iked(8): add stronger RNG/INTEGR transforms by default

[Tobias Heider]

Hi,

I would like to activate the stronger SHA2-364 and SHA2-512 by default for
INTEGR and PRF transforms to get a bit better out of the box compatibility.

iked to iked connections default to AES-GCM-128 and don't use an explicit
INTEGR transform, so performance should not suffer.

Any objections or ok?

diff --git a/sbin/iked/parse.y b/sbin/iked/parse.y
index bc68823e750..40859f7d5cb 100644
--- a/sbin/iked/parse.y
+++ b/sbin/iked/parse.y
@@ -138,8 +138,12 @@ struct iked_transform ikev2_default_ike_transforms[] = {
        { IKEV2_XFORMTYPE_ENCR, IKEV2_XFORMENCR_AES_CBC, 192 },
        { IKEV2_XFORMTYPE_ENCR, IKEV2_XFORMENCR_AES_CBC, 128 },
        { IKEV2_XFORMTYPE_ENCR, IKEV2_XFORMENCR_3DES },
+       { IKEV2_XFORMTYPE_PRF,  IKEV2_XFORMPRF_HMAC_SHA2_512 },
+       { IKEV2_XFORMTYPE_PRF,  IKEV2_XFORMPRF_HMAC_SHA2_384 },
        { IKEV2_XFORMTYPE_PRF,  IKEV2_XFORMPRF_HMAC_SHA2_256 },
        { IKEV2_XFORMTYPE_PRF,  IKEV2_XFORMPRF_HMAC_SHA1 },
+       { IKEV2_XFORMTYPE_INTEGR, IKEV2_XFORMAUTH_HMAC_SHA2_512_256 },
+       { IKEV2_XFORMTYPE_INTEGR, IKEV2_XFORMAUTH_HMAC_SHA2_384_192 },
        { IKEV2_XFORMTYPE_INTEGR, IKEV2_XFORMAUTH_HMAC_SHA2_256_128 },
        { IKEV2_XFORMTYPE_INTEGR, IKEV2_XFORMAUTH_HMAC_SHA1_96 },
        { IKEV2_XFORMTYPE_DH,   IKEV2_XFORMDH_CURVE25519 },
@@ -182,6 +186,8 @@ struct iked_transform ikev2_default_esp_transforms[] = {
        { IKEV2_XFORMTYPE_ENCR, IKEV2_XFORMENCR_AES_CBC, 256 },
        { IKEV2_XFORMTYPE_ENCR, IKEV2_XFORMENCR_AES_CBC, 192 },
        { IKEV2_XFORMTYPE_ENCR, IKEV2_XFORMENCR_AES_CBC, 128 },
+       { IKEV2_XFORMTYPE_INTEGR, IKEV2_XFORMAUTH_HMAC_SHA2_512_256 },
+       { IKEV2_XFORMTYPE_INTEGR, IKEV2_XFORMAUTH_HMAC_SHA2_384_192 },
        { IKEV2_XFORMTYPE_INTEGR, IKEV2_XFORMAUTH_HMAC_SHA2_256_128 },
        { IKEV2_XFORMTYPE_INTEGR, IKEV2_XFORMAUTH_HMAC_SHA1_96 },
        { IKEV2_XFORMTYPE_ESN,  IKEV2_XFORMESN_ESN },