Home | History | Annotate | Download | only in tcpdump
      1 /*
      2  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
      3  * All rights reserved.
      4  *
      5  * Redistribution and use in source and binary forms, with or without
      6  * modification, are permitted provided that the following conditions
      7  * are met:
      8  * 1. Redistributions of source code must retain the above copyright
      9  *    notice, this list of conditions and the following disclaimer.
     10  * 2. Redistributions in binary form must reproduce the above copyright
     11  *    notice, this list of conditions and the following disclaimer in the
     12  *    documentation and/or other materials provided with the distribution.
     13  * 3. Neither the name of the project nor the names of its contributors
     14  *    may be used to endorse or promote products derived from this software
     15  *    without specific prior written permission.
     16  *
     17  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
     18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
     21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     27  * SUCH DAMAGE.
     28  */
     29 /* YIPS @(#)$Id: isakmp.h,v 1.12 2007-11-24 18:13:33 mcr Exp $ */
     30 
     31 /* refer to RFC 2408 */
     32 
     33 /* must include <netinet/in.h> */
     34 
     35 #if !defined(_ISAKMP_H_)
     36 #define _ISAKMP_H_
     37 
     38 typedef u_char cookie_t[8];
     39 typedef u_char msgid_t[4];
     40 
     41 typedef struct { /* i_cookie + r_cookie */
     42 	cookie_t i_ck;
     43 	cookie_t r_ck;
     44 } isakmp_index;
     45 
     46 #define INITIATOR       1
     47 #define RESPONDER       2
     48 
     49 #define PORT_ISAKMP 500
     50 
     51 #define GENERATE  1
     52 #define VALIDATE  0
     53 
     54 /* Phase of oakley definition */
     55 /*
     56   0000 0000 0000 0000
     57        |    |||| ||||
     58        |    |||| ++++--> negosiation number in phase
     59        |    ++++-------> phase number
     60        +---------------> expire ?
     61  */
     62 #define ISAKMP_PH1      0x0010
     63 #define ISAKMP_PH2      0x0020
     64 #define ISAKMP_EXPIRED  0x0100
     65 
     66 #define ISAKMP_NGP_0    0x0000
     67 #define ISAKMP_NGP_1    0x0001
     68 #define ISAKMP_NGP_2    0x0002
     69 #define ISAKMP_NGP_3    0x0003
     70 #define ISAKMP_NGP_4    0x0004
     71 
     72 #define ISAKMP_PH1_N    (ISAKMP_PH1 | ISAKMP_NGP_0)  /* i.e. spawn */
     73 #define ISAKMP_PH1_1    (ISAKMP_PH1 | ISAKMP_NGP_1)
     74 #define ISAKMP_PH1_2    (ISAKMP_PH1 | ISAKMP_NGP_2)
     75 #define ISAKMP_PH1_3    (ISAKMP_PH1 | ISAKMP_NGP_3)
     76 #define ISAKMP_PH2_N    (ISAKMP_PH2 | ISAKMP_NGP_0)
     77 #define ISAKMP_PH2_1    (ISAKMP_PH2 | ISAKMP_NGP_1)
     78 #define ISAKMP_PH2_2    (ISAKMP_PH2 | ISAKMP_NGP_2)
     79 #define ISAKMP_PH2_3    (ISAKMP_PH2 | ISAKMP_NGP_3)
     80 
     81 #define ISAKMP_TIMER_DEFAULT     10 /* seconds */
     82 #define ISAKMP_TRY_DEFAULT        3 /* times */
     83 
     84 /* 3.1 ISAKMP Header Format (IKEv1 and IKEv2)
     85          0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
     86         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
     87         !                          Initiator                            !
     88         !                            Cookie                             !
     89         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
     90         !                          Responder                            !
     91         !                            Cookie                             !
     92         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
     93         !  Next Payload ! MjVer ! MnVer ! Exchange Type !     Flags     !
     94         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
     95         !                          Message ID                           !
