isakmp_fragment_multiple_tails,
- &hf_isakmp_fragment_too_long_fragment,
- &hf_isakmp_fragment_error,
- &hf_isakmp_fragment_count,
- /* Reassembled in field */
- &hf_isakmp_reassembled_in,
- /* Reassembled length field */
- &hf_isakmp_reassembled_length,
- /* Reassembled data field */
- NULL,
- /* Tag */
- "Message fragments"
- };
- /* IKE port number assigned by IANA */
- #define UDP_PORT_ISAKMP 500
- #define TCP_PORT_ISAKMP 500
- /*
- * Identifier Type
- * RFC2407 for IKEv1
- * RFC3554 for ID_LIST
- * RFC4306 for IKEv2
- * RFC4595 for ID_FC_NAME
- */
- #define IKE_ID_IPV4_ADDR 1
- #define IKE_ID_FQDN 2
- #define IKE_ID_USER_FQDN 3
- #define IKE_ID_IPV4_ADDR_SUBNET 4
- #define IKE_ID_IPV6_ADDR 5
- #define IKE_ID_IPV6_ADDR_SUBNET 6
- #define IKE_ID_IPV4_ADDR_RANGE 7
- #define IKE_ID_IPV6_ADDR_RANGE 8
- #define IKE_ID_DER_ASN1_DN 9
- #define IKE_ID_DER_ASN1_GN 10
- #define IKE_ID_KEY_ID 11
- #define IKE_ID_LIST 12
- #define IKE_ID_FC_NAME 12
- #define IKE_ID_RFC822_ADDR 3
- /*
- * Traffic Selector Type
- * Not in use for IKEv1
- */
- #define IKEV2_TS_IPV4_ADDR_RANGE 7
- #define IKEV2_TS_IPV6_ADDR_RANGE 8
- #define IKEV2_TS_FC_ADDR_RANGE 9
- /*
- * Configuration Payload Attribute Types
- * draft-ietf-ipsec-isakmp-mode-cfg-05.txt for IKEv1
- * draft-ietf-ipsec-isakmp-xauth-06.txt and draft-beaulieu-ike-xauth-02.txt for XAUTH
- * RFC4306 for IKEv2
- * RFC5739 for INTERNAL_IP6_LINK and INTERNAL_IP6_PREFIX
- */
- #define INTERNAL_IP4_ADDRESS 1
- #define INTERNAL_IP4_NETMASK 2
- #define INTERNAL_IP4_DNS 3
- #define INTERNAL_IP4_NBNS 4
- #define INTERNAL_ADDRESS_EXPIRY 5
- #define INTERNAL_IP4_DHCP 6
- #define APPLICATION_VERSION 7
- #define INTERNAL_IP6_ADDRESS 8
- #define INTERNAL_IP6_NETMASK 9
- #define INTERNAL_IP6_DNS 10
- #define INTERNAL_IP6_NBNS 11
- #define INTERNAL_IP6_DHCP 12
- #define INTERNAL_IP4_SUBNET 13
- #define SUPPORTED_ATTRIBUTES 14
- #define INTERNAL_IP6_SUBNET 15
- #define MIP6_HOME_PREFIX 16
- #define INTERNAL_IP6_LINK 17
- #define INTERNAL_IP6_PREFIX 18
- /* checkpoint configuration attributes */
- #define CHKPT_DEF_DOMAIN 16387
- #define CHKPT_MAC_ADDRESS 16388
- #define CHKPT_MARCIPAN_REASON_CODE 16389
- #define CHKPT_UNKNOWN1 16400
- #define CHKPT_UNKNOWN2 16401
- #define CHKPT_UNKNOWN3 16402
- /* XAUTH configuration attributes */
- #define XAUTH_TYPE 16520
- #define XAUTH_USER_NAME 16521
- #define XAUTH_USER_PASSWORD 16522
- #define XAUTH_PASSCODE 16523
- #define XAUTH_MESSAGE 16524
- #define XAUTH_CHALLENGE 16525
- #define XAUTH_DOMAIN 16526
- #define XAUTH_STATUS 16527
- #define XAUTH_NEXT_PIN 16528
- #define XAUTH_ANSWER 16529
- /* unity (CISCO) configuration attributes */
- #define UNITY_BANNER 28672
- #define UNITY_SAVE_PASSWD 28673
- #define UNITY_DEF_DOMAIN 28674
- #define UNITY_SPLIT_DOMAIN 28675
- #define UNITY_SPLIT_INCLUDE 28676
- #define UNITY_NATT_PORT 28677
- #define UNITY_SPLIT_EXCLUDE 28678
- #define UNITY_PFS 28679
- #define UNITY_FW_TYPE 28680
- #define UNITY_BACKUP_SERVERS 28681
- #define UNITY_DDNS_HOSTNAME 28682
- /* Payload Type
- * RFC2408 / RFC3547 for IKEv1
- * RFC4306 for IKEv2
- */
- #define PLOAD_IKE_NONE 0
- #define PLOAD_IKE_SA 1
- #define PLOAD_IKE_P 2
- #define PLOAD_IKE_T 3
- #define PLOAD_IKE_KE 4
- #define PLOAD_IKE_ID 5
- #define PLOAD_IKE_CERT 6
- #define PLOAD_IKE_CR 7
- #define PLOAD_IKE_HASH 8
- #define PLOAD_IKE_SIG 9
- #define PLOAD_IKE_NONCE 10
- #define PLOAD_IKE_N 11
- #define PLOAD_IKE_D 12
- #define PLOAD_IKE_VID 13
- #define PLOAD_IKE_A 14
- #define PLOAD_IKE_NAT_D48 15
- #define PLOAD_IKE_NAT_OA58 16
- #define PLOAD_IKE_NAT_D 20
- #define PLOAD_IKE_NAT_OA 21
- #define PLOAD_IKE_GAP 22
- #define PLOAD_IKE2_SA 33
- #define PLOAD_IKE2_KE 34
- #define PLOAD_IKE2_IDI 35
- #define PLOAD_IKE2_IDR 36
- #define PLOAD_IKE2_CERT 37
- #define PLOAD_IKE2_CERTREQ 38
- #define PLOAD_IKE2_AUTH 39
- #define PLOAD_IKE2_NONCE 40
- #define PLOAD_IKE2_N 41
- #define PLOAD_IKE2_D 42
- #define PLOAD_IKE2_V 43
- #define PLOAD_IKE2_TSI 44
- #define PLOAD_IKE2_TSR 45
- #define PLOAD_IKE2_SK 46
- #define PLOAD_IKE2_CP 47
- #define PLOAD_IKE2_EAP 48
- #define PLOAD_IKE2_GSPM 49
- #define PLOAD_IKE_NAT_D13 130
- #define PLOAD_IKE_NAT_OA14 131
