Project

General

Profile

Issue #3061

Confirm that there is no INITIAL_CONTACT in IKE_AUTH response

Added by li yang 3 months ago. Updated about 2 months ago.

Status:
Closed
Priority:
Normal
Category:
libcharon
Affected version:
5.6.3
Resolution:
No change required

Description

Hi expert,

In RFC 7296 (https://www.rfc-editor.org/rfc/rfc7296.txt), chapter 2.4. State Synchronization and Connection Timeouts,

The INITIAL_CONTACT notification, if sent, MUST be in the first IKE_AUTH request or response

I'm trying to build the scenario for INITIAL_CONTACT in response as following:
1. build connection between local and remote peer;
2. kill local ipsec service forcelly (kill -kill start&charon pid), there is still IKE_SA and IPsec_SA in remote peer;
3. start ipsec in local peer manually, there is no SAs locally;
4. initiate connect from remote peer by command "ipsec up connection_name", local ipsec service does not send INITIAL_CONTACT and remote peer has two pairs SAs.

I also checked code, INITIAL_CONTACT is only added as payload in function build_i ike_auth.c.

Could you confirm my statement is correct or not?
If not correct, please guide how to config or build the scenario for INITIAL_CONTACT via IKE_AUTH response.

History

#1 Updated by Tobias Brunner 3 months ago

  • Category set to libcharon
  • Status changed from New to Feedback

Could you confirm my statement is correct or not?

Yes, strongSwan does not send it in the response.

#2 Updated by li yang 3 months ago

Yes, strongSwan does not send it in the response.

Can I know the background why strongSwan does not sent INITIAL_CONTACT in the response?

#3 Updated by Tobias Brunner 3 months ago

Can I know the background why strongSwan does not sent INITIAL_CONTACT in the response?

I guess because there was no use case for it so far (strongSwan also only processes the notify in IKE_AUTH requests).

#4 Updated by li yang about 2 months ago

It is Ok for my question. Please close it. Thanks.

#5 Updated by Tobias Brunner about 2 months ago

  • Status changed from Feedback to Closed
  • Assignee set to Tobias Brunner
  • Resolution set to No change required

Also available in: Atom PDF