     96         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
     97         !                            Length                             !
     98         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
     99 */
    100 struct isakmp {
    101 	cookie_t i_ck;		/* Initiator Cookie */
    102 	cookie_t r_ck;		/* Responder Cookie */
    103 	u_int8_t np;		/* Next Payload Type */
    104 	u_int8_t vers;
    105 #define ISAKMP_VERS_MAJOR	0xf0
    106 #define ISAKMP_VERS_MAJOR_SHIFT	4
    107 #define ISAKMP_VERS_MINOR	0x0f
    108 #define ISAKMP_VERS_MINOR_SHIFT	0
    109 	u_int8_t etype;		/* Exchange Type */
    110 	u_int8_t flags;		/* Flags */
    111 	msgid_t msgid;
    112 	u_int32_t len;		/* Length */
    113 };
    114 
    115 /* Next Payload Type */
    116 #define ISAKMP_NPTYPE_NONE   0 /* NONE*/
    117 #define ISAKMP_NPTYPE_SA     1 /* Security Association */
    118 #define ISAKMP_NPTYPE_P      2 /* Proposal */
    119 #define ISAKMP_NPTYPE_T      3 /* Transform */
    120 #define ISAKMP_NPTYPE_KE     4 /* Key Exchange */
    121 #define ISAKMP_NPTYPE_ID     5 /* Identification */
    122 #define ISAKMP_NPTYPE_CERT   6 /* Certificate */
    123 #define ISAKMP_NPTYPE_CR     7 /* Certificate Request */
    124 #define ISAKMP_NPTYPE_HASH   8 /* Hash */
    125 #define ISAKMP_NPTYPE_SIG    9 /* Signature */
    126 #define ISAKMP_NPTYPE_NONCE 10 /* Nonce */
    127 #define ISAKMP_NPTYPE_N     11 /* Notification */
    128 #define ISAKMP_NPTYPE_D     12 /* Delete */
    129 #define ISAKMP_NPTYPE_VID   13 /* Vendor ID */
    130 #define ISAKMP_NPTYPE_v2E   46 /* v2 Encrypted payload */
    131 
    132 #define IKEv1_MAJOR_VERSION  1
    133 #define IKEv1_MINOR_VERSION  0
    134 
    135 #define IKEv2_MAJOR_VERSION  2
    136 #define IKEv2_MINOR_VERSION  0
    137 
    138 /* Exchange Type */
    139 #define ISAKMP_ETYPE_NONE   0 /* NONE */
    140 #define ISAKMP_ETYPE_BASE   1 /* Base */
    141 #define ISAKMP_ETYPE_IDENT  2 /* Identity Proteciton */
    142 #define ISAKMP_ETYPE_AUTH   3 /* Authentication Only */
    143 #define ISAKMP_ETYPE_AGG    4 /* Aggressive */
    144 #define ISAKMP_ETYPE_INF    5 /* Informational */
    145 
    146 /* Flags */
    147 #define ISAKMP_FLAG_E 0x01 /* Encryption Bit */
    148 #define ISAKMP_FLAG_C 0x02 /* Commit Bit */
    149 #define ISAKMP_FLAG_extra 0x04
    150 
    151 /* IKEv2 */
    152 #define ISAKMP_FLAG_I (1 << 3)  /* (I)nitiator */
    153 #define ISAKMP_FLAG_V (1 << 4)  /* (V)ersion   */
    154 #define ISAKMP_FLAG_R (1 << 5)  /* (R)esponse  */
    155 
    156 
    157 /* 3.2 Payload Generic Header
    158          0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    159         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    160         ! Next Payload  !   RESERVED    !         Payload Length        !
    161         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    162 */
    163 struct isakmp_gen {
    164 	u_int8_t  np;       /* Next Payload */
    165 	u_int8_t  critical; /* bit 7 - critical, rest is RESERVED */
    166 	u_int16_t len;      /* Payload Length */
    167 };
    168 
    169 /* 3.3 Data Attributes
    170          0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    171         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    172         !A!       Attribute Type        !    AF=0  Attribute Length     !