- #define PLOAD_IKE_CISCO_FRAG 132
- /*
- * IPSEC Situation Definition (RFC2407)
- */
- #define SIT_IDENTITY_ONLY 0x01
- #define SIT_SECRECY 0x02
- #define SIT_INTEGRITY 0x04
- static const value_string exchange_v1_type[] = {
- { 0, "NONE" },
- { 1, "Base" },
- { 2, "Identity Protection (Main Mode)" },
- { 3, "Authentication Only" },
- { 4, "Aggressive" },
- { 5, "Informational" },
- { 6, "Transaction (Config Mode)" },
- { 32, "Quick Mode" },
- { 33, "New Group Mode" },
- { 0, NULL },
- };
- static const value_string exchange_v2_type[] = {
- { 34, "IKE_SA_INIT" },
- { 35, "IKE_AUTH " },
- { 36, "CREATE_CHILD_SA" },
- { 37, "INFORMATIONAL" },
- { 38, "IKE_SESSION_RESUME" }, /* RFC5723 */
- { 0, NULL },
- };
- static const value_string frag_last_vals[] = {
- { 0, "More fragments" },
- { 1, "Last fragment" },
- { 0, NULL },
- };
- /* Ex vs_proto */
- static const value_string protoid_v1_type[] = {
- { 0, "RESERVED" },
- { 1, "ISAKMP" },
- { 2, "IPSEC_AH" },
- { 3, "IPSEC_ESP" },
- { 4, "IPCOMP" },
- { 5, "GIGABEAM_RADIO" }, /* RFC4705 */
- { 0, NULL },
- };
- static const value_string protoid_v2_type[] = {
- { 0, "RESERVED" },
- { 1, "IKE" },
- { 2, "AH" },
- { 3, "ESP" },
- { 4, "FC_ESP_HEADER" },
- { 5, "FC_CT_AUTHENTICATION" },
- { 0, NULL },
- };
- static const range_string payload_type[] = {
- { PLOAD_IKE_NONE,PLOAD_IKE_NONE, "NONE / No Next Payload " },
- { PLOAD_IKE_SA,PLOAD_IKE_SA, "Security Association" },
- { PLOAD_IKE_P,PLOAD_IKE_P, "Proposal" },
- { PLOAD_IKE_T,PLOAD_IKE_T, "Transform" },
- { PLOAD_IKE_KE,PLOAD_IKE_KE, "Key Exchange" },
- { PLOAD_IKE_ID,PLOAD_IKE_ID, "Identification" },
- { PLOAD_IKE_CERT,PLOAD_IKE_CERT, "Certificate" },
- { PLOAD_IKE_CR,PLOAD_IKE_CR, "Certificate Request" },
- { PLOAD_IKE_HASH,PLOAD_IKE_HASH, "Hash" },
- { PLOAD_IKE_SIG,PLOAD_IKE_SIG, "Signature" },
- { PLOAD_IKE_NONCE,PLOAD_IKE_NONCE, "Nonce" },
- { PLOAD_IKE_N,PLOAD_IKE_N, "Notification" },
- { PLOAD_IKE_D,PLOAD_IKE_D, "Delete" },
- { PLOAD_IKE_VID,PLOAD_IKE_VID, "Vendor ID" },
- { PLOAD_IKE_A,PLOAD_IKE_A, "Attributes" }, /* draft-ietf-ipsec-isakmp-mode-cfg-05.txt */
- { PLOAD_IKE_NAT_D48,PLOAD_IKE_NAT_D48, "NAT-Discovery" }, /* draft-ietf-ipsec-nat-t-ike-04 to 08 */
- { PLOAD_IKE_NAT_OA58,PLOAD_IKE_NAT_OA58, "NAT-Original Address"}, /* draft-ietf-ipsec-nat-t-ike-05 to 08*/
- { PLOAD_IKE_NAT_D,PLOAD_IKE_NAT_D, "NAT-D (RFC 3947)" },
- { PLOAD_IKE_NAT_OA,PLOAD_IKE_NAT_OA, "NAT-OA (RFC 3947)"},
- { PLOAD_IKE_GAP,PLOAD_IKE_GAP, "Group Associated Policy"},
- { PLOAD_IKE2_SA,PLOAD_IKE2_SA, "Security Association"},
- { PLOAD_IKE2_KE,PLOAD_IKE2_KE, "Key Exchange"},
- { PLOAD_IKE2_IDI,PLOAD_IKE2_IDI, "Identification - Initiator"},
- { PLOAD_IKE2_IDR,PLOAD_IKE2_IDR, "Identification - Responder"},
- { PLOAD_IKE2_CERT,PLOAD_IKE2_CERT, "Certificate"},
- { PLOAD_IKE2_CERTREQ,PLOAD_IKE2_CERTREQ, "Certificate Request"},
- { PLOAD_IKE2_AUTH,PLOAD_IKE2_AUTH, "Authentication"},
- { PLOAD_IKE2_NONCE,PLOAD_IKE2_NONCE, "Nonce"},
- { PLOAD_IKE2_N,PLOAD_IKE2_N, "Notify"},
- { PLOAD_IKE2_D,PLOAD_IKE2_D, "Delete"},
- { PLOAD_IKE2_V,PLOAD_IKE2_V, "Vendor ID"},
- { PLOAD_IKE2_TSI,PLOAD_IKE2_TSI, "Traffic Selector - Initiator"},
- { PLOAD_IKE2_TSR,PLOAD_IKE2_TSR, "Traffic Selector - Responder"},
- { PLOAD_IKE2_SK,PLOAD_IKE2_SK, "Encrypted and Authenticated"},
- { PLOAD_IKE2_CP,PLOAD_IKE2_CP, "Configuration"},
- { PLOAD_IKE2_EAP,PLOAD_IKE2_EAP, "Extensible Authentication"},
- { PLOAD_IKE2_GSPM,PLOAD_IKE2_GSPM, "Generic Secure Password Method"},
- { 50,127, "Unassigned" },
- { 128,129, "Private Use" },
- { PLOAD_IKE_NAT_D13,PLOAD_IKE_NAT_D13, "NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03)"},
- { PLOAD_IKE_NAT_OA14,PLOAD_IKE_NAT_OA14, "NAT-OA (draft-ietf-ipsec-nat-t-ike-01 to 03)"},
- { PLOAD_IKE_CISCO_FRAG,PLOAD_IKE_CISCO_FRAG, "Cisco-Fragmentation"},
- { 133,256, "Private Use" },
- { 0,0, NULL },
- };
- /*
- * ISAKMP Domain of Interpretation (DOI)
- * RFC2408 for ISAKMP
- * RFC2407 for IPSEC
- * RFC3547 for GDOI
- */
- static const value_string doi_type[] = {
- { 0, "ISAKMP" },
- { 1, "IPSEC" },
- { 2, "GDOI" },
- { 0, NULL },
- };
- /* Transform Type */
- #define ISAKMP_ATTR_LIFE_TYPE 1
- #define ISAKMP_ATTR_LIFE_DURATION 2
