Test IKEv2.EN.I.1.1.8.2: INVALID_SELECTORS
Part A (BASIC)
To verify an IKEv2 device properly handles an ESP or AH packet whose selectors do not
match those of the CHILD_SA.
* [RFC 4306] - Sections 3.10.1
* [RFC 4307] - Sections 7.8
* Network Topology
Connect the devices according to the Common Topology.
* Configuration
In each part, configure the devices according to the Common Configuration except
Traffic Selector. Traffic Selector should be configured as following.
|
TSi |
TSr |
| IP Protocol ID |
IPv6-ICMP |
IPv6-ICMP |
| Start Port |
0 |
0 |
| End Port |
65535 |
65535 |
| Starting Address |
TH1 |
NUT |
| Ending Address |
TH1 |
NUT |
* Pre-Sequence and Cleanup Sequence
IKEv2 on the NUT is disabled after each part.
NUT TN1
(End-Node) (End-Node)
| |
|------------------->| IKE_SA_INIT request (HDR, SAi1, KEi, Ni)
| | (Judgement #1)
|<-------------------| IKE_SA_INIT Response (HDR, SAr1, KEr, Nr)
| | (Packet #1)
| |
|------------------->| IKE_AUTH request (HDR, SK {IDi, AUTH, N, SAi2, TSi, TSr})
| | (Judgement #2)
|<-------------------| IKE_AUTH Response (HDR, SK {IDr, AUTH, N, SAr2, TSi, TSr})
| | (Packet #2)
| |
|<-------------------| IPsec {TCP SYN}
| | (Packet #3)
|---------X | No Packets
| | (Judgement #3)
| | or
|------------------->| INFORMATIONAL request (HDR, SK {N(INVALID_SELECTORS)})
| | (Judgement #3)
| |
|<-------------------| IPsec {Echo Request}
| | (Packet #4)
|------------------->| IPsec {Echo Reply}
| | (Judgement #4)
| |
V V
N: USE_TRANSPORT_MODE
| Packet #1 |
See Common Packet #2 |
| Packet #2 |
See Common Packet #4 |
| Packet #3 |
See below |
| Packet #4 |
See Common Packet #19 |
Packet #3: TCP-SYN
| IPv6 Header |
Source Address |
TN1's Global Address on Link X |
| Destination Address |
NUT's Global Address on Link A |
| ESP |
Security Parameter Index |
CHILD_SA's SPI value used by
this message |
| Sequence Number |
The value incremented the
previous encrypted packet's
Sequence Number by one. |
| Payload Data |
Subsequent data encrypted by
underlying encryption algorithm |
| Padding |
Any value which to be a multiple
of the encryption block size |
| Pad Length |
The length of the Padding field |
| Next Header |
6 (TCP) |
| Integrity Check Value |
The cryptographic checksum of
the entire message |
| TCP Header |
Source Port |
30000 |
| Destination Port |
30000 |
| Flags |
SYN (0x02) |
Part A (BASIC)
1. NUT starts to negotiate with TN1 by sending IKE_SA_INIT request.
2. Observe the messages transmitted on Link A.
3. TN1 responds with an IKE_SA_INIT response to the NUT.
4. Observe the messages transmitted on Link A.
5. After reception of IKE_AUTH request from the NUT, TN1 responds with an IKE_AUTH
response to the NUT
6. TN1 transmits a TCP-SYN packet t with IPsec ESP using corresponding algorithms to NUT.
7. Observe the messages transmitted on Link A.
8. TN1 transmits an Echo Request with IPsec ESP using corresponding algorithms to NUT.
9. Observe the messages transmitted on Link A.
Part A
Step 2: Judgment #1
The NUT transmits an IKE_SA_INIT request including "ENCR_3DES",
"PRF_HMAC_SHA1", "AUTH_HMAC_SHA1_96" and "D-H group 2" as proposed
algorithms.
Step 4: Judgment #2
The NUT transmits an IKE_AUTH request including "ENCR_3DES",
"AUTH_HMAC_SHA1_96" and "No Extended Sequence Numbers" as proposed algorithms.
Step 7: Judgment #3
The NUT does not transmit any packets or transmits an INFORMATIONAL request with a
Notify of type INVALID_SELECTORS.
Step 9: Judgment #4
The NUT transmits an Echo Reply with IPsec ESP using corresponding algorithms.
* Notification Type depends on the implementation at Step 7.
* If the NUT uses TCP port 30000 for other applications, the TN1 transmits TCP-SYN
packets to other closed TCP port on the NUT.