    173         !F!                             !    AF=1  Attribute Value      !
    174         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    175         .                   AF=0  Attribute Value                       .
    176         .                   AF=1  Not Transmitted                       .
    177         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    178 */
    179 struct isakmp_data {
    180 	u_int16_t type;     /* defined by DOI-spec, and Attribute Format */
    181 	u_int16_t lorv;     /* if f equal 1, Attribute Length */
    182 	                  /* if f equal 0, Attribute Value */
    183 	/* if f equal 1, Attribute Value */
    184 };
    185 #define ISAKMP_GEN_TLV 0x0000
    186 #define ISAKMP_GEN_TV  0x8000
    187 	/* mask for type of attribute format */
    188 #define ISAKMP_GEN_MASK 0x8000
    189 
    190 /* 3.4 Security Association Payload */
    191 	/* MAY NOT be used, because of being defined in ipsec-doi. */
    192 	/*
    193 	If the current payload is the last in the message,
    194 	then the value of the next payload field will be 0.
    195 	This field MUST NOT contain the
    196 	values for the Proposal or Transform payloads as they are considered
    197 	part of the security association negotiation.  For example, this
    198 	field would contain the value "10" (Nonce payload) in the first
    199 	message of a Base Exchange (see Section 4.4) and the value "0" in the
    200 	first message of an Identity Protect Exchange (see Section 4.5).
    201 	*/
    202 struct ikev1_pl_sa {
    203 	struct isakmp_gen h;
    204 	u_int32_t doi; /* Domain of Interpretation */
    205 	u_int32_t sit; /* Situation */
    206 };
    207 
    208 /* 3.5 Proposal Payload */
    209 	/*
    210 	The value of the next payload field MUST only contain the value "2"
    211 	or "0".  If there are additional Proposal payloads in the message,
    212 	then this field will be 2.  If the current Proposal payload is the
    213 	last within the security association proposal, then this field will
    214 	be 0.
    215 	*/
    216 struct ikev1_pl_p {
    217 	struct isakmp_gen h;
    218 	u_int8_t p_no;      /* Proposal # */
    219 	u_int8_t prot_id;   /* Protocol */
    220 	u_int8_t spi_size;  /* SPI Size */
    221 	u_int8_t num_t;     /* Number of Transforms */
    222 	/* SPI */
    223 };
    224 
    225 /* 3.6 Transform Payload */
    226 	/*
    227 	The value of the next payload field MUST only contain the value "3"
    228 	or "0".  If there are additional Transform payloads in the proposal,
    229 	then this field will be 3.  If the current Transform payload is the
    230 	last within the proposal, then this field will be 0.
    231 	*/
    232 struct ikev1_pl_t {
    233 	struct isakmp_gen h;
    234 	u_int8_t  t_no;     /* Transform # */
    235 	u_int8_t  t_id;     /* Transform-Id */
    236 	u_int16_t reserved; /* RESERVED2 */
    237 	/* SA Attributes */
    238 };
    239 
    240 /* 3.7 Key Exchange Payload */
    241 struct ikev1_pl_ke {
    242 	struct isakmp_gen h;
    243 	/* Key Exchange Data */
    244 };
    245 
    246 /* 3.8 Identification Payload */
    247 	/* MUST NOT to be used, because of being defined in ipsec-doi. */
    248 struct ikev1_pl_id {
    249 	struct isakmp_gen h;
    250 	union {
    251 		u_int8_t  id_type;   /* ID Type */
    252 		u_int32_t doi_data;  /* DOI Specific ID Data */
    253 	} d;
    254 	/* Identification Data */
    255 };
    256 
    257 /* 3.9 Certificate Payload */
    258 struct ikev1_pl_cert {
    259 	struct isakmp_gen h;