- #define ISAKMP_ATTR_GROUP_DESC 3
- #define ISAKMP_ATTR_ENCAP_MODE 4
- #define ISAKMP_ATTR_AUTH_ALGORITHM 5
- #define ISAKMP_ATTR_KEY_LENGTH 6
- #define ISAKMP_ATTR_KEY_ROUNDS 7
- #define ISAKMP_ATTR_CMPR_DICT_SIZE 8
- #define ISAKMP_ATTR_CMPR_ALGORITHM 9
- #define ISAKMP_ATTR_ECN_TUNNEL 10 /* [RFC3168] */
- #define ISAKMP_ATTR_EXT_SEQ_NBR 11 /* [RFC4304] */
- #define ISAKMP_ATTR_AUTH_KEY_LENGTH 12 /* [RFC4359] */
- #define ISAKMP_ATTR_SIG_ENCO_ALGORITHM 13 /* [RFC4359] */
- #define ISAKMP_ATTR_ADDR_PRESERVATION 14 /* [RFC6407] */
- #define ISAKMP_ATTR_SA_DIRECTION 15 /* [RFC6407] */
- static const value_string transform_isakmp_attr_type[] = {
- { ISAKMP_ATTR_LIFE_TYPE, "SA-Life-Type" },
- { ISAKMP_ATTR_LIFE_DURATION, "SA-Life-Duration" },
- { ISAKMP_ATTR_GROUP_DESC, "Group-Description" },
- { ISAKMP_ATTR_ENCAP_MODE, "Encapsulation-Mode" },
- { ISAKMP_ATTR_AUTH_ALGORITHM, "Authentication-Algorithm" },
- { ISAKMP_ATTR_KEY_LENGTH, "Key-Length" },
- { ISAKMP_ATTR_KEY_ROUNDS, "Key-Rounds" },
- { ISAKMP_ATTR_CMPR_DICT_SIZE, "Compress-Dictionary-Size" },
- { ISAKMP_ATTR_CMPR_ALGORITHM, "Compress-Private-Algorithm" },
- { ISAKMP_ATTR_ECN_TUNNEL, "ECN Tunnel" },
- { ISAKMP_ATTR_EXT_SEQ_NBR, "Extended (64-bit) Sequence Number" },
- { ISAKMP_ATTR_AUTH_KEY_LENGTH, "Authentication Key Length" },
- { ISAKMP_ATTR_SIG_ENCO_ALGORITHM, "Signature Encoding Algorithm" },
- { ISAKMP_ATTR_ADDR_PRESERVATION, "Address Preservation" },
- { ISAKMP_ATTR_SA_DIRECTION, "SA Direction" },
- { 0, NULL },
- };
- /* Transform IKE Type */
- #define IKE_ATTR_ENCRYPTION_ALGORITHM 1
- #define IKE_ATTR_HASH_ALGORITHM 2
- #define IKE_ATTR_AUTHENTICATION_METHOD 3
- #define IKE_ATTR_GROUP_DESCRIPTION 4
- #define IKE_ATTR_GROUP_TYPE 5
- #define IKE_ATTR_GROUP_PRIME 6
- #define IKE_ATTR_GROUP_GENERATOR_ONE 7
- #define IKE_ATTR_GROUP_GENERATOR_TWO 8
- #define IKE_ATTR_GROUP_CURVE_A 9
- #define IKE_ATTR_GROUP_CURVE_B 10
- #define IKE_ATTR_LIFE_TYPE 11
- #define IKE_ATTR_LIFE_DURATION 12
- #define IKE_ATTR_PRF 13
- #define IKE_ATTR_KEY_LENGTH 14
- #define IKE_ATTR_FIELD_SIZE 15
- #define IKE_ATTR_GROUP_ORDER 16
- static const value_string transform_ike_attr_type[] = {
- { IKE_ATTR_ENCRYPTION_ALGORITHM,"Encryption-Algorithm" },
- { IKE_ATTR_HASH_ALGORITHM, "Hash-Algorithm" },
- { IKE_ATTR_AUTHENTICATION_METHOD,"Authentication-Method" },
- { IKE_ATTR_GROUP_DESCRIPTION, "Group-Description" },
- { IKE_ATTR_GROUP_TYPE, "Group-Type" },
- { IKE_ATTR_GROUP_PRIME, "Group-Prime" },
- { IKE_ATTR_GROUP_GENERATOR_ONE,"Group-Generator-One" },
- { IKE_ATTR_GROUP_GENERATOR_TWO,"Group-Generator-Two" },
- { IKE_ATTR_GROUP_CURVE_A, "Group-Curve-A" },
- { IKE_ATTR_GROUP_CURVE_B, "Group-Curve-B" },
- { IKE_ATTR_LIFE_TYPE, "Life-Type" },
- { IKE_ATTR_LIFE_DURATION, "Life-Duration" },
- { IKE_ATTR_PRF, "PRF" },
- { IKE_ATTR_KEY_LENGTH, "Key-Length" },
- { IKE_ATTR_FIELD_SIZE, "Field-Size" },
- { IKE_ATTR_GROUP_ORDER, "Group-Order" },
- { 0, NULL },
- };
- static const value_string vs_v2_sttr[] = {
- { 1, "SA-Life-Type" },
- { 2, "SA-Life-Duration" },
- { 3, "Group-Description" },
- { 4, "Encapsulation-Mode" },
- { 5, "Authentication-Algorithm" },
- { 6, "Key-Length" },
- { 7, "Key-Rounds" },
- { 8, "Compress-Dictionary-Size" },
- { 9, "Compress-Private-Algorithm" },
- { 10, "ECN Tunnel" },
- { 0, NULL },
- };
- static const value_string vs_v1_trans_isakmp[] = {
- { 0, "RESERVED" },
- { 1, "KEY_IKE" },
- { 0, NULL },
- };
- static const value_string vs_v1_trans_ah[] = {
- { 0, "RESERVED" },
- { 1, "RESERVED" },
- { 2, "MD5" },
- { 3, "SHA" },
- { 4, "DES" },
- { 5, "SHA2-256" },
- { 6, "SHA2-384" },
- { 7, "SHA2-512" },
- { 0, NULL },
- };
- static const value_string vs_v1_trans_esp[] = {
- { 0, "RESERVED" },
- { 1, "DES-IV64" },
- { 2, "DES" },
- { 3, "3DES" },
- { 4, "RC5" },
- { 5, "IDEA" },
- { 6, "CAST" },
- { 7, "BLOWFISH" },
- { 8, "3IDEA" },
- { 9, "DES-IV32" },
- { 10, "RC4" },
- { 11, "NULL" },
- { 12, "AES" },
- { 0, NULL },
- };
- static const value_string transform_id_ipcomp[] = {
- { 0, "RESERVED" },
- { 1, "OUI" },
- { 2, "DEFLATE" },
- { 3, "LZS" },
- { 4, "LZJH" },
- { 0, NULL },
- };
- static const value_string redirect_gateway_identity_type[] = {
