Add new IKEv2 algorithm identifiers

configure.ac

@@ -1,6 +1,6 @@
 dnl Process this file with autoconf to produce a configure script.
 
-AC_INIT([ike-scan],[1.9.6],[https://github.com/royhills/ike-scan])
+AC_INIT([ike-scan],[1.9.7],[https://github.com/royhills/ike-scan])
 AC_PREREQ(2.61)
 AC_REVISION($Revision$)
 AC_CONFIG_SRCDIR([ike-scan.c])

ike-scan.1

@@ -4,7 +4,7 @@
 .\" are permitted in any medium without royalty provided the copyright
 .\" notice and this notice are preserved.
 .\"
-.TH IKE-SCAN 1 "July 5, 2020"
+.TH IKE-SCAN 1 "June 9, 2024"
 .\" Please adjust this date whenever revising the manpage.
 .SH NAME
 ike-scan \- Discover and fingerprint IKE hosts (IPsec VPN servers)
@@ -280,7 +280,7 @@ size of the key exchange payload.
 If you use Aggressive Mode with custom transforms, then
 you will normally need to use the --dhgroup option
 unless you are using the default DH group.
-Acceptable values are 1,2,5,14,15,16,17,18 (MODP only).
+Acceptable values are 1,2,5,14,15,16,17,18,19,20,21.
 .TP
 .B --gssid=<n> or -G <n>
 Use GSS ID <n> where <n> is a hex string.

ike-scan.c

@@ -2208,15 +2208,21 @@ initialise_ike_packet(size_t *packet_out_len, ike_packet_params *params) {
       free(attr);
       add_transform2(0, NULL, IKEV2_TYPE_ENCR, IKEV2_ENCR_3DES, NULL, 0);
       add_transform2(0, NULL, IKEV2_TYPE_ENCR, IKEV2_ENCR_DES, NULL, 0);
+      add_transform2(0, NULL, IKEV2_TYPE_PRF, IKEV2_PRF_HMAC_SHA2_512, NULL, 0);
+      add_transform2(0, NULL, IKEV2_TYPE_PRF, IKEV2_PRF_HMAC_SHA2_256, NULL, 0);
       add_transform2(0, NULL, IKEV2_TYPE_PRF, IKEV2_PRF_HMAC_SHA1, NULL, 0);
       add_transform2(0, NULL, IKEV2_TYPE_PRF, IKEV2_PRF_HMAC_MD5, NULL, 0);
+      add_transform2(0, NULL, IKEV2_TYPE_INTEG, IKEV2_AUTH_HMAC_SHA2_512_256, NULL, 0);
+      add_transform2(0, NULL, IKEV2_TYPE_INTEG, IKEV2_AUTH_HMAC_SHA2_256_128, NULL, 0);
       add_transform2(0, NULL, IKEV2_TYPE_INTEG, IKEV2_AUTH_HMAC_SHA1_96, NULL, 0);
       add_transform2(0, NULL, IKEV2_TYPE_INTEG, IKEV2_AUTH_HMAC_MD5_96, NULL, 0);
       add_transform2(0, NULL, IKEV2_TYPE_DH, 2, NULL, 0);
       add_transform2(0, NULL, IKEV2_TYPE_DH, 5, NULL, 0);
       add_transform2(0, NULL, IKEV2_TYPE_DH, 14, NULL, 0);
+      add_transform2(0, NULL, IKEV2_TYPE_DH, 20, NULL, 0);
+      add_transform2(0, NULL, IKEV2_TYPE_DH, 21, NULL, 0);
       transforms = add_transform2(1, &trans_len, 0, 0, NULL, 0);
-      no_trans=11;
+      no_trans=17;
    }
 /*
  *	Proposal payload

isakmp.h

@@ -184,13 +184,19 @@
 #define IKEV2_PRF_HMAC_SHA1	2
 #define IKEV2_PRF_HMAC_TIGER	3
 #define IKEV2_PRF_AES128_XCBC	4
+#define IKEV2_PRF_HMAC_SHA2_256	5	/* RFC 4868 */
+#define IKEV2_PRF_HMAC_SHA2_384	6	/* RFC 4868 */
+#define IKEV2_PRF_HMAC_SHA2_512	7	/* RFC 4868 */
 
 /* IKEv2 transform IDs for IKEV2_TYPE_INTEG */
 #define IKEV2_AUTH_HMAC_MD5_96	1
 #define IKEV2_AUTH_HMAC_SHA1_96	2
 #define IKEV2_AUTH_DES_MAC	3
 #define IKEV2_AUTH_KPDK_MD5	4
 #define IKEV2_AUTH_AES_XCBC_96	5
+#define IKEV2_AUTH_HMAC_SHA2_256_128	12 /* RFC 4868 */
+#define IKEV2_AUTH_HMAC_SHA2_384_192	13 /* RFC 4868 */
+#define IKEV2_AUTH_HMAC_SHA2_512_256	14 /* RFC 4868 */
 
 /*
  * Define packet structures