    260 	u_int8_t encode; /* Cert Encoding */
    261 	char   cert;   /* Certificate Data */
    262 		/*
    263 		This field indicates the type of
    264 		certificate or certificate-related information contained in the
    265 		Certificate Data field.
    266 		*/
    267 };
    268 
    269 /* Certificate Type */
    270 #define ISAKMP_CERT_NONE   0
    271 #define ISAKMP_CERT_PKCS   1
    272 #define ISAKMP_CERT_PGP    2
    273 #define ISAKMP_CERT_DNS    3
    274 #define ISAKMP_CERT_SIGN   4
    275 #define ISAKMP_CERT_KE     5
    276 #define ISAKMP_CERT_KT     6
    277 #define ISAKMP_CERT_CRL    7
    278 #define ISAKMP_CERT_ARL    8
    279 #define ISAKMP_CERT_SPKI   9
    280 
    281 /* 3.10 Certificate Request Payload */
    282 struct ikev1_pl_cr {
    283 	struct isakmp_gen h;
    284 	u_int8_t num_cert; /* # Cert. Types */
    285 	/*
    286 	Certificate Types (variable length)
    287 	  -- Contains a list of the types of certificates requested,
    288 	  sorted in order of preference.  Each individual certificate
    289 	  type is 1 octet.  This field is NOT requiredo
    290 	*/
    291 	/* # Certificate Authorities (1 octet) */
    292 	/* Certificate Authorities (variable length) */
    293 };
    294 
    295 /* 3.11 Hash Payload */
    296 	/* may not be used, because of having only data. */
    297 struct ikev1_pl_hash {
    298 	struct isakmp_gen h;
    299 	/* Hash Data */
    300 };
    301 
    302 /* 3.12 Signature Payload */
    303 	/* may not be used, because of having only data. */
    304 struct ikev1_pl_sig {
    305 	struct isakmp_gen h;
    306 	/* Signature Data */
    307 };
    308 
    309 /* 3.13 Nonce Payload */
    310 	/* may not be used, because of having only data. */
    311 struct ikev1_pl_nonce {
    312 	struct isakmp_gen h;
    313 	/* Nonce Data */
    314 };
    315 
    316 /* 3.14 Notification Payload */
    317 struct ikev1_pl_n {
    318 	struct isakmp_gen h;
    319 	u_int32_t doi;      /* Domain of Interpretation */
    320 	u_int8_t  prot_id;  /* Protocol-ID */
    321 	u_int8_t  spi_size; /* SPI Size */
    322 	u_int16_t type;     /* Notify Message Type */
    323 	/* SPI */
    324 	/* Notification Data */
    325 };
    326 
    327 /* 3.14.1 Notify Message Types */
    328 /* NOTIFY MESSAGES - ERROR TYPES */
    329 #define ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE           1
    330 #define ISAKMP_NTYPE_DOI_NOT_SUPPORTED              2
    331 #define ISAKMP_NTYPE_SITUATION_NOT_SUPPORTED        3
    332 #define ISAKMP_NTYPE_INVALID_COOKIE                 4
    333 #define ISAKMP_NTYPE_INVALID_MAJOR_VERSION          5
    334 #define ISAKMP_NTYPE_INVALID_MINOR_VERSION          6
    335 #define ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE          7
    336 #define ISAKMP_NTYPE_INVALID_FLAGS                  8
    337 #define ISAKMP_NTYPE_INVALID_MESSAGE_ID             9
    338 #define ISAKMP_NTYPE_INVALID_PROTOCOL_ID            10
    339 #define ISAKMP_NTYPE_INVALID_SPI                    11
