Ikev2 #34

Himself132 · 2021-06-10T14:08:35Z

Are you aware of any scripts that can enumerate acceptable cipher suites and combinations of the separate attributes for ikev2 similar to what ike-scan does for ikev1? I see that I can see what dhgroups are acceptable but ike-scan responds with a message saying that ikev2 does not accept custom proposals. Does this mean that ikev2 hides what is acceptable until further along the handshake/auth or am I missing something? If the cipher suites can be enumerated how much work would it be to modify the script and do you have any suggestions on how to go about it? I'd like to spend some time on this outside of a test I'm doing and just wondering how much of an investment it'd be or if I should work through scapy.

royhills · 2021-06-10T16:15:53Z

As you've noted, the current version of ike-scan doesn't support custom transforms for ikev2. It only supports a pre-defined ikev2 transform set, which is generated by the following code in ike-scan.c:

   2197    if (params->ike_version != 1) {      /* IKEv2 Transforms */
   2198       unsigned char *attr;
   2199       size_t attr_len;
   2200
   2201       add_attr(0, NULL, 'B', OAKLEY_KEY_LENGTH, 0, 256, NULL);
   2202       attr = add_attr(1, &attr_len, '\0', 0, 0, 0, NULL);
   2203       add_transform2(0, NULL, IKEV2_TYPE_ENCR, IKEV2_ENCR_AES_CBC, attr, attr_len);
   2204       free(attr);
   2205       add_attr(0, NULL, 'B', OAKLEY_KEY_LENGTH, 0, 128, NULL);
   2206       attr = add_attr(1, &attr_len, '\0', 0, 0, 0, NULL);
   2207       add_transform2(0, NULL, IKEV2_TYPE_ENCR, IKEV2_ENCR_AES_CBC, attr, attr_len);
   2208       free(attr);
   2209       add_transform2(0, NULL, IKEV2_TYPE_ENCR, IKEV2_ENCR_3DES, NULL, 0);
   2210       add_transform2(0, NULL, IKEV2_TYPE_ENCR, IKEV2_ENCR_DES, NULL, 0);
   2211       add_transform2(0, NULL, IKEV2_TYPE_PRF, IKEV2_PRF_HMAC_SHA1, NULL, 0);
   2212       add_transform2(0, NULL, IKEV2_TYPE_PRF, IKEV2_PRF_HMAC_MD5, NULL, 0);
   2213       add_transform2(0, NULL, IKEV2_TYPE_INTEG, IKEV2_AUTH_HMAC_SHA1_96, NULL, 0);
   2214       add_transform2(0, NULL, IKEV2_TYPE_INTEG, IKEV2_AUTH_HMAC_MD5_96, NULL, 0);
   2215       add_transform2(0, NULL, IKEV2_TYPE_DH, 2, NULL, 0);
   2216       add_transform2(0, NULL, IKEV2_TYPE_DH, 5, NULL, 0);
   2217       add_transform2(0, NULL, IKEV2_TYPE_DH, 14, NULL, 0);
   2218       transforms = add_transform2(1, &trans_len, 0, 0, NULL, 0);
   2219       no_trans=11;
   2220    }

It is possible to alter this code to change the transforms, which is what I've done when experimenting with ikev2, but I realise that's far from ideal.

It would be preferrable to add support for custom transforms, but that would require some code refactoring in order to do so neatly.

Now I know that there's some interest in ikev2 enumeration I might look at this. Of course, pull requests are always welcome :-)

Himself132 · 2021-06-11T14:59:27Z

If i get some spare time I'd love to contribute and will aim at doing so, but I'll warn you, the extent of my coding is dirty scripting in python for pen testing. Do you have a good reference to ensure i have the write syntax for similar items above for other encryption, algorithm and dh groups somewhere? I am also a bit confused, maybe you could clarify, is the above block of code sending one request that says this is what i support so the server can respond with the default (this is what I'm obsering now). The idea here would be to allow a user the option of which transforms to choose and send that as well as to enumerate all correct?

royhills · 2021-06-12T12:45:16Z

The code shown above is constructing the following IKEv2 transforms:

Encryption Algorithm = AES_CBC, 256 bit key
Encryption Algorithm = AES_CBC, 128 bit key
Encryption Algorithm = 3DES
Encryption Algorithm = DES
Pseudo-random Function = SHA1
Pseudo-random Function = MD5
Integrity Algorithm = SHA1
Integrity Algorithm = MD5
Diffie-Hellman Group = 2
Diffie-Hellman Group = 5
Diffie-Hellman Group = 14

This transform set forms part of the proposal which in turn forms part of the SA payload.

RFC 4306 states:

If there are multiple transforms with the same Transform Type, the proposal is an OR of those transforms. If there are multiple Transforms with different Transform Types, the proposal is an AND of the different groups

Which means the proposal is:

Encryption: (AES/256 or AES/128 or 3DES or DES) and
Pseudo-random Function: (SHA1 or MD5) and
Integrity Algorithm: (SHA1 or MD5) and
Diffie-Hellman Group: (2 or 5 or 14)

Edit: the simplest way to enumerate transforms is to send one custom transform at a time and see what responses are returned. But this custom transform needs to be sent instead of the default, not in addition to it.

Zamanry · 2022-02-22T23:21:14Z

I've been trying to understand the yIKEs tool seen here which exclusively supports IKEv2. It is the only custom transform tool I've seen public:

https://github.com/aatlasis/yIKEs

Would love to eventually have ike-scan perform the same function as yIKEs but at a higher level.

If you want super quick IKEv1 full algorithm support, checkout Patator:

https://github.com/lanjelot/patator

Hoasd · 2024-06-08T09:17:24Z

Since I manage over hundreds of VPN tunnels with IKEv2, I would be very happy about a corresponding implementation.

In the meantime, it would be enough for me if I could use ike-scan to test remote peers with the following proposal:

Encryption: (AES/256) and
Pseudo-random Function: (SHA2_512) and
Integrity Algorithm: (SHA2_512) and
Diffie-Hellman Group: (20 or 21)

I thought I could customize the ike-scan.c with the above parameters, but I saw that the isakmp.h only contains the following “maximum” algorithms:

/* IKEv2 transform IDs for IKEV2_TYPE_PRF */
#define IKEV2_PRF_HMAC_SHA1 2
#define IKEV2_PRF_HMAC_SHA2_512 <--- Needed, but not implemented

/* IKEv2 transform IDs for IKEV2_TYPE_INTEG */
#define IKEV2_AUTH_HMAC_SHA1_96 2
#define IKEV2_AUTH_HMAC_SHA2_512 <--- Needed, but not implemented

Would it perhaps be possible to have a quick and dirty implementation in the short term with the above proposal?

If it is useful, I could use it to run many tests with different appliances (Cisco Routers and ASAs, StrongSwan [heavily used with IKEv2], Fortigate, WatchGuard, Sophos, Palo Alto and so on) and provide the results?

