<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style>
</head>
<body class='hmmessage'>
Hi, all<BR>
Thank for you previous reply. <BR>
I met an other issue. Please help to figure out the root cuase. <BR>
According to the RFC 4306 Chatper 4 : <BR>
<P class=MsoPlainText style="MARGIN: 0cm 0cm 0pt"><SPAN lang=EN-US style="mso-hansi-font-family: 宋体; mso-bidi-font-family: 宋体"><FONT size=3><FONT face=宋体>A minimal</FONT></FONT></SPAN><SPAN lang=EN-US style="mso-hansi-font-family: 宋体; mso-bidi-font-family: 宋体"><FONT size=3><FONT face=宋体>implementation MAY support the CREATE_CHILD_SA exchange only in so<?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" /><o:p></o:p></FONT></FONT></SPAN></P>
<P class=MsoPlainText style="MARGIN: 0cm 0cm 0pt"><SPAN lang=EN-US style="mso-hansi-font-family: 宋体; mso-bidi-font-family: 宋体"><FONT size=3><FONT face=宋体><SPAN style="mso-spacerun: yes"> </SPAN>far as to recognize requests and reject them with a Notify payload of<o:p></o:p></FONT></FONT></SPAN></P>
<SPAN lang=EN-US style="FONT-SIZE: 10.5pt; FONT-FAMILY: 宋体; mso-bidi-font-family: 宋体; mso-font-kerning: 1.0pt; mso-ansi-language: EN-US; mso-fareast-language: ZH-CN; mso-bidi-language: AR-SA"><SPAN style="mso-spacerun: yes"> </SPAN>type NO_ADDITIONAL_SAS.</SPAN><BR>
So I did a implementation which only supports to reply the CREATE_CHILD_SA with Notify Payload of type NO_ADDITIONAL_SAS.<BR>
But the strongswan doesn't seem to recognize the reply and still retransmite the CREATE_CHILD_SA request. <BR>
<FONT style="BACKGROUND-COLOR: #ffffff">I try to find the root cause from the syslog, but I don't understand the lines marked with red. What's that mean? The CREATE_CHILD_SA reply should not be encrypted.</FONT><BR>
The files of syslog and packets (captured by wireshark) are enclosed.<BR>
<BR>
<U><STRONG>Content of the Notify Payload </STRONG></U><BR> Next Payload 33 (SA)<BR> Critical 0<BR> Reserved 0<BR> Payload Length 8<BR> Protocol ID 3 (ESP)<BR> SPI Size 0<BR> N Payload<BR> Notify Message Type 35(<SPAN lang=EN-US style="FONT-SIZE: 10.5pt; FONT-FAMILY: 宋体; mso-bidi-font-family: 宋体; mso-font-kerning: 1.0pt; mso-ansi-language: EN-US; mso-fareast-language: ZH-CN; mso-bidi-language: AR-SA">NO_ADDITIONAL_SAS</SPAN>)<BR>
<BR>
<U><STRONG>Syslog </STRONG></U><BR>
Nov 23 13:57:16 michalle-desktop charon: 08[ENC] parsing ENCRYPTED payload, 8 bytes left <BR>Nov 23 13:57:16 michalle-desktop charon: 08[ENC] parsing payload from => 8 bytes @ 0xb8d821c8 <BR>Nov 23 13:57:16 michalle-desktop charon: 08[ENC] 0: 00 00 00 08 03 00 00 23 .......# <BR>Nov 23 13:57:16 michalle-desktop charon: 08[ENC] parsing rule 0 U_INT_8 <BR>Nov 23 13:57:16 michalle-desktop charon: 08[ENC] => 0 <BR>Nov 23 13:57:16 michalle-desktop charon: 08[ENC] parsing rule 1 FLAG <BR>Nov 23 13:57:16 michalle-desktop charon: 08[ENC] => 0 <BR>Nov 23 13:57:16 michalle-desktop charon: 08[ENC] parsing rule 2 RESERVED_BIT <BR>Nov 23 13:57:16 michalle-desktop charon: 08[ENC] parsing rule 3 RESERVED_BIT <BR>Nov 23 13:57:16 michalle-desktop charon: 08[ENC] parsing rule 4 RESERVED_BIT <BR>Nov 23 13:57:16 michalle-desktop charon: 08[ENC] parsing rule 5 RESERVED_BIT <BR>Nov 23 13:57:16 michalle-desktop charon: 08[ENC] parsing rule 6 RESERVED_BIT <BR>Nov 23 13:57:16 michalle-desktop charon: 08[ENC] parsing rule 7 RESERVED_BIT <BR>Nov 23 13:57:16 michalle-desktop charon: 08[ENC] parsing rule 8 RESERVED_BIT <BR>Nov 23 13:57:16 michalle-desktop charon: 08[ENC] parsing rule 9 PAYLOAD_LENGTH <BR>Nov 23 13:57:16 michalle-desktop charon: 08[ENC] => 8 <BR>Nov 23 13:57:16 michalle-desktop charon: 08[ENC] parsing rule 10 ENCRYPTED_DATA <BR>Nov 23 13:57:16 michalle-desktop charon: 08[ENC] => => 4 bytes @ 0xb8d82c78 <BR>Nov 23 13:57:16 michalle-desktop charon: 08[ENC] 0: 03 00 00 23 ...# <BR>Nov 23 13:57:16 michalle-desktop charon: 08[ENC] parsing ENCRYPTED payload finished <BR>Nov 23 13:57:16 michalle-desktop charon: 08[ENC] succesfully parsed content of encryption payload <BR>
<FONT style="BACKGROUND-COLOR: #f79646">Nov 23 13:57:16 michalle-desktop charon: 08[ENC] payload type ENCRYPTED not allowed <BR>Nov 23 13:57:16 michalle-desktop charon: 08[ENC] could not decrypt payloads <BR>Nov 23 13:57:16 michalle-desktop charon: 08[IKE] CREATE_CHILD_SA response with message ID 2 processing failed </FONT><BR>
<FONT style="BACKGROUND-COLOR: #f79646"></FONT> <BR>
<FONT style="BACKGROUND-COLOR: #ffffff"></FONT> <BR> </body>
</html>