    340 #define ISAKMP_NTYPE_INVALID_TRANSFORM_ID           12
    341 #define ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED       13
    342 #define ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN             14
    343 #define ISAKMP_NTYPE_BAD_PROPOSAL_SYNTAX            15
    344 #define ISAKMP_NTYPE_PAYLOAD_MALFORMED              16
    345 #define ISAKMP_NTYPE_INVALID_KEY_INFORMATION        17
    346 #define ISAKMP_NTYPE_INVALID_ID_INFORMATION         18
    347 #define ISAKMP_NTYPE_INVALID_CERT_ENCODING          19
    348 #define ISAKMP_NTYPE_INVALID_CERTIFICATE            20
    349 #define ISAKMP_NTYPE_BAD_CERT_REQUEST_SYNTAX        21
    350 #define ISAKMP_NTYPE_INVALID_CERT_AUTHORITY         22
    351 #define ISAKMP_NTYPE_INVALID_HASH_INFORMATION       23
    352 #define ISAKMP_NTYPE_AUTHENTICATION_FAILED          24
    353 #define ISAKMP_NTYPE_INVALID_SIGNATURE              25
    354 #define ISAKMP_NTYPE_ADDRESS_NOTIFICATION           26
    355 /* NOTIFY MESSAGES - STATUS TYPES */
    356 #define ISAKMP_NTYPE_CONNECTED                   16384
    357 /* using only to log */
    358 #define ISAKMP_LOG_RETRY_LIMIT_REACHED           65530
    359 
    360 /* 3.15 Delete Payload */
    361 struct ikev1_pl_d {
    362 	struct isakmp_gen h;
    363 	u_int32_t doi;      /* Domain of Interpretation */
    364 	u_int8_t  prot_id;  /* Protocol-Id */
    365 	u_int8_t  spi_size; /* SPI Size */
    366 	u_int16_t num_spi;  /* # of SPIs */
    367 	/* SPI(es) */
    368 };
    369 
    370 
    371 struct ikev1_ph1tab {
    373 	struct ikev1_ph1 *head;
    374 	struct ikev1_ph1 *tail;
    375 	int len;
    376 };
    377 
    378 struct isakmp_ph2tab {
    379 	struct ikev1_ph2 *head;
    380 	struct ikev1_ph2 *tail;
    381 	int len;
    382 };
    383 
    384 #define EXCHANGE_PROXY   1
    385 #define EXCHANGE_MYSELF  0
    386 
    387 #define PFS_NEED	1
    388 #define PFS_NONEED	0
    389 
    390 /* IKEv2 (RFC4306) */
    391 
    392 /* 3.3  Security Association Payload -- generic header */
    393 /* 3.3.1.  Proposal Substructure */
    394 struct ikev2_p {
    395 	struct isakmp_gen h;
    396 	u_int8_t p_no;      /* Proposal # */
    397 	u_int8_t prot_id;   /* Protocol */
    398 	u_int8_t spi_size;  /* SPI Size */
    399 	u_int8_t num_t;     /* Number of Transforms */
    400 };
    401 
    402 /* 3.3.2.  Transform Substructure */
    403 struct ikev2_t {
    404 	struct isakmp_gen h;
    405 	u_int8_t t_type;    /* Transform Type (ENCR,PRF,INTEG,etc.*/
    406 	u_int8_t res2;      /* reserved byte */
    407 	u_int16_t t_id;     /* Transform ID */
    408 };
    409 
    410 enum ikev2_t_type {
    411 	IV2_T_ENCR = 1,
    412 	IV2_T_PRF  = 2,
    413 	IV2_T_INTEG= 3,
    414 	IV2_T_DH   = 4,
    415 	IV2_T_ESN  = 5,
    416 };
    417 
    418 /* 3.4.  Key Exchange Payload */
    419 struct ikev2_ke {
    420 	struct isakmp_gen h;
    421 	u_int16_t  ke_group;
    422 	u_int16_t  ke_res1;
    423 	/* KE data */
    424 };
    425 