- { 1, "IPv4 address" },
- { 2, "IPv6 address" },
- { 3, "FQDN" },
- { 0, NULL },
- };
- static const value_string transform_attr_sa_life_type[] = {
- { 0, "RESERVED" },
- { 1, "Seconds" },
- { 2, "Kilobytes" },
- { 0, NULL },
- };
- static const value_string transform_attr_encap_type[] = {
- { 0, "RESERVED" },
- { 1, "Tunnel" },
- { 2, "Transport" },
- { 3, "UDP-Encapsulated-Tunnel" }, /* RFC3947 */
- { 4, "UDP-Encapsulated-Transport" }, /* RFC3947 */
- { 61440, "Check Point IPSec UDP Encapsulation" },
- { 61443, "UDP-Encapsulated-Tunnel (draft)" },
- { 61444, "UDP-Encapsulated-Transport (draft)" },
- { 0, NULL },
- };
- static const value_string transform_attr_auth_type[] = {
- { 0, "RESERVED" },
- { 1, "HMAC-MD5" },
- { 2, "HMAC-SHA" },
- { 3, "DES-MAC" },
- { 4, "KPDK" },
- { 5, "HMAC-SHA2-256" },
- { 6, "HMAC-SHA2-384" },
- { 7, "HMAC-SHA2-512" },
- { 8, "HMAC-RIPEMD" }, /* [RFC2857] */
- { 9, "AES-XCBC-MAC" }, /* [RFC3566] */
- { 10, "SIG-RSA" }, /* [RFC4359] */
- { 11, "AES-128-GMAC" }, /* [RFC4543][Errata1821] */
- { 12, "AES-192-GMAC" }, /* [RFC4543][Errata1821] */
- { 13, "AES-256-GMAC" }, /* [RFC4543][Errata1821] */
- /*
- Values 11-61439 are reserved to IANA. Values 61440-65535 are
- for private use.
- */
- { 0, NULL },
- };
- #define ENC_DES_CBC 1
- #define ENC_IDEA_CBC 2
- #define ENC_BLOWFISH_CBC 3
- #define ENC_RC5_R16_B64_CBC 4
- #define ENC_3DES_CBC 5
- #define ENC_CAST_CBC 6
- #define ENC_AES_CBC 7
- #define ENC_CAMELLIA_CBC 8
- static const value_string transform_attr_enc_type[] = {
- { 0, "RESERVED" },
- { ENC_DES_CBC, "DES-CBC" },
- { ENC_IDEA_CBC, "IDEA-CBC" },
- { ENC_BLOWFISH_CBC, "BLOWFISH-CBC" },
- { ENC_RC5_R16_B64_CBC, "RC5-R16-B64-CBC" },
- { ENC_3DES_CBC, "3DES-CBC" },
- { ENC_CAST_CBC, "CAST-CBC" },
- { ENC_AES_CBC, "AES-CBC" },
- { ENC_CAMELLIA_CBC, "CAMELLIA-CBC" },
- { 0, NULL },
- };
- #define HMAC_MD5 1
- #define HMAC_SHA 2
- #define HMAC_TIGER 3
- #define HMAC_SHA2_256 4
- #define HMAC_SHA2_384 5
- #define HMAC_SHA2_512 6
- static const value_string transform_attr_hash_type[] = {
- { 0, "RESERVED" },
- { HMAC_MD5, "MD5" },
- { HMAC_SHA, "SHA" },
- { HMAC_TIGER, "TIGER" },
- { HMAC_SHA2_256, "SHA2-256" },
- { HMAC_SHA2_384, "SHA2-384" },
- { HMAC_SHA2_512, "SHA2-512" },
- { 0, NULL },
- };
- static const value_string transform_attr_ecn_type[] = {
- { 0, "RESERVED" },
- { 1, "Allowed" },
- { 2, "Forbidden" },
- { 0, NULL },
- };
- static const value_string transform_attr_ext_seq_nbr_type[] = {
- { 0, "RESERVED" },
- { 1, "64-bit Sequence Number" },
- { 0, NULL },
- };
- static const value_string transform_attr_sig_enco_algo_type[] = {
- { 0, "RESERVED" },
- { 1, "RSASSA-PKCS1-v1_5" },
- { 2, "RSASSA-PSS" },
- { 0, NULL },
- };
- static const value_string transform_attr_addr_preservation_type[] = {
- { 0, "Reserved" },
- { 1, "None" },
- { 2, "Source-Only" },
- { 3, "Destination-Only" },
- { 4, "Source-and-Destination" },
- { 0, NULL },
- };
- static const value_string transform_attr_sa_direction_type[] = {
- { 0, "Reserved" },
- { 1, "Sender-Only" },
- { 2, "Receiver-Only" },
- { 3, "Symmetric" },
- { 0, NULL },
- };
- static const value_string transform_attr_authmeth_type[] = {
- { 0, "RESERVED" },
- { 1, "PSK" },
- { 2, "DSS-SIG" },
- { 3, "RSA-SIG" },
- { 4, "RSA-ENC" },
- { 5, "RSA-Revised-ENC" },
- { 6, "Encryption with El-Gamal" },
- { 7, "Revised encryption with El-Gamal" },
- { 8, "ECDSA signatures" },
- { 9, "AES-XCBC-MAC" },
- { 64221, "HybridInitRSA" },
- { 64222, "HybridRespRSA" },
- { 64223, "HybridInitDSS" },
- { 64224, "HybridRespDSS" },
- { 65001, "XAUTHInitPreShared" },
- { 65002, "XAUTHRespPreShared" },
- { 65003, "XAUTHInitDSS" },
- { 65004, "XAUTHRespDSS" },
- { 65005, "XAUTHInitRSA" },
- { 65006, "XAUTHRespRSA" },
- { 65007, "XAUTHInitRSAEncryption" },
- { 65008, "XAUTHRespRSAEncryption" },
- { 65009, "XAUTHInitRSARevisedEncryption" },
- { 65010, "XAUTHRespRSARevisedEncryption" },
- { 0, NULL },
- };
- static const value_string transform_dh_group_type[] = {
- { 0, "UNDEFINED - 0" },
- { 1, "Default 768-bit MODP group" },
- { 2, "Alternate 1024-bit MODP group" },
- { 3, "EC2N group on GP[2^155] group" },
- { 4, "EC2N group on GP[2^185] group" },