I would like to take this opportunity to thank Roy Hills for his efforts and the implementation of ike-scan. Tests that would otherwise take hours can now be carried out in just a few seconds. It is invaluable for daily error analysis. AMAZING!

royhills · 2024-06-08T12:19:25Z

The algorithms you mention are defined in rfc 4868:

For use of HMAC-SHA-256+ as a PRF in IKEv2, IANA has assigned the
following IKEv2 Pseudo-random function (type 2) transform
identifiers:

PRF_HMAC_SHA2_256  5
PRF_HMAC_SHA2_384  6
PRF_HMAC_SHA2_512  7

For the use of HMAC-SHA-256+ algorithms for data origin
authentication and integrity verification in IKEv2, ESP, or AH, IANA
has assigned the following IKEv2 integrity (type 3) transform
identifiers:

AUTH_HMAC_SHA2_256_128  12
AUTH_HMAC_SHA2_384_192  13
AUTH_HMAC_SHA2_512_256  14

I'll create a PR to add these algorithm identifiers.

Hoasd · 2024-06-08T17:32:28Z

I have adapted the file ike-scan.c as follows:

2197    if (params->ike_version != 1) {      /* IKEv2 Transforms */
2198       unsigned char *attr;
2199       size_t attr_len;
2200
2201       add_attr(0, NULL, 'B', OAKLEY_KEY_LENGTH, 0, 256, NULL);
2202       attr = add_attr(1, &attr_len, '\0', 0, 0, 0, NULL);
2203       add_transform2(0, NULL, IKEV2_TYPE_ENCR, IKEV2_ENCR_AES_CBC, attr, attr_len);
2204       free(attr);
2205       add_transform2(0, NULL, IKEV2_TYPE_ENCR, IKEV2_ENCR_AES_CBC, NULL, 0);
2206       add_transform2(0, NULL, IKEV2_TYPE_PRF, IKEV2_PRF_HMAC_SHA2_512, NULL, 0);
2207       add_transform2(0, NULL, IKEV2_TYPE_INTEG, IKEV2_AUTH_HMAC_SHA2_512_256, NULL, 0);
2208       add_transform2(0, NULL, IKEV2_TYPE_DH, 20, NULL, 0);
2209       add_transform2(0, NULL, IKEV2_TYPE_DH, 21, NULL, 0);
2210       transforms = add_transform2(1, &trans_len, 0, 0, NULL, 0);
2211       no_trans=11;
2212    }

Added the following lines to isakmp.h:

182 /* IKEv2 transform IDs for IKEV2_TYPE_PRF */
183 #define IKEV2_PRF_HMAC_MD5      1
184 #define IKEV2_PRF_HMAC_SHA1     2
185 #define IKEV2_PRF_HMAC_TIGER    3
186 #define IKEV2_PRF_AES128_XCBC   4
187 #define IKEV2_PRF_HMAC_SHA2_256 5       /* RFC 4868 */
188 #define IKEV2_PRF_HMAC_SHA2_384 6       /* RFC 4868 */
189 #define IKEV2_PRF_HMAC_SHA2_512 7       /* RFC 4868 */
190
191 /* IKEv2 transform IDs for IKEV2_TYPE_INTEG */
192 #define IKEV2_AUTH_HMAC_MD5_96  1
193 #define IKEV2_AUTH_HMAC_SHA1_96 2
194 #define IKEV2_AUTH_DES_MAC      3
195 #define IKEV2_AUTH_KPDK_MD5     4
196 #define IKEV2_AUTH_AES_XCBC_96  5
197 #define IKEV2_AUTH_HMAC_SHA2_256_128    12 /* RFC 4868 */
198 #define IKEV2_AUTH_HMAC_SHA2_384_192    13 /* RFC 4868 */
199 #define IKEV2_AUTH_HMAC_SHA2_512_256    14 /* RFC 4868 */

Then I executed the commands as described in the documentation (autoreconf --install, ./configure --with-openssl, make and make check). make check throws the following exception:

======================================
  ike-scan 1.9.6: ./test-suite.log
======================================

# TOTAL: 13
# PASS:  12
# SKIP:  0
# XFAIL: 0
# FAIL:  1
# XPASS: 0
# ERROR: 0

.. contents:: :depth: 2

FAIL: check-packet
==================

Checking ike-scan default packet against ./pkt-default-proposal.dat ...
ok
Checking ike-scan custom packet (adv trans) against ./pkt-custom-proposal.dat ...
ok
Checking ike-scan aggressive mode packet against ./pkt-aggressive.dat ...
ok
Checking ike-scan malformed packet against ./pkt-malformed.dat ...
ok
Checking ike-scan IKEv2 packet against ./pkt-ikev2.dat ...
FAILED
FAIL check-packet (exit status: 1)

royhills · 2024-06-08T17:57:28Z

That is expected behaviour - if you change the IKEv2 transforms then the packet data won't match the sample data in pkt-ikev2.dat. You don't need to run "make check" to install and run so you can ignore this step.

Hoasd · 2024-06-08T18:57:58Z

Thank you very much for your swift response, Roy. I have successfully compiled it with the changes mentioned above.

Tried an ikev2 scan against StrongSwan:

ike-scan  --ikev2 -M 37.83.x.x
Starting ike-scan 1.9.5 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
37.83.x.x      Notify message 14 (NO_PROPOSAL_CHOSEN)
        HDR=(CKY-R=0000000000000000, IKEv2)
Ending ike-scan 1.9.5: 1 hosts scanned in 0.064 seconds (15.73 hosts/sec).  0 returned handshake; 1 returned notify

According to the logs of the strongswan, the above changes are ignored and the old parameters are still used:

[IKE] <3> IKE_SA (unnamed)[3] state change: CREATED => CONNECTING
[CFG] <3> received proposals: IKE:AES_CBC_256/AES_CBC_128/3DES_CBC/DES_CBC/HMAC_SHA1_96/HMAC_MD5_96/PRF_HMAC_SHA1/PRF_HMAC_MD5/MODP_1024/MODP_1536/MODP_2048
[CFG] <3> configured proposals: IKE:AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/ECP_521

royhills · 2024-06-09T09:21:43Z

I have committed this change to the PR which adds four new transforms to the default ikev2 proposal. Note that you need to adjust no_trans if the number of transforms is changed. This fails make check but should still build and run.

rsh@bookworm:~/ike-scan$ git diff
diff --git a/ike-scan.c b/ike-scan.c
index b14c82a..5448060 100644
--- a/ike-scan.c
+++ b/ike-scan.c
@@ -2208,15 +2208,19 @@ initialise_ike_packet(size_t *packet_out_len, ike_packet_params *params) {
       free(attr);
       add_transform2(0, NULL, IKEV2_TYPE_ENCR, IKEV2_ENCR_3DES, NULL, 0);
       add_transform2(0, NULL, IKEV2_TYPE_ENCR, IKEV2_ENCR_DES, NULL, 0);
+      add_transform2(0, NULL, IKEV2_TYPE_PRF, IKEV2_PRF_HMAC_SHA2_512, NULL, 0);
+      add_transform2(0, NULL, IKEV2_TYPE_PRF, IKEV2_PRF_HMAC_SHA2_256, NULL, 0);
       add_transform2(0, NULL, IKEV2_TYPE_PRF, IKEV2_PRF_HMAC_SHA1, NULL, 0);
       add_transform2(0, NULL, IKEV2_TYPE_PRF, IKEV2_PRF_HMAC_MD5, NULL, 0);
+      add_transform2(0, NULL, IKEV2_TYPE_INTEG, IKEV2_AUTH_HMAC_SHA2_512_256, NULL, 0);
+      add_transform2(0, NULL, IKEV2_TYPE_INTEG, IKEV2_AUTH_HMAC_SHA2_256_128, NULL, 0);
       add_transform2(0, NULL, IKEV2_TYPE_INTEG, IKEV2_AUTH_HMAC_SHA1_96, NULL, 0);
       add_transform2(0, NULL, IKEV2_TYPE_INTEG, IKEV2_AUTH_HMAC_MD5_96, NULL, 0);
       add_transform2(0, NULL, IKEV2_TYPE_DH, 2, NULL, 0);
       add_transform2(0, NULL, IKEV2_TYPE_DH, 5, NULL, 0);
       add_transform2(0, NULL, IKEV2_TYPE_DH, 14, NULL, 0);
       transforms = add_transform2(1, &trans_len, 0, 0, NULL, 0);
-      no_trans=11;
+      no_trans=15;
    }
 /*
  *     Proposal payload

