<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hi,<br>
<br>
IN IKEV2 tahi tests, testing end-node as responder for Receipt of a
higher major version number<br>
<br>
As per RFC 5996:<br>
If an endpoint receives a message with a higher major version
number,<br>
it MUST drop the message and SHOULD send an unauthenticated
Notify<br>
message of type INVALID_MAJOR_VERSION containing the highest<br>
(closest) version number it supports. <br>
<br>
IKE_SA_INIT request with major version 3 is sent, charon log shows
that the header verification failed<br>
<br>
/etc/strongswan/ipsec.conf has "keyexchange=ikev2"<br>
<br>
-bash-4.2# strongswan start<br>
Starting strongSwan 5.2.0 IPsec [starter]...<br>
<br>
loaded plugins: charon curl aes des rc2 sha1 sha2 md4 md5 random
nonce x509 revocation constraints acert pubkey pkcs1 pkcs8 pkcs12
pgp dnskey sshkey pem openssl fips-prf gmp xcbc cmac hmac attr
kernel-netlink resolve socket-default farp stroke vici updown
eap-identity eap-md5 eap-gtc eap-mschapv2 eap-tls eap-ttls eap-peap
xauth-generic xauth-eap xauth-pam dhcp<br>
<br>
<br>
<u>from charon.log</u><br>
Sep 8 11:40:01 01[NET] received packet: from 2001:db8:f:1::1[500]
to 2001:db8:1:1::1[500]<br>
Sep 8 11:40:01 01[ENC] parsing header of message<br>
Sep 8 11:40:01 01[ENC] parsing HEADER payload, 337 bytes left<br>
...<br>
Sep 8 11:40:01 01[ENC] parsing rule 0 IKE_SPI<br>
Sep 8 11:40:01 01[ENC] => 8 bytes @ 0x3fff580010a8<br>
Sep 8 11:40:01 01[ENC] 0: CC 38 37 F0 27 9B 88
D4 .87.'...<br>
Sep 8 11:40:01 01[ENC] parsing rule 1 IKE_SPI<br>
Sep 8 11:40:01 01[ENC] => 8 bytes @ 0x3fff580010b0<br>
Sep 8 11:40:01 01[ENC] 0: 00 00 00 00 00 00 00
00 ........<br>
Sep 8 11:40:01 01[ENC] parsing rule 2 U_INT_8<br>
Sep 8 11:40:01 01[ENC] => 33<br>
Sep 8 11:40:01 01[ENC] parsing rule 3 U_INT_4<br>
Sep 8 11:40:01 01[ENC] => 3<br>
Sep 8 11:40:01 01[ENC] parsing rule 4 U_INT_4<br>
Sep 8 11:40:01 01[ENC] => 0<br>
Sep 8 11:40:01 01[ENC] parsing rule 5 U_INT_8<br>
Sep 8 11:40:01 01[ENC] => 34<br>
Sep 8 11:40:01 01[ENC] parsing rule 6 RESERVED_BIT<br>
Sep 8 11:40:01 01[ENC] => 0<br>
Sep 8 11:40:01 01[ENC] parsing rule 7 RESERVED_BIT<br>
Sep 8 11:40:01 01[ENC] => 0<br>
Sep 8 11:40:01 01[ENC] parsing rule 8 FLAG<br>
Sep 8 11:40:01 01[ENC] => 0<br>
Sep 8 11:40:01 01[ENC] parsing rule 9 FLAG<br>
Sep 8 11:40:01 01[ENC] => 0<br>
Sep 8 11:40:01 01[ENC] parsing rule 10 FLAG<br>
Sep 8 11:40:01 01[ENC] => 1<br>
Sep 8 11:40:01 01[ENC] parsing rule 11 FLAG<br>
Sep 8 11:40:01 01[ENC] => 0<br>
Sep 8 11:40:01 01[ENC] parsing rule 12 FLAG<br>
Sep 8 11:40:01 01[ENC] => 0<br>
Sep 8 11:40:01 01[ENC] parsing rule 13 FLAG<br>
Sep 8 11:40:01 01[ENC] => 0<br>
Sep 8 11:40:01 01[ENC] parsing rule 14 U_INT_32<br>
Sep 8 11:40:01 01[ENC] => 0<br>
Sep 8 11:40:01 01[ENC] parsing rule 15 HEADER_LENGTH<br>
Sep 8 11:40:01 01[ENC] => 337<br>
Sep 8 11:40:01 01[ENC] parsing HEADER payload finished<br>
Sep 8 11:40:01 01[ENC] header verification failed<br>
Sep 8 11:40:01 01[NET] received invalid IKE header from
2001:db8:f:1::1 - ignored<br>
Sep 8 11:40:01 01[NET] waiting for data on sockets<br>
<br>
Does it mean it received a corrupt IKE_SA_INIT from the initiator?<br>
Is there any configuration to be enabled to receive the
INVALID-MAJOR-VERSION package?<br>
<br>
<br>
Regards,<br>
Kumuda G<br>
</body>
</html>