- { 5, "1536 bit MODP group" },
- { 6, "EC2N group over GF[2^163]" },
- { 7, "EC2N group over GF[2^163]" },
- { 8, "EC2N group over GF[2^283]" },
- { 9, "EC2N group over GF[2^283]" },
- { 10, "EC2N group over GF[2^409]" },
- { 11, "EC2N group over GF[2^409]" },
- { 12, "EC2N group over GF[2^571]" },
- { 13, "EC2N group over GF[2^571]" },
- { 14, "2048 bit MODP group" },
- { 15, "3072 bit MODP group" },
- { 16, "4096 bit MODP group" },
- { 17, "6144 bit MODP group" },
- { 18, "8192 bit MODP group" },
- { 19, "256-bit random ECP group" },
- { 20, "384-bit random ECP group" },
- { 21, "521-bit random ECP group" },
- { 22, "1024-bit MODP Group with 160-bit Prime Order Subgroup" },
- { 23, "2048-bit MODP Group with 224-bit Prime Order Subgroup" },
- { 24, "2048-bit MODP Group with 256-bit Prime Order Subgroup" },
- { 25, "192-bit Random ECP Group" },
- { 26, "224-bit Random ECP Group" },
- { 0, NULL }
- };
- static const value_string transform_attr_grp_type[] = {
- { 0, "UNDEFINED - 0" },
- { 1, "MODP" },
- { 2, "ECP" },
- { 3, "EC2N" },
- { 0, NULL },
- };
- #define TF_IKE2_ENCR 1
- #define TF_IKE2_PRF 2
- #define TF_IKE2_INTEG 3
- #define TF_IKE2_DH 4
- #define TF_IKE2_ESN 5
- static const range_string transform_ike2_type[] = {
- { 0,0, "RESERVED" },
- { TF_IKE2_ENCR,TF_IKE2_ENCR, "Encryption Algorithm (ENCR)" },
- { TF_IKE2_PRF,TF_IKE2_PRF, "Pseudo-random Function (PRF)"},
- { TF_IKE2_INTEG,TF_IKE2_INTEG,"Integrity Algorithm (INTEG)"},
- { TF_IKE2_DH,TF_IKE2_DH, "Diffie-Hellman Group (D-H)"},
- { TF_IKE2_ESN,TF_IKE2_ESN, "Extended Sequence Numbers (ESN)"},
- { 6,240, "Reserved to IANA"},
- { 241,255, "Private Use"},
- { 0,0, NULL },
- };
- /* For Transform Type 1 (Encryption Algorithm), defined Transform IDs */
- static const value_string transform_ike2_encr_type[] = {
- { 0, "RESERVED" },
- { 1, "ENCR_DES_IV64" },
- { 2, "ENCR_DES" },
- { 3, "ENCR_3DES" },
- { 4, "ENCR_RC5" },
- { 5, "ENCR_IDEA" },
- { 6, "ENCR_CAST" },
- { 7, "ENCR_BLOWFISH" },
- { 8, "ENCR_3IDEA" },
- { 9, "ENCR_DES_IV32" },
- { 10, "RESERVED" },
- { 11, "ENCR_NULL" },
- { 12, "ENCR_AES_CBC" },
- { 13, "ENCR_AES_CTR" }, /* [RFC3686] */
- { 14, "ENCR_AES-CCM_8" }, /* [RFC4309] */
- { 15, "ENCR-AES-CCM_12" }, /* [RFC4309] */
- { 16, "ENCR-AES-CCM_16" }, /* [RFC4309] */
- { 17, "UNASSIGNED" },
- { 18, "AES-GCM with a 8 octet ICV" }, /* [RFC4106] */
- { 19, "AES-GCM with a 12 octet ICV" }, /* [RFC4106] */
- { 20, "AES-GCM with a 16 octet ICV" }, /* [RFC4106] */
- { 21, "ENCR_NULL_AUTH_AES_GMAC" }, /* [RFC4543] */
- { 22, "Reserved for IEEE P1619 XTS-AES" }, /* [Ball] */
- { 23, "ENCR_CAMELLIA_CBC" }, /* [RFC5529] */
- { 24, "ENCR_CAMELLIA_CTR" }, /* [RFC5529] */
- { 25, "ENCR_CAMELLIA_CCM with an 8-octet ICV" }, /* [RFC5529] */
- { 26, "ENCR_CAMELLIA_CCM with a 12-octet ICV" }, /* [RFC5529] */
- { 27, "ENCR_CAMELLIA_CCM with a 16-octet ICV" }, /* [RFC5529] */
- /*
- * 28-1023 RESERVED TO IANA [RFC4306]
- * 1024-65535 PRIVATE USE [RFC4306]
- */
- { 0, NULL },
- };
- /* For Transform Type 2 (Pseudo-random Function), defined Transform IDs */
- static const value_string transform_ike2_prf_type[] = {
- { 0, "RESERVED" },
- { 1, "PRF_HMAC_MD5" },
- { 2, "PRF_HMAC_SHA1" },
- { 3, "PRF_HMAC_TIGER" },
- { 4, "PRF_AES128_CBC" },
- { 5, "PRF_HMAC_SHA2_256" }, /* [RFC4868] */
- { 6, "PRF_HMAC_SHA2_384" }, /* [RFC4868] */
- { 7, "PRF_HMAC_SHA2_512" }, /* [RFC4868] */
- { 8, "PRF_AES128_CMAC6" }, /* [RFC4615] */
- /*
- 9-1023 RESERVED TO IANA [RFC4306]
- 1024-65535 PRIVATE USE [RFC4306]
- */
- { 0, NULL },
- };
- /* For Transform Type 3 (Integrity Algorithm), defined Transform IDs */
- static const value_string transform_ike2_integ_type[] = {
- { 0, "NONE" },
- { 1, "AUTH_HMAC_MD5_96" },
- { 2, "AUTH_HMAC_SHA1_96" },
- { 3, "AUTH_DES_MAC" },
- { 4, "AUTH_KPDK_MD5" },
- { 5, "AUTH_AES_XCBC_96" },
- { 6, "AUTH_HMAC_MD5_128" }, /* [RFC4595] */
- { 7, "AUTH_HMAC_SHA1_160" }, /* [RFC4595] */
- { 8, "AUTH_AES_CMAC_96" }, /* [RFC4494] */
- { 9, "AUTH_AES_128_GMAC" }, /* [RFC4543] */
- { 10, "AUTH_AES_192_GMAC" }, /* [RFC4543] */
- { 11, "AUTH_AES_256_GMAC" }, /* [RFC4543] */
- { 12, "AUTH_HMAC_SHA2_256_128" }, /* [RFC4868] */
