Looking through RFC 7296 Internet Key Exchange Protocol Version 2 all the error responses seem to terminate processing which means only one should be possible and, presumably, finding two indicates a broken peer.
However, I do wonder what should happen when the IKE_AUTH response, along with other payloads, contains: - two error notifications, and/or (which is correct) - unknown error notifications (is that for the IKE SA or Child SA) My instinct is to view the peer as hostile and abandon the IKE SA. 2.21.2 contains the text In an IKE_AUTH exchange, or in the INFORMATIONAL exchange immediately following it (in case an error happened when processing a response to IKE_AUTH), the UNSUPPORTED_CRITICAL_PAYLOAD, INVALID_SYNTAX, and AUTHENTICATION_FAILED notifications are the only ones to cause the IKE SA to be deleted or not created, without a Delete payload. Extension documents may define new error notifications with these semantics, but MUST NOT use them unless the peer has been shown to understand them, such as by using the Vendor ID payload. which I can read as establish the IKE SA when possible and then fail the Child SA; I think the MUST NOT may want to trump that. _______________________________________________ IPsec mailing list -- [email protected] To unsubscribe send an email to [email protected]