The initiator packet now looks like this:

rsh@bookworm:~$ sudo tcpdump -n -i ens33 -v -X udp port 500
tcpdump: listening on ens33, link-type EN10MB (Ethernet), snapshot length 262144 bytes
10:11:22.580252 IP (tos 0x0, ttl 64, id 51843, offset 0, flags [DF], proto UDP (17), length 356)
    192.168.1.138.500 > 192.168.1.1.500: isakmp 2.0 msgid 00000000: parent_sa ikev2_init[I]:
    (sa: len=136
        (p: #1 protoid=isakmp transform=15 len=136
            (t: #1 type=encr id=aes (type=keylen value=0100))
            (t: #2 type=encr id=aes (type=keylen value=0080))
            (t: #3 type=encr id=3des )
            (t: #4 type=encr id=1des )
            (t: #5 type=prf id=#7 )
            (t: #6 type=prf id=#5 )
            (t: #7 type=prf id=hmac-sha )
            (t: #8 type=prf id=hmac-md5 )
            (t: #9 type=integ id=#14 )
            (t: #10 type=integ id=#12 )
            (t: #11 type=integ id=hmac-sha )
            (t: #12 type=integ id=hmac-md5 )
            (t: #13 type=dh id=modp1024 )
            (t: #14 type=dh id=modp1536 )
            (t: #15 type=dh id=modp2048 )))
    (v2ke: len=128 group=modp1024)
    (nonce: len=20 data=(fc5fad52f5657964ffde...d19e2432540e6adac1f0))
        0x0000:  4500 0164 ca83 4000 4011 eb29 c0a8 018a  E..d..@.@..)....
        0x0010:  c0a8 0101 01f4 01f4 0150 853d 1ef0 1a33  .........P.=...3
        0x0020:  df5a c5a2 0000 0000 0000 0000 2120 2208  .Z..........!.".
        0x0030:  0000 0000 0000 0148 2200 008c 0000 0088  .......H".......
        0x0040:  0101 000f 0300 000c 0100 000c 800e 0100  ................
        0x0050:  0300 000c 0100 000c 800e 0080 0300 0008  ................
        0x0060:  0100 0003 0300 0008 0100 0002 0300 0008  ................
        0x0070:  0200 0007 0300 0008 0200 0005 0300 0008  ................
        0x0080:  0200 0002 0300 0008 0200 0001 0300 0008  ................
        0x0090:  0300 000e 0300 0008 0300 000c 0300 0008  ................
        0x00a0:  0300 0002 0300 0008 0300 0001 0300 0008  ................
        0x00b0:  0400 0002 0300 0008 0400 0005 0000 0008  ................
        0x00c0:  0400 000e 2800 0088 0002 0000 f0e0 5409  ....(.........T.
        0x00d0:  6e05 60db 18db 8d5b 1696 7dbc a904 78b5  n.`....[..}...x.
        0x00e0:  f317 4aa8 7ad8 c91a 3d11 c02f 0d94 e02d  ..J.z...=../...-
        0x00f0:  cc09 8f0f f363 442e dbb8 3c52 6109 6fe7  .....cD...<Ra.o.
        0x0100:  d6bf 1878 bc6f f5cd 95e9 2d22 c737 c241  ...x.o....-".7.A
        0x0110:  3508 67a3 3103 3d3c cbd9 7368 5cef 710f  5.g.1.=<..sh\.q.
        0x0120:  dbab edf4 194f 1ead 98d6 b3d0 0432 69b9  .....O.......2i.
        0x0130:  9018 8de5 2dfa 05b6 89e7 ef33 f560 44dc  ....-......3.`D.
        0x0140:  e0fb b784 50d8 fe82 1c85 b4b9 0000 0018  ....P...........
        0x0150:  fc5f ad52 f565 7964 ffde d19e 2432 540e  ._.R.eyd....$2T.
        0x0160:  6ada c1f0                                j...
^C
1 packet captured
1 packet received by filter
0 packets dropped by kernel

Please let me know if this works.

Hoasd · 2024-06-09T12:22:14Z

I've added the Key Exchange Method Transform IDs DH Group 20 and Group 21. The IANA transform identifiers are:

[21] 521-bit random ECP group [RFC6989], Sec. 2.3 [RFC5903]
[20] 384-bit random ECP group [RFC6989], Sec. 2.3 [RFC5903]

As I added the two lines to the code I also updated no_trans to 17.

ritter@dev:~/ike-scan$ git diff
diff --git a/ike-scan.c b/ike-scan.c
index b14c82a..255d61b 100644
--- a/ike-scan.c
+++ b/ike-scan.c
@@ -2208,15 +2208,21 @@ initialise_ike_packet(size_t *packet_out_len, ike_packet_params *params) {
       free(attr);
       add_transform2(0, NULL, IKEV2_TYPE_ENCR, IKEV2_ENCR_3DES, NULL, 0);
       add_transform2(0, NULL, IKEV2_TYPE_ENCR, IKEV2_ENCR_DES, NULL, 0);
+      add_transform2(0, NULL, IKEV2_TYPE_PRF, IKEV2_PRF_HMAC_SHA2_512, NULL, 0);
+      add_transform2(0, NULL, IKEV2_TYPE_PRF, IKEV2_PRF_HMAC_SHA2_256, NULL, 0);
       add_transform2(0, NULL, IKEV2_TYPE_PRF, IKEV2_PRF_HMAC_SHA1, NULL, 0);
       add_transform2(0, NULL, IKEV2_TYPE_PRF, IKEV2_PRF_HMAC_MD5, NULL, 0);
+      add_transform2(0, NULL, IKEV2_TYPE_INTEG, IKEV2_AUTH_HMAC_SHA2_512_256, NULL, 0);
+      add_transform2(0, NULL, IKEV2_TYPE_INTEG, IKEV2_AUTH_HMAC_SHA2_256_128, NULL, 0);
       add_transform2(0, NULL, IKEV2_TYPE_INTEG, IKEV2_AUTH_HMAC_SHA1_96, NULL, 0);
       add_transform2(0, NULL, IKEV2_TYPE_INTEG, IKEV2_AUTH_HMAC_MD5_96, NULL, 0);
       add_transform2(0, NULL, IKEV2_TYPE_DH, 2, NULL, 0);
       add_transform2(0, NULL, IKEV2_TYPE_DH, 5, NULL, 0);
       add_transform2(0, NULL, IKEV2_TYPE_DH, 14, NULL, 0);
+      add_transform2(0, NULL, IKEV2_TYPE_DH, 20, NULL, 0);
+      add_transform2(0, NULL, IKEV2_TYPE_DH, 21, NULL, 0);
       transforms = add_transform2(1, &trans_len, 0, 0, NULL, 0);
-      no_trans=11;
+      no_trans=17;
    }
 /*
  *     Proposal payload

diff --git a/isakmp.h b/isakmp.h
index 72125d3..fc53623 100644
--- a/isakmp.h
+++ b/isakmp.h
@@ -184,6 +184,9 @@
 #define IKEV2_PRF_HMAC_SHA1    2
 #define IKEV2_PRF_HMAC_TIGER   3
 #define IKEV2_PRF_AES128_XCBC  4
+#define IKEV2_PRF_HMAC_SHA2_256        5       /* RFC 4868 */
+#define IKEV2_PRF_HMAC_SHA2_384        6       /* RFC 4868 */
+#define IKEV2_PRF_HMAC_SHA2_512        7       /* RFC 4868 */
 