- { 13, "AUTH_HMAC_SHA2_384_192" }, /* [RFC4868] */
- { 14, "AUTH_HMAC_SHA2_512_256" }, /* [RFC4868] */
- /*
- 15-1023 RESERVED TO IANA [RFC4306]
- 1024-65535 PRIVATE USE [RFC4306]
- */
- { 0, NULL },
- };
- /* For Transform Type 5 (Extended Sequence Numbers), defined Transform */
- static const value_string transform_ike2_esn_type[] = {
- { 0, "No Extended Sequence Numbers" },
- { 1, "Extended Sequence Numbers" },
- { 0, NULL },
- };
- /* Transform IKE2 Type */
- #define IKE2_ATTR_KEY_LENGTH 14
- static const value_string transform_ike2_attr_type[] = {
- { IKE2_ATTR_KEY_LENGTH, "Key-Length" },
- { 0, NULL },
- };
- static const range_string cert_v1_type[] = {
- { 0,0, "NONE" },
- { 1,1, "PKCS #7 wrapped X.509 certificate" },
- { 2,2, "PGP Certificate" },
- { 3,3, "DNS Signed Key" },
- { 4,4, "X.509 Certificate - Signature" },
- { 5,5, "X.509 Certificate - Key Exchange" },
- { 6,6, "Kerberos Tokens" },
- { 7,7, "Certificate Revocation List (CRL)" },
- { 8,8, "Authority Revocation List (ARL)" },
- { 9,9, "SPKI Certificate" },
- { 10,10, "X.509 Certificate - Attribute" },
- { 11,255, "RESERVED" },
- { 0,0, NULL },
- };
- static const range_string cert_v2_type[] = {
- { 0,0, "RESERVED" },
- { 1,1, "PKCS #7 wrapped X.509 certificate" },
- { 2,2, "PGP Certificate" },
- { 3,3, "DNS Signed Key" },
- { 4,4, "X.509 Certificate - Signature" },
- { 5,5, "*undefined by any document*" },
- { 6,6, "Kerberos Tokens" },
- { 7,7, "Certificate Revocation List (CRL)" },
- { 8,8, "Authority Revocation List (ARL)" },
- { 9,9, "SPKI Certificate" },
- { 10,10, "X.509 Certificate - Attribute" },
- { 11,11, "Raw RSA Key" },
- { 12,12, "Hash and URL of X.509 certificate" },
- { 13,13, "Hash and URL of X.509 bundle" },
- { 14,14, "OCSP Content" }, /* [RFC4806] */
- { 15,200, "RESERVED to IANA" },
- { 201,255, "PRIVATE USE" },
- { 0,0, NULL },
- };
- static const range_string authmeth_v2_type[] = {
- { 0,0, "RESERVED TO IANA" },
- { 1,1, "RSA Digital Signature" },
- { 2,2, "Shared Key Message Integrity Code" },
- { 3,3, "DSS Digital Signature" },
- { 4,8, "RESERVED TO IANA" },
- { 9,9, "ECDSA with SHA-256 on the P-256 curve" }, /* RFC4754 */
- { 10,10, "ECDSA with SHA-256 on the P-256 curve" }, /* RFC4754 */
- { 11,11, "ECDSA with SHA-256 on the P-256 curve" }, /* RFC4754 */
- { 12,12, "Generic Secure Password Authentication Method" }, /* RFC6467 */
- { 13,200, "RESERVED TO IANA" },
- { 201,255, "PRIVATE USE" },
- { 0,0, NULL },
- };
- static const range_string notifmsg_v1_type[] = {
- { 0,0, "<UNKNOWN>" },
- { 1,1, "INVALID-PAYLOAD-TYPE" },
- { 2,2, "DOI-NOT-SUPPORTED" },
- { 3,3, "SITUATION-NOT-SUPPORTED" },
- { 4,4, "INVALID-COOKIE" },
- { 5,5, "INVALID-MAJOR-VERSION" },
- { 6,6, "INVALID-MINOR-VERSION" },
- { 7,7, "INVALID-EXCHANGE-TYPE" },
- { 8,8, "INVALID-FLAGS" },
- { 9,9, "INVALID-MESSAGE-ID" },
- { 10,10, "INVALID-PROTOCOL-ID" },
- { 11,11, "INVALID-SPI" },
- { 12,12, "INVALID-TRANSFORM-ID" },
- { 13,13, "ATTRIBUTES-NOT-SUPPORTED" },
- { 14,14, "NO-PROPOSAL-CHOSEN" },
- { 15,15, "BAD-PROPOSAL-SYNTAX" },
- { 16,16, "PAYLOAD-MALFORMED" },
- { 17,17, "INVALID-KEY-INFORMATION" },
- { 18,18, "INVALID-ID-INFORMATION" },
- { 19,19, "INVALID-CERT-ENCODING" },
- { 20,20, "INVALID-CERTIFICATE" },
- { 21,21, "CERT-TYPE-UNSUPPORTED" },
- { 22,22, "INVALID-CERT-AUTHORITY" },
- { 23,23, "INVALID-HASH-INFORMATION" },
- { 24,24, "AUTHENTICATION-FAILED" },
- { 25,25, "INVALID-SIGNATURE" },
- { 26,26, "ADDRESS-NOTIFICATION" },
- { 27,27, "NOTIFY-SA-LIFETIME" },
- { 28,28, "CERTIFICATE-UNAVAILABLE" },
- { 29,29, "UNSUPPORTED-EXCHANGE-TYPE" },
- { 30,30, "UNEQUAL-PAYLOAD-LENGTHS" },
- { 31,8191, "RESERVED (Future Use)" },
- { 8192,16383, "Private Use" },
- { 16384,16384,"CONNECTED" },
- { 16385,24575,"RESERVED (Future Use)" },
- { 24576,24576,"RESPONDER-LIFETIME" },
- { 24577,24577,"REPLAY-STATUS" },
- { 24578,24578,"INITIAL-CONTACT" },
- { 24579,32767,"DOI-specific codes" },
- { 32768,36135,"Private Use" },
- { 36136,36136,"R-U-THERE" },
- { 36137,36137,"R-U-THERE-ACK" },
- { 36138,40500,"Private Use" },
- { 40501,40501,"UNITY-LOAD-BALANCE" },
- { 40502,40502,"UNITY-UNKNOWN" },
- { 40503,40503,"UNITY-GROUP-HASH" },
- { 40503,40959,"Private Use" },