    426 
    427 /* 3.5.  Identification Payloads */
    428 enum ikev2_id_type {
    429 	ID_IPV4_ADDR=1,
    430 	ID_FQDN=2,
    431 	ID_RFC822_ADDR=3,
    432 	ID_IPV6_ADDR=5,
    433 	ID_DER_ASN1_DN=9,
    434 	ID_DER_ASN1_GN=10,
    435 	ID_KEY_ID=11,
    436 };
    437 struct ikev2_id {
    438 	struct isakmp_gen h;
    439 	u_int8_t  type;        /* ID type */
    440 	u_int8_t  res1;
    441 	u_int16_t res2;
    442 	/* SPI */
    443 	/* Notification Data */
    444 };
    445 
    446 /* 3.10 Notification Payload */
    447 struct ikev2_n {
    448 	struct isakmp_gen h;
    449 	u_int8_t  prot_id;  /* Protocol-ID */
    450 	u_int8_t  spi_size; /* SPI Size */
    451 	u_int16_t type;     /* Notify Message Type */
    452 };
    453 
    454 enum ikev2_n_type {
    455 	IV2_NOTIFY_UNSUPPORTED_CRITICAL_PAYLOAD            = 1,
    456 	IV2_NOTIFY_INVALID_IKE_SPI                         = 4,
    457 	IV2_NOTIFY_INVALID_MAJOR_VERSION                   = 5,
    458 	IV2_NOTIFY_INVALID_SYNTAX                          = 7,
    459 	IV2_NOTIFY_INVALID_MESSAGE_ID                      = 9,
    460 	IV2_NOTIFY_INVALID_SPI                             =11,
    461 	IV2_NOTIFY_NO_PROPOSAL_CHOSEN                      =14,
    462 	IV2_NOTIFY_INVALID_KE_PAYLOAD                      =17,
    463 	IV2_NOTIFY_AUTHENTICATION_FAILED                   =24,
    464 	IV2_NOTIFY_SINGLE_PAIR_REQUIRED                    =34,
    465 	IV2_NOTIFY_NO_ADDITIONAL_SAS                       =35,
    466 	IV2_NOTIFY_INTERNAL_ADDRESS_FAILURE                =36,
    467 	IV2_NOTIFY_FAILED_CP_REQUIRED                      =37,
    468 	IV2_NOTIFY_INVALID_SELECTORS                       =39,
    469 	IV2_NOTIFY_INITIAL_CONTACT                         =16384,
    470 	IV2_NOTIFY_SET_WINDOW_SIZE                         =16385,
    471 	IV2_NOTIFY_ADDITIONAL_TS_POSSIBLE                  =16386,
    472 	IV2_NOTIFY_IPCOMP_SUPPORTED                        =16387,
    473 	IV2_NOTIFY_NAT_DETECTION_SOURCE_IP                 =16388,
    474 	IV2_NOTIFY_NAT_DETECTION_DESTINATION_IP            =16389,
    475 	IV2_NOTIFY_COOKIE                                  =16390,
    476 	IV2_NOTIFY_USE_TRANSPORT_MODE                      =16391,
    477 	IV2_NOTIFY_HTTP_CERT_LOOKUP_SUPPORTED              =16392,
    478 	IV2_NOTIFY_REKEY_SA                                =16393,
    479 	IV2_NOTIFY_ESP_TFC_PADDING_NOT_SUPPORTED           =16394,
    480 	IV2_NOTIFY_NON_FIRST_FRAGMENTS_ALSO                =16395
    481 };
    482 
    483 struct notify_messages {
    484 	u_int16_t type;
    485 	char     *msg;
    486 };
    487 
    488 /* 3.8 Notification Payload */
    489 struct ikev2_auth {
    490 	struct isakmp_gen h;
    491 	u_int8_t  auth_method;  /* Protocol-ID */
    492 	u_int8_t  reserved[3];
    493 	/* authentication data */
    494 };
    495 
    496 enum ikev2_auth_type {
    497 	IV2_RSA_SIG = 1,
    498 	IV2_SHARED  = 2,
    499 	IV2_DSS_SIG = 3,
    500 };
    501 
    502 #endif /* !defined(_ISAKMP_H_) */
    503