 /* IKEv2 transform IDs for IKEV2_TYPE_INTEG */
 #define IKEV2_AUTH_HMAC_MD5_96 1
@@ -191,6 +194,9 @@
 #define IKEV2_AUTH_DES_MAC     3
 #define IKEV2_AUTH_KPDK_MD5    4
 #define IKEV2_AUTH_AES_XCBC_96 5
+#define IKEV2_AUTH_HMAC_SHA2_256_128   12 /* RFC 4868 */
+#define IKEV2_AUTH_HMAC_SHA2_384_192   13 /* RFC 4868 */
+#define IKEV2_AUTH_HMAC_SHA2_512_256   14 /* RFC 4868 */
 
 /*
  * Define packet structures

ike-scan  --ikev2 -M 37.83.x.x
Starting ike-scan 1.9.5 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
37.83.x.x	Notify message 14 (NO_PROPOSAL_CHOSEN)
	HDR=(CKY-R=0000000000000000, IKEv2)

Ending ike-scan 1.9.5: 1 hosts scanned in 0.076 seconds (13.24 hosts/sec).  0 returned handshake; 1 returned notify

root@rasp3:~# tcpdump -n -i eth0 -v -X udp port 500
tcpdump: listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
13:59:11.200503 IP (tos 0x0, ttl 51, id 7520, offset 0, flags [DF], proto UDP (17), length 324)
    ip.ip.ip.ip.500 > 192.168.3.152.500: isakmp 2.0 msgid 00000000: parent_sa ikev2_init[I]:
    (sa: len=104
        (p: #1 protoid=isakmp transform=11 len=104
            (t: #1 type=encr id=aes (type=keylen value=0100))
            (t: #2 type=encr id=aes (type=keylen value=0080))
            (t: #3 type=encr id=3des )
            (t: #4 type=encr id=1des )
            (t: #5 type=prf id=hmac-sha )
            (t: #6 type=prf id=hmac-md5 )
            (t: #7 type=integ id=hmac-sha )
            (t: #8 type=integ id=hmac-md5 )
            (t: #9 type=dh id=modp1024 )
            (t: #10 type=dh id=modp1536 )
            (t: #11 type=dh id=modp2048 )))
    (v2ke: len=128 group=modp1024)
    (nonce: len=20 data=(65503989751df97ed5b9...feeac95fa905559fcb6f))
	0x0000:  4500 0144 1d60 4000 3311 db62 023b 876b  E..D.`@.3..b.;.k
	0x0010:  c0a8 0398 01f4 01f4 0130 372f 0757 9158  .........07/.W.X
	0x0020:  9ba9 6b49 0000 0000 0000 0000 2120 2208  ..kI........!.".
	0x0030:  0000 0000 0000 0128 2200 006c 0000 0068  .......("..l...h
	0x0040:  0101 000b 0300 000c 0100 000c 800e 0100  ................
	0x0050:  0300 000c 0100 000c 800e 0080 0300 0008  ................
	0x0060:  0100 0003 0300 0008 0100 0002 0300 0008  ................
	0x0070:  0200 0002 0300 0008 0200 0001 0300 0008  ................
	0x0080:  0300 0002 0300 0008 0300 0001 0300 0008  ................
	0x0090:  0400 0002 0300 0008 0400 0005 0000 0008  ................
	0x00a0:  0400 000e 2800 0088 0002 0000 b25a 5c71  ....(........Z\q
	0x00b0:  c67d 9028 69db 5ace a6fb 6026 48c8 4b80  .}.(i.Z...`&H.K.
	0x00c0:  b8a1 ceeb 0d74 e5ba 17ca 41dd 3d7d ede2  .....t....A.=}..
	0x00d0:  0549 4ff5 7611 a59e ef89 be2f d723 8fab  .IO.v....../.#..
	0x00e0:  75fe 4a13 2a4e 7602 e5c3 1240 817c 389f  u.J.*Nv....@.|8.
	0x00f0:  0733 4945 91ff 924f 0cb9 6081 c2ab 1280  .3IE...O..`.....
	0x0100:  ccbe 13b2 a70b 7372 0445 1c54 e357 0a63  ......sr.E.T.W.c
	0x0110:  7df8 78f5 9f87 c47b d37b b01e 70e1 a4d9  }.x....{.{..p...
	0x0120:  a8e6 69f3 7818 a099 2124 35aa 0000 0018  ..i.x...!$5.....
	0x0130:  6550 3989 751d f97e d5b9 feea c95f a905  eP9.u..~....._..
	0x0140:  559f cb6f                                U..o
13:59:11.206231 IP (tos 0x0, ttl 64, id 714, offset 0, flags [DF], proto UDP (17), length 64)
    192.168.3.152.500 >  ip.ip.ip.ip.500: isakmp 2.0 msgid 00000000: parent_sa ikev2_init[R]:
    (n: prot_id=#0 type=14(no_protocol_chosen))
	0x0000:  4500 0040 02ca 4000 4011 e9fc c0a8 0398  E..@..@.@.......
	0x0010:  023b 876b 01f4 01f4 002c 4e24 0757 9158  .;.k.....,N$.W.X
	0x0020:  9ba9 6b49 0000 0000 0000 0000 2920 2220  ..kI........).".
	0x0030:  0000 0000 0000 0024 0000 0008 0000 000e  .......$........

As seen in the excerpt above, the changes are still not considered.

royhills · 2024-06-09T12:32:05Z

Check that you are running the modified and rebuilt version (e.g. with ./ike-scan) and you're not running an old binary in the path. Changing the code should definately change the transforms in the initiatior payload.

Hoasd · 2024-06-09T13:25:48Z

Dear Roy, I assure you that I have recompiled the source code. Even more, I cloned the repository from scratch every time.