- { 40960,65535,"RESERVED (Future Use)" },
- { 0,0, NULL },
- };
- static const range_string notifmsg_v2_type[] = {
- { 0,0, "RESERVED" },
- { 1,1, "UNSUPPORTED_CRITICAL_PAYLOAD" },
- { 2,3, "RESERVED" },
- { 4,4, "INVALID_IKE_SPI" },
- { 5,5, "INVALID_MAJOR_VERSION" },
- { 6,6, "RESERVED" },
- { 7,7, "INVALID_SYNTAX" },
- { 8,8, "RESERVED" },
- { 9,9, "INVALID_MESSAGE_ID" },
- { 10,10, "RESERVED" },
- { 11,11, "INVALID_SPI" },
- { 12,13, "RESERVED" },
- { 14,14, "NO_PROPOSAL_CHOSEN" },
- { 15,16, "RESERVED" },
- { 17,17, "INVALID_KE_PAYLOAD" },
- { 15,16, "RESERVED" },
- { 24,24, "AUTHENTICATION_FAILED" },
- { 25,33, "RESERVED" },
- { 34,34, "SINGLE_PAIR_REQUIRED" },
- { 35,35, "NO_ADDITIONAL_SAS" },
- { 36,36, "INTERNAL_ADDRESS_FAILURE" },
- { 37,37, "FAILED_CP_REQUIRED" },
- { 38,38, "TS_UNACCEPTABLE" },
- { 39,39, "INVALID_SELECTORS" },
- { 40,40, "UNACCEPTABLE_ADDRESSES" }, /* RFC4555 */
- { 41,41, "UNEXPECTED_NAT_DETECTED" }, /* RFC4555 */
- { 42,42, "USE_ASSIGNED_HoA" }, /* RFC5026 */
- { 43,43, "TEMPORARY_FAILURE" }, /* RFC5996 */
- { 44,44, "CHILD_SA_NOT_FOUND" }, /* RFC5996 */
- { 45,8191, "RESERVED TO IANA - Error types" },
- { 8192,16383, "Private Use - Errors" },
- { 16384,16384, "INITIAL_CONTACT" },
- { 16385,16385, "SET_WINDOW_SIZE" },
- { 16386,16386, "ADDITIONAL_TS_POSSIBLE" },
- { 16387,16387, "IPCOMP_SUPPORTED" },
- { 16388,16388, "NAT_DETECTION_SOURCE_IP" },
- { 16389,16389, "NAT_DETECTION_DESTINATION_IP" },
- { 16390,16390, "COOKIE" },
- { 16391,16391, "USE_TRANSPORT_MODE" },
- { 16392,16392, "HTTP_CERT_LOOKUP_SUPPORTED" },
- { 16393,16393, "REKEY_SA" },
- { 16394,16394, "ESP_TFC_PADDING_NOT_SUPPORTED" },
- { 16395,16395, "NON_FIRST_FRAGMENTS_ALSO" },
- { 16396,16396, "MOBIKE_SUPPORTED" }, /* RFC4555 */
- { 16397,16397, "ADDITIONAL_IP4_ADDRESS" }, /* RFC4555 */
- { 16398,16398, "ADDITIONAL_IP6_ADDRESS" }, /* RFC4555 */
- { 16399,16399, "NO_ADDITIONAL_ADDRESSES" }, /* RFC4555 */
- { 16400,16400, "UPDATE_SA_ADDRESSES" }, /* RFC4555 */
- { 16401,16401, "COOKIE2" }, /* RFC4555 */
- { 16402,16402, "NO_NATS_ALLOWED" }, /* RFC4555 */
- { 16403,16403, "AUTH_LIFETIME" }, /* RFC4478 */
- { 16404,16404, "MULTIPLE_AUTH_SUPPORTED" }, /* RFC4739 */
- { 16405,16405, "ANOTHER_AUTH_FOLLOWS" }, /* RFC4739 */
- { 16406,16406, "REDIRECT_SUPPORTED" }, /* RFC5685 */
- { 16407,16407, "REDIRECT" }, /* RFC5685 */
- { 16408,16408, "REDIRECTED_FROM" }, /* RFC5685 */
- { 16409,16409, "TICKET_LT_OPAQUE" }, /* RFC5723 */
- { 16410,16410, "TICKET_REQUEST" }, /* RFC5723 */
- { 16411,16411, "TICKET_ACK" }, /* RFC5723 */
- { 16412,16412, "TICKET_NACK" }, /* RFC5723 */
- { 16413,16413, "TICKET_OPAQUE" }, /* RFC5723 */
- { 16414,16414, "LINK_ID" }, /* RFC5739 */
- { 16415,16415, "USE_WESP_MODE" }, /* RFC5840 */
- { 16416,16416, "ROHC_SUPPORTED" }, /* RFC5857 */
- { 16417,16417, "EAP_ONLY_AUTHENTICATION" }, /* RFC5998 */
- { 16418,16418, "CHILDLESS_IKEV2_SUPPORTED" }, /* RFC6023 */
- { 16419,16419, "QUICK_CRASH_DETECTION" }, /* RFC6290 */
- { 16420,16420, "IKEV2_MESSAGE_ID_SYNC_SUPPORTED" }, /* RFC6311 */
- { 16421,16421, "IPSEC_REPLAY_COUNTER_SYNC_SUPPORTED" },/* RFC6311 */
- { 16422,16422, "IKEV2_MESSAGE_ID_SYNC" }, /* RFC6311 */
- { 16423,16423, "IPSEC_REPLAY_COUNTER_SYNC" }, /* RFC6311 */
- { 16424,16424, "SECURE_PASSWORD_METHODS" }, /* RFC6467 */
- { 16425,40959, "RESERVED TO IANA - STATUS TYPES" },
- { 40960,65535, "Private Use - STATUS TYPES" },
- { 0,0, NULL },
- };
- static const range_string vs_v1_cfgtype[] = {
- { 0,0, "Reserved" },
- { 1,1, "ISAKMP_CFG_REQUEST" },
- { 2,2, "ISAKMP_CFG_REPLY" },
- { 3,3, "ISAKMP_CFG_SET" },
- { 4,4, "ISAKMP_CFG_ACK" },
- { 5,127, "Future use" },
- { 128,256, "Private Use" },
- { 0,0, NULL },
- };
- static const range_string vs_v2_cfgtype[] = {
- { 0,0, "RESERVED" },
- { 1,1, "CFG_REQUEST" },
- { 2,2, "CFG_REPLY" },
- { 3,3, "CFG_SET" },
- { 4,4, "CFG_ACK" },
- { 5,127, "Future use" },
- { 128,256, "Private Use" },
- { 0,0, NULL },
- };
- static const range_string vs_v1_cfgattr[] = {
- { 0,0, "RESERVED" },
- { 1,1, "INTERNAL_IP4_ADDRESS" },
- { 2,2, "INTERNAL_IP4_NETMASK" },
- { 3,3, "INTERNAL_IP4_DNS" },
- { 4,4, "INTERNAL_IP4_NBNS" },