Here are my commands:

git clone [email protected]:royhills/ike-scan.git

cd ike-scan
autoreconf --install

cd ..

cp -v ike_diff/* ike-scan 
ike_diff/ike-scan.c -> ike-scan/ike-scan.c
ike_diff/isakmp.h -> ike-scan/isakmp.h

cd ike-scan

cross check isakmp.h:

$ git diff isakmp.h
diff --git a/isakmp.h b/isakmp.h
index 72125d3..fc53623 100644
--- a/isakmp.h
+++ b/isakmp.h
@@ -184,6 +184,9 @@
 #define IKEV2_PRF_HMAC_SHA1    2
 #define IKEV2_PRF_HMAC_TIGER   3
 #define IKEV2_PRF_AES128_XCBC  4
+#define IKEV2_PRF_HMAC_SHA2_256        5       /* RFC 4868 */
+#define IKEV2_PRF_HMAC_SHA2_384        6       /* RFC 4868 */
+#define IKEV2_PRF_HMAC_SHA2_512        7       /* RFC 4868 */
 
 /* IKEv2 transform IDs for IKEV2_TYPE_INTEG */
 #define IKEV2_AUTH_HMAC_MD5_96 1
@@ -191,6 +194,9 @@
 #define IKEV2_AUTH_DES_MAC     3
 #define IKEV2_AUTH_KPDK_MD5    4
 #define IKEV2_AUTH_AES_XCBC_96 5
+#define IKEV2_AUTH_HMAC_SHA2_256_128   12 /* RFC 4868 */
+#define IKEV2_AUTH_HMAC_SHA2_384_192   13 /* RFC 4868 */
+#define IKEV2_AUTH_HMAC_SHA2_512_256   14 /* RFC 4868 */
 
 /*
  * Define packet structures

cross check ike-scan.c:

$ git diff ike-scan.c
diff --git a/ike-scan.c b/ike-scan.c
index b14c82a..255d61b 100644
--- a/ike-scan.c
+++ b/ike-scan.c
@@ -2208,15 +2208,21 @@ initialise_ike_packet(size_t *packet_out_len, ike_packet_params *params) {
       free(attr);
       add_transform2(0, NULL, IKEV2_TYPE_ENCR, IKEV2_ENCR_3DES, NULL, 0);
       add_transform2(0, NULL, IKEV2_TYPE_ENCR, IKEV2_ENCR_DES, NULL, 0);
+      add_transform2(0, NULL, IKEV2_TYPE_PRF, IKEV2_PRF_HMAC_SHA2_512, NULL, 0);
+      add_transform2(0, NULL, IKEV2_TYPE_PRF, IKEV2_PRF_HMAC_SHA2_256, NULL, 0);
       add_transform2(0, NULL, IKEV2_TYPE_PRF, IKEV2_PRF_HMAC_SHA1, NULL, 0);
       add_transform2(0, NULL, IKEV2_TYPE_PRF, IKEV2_PRF_HMAC_MD5, NULL, 0);
+      add_transform2(0, NULL, IKEV2_TYPE_INTEG, IKEV2_AUTH_HMAC_SHA2_512_256, NULL, 0);
+      add_transform2(0, NULL, IKEV2_TYPE_INTEG, IKEV2_AUTH_HMAC_SHA2_256_128, NULL, 0);
       add_transform2(0, NULL, IKEV2_TYPE_INTEG, IKEV2_AUTH_HMAC_SHA1_96, NULL, 0);
       add_transform2(0, NULL, IKEV2_TYPE_INTEG, IKEV2_AUTH_HMAC_MD5_96, NULL, 0);
       add_transform2(0, NULL, IKEV2_TYPE_DH, 2, NULL, 0);
       add_transform2(0, NULL, IKEV2_TYPE_DH, 5, NULL, 0);
       add_transform2(0, NULL, IKEV2_TYPE_DH, 14, NULL, 0);
+      add_transform2(0, NULL, IKEV2_TYPE_DH, 20, NULL, 0);
+      add_transform2(0, NULL, IKEV2_TYPE_DH, 21, NULL, 0);
       transforms = add_transform2(1, &trans_len, 0, 0, NULL, 0);
-      no_trans=11;
+      no_trans=17;
    }
 /*
  *     Proposal payload


./configure --prefix=/opt/ike-scan --exec-prefix=/opt/ike-scan
make

rm -rfv /opt/ike-scan
make install

Transferring the freshly build binaries to the remote test system:

tar cf - /opt/ike-scan/ | ssh [email protected] 'cd / && tar xpvf -'
tar: Removing leading `/' from member names
opt/ike-scan/
opt/ike-scan/bin/
opt/ike-scan/bin/ike-scan
opt/ike-scan/bin/psk-crack
opt/ike-scan/share/
opt/ike-scan/share/man/
opt/ike-scan/share/man/man1/
opt/ike-scan/share/man/man1/psk-crack.1
opt/ike-scan/share/man/man1/ike-scan.1
opt/ike-scan/share/ike-scan/
opt/ike-scan/share/ike-scan/psk-crack-dictionary
opt/ike-scan/share/ike-scan/ike-backoff-patterns
opt/ike-scan/share/ike-scan/ike-vendor-ids

It is a mystery to me that the changes to the transform sets seem to be ignored every time.

Would it be worth a try to upload the isakmp.h and ike-scan.c I modified to your repository and then carry out the individual steps (clone) yourself as I described above?

royhills · 2024-06-09T13:30:07Z

Thanks for confirming - just checking. I should be able to reproduce your changes from the diffs you posted. It'll probably make sense when I get a branch with your changes to compare.

royhills · 2024-06-09T14:47:58Z

Can you try revision d6c11fb on branch ikev2-new-algorithms. That should generate a single proposal with 17 transforms:

        (p: #1 protoid=isakmp transform=17 len=152
            (t: #1 type=encr id=aes (type=keylen value=0100))
            (t: #2 type=encr id=aes (type=keylen value=0080))
            (t: #3 type=encr id=3des )
            (t: #4 type=encr id=1des )
            (t: #5 type=prf id=#7 )
            (t: #6 type=prf id=#5 )
            (t: #7 type=prf id=hmac-sha )
            (t: #8 type=prf id=hmac-md5 )
            (t: #9 type=integ id=#14 )
            (t: #10 type=integ id=#12 )
            (t: #11 type=integ id=hmac-sha )
            (t: #12 type=integ id=hmac-md5 )
            (t: #13 type=dh id=modp1024 )
            (t: #14 type=dh id=modp1536 )
            (t: #15 type=dh id=modp2048 )
            (t: #16 type=dh id=#20 )
            (t: #17 type=dh id=#21 )))

I've updated pkt-ikev2.dat that is used by the check-packet self-test script, so make check should work - and if make check works then it must be sending the expected initiator packet.

I've also incremented the version number in this branch to 1.9.7, so you can double-check which branch you're using with ike-scan --version.

Hoasd · 2024-06-09T17:43:43Z

Progress!!!

We are close to the finish.