- { 5,5, "INTERNAL_ADDRESS_EXPIREY" },
- { 6,6, "INTERNAL_IP4_DHCP" },
- { 7,7, "APPLICATION_VERSION" },
- { 8,8, "INTERNAL_IP6_ADDRESS" },
- { 9,9, "INTERNAL_IP6_NETMASK" },
- { 10,10, "INTERNAL_IP6_DNS" },
- { 11,11, "INTERNAL_IP6_NBNS" },
- { 12,12, "INTERNAL_IP6_DHCP" },
- { 13,13, "INTERNAL_IP4_SUBNET" },
- { 14,14, "SUPPORTED_ATTRIBUTES" },
- { 15,16383, "FUTURE USE"},
- { 16384,16386, "PRIVATE USE"},
- { 16387,16387, "CHKPT_DEF_DOMAIN" },
- { 16388,16388, "CHKPT_MAC_ADDRESS" },
- { 16389,16389, "CHKPT_MARCIPAN_REASON_CODE" },
- { 16400,16400, "CHKPT_UNKNOWN1" },
- { 16401,16401, "CHKPT_UNKNOWN2" },
- { 16402,16402, "CHKPT_UNKNOWN3" },
- { 16403,16519, "PRIVATE USE"},
- { 16520,16520, "XAUTH_TYPE" },
- { 16521,16521, "XAUTH_USER_NAME" },
- { 16522,16522, "XAUTH_USER_PASSWORD" },
- { 16523,16523, "XAUTH_PASSCODE" },
- { 16524,16524, "XAUTH_MESSAGE" },
- { 16525,16525, "XAUTH_CHALLANGE" },
- { 16526,16526, "XAUTH_DOMAIN" },
- { 16527,16527, "XAUTH_STATUS" },
- { 16528,16528, "XAUTH_NEXT_PIN" },
- { 16529,16529, "XAUTH_ANSWER" },
- { 16530,28671, "PRIVATE USE"},
- { 28672,28672, "UNITY_BANNER" },
- { 28673,28673, "UNITY_SAVE_PASSWD" },
- { 28674,28674, "UNITY_DEF_DOMAIN" },
- { 28675,28675, "UNITY_SPLIT_DOMAIN" },
- { 28676,28676, "UNITY_SPLIT_INCLUDE" },
- { 28677,28677, "UNITY_NATT_PORT" },
- { 28678,28678, "UNITY_SPLIT_EXCLUDE" },
- { 28679,28679, "UNITY_PFS" },
- { 28680,28680, "UNITY_FW_TYPE" },
- { 28681,28681, "UNITY_BACKUP_SERVERS" },
- { 28682,28682, "UNITY_DDNS_HOSTNAME" },
- { 28683,32767, "PRIVATE USE"},
- { 0,0, NULL },
- };
- static const range_string vs_v2_cfgattr[] = {
- { 0,0, "RESERVED" },
- { 1,1, "INTERNAL_IP4_ADDRESS" },
- { 2,2, "INTERNAL_IP4_NETMASK" },
- { 3,3, "INTERNAL_IP4_DNS" },
- { 4,4, "INTERNAL_IP4_NBNS" },
- { 5,5, "INTERNAL_ADDRESS_EXPIREY" }, /* OBSO */
- { 6,6, "INTERNAL_IP4_DHCP" },
- { 7,7, "APPLICATION_VERSION" },
- { 8,8, "INTERNAL_IP6_ADDRESS" },
- { 9,9, "RESERVED" },
- { 10,10, "INTERNAL_IP6_DNS" },
- { 11,11, "INTERNAL_IP6_NBNS" }, /* OBSO */
- { 12,12, "INTERNAL_IP6_DHCP" },
- { 13,13, "INTERNAL_IP4_SUBNET" },
- { 14,14, "SUPPORTED_ATTRIBUTES" },
- { 15,15, "INTERNAL_IP6_SUBNET" },
- { 16,16, "MIP6_HOME_PREFIX" },
- { 17,17, "INTERNAL_IP6_LINK" },
- { 18,18, "INTERNAL_IP6_PREFIX" },
- { 19,19, "HOME_AGENT_ADDRESS" }, /* 3GPP TS 24.302 http://www.3gpp.org/ftp/Specs/html-info/24302.htm */
- { 20,16383, "RESERVED TO IANA"},
- { 16384,32767, "PRIVATE USE"},
- { 0,0, NULL },
- };
- static const range_string cfgattr_xauth_type[] = {
- { 0,0, "Generic" },
- { 1,1, "RADIUS-CHAP" },
- { 2,2, "OTP" },
- { 3,3, "S/KEY" },
- { 4,32767, "Future use" },
- { 32768,65535, "Private use" },
- { 0,0, NULL },
- };
- static const value_string cfgattr_xauth_status[] = {
- { 0, "Fail" },
- { 1, "Success" },
- { 0, NULL },
- };
- static const value_string cp_product[] = {
- { 1, "Firewall-1" },
- { 2, "SecuRemote/SecureClient" },
- { 0, NULL },
- };
- static const value_string cp_version[] = {
- { 2,"4.1" },
- { 3,"4.1 SP-1" },
- { 4002,"4.1 (SP-2 or above)" },
- { 5000,"NG" },
- { 5001,"NG Feature Pack 1" },
- { 5002,"NG Feature Pack 2" },
- { 5003,"NG Feature Pack 3" },
- { 5004,"NG with Application Intelligence" },
- { 5005,"NG with Application Intelligence R55" },
- { 5006,"NG with Application Intelligence R56" },
- { 0, NULL },
- };
- static const range_string traffic_selector_type[] = {
- { 0,6, "Reserved" },
- { 7,7, "TS_IPV4_ADDR_RANGE" },
- { 8,8, "TS_IPV6_ADDR_RANGE" },
- { 9,9, "TS_FC_ADDR_RANGE" },
- { 10,240, "Future use" },
- { 241,255, "Private use" },
- { 0,0, NULL },
- };
- static const value_string ms_nt5_isakmpoakley_type[] = {
- { 2, "Windows 2000" },
- { 3, "Windows XP SP1" },
- { 4, "Windows 2003 and Windows XP SP2" },
- { 5, "Windows Vista" },
- { 0, NULL }
- };
- static const range_string vs_v1_id_type[] = {
- { 0,0, "RESERVED" },
- { IKE_ID_IPV4_ADDR,IKE_ID_IPV4_ADDR, "IPV4_ADDR" },
- { IKE_ID_FQDN,IKE_ID_FQDN, "FQDN" },
- { IKE_ID_USER_FQDN,IKE_ID_USER_FQDN, "USER_FQDN" },
- { IKE_ID_IPV4_ADDR_SUBNET,IKE_ID_IPV4_ADDR_SUBNET, "IPV4_ADDR_SUBNET" },
- { IKE_ID_IPV6_ADDR,IKE_ID_IPV6_ADD…
Large files files are truncated, but you can click here to view the full file