make check
make  check-sizes check-hash \
  check-run1 check-run2 check-run3 check-psk-crack-1 check-psk-crack-2 check-psk-crack-3 check-psk-crack-4 check-packet check-decode check-error check-vendor-ids
make[1]: Entering directory '/home/ritter/ike-scan'
gcc -DHAVE_CONFIG_H -I.  -DIKEDATADIR=\"/opt/ike-scan/share/ike-scan\"   -g -O2 -Wall -Wshadow -Wwrite-strings -Wextra -fstack-protector -Wformat -Wformat-security -D_FORTIFY_SOURCE=2 -MT check-sizes.o -MD -MP -MF .deps/check-sizes.Tpo -c -o check-sizes.o check-sizes.c
mv -f .deps/check-sizes.Tpo .deps/check-sizes.Po
gcc  -g -O2 -Wall -Wshadow -Wwrite-strings -Wextra -fstack-protector -Wformat -Wformat-security -D_FORTIFY_SOURCE=2   -o check-sizes check-sizes.o error.o md5.o sha1.o strlcat.o strlcpy.o 
gcc -DHAVE_CONFIG_H -I.  -DIKEDATADIR=\"/opt/ike-scan/share/ike-scan\"   -g -O2 -Wall -Wshadow -Wwrite-strings -Wextra -fstack-protector -Wformat -Wformat-security -D_FORTIFY_SOURCE=2 -MT check-hash.o -MD -MP -MF .deps/check-hash.Tpo -c -o check-hash.o check-hash.c
mv -f .deps/check-hash.Tpo .deps/check-hash.Po
gcc  -g -O2 -Wall -Wshadow -Wwrite-strings -Wextra -fstack-protector -Wformat -Wformat-security -D_FORTIFY_SOURCE=2   -o check-hash check-hash.o error.o utils.o wrappers.o mt19937ar.o md5.o sha1.o strlcat.o strlcpy.o 
make[1]: Nothing to be done for 'check-run1'.
make[1]: Nothing to be done for 'check-run2'.
make[1]: Nothing to be done for 'check-run3'.
make[1]: Nothing to be done for 'check-psk-crack-1'.
make[1]: Nothing to be done for 'check-psk-crack-2'.
make[1]: Nothing to be done for 'check-psk-crack-3'.
make[1]: Nothing to be done for 'check-psk-crack-4'.
make[1]: Nothing to be done for 'check-packet'.
make[1]: Nothing to be done for 'check-decode'.
make[1]: Nothing to be done for 'check-error'.
make[1]: Nothing to be done for 'check-vendor-ids'.
make[1]: Leaving directory '/home/ritter/ike-scan'
make  check-TESTS
make[1]: Entering directory '/home/ritter/ike-scan'
make[2]: Entering directory '/home/ritter/ike-scan'
PASS: check-sizes
PASS: check-hash
PASS: check-run1
PASS: check-run2
PASS: check-run3
PASS: check-psk-crack-1
PASS: check-psk-crack-2
PASS: check-psk-crack-3
PASS: check-psk-crack-4
PASS: check-packet
PASS: check-decode
PASS: check-error
PASS: check-vendor-ids
============================================================================
Testsuite summary for ike-scan 1.9.7
============================================================================
# TOTAL: 13
# PASS:  13
# SKIP:  0
# XFAIL: 0
# FAIL:  0
# XPASS: 0
# ERROR: 0
============================================================================
make[2]: Leaving directory '/home/ritter/ike-scan'
make[1]: Leaving directory '/home/ritter/ike-scan'

/opt/ike-scan-1.9.7/bin/ike-scan --version
ike-scan 1.9.7

Copyright (C) 2003-2013 Roy Hills, NTA Monitor Ltd.
ike-scan comes with NO WARRANTY to the extent permitted by law.
You may redistribute copies of ike-scan under the terms of the GNU
General Public License.
For more information about these matters, see the file named COPYING.

/opt/ike-scan-1.9.7/bin/ike-scan --ikev2 -M 37.83.x.x
Starting ike-scan 1.9.7 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
37.83.x.x	Notify message 17 (INVALID_KE_PAYLOAD)
	HDR=(CKY-R=0000000000000000, IKEv2)
	VID=882fe56d6fd20dbc2251613b2ebe5beb (strongSwan)

Ending ike-scan 1.9.7: 1 hosts scanned in 0.078 seconds (12.79 hosts/sec).  0 returned handshake; 1 returned notify

tcpdump -c 2 -n -i eth0 -v -X udp port 500
tcpdump: listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
19:18:10.805234 IP (tos 0x0, ttl 51, id 46586, offset 0, flags [DF], proto UDP (17), length 372)
    10.10.10.10.500 > 192.168.3.152.500: isakmp 2.0 msgid 00000000: parent_sa ikev2_init[I]:
    (sa: len=152
        (p: #1 protoid=isakmp transform=17 len=152
            (t: #1 type=encr id=aes (type=keylen value=0100))
            (t: #2 type=encr id=aes (type=keylen value=0080))
            (t: #3 type=encr id=3des )
            (t: #4 type=encr id=1des )
            (t: #5 type=prf id=#7 )
            (t: #6 type=prf id=#5 )
            (t: #7 type=prf id=hmac-sha )
            (t: #8 type=prf id=hmac-md5 )
            (t: #9 type=integ id=#14 )
            (t: #10 type=integ id=#12 )
            (t: #11 type=integ id=hmac-sha )
            (t: #12 type=integ id=hmac-md5 )
            (t: #13 type=dh id=modp1024 )
            (t: #14 type=dh id=modp1536 )
            (t: #15 type=dh id=modp2048 )
            (t: #16 type=dh id=#20 )
            (t: #17 type=dh id=#21 )))
    (v2ke: len=128 group=modp1024)
    (nonce: len=20 data=(eb0858c94fe1db1ea871...eef4222570b876c60de9))
	0x0000:  4500 0174 b5fa 4000 3311 4298 023b 876b  [email protected]..;.k
	0x0010:  c0a8 0398 01f4 01f4 0160 4648 c781 f73e  .........`FH...>
	0x0020:  4723 7ced 0000 0000 0000 0000 2120 2208  G#|.........!.".
	0x0030:  0000 0000 0000 0158 2200 009c 0000 0098  .......X".......
	0x0040:  0101 0011 0300 000c 0100 000c 800e 0100  ................
	0x0050:  0300 000c 0100 000c 800e 0080 0300 0008  ................
	0x0060:  0100 0003 0300 0008 0100 0002 0300 0008  ................
	0x0070:  0200 0007 0300 0008 0200 0005 0300 0008  ................
	0x0080:  0200 0002 0300 0008 0200 0001 0300 0008  ................
	0x0090:  0300 000e 0300 0008 0300 000c 0300 0008  ................
	0x00a0:  0300 0002 0300 0008 0300 0001 0300 0008  ................
	0x00b0:  0400 0002 0300 0008 0400 0005 0300 0008  ................
	0x00c0:  0400 000e 0300 0008 0400 0014 0000 0008  ................
	0x00d0:  0400 0015 2800 0088 0002 0000 8ce0 13bc  ....(...........
	0x00e0:  7cfc 30ad f233 0757 db31 9df2 4548 73d1  |.0..3.W.1..EHs.
	0x00f0:  4396 100b d1eb 1d6b 37ab 1af6 f8ff 1e24  C......k7......$
	0x0100:  7a20 0dad cf25 7e4a ac37 9987 c1d6 9043  z....%~J.7.....C
	0x0110:  414e eb25 58f6 df5a be8a cc80 dbbe c6e7  AN.%X..Z........
	0x0120:  ac67 e08b 533d 2ad0 09e0 f75a e05b 42b2  .g..S=*....Z.[B.
	0x0130:  c7a2 d3d1 77af f2b5 8ea5 cb2e cec4 0637  ....w..........7
	0x0140:  dee7 260b 0303 ab6c 9dd9 d6ce ec8e 3db5  ..&....l......=.
	0x0150:  646a b2c0 be64 46cd ec6b eef9 0000 0018  dj...dF..k......
	0x0160:  eb08 58c9 4fe1 db1e a871 eef4 2225 70b8  ..X.O....q.."%p.
	0x0170:  76c6 0de9                                v...
19:18:10.811124 IP (tos 0x0, ttl 64, id 15783, offset 0, flags [DF], proto UDP (17), length 86)
    192.168.3.152.500 > 10.10.10.10.500: isakmp 2.0 msgid 00000000: parent_sa ikev2_init[R]:
    (n: prot_id=#0 type=17(invalid_ke_payload))
    (v2vid: len=16 vid=./.mo..."Qa;..[.)
	0x0000:  4500 0056 3da7 4000 4011 af09 c0a8 0398  E..V=.@.@.......
	0x0010:  023b 876b 01f4 01f4 0042 4e3a c781 f73e  .;.k.....BN:...>
	0x0020:  4723 7ced 0000 0000 0000 0000 2920 2220  G#|.........).".
	0x0030:  0000 0000 0000 003a 2b00 000a 0000 0011  .......:+.......
	0x0040:  0015 0000 0014 882f e56d 6fd2 0dbc 2251  ......./.mo..."Q
	0x0050:  613b 2ebe 5beb                           a;..[.
2 packets captured
2 packets received by filter
0 packets dropped by kernel

swanctl --version
strongSwan swanctl 5.9.8

tail -f charon_debug.log
[NET] <10> received packet: from 10.10.10.10[500] to 192.168.3.152[500] (344 bytes)
[ENC] <10> parsed IKE_SA_INIT request 0 [ SA KE No ]
[IKE] <10> local endpoint changed from 0.0.0.0[500] to 192.168.3.152[500]
[IKE] <10> remote endpoint changed from 0.0.0.0 to 10.10.10.10[500]
[IKE] <10> 10.10.10.10 is initiating an IKE_SA
[IKE] <10> IKE_SA (unnamed)[10] state change: CREATED => CONNECTING
[CFG] <10> selected proposal: IKE:AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/ECP_521
[IKE] <10> natd_chunk => 22 bytes @ 0x7f64005f20
[IKE] <10>    0: 01 D0 21 4B 3C 55 F2 9B 00 00 00 00 00 00 00 00  ..!K   16: C0 A8 03 98 01 F4                                ......
[IKE] <10> natd_hash => 20 bytes @ 0x7f64005810
[IKE] <10>    0: F5 8C 36 90 7C 1D 52 C9 66 F4 9B A0 8F 04 9B CB  ..6.|.R.f.......
[IKE] <10>   16: F2 EF C6 20                                      ... 
[IKE] <10> natd_chunk => 22 bytes @ 0x7f64005f20
[IKE] <10>    0: 01 D0 21 4B 3C 55 F2 9B 00 00 00 00 00 00 00 00  ..!K   16: 02 3B 87 6B 01 F4                                .;.k..
[IKE] <10> natd_hash => 20 bytes @ 0x7f640048f0
[IKE] <10>    0: 22 94 9F F9 DF 90 38 5C A2 E6 8A CF 40 F3 01 35  ".....8\[email protected]
[IKE] <10>   16: 57 8E 86 80                                      W...
[IKE] <10> precalculated src_hash => 20 bytes @ 0x7f640048f0
[IKE] <10>    0: 22 94 9F F9 DF 90 38 5C A2 E6 8A CF 40 F3 01 35  ".....8\[email protected]
[IKE] <10>   16: 57 8E 86 80                                      W...
[IKE] <10> precalculated dst_hash => 20 bytes @ 0x7f64005810
[IKE] <10>    0: F5 8C 36 90 7C 1D 52 C9 66 F4 9B A0 8F 04 9B CB  ..6.|.R.f.......
[IKE] <10>   16: F2 EF C6 20                                      ... 
[IKE] <10> sending strongSwan vendor ID
[IKE] <10> DH group MODP_1024 unacceptable, requesting ECP_521
[ENC] <10> generating IKE_SA_INIT response 0 [ N(INVAL_KE) V ]
[NET] <10> sending packet: from 192.168.3.152[500] to 10.10.10.10[500] (58 bytes)
[IKE] <10> IKE_SA (unnamed)[10] state change: CONNECTING => DESTROYING

royhills · 2024-06-09T17:58:08Z

[IKE] <10> DH group MODP_1024 unacceptable, requesting ECP_521

Looks like it's sending DH group 2 when it wants group 21.

Try including the --dhgroup=21 option.

Hoasd · 2024-06-09T18:16:09Z

A brief idea in advance:

The StrongSwan server is connected to a connection with a dynamic IP address, which will be renewed shortly anyway.

Hence, here is the IP address 37.83.1.50 (which is NATed to 192.168.3.152 in the logs below), so that you can also test directly. It's easier for both of us.

/opt/ike-scan-1.9.7/bin/ike-scan --dhgroup=21 --ikev2 -M 37.83.1.50
Starting ike-scan 1.9.7 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
37.83.1.50 Notify message 14 (NO_PROPOSAL_CHOSEN)
	HDR=(CKY-R=0000000000000000, IKEv2)

Ending ike-scan 1.9.7: 1 hosts scanned in 0.117 seconds (8.54 hosts/sec).  0 returned handshake; 1 returned notify

[NET] <13> received packet: from 10.10.10.10[500] to 192.168.3.152[500] (348 bytes)
[ENC] <13> parsed IKE_SA_INIT request 0 [ SA KE No ]
[IKE] <13> local endpoint changed from 0.0.0.0[500] to 192.168.3.152[500]
[IKE] <13> remote endpoint changed from 0.0.0.0 to 10.10.10.10[500]
[IKE] <13> 10.10.10.10 is initiating an IKE_SA
[IKE] <13> IKE_SA (unnamed)[13] state change: CREATED => CONNECTING
[CFG] <13> selected proposal: IKE:AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/ECP_521
[LIB] <13> ECDH public value is malformed
[IKE] <13> natd_chunk => 22 bytes @ 0x7f44008830
[IKE] <13>    0: B1 FF A1 CB A3 34 B4 4B 00 00 00 00 00 00 00 00  .....4.K........
[IKE] <13>   16: C0 A8 03 98 01 F4                                ......
[IKE] <13> natd_hash => 20 bytes @ 0x7f44008810
[IKE] <13>    0: 70 F6 29 29 9A EF 76 18 E2 07 C0 61 52 F1 CF 15  p.))..v....aR...
[IKE] <13>   16: 71 11 E3 65                                      q..e
[IKE] <13> natd_chunk => 22 bytes @ 0x7f44008830
[IKE] <13>    0: B1 FF A1 CB A3 34 B4 4B 00 00 00 00 00 00 00 00  .....4.K........
[IKE] <13>   16: 02 3B 87 6B 01 F4                                .;.k..
[IKE] <13> natd_hash => 20 bytes @ 0x7f44006b90
[IKE] <13>    0: 01 AB C2 AF 83 9D D3 01 F9 48 2C 41 C2 DC AB 67  .........H,A...g
[IKE] <13>   16: 73 5A 18 01                                      sZ..
[IKE] <13> precalculated src_hash => 20 bytes @ 0x7f44006b90
[IKE] <13>    0: 01 AB C2 AF 83 9D D3 01 F9 48 2C 41 C2 DC AB 67  .........H,A...g
[IKE] <13>   16: 73 5A 18 01                                      sZ..
[IKE] <13> precalculated dst_hash => 20 bytes @ 0x7f44008810
[IKE] <13>    0: 70 F6 29 29 9A EF 76 18 E2 07 C0 61 52 F1 CF 15  p.))..v....aR...
[IKE] <13>   16: 71 11 E3 65                                      q..e
[IKE] <13> sending strongSwan vendor ID
[IKE] <13> applying DH public value failed
[ENC] <13> generating IKE_SA_INIT response 0 [ N(NO_PROP) ]
[NET] <13> sending packet: from 192.168.3.152[500] to 10.10.10.10[500] (36 bytes)
[IKE] <13> IKE_SA (unnamed)[13] state change: CONNECTING => DESTROYING

tcpdump -c 2 -n -i eth0 -v -X udp port 500
tcpdump: listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes

20:12:43.614420 IP (tos 0x0, ttl 51, id 25106, offset 0, flags [DF], proto UDP (17), length 376)
    10.10.10.10.500 > 192.168.3.152.500: isakmp 2.0 msgid 00000000: parent_sa ikev2_init[I]:
    (sa: len=152
        (p: #1 protoid=isakmp transform=17 len=152
            (t: #1 type=encr id=aes (type=keylen value=0100))
            (t: #2 type=encr id=aes (type=keylen value=0080))
            (t: #3 type=encr id=3des )
            (t: #4 type=encr id=1des )
            (t: #5 type=prf id=#7 )
            (t: #6 type=prf id=#5 )
            (t: #7 type=prf id=hmac-sha )
            (t: #8 type=prf id=hmac-md5 )
            (t: #9 type=integ id=#14 )
            (t: #10 type=integ id=#12 )
            (t: #11 type=integ id=hmac-sha )
            (t: #12 type=integ id=hmac-md5 )
            (t: #13 type=dh id=modp1024 )
            (t: #14 type=dh id=modp1536 )
            (t: #15 type=dh id=modp2048 )
            (t: #16 type=dh id=#20 )
            (t: #17 type=dh id=#21 )))
    (v2ke: len=132 group=#21)
    (nonce: len=20 data=(a4bcf746d3267f883cd9...67a163c6da55a19ae2c8))
	0x0000:  4500 0178 6212 4000 3311 967c 023b 876b  [email protected]..|.;.k
	0x0010:  c0a8 0398 01f4 01f4 0164 6852 fb5d 4cd4  .........dhR.]L.
	0x0020:  123b a3c5 0000 0000 0000 0000 2120 2208  .;..........!.".
	0x0030:  0000 0000 0000 015c 2200 009c 0000 0098  .......\".......
	0x0040:  0101 0011 0300 000c 0100 000c 800e 0100  ................
	0x0050:  0300 000c 0100 000c 800e 0080 0300 0008  ................
	0x0060:  0100 0003 0300 0008 0100 0002 0300 0008  ................
	0x0070:  0200 0007 0300 0008 0200 0005 0300 0008  ................
	0x0080:  0200 0002 0300 0008 0200 0001 0300 0008  ................
	0x0090:  0300 000e 0300 0008 0300 000c 0300 0008  ................
	0x00a0:  0300 0002 0300 0008 0300 0001 0300 0008  ................
	0x00b0:  0400 0002 0300 0008 0400 0005 0300 0008  ................
	0x00c0:  0400 000e 0300 0008 0400 0014 0000 0008  ................
	0x00d0:  0400 0015 2800 008c 0015 0000 25a0 d595  ....(.......%...
	0x00e0:  d180 a932 505a 6af5 92b1 8ba2 44a2 4cf7  ...2PZj.....D.L.
	0x00f0:  a968 36ee 8eb2 6ccb eeb9 a22e 2cc7 c85b  .h6...l.....,..[
	0x0100:  6d2d 48aa 12c2 e85d b52d 94ee 13c7 6d8e  m-H....].-....m.
	0x0110:  4708 df92 62b3 86c5 b143 5682 65fe 0abd  G...b....CV.e...
	0x0120:  cd9c 32f9 1f02 96ea f06b 5e8f 85ac ff4a  ..2......k^....J
	0x0130:  b1d1 8669 89a8 81f4 361e a23c f2cd 5aa2  ...i....6..<..Z.
	0x0140:  751c 2ad9 5592 c790 a610 bcf5 2915 291e  u.*.U.......).).
	0x0150:  e3ad 4f0c aad4 a320 74af f09b 1ac2 4fbe  ..O.....t.....O.
	0x0160:  0000 0018 a4bc f746 d326 7f88 3cd9 67a1  .......F.&..<.g.
	0x0170:  63c6 da55 a19a e2c8                      c..U....
20:12:43.661927 IP (tos 0x0, ttl 64, id 20780, offset 0, flags [DF], proto UDP (17), length 64)
    192.168.3.152.500 > 10.10.10.10.500: isakmp 2.0 msgid 00000000: parent_sa ikev2_init[R]:
    (n: prot_id=#0 type=14(no_protocol_chosen))
	0x0000:  4500 0040 512c 4000 4011 9b9a c0a8 0398  E..@Q,@.@.......
	0x0010:  023b 876b 01f4 01f4 002c 4e24 fb5d 4cd4  .;.k.....,N$.]L.
	0x0020:  123b a3c5 0000 0000 0000 0000 2920 2220  .;..........).".
	0x0030:  0000 0000 0000 0024 0000 0008 0000 000e  .......$........
2 packets captured
2 packets received by filter
0 packets dropped by kernel

And here the response for DH20:

/opt/ike-scan-1.9.7/bin/ike-scan --dhgroup=20 --ikev2 -M 37.83.1.50  
Starting ike-scan 1.9.7 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
37.83.1.50	Notify message 17 (INVALID_KE_PAYLOAD)
	HDR=(CKY-R=0000000000000000, IKEv2)
	VID=882fe56d6fd20dbc2251613b2ebe5beb (strongSwan)

Ending ike-scan 1.9.7: 1 hosts scanned in 0.090 seconds (11.16 hosts/sec).  0 returned handshake; 1 returned notify

royhills · 2024-06-09T18:40:25Z

CFG] <13> selected proposal: IKE:AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/ECP_521
[LIB] <13> ECDH public value is malformed

It looks like strongswan checks the DH value and fails because ike-scan just creates a KE payload with the correct format and length but fills it with random data. That is generally enough for the handshake to progress on most systems, but obviously not all. You would need to supply a valid key exchange payload with valid DH values, which isn't an easy task because you'd need a crypto library; and it's outside the scope of ike-scan.

royhills mentioned this issue Jun 8, 2024

Add new IKEv2 algorithm identifiers #42

Open

marcosrmartin mentioned this issue Oct 1, 2024

contact Hoasd/TermSimulation#1

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Ikev2 #34

Ikev2 #34

Himself132 commented Jun 10, 2021

royhills commented Jun 10, 2021

Himself132 commented Jun 11, 2021

royhills commented Jun 12, 2021 •

edited

Loading

Zamanry commented Feb 22, 2022

Hoasd commented Jun 8, 2024 •

edited

Loading

royhills commented Jun 8, 2024

Hoasd commented Jun 8, 2024 •

edited

Loading

royhills commented Jun 8, 2024

Hoasd commented Jun 8, 2024

royhills commented Jun 9, 2024

Hoasd commented Jun 9, 2024

royhills commented Jun 9, 2024

Hoasd commented Jun 9, 2024

royhills commented Jun 9, 2024

royhills commented Jun 9, 2024

Hoasd commented Jun 9, 2024

royhills commented Jun 9, 2024

Hoasd commented Jun 9, 2024 •

edited

Loading

royhills commented Jun 9, 2024

Ikev2 #34

Ikev2 #34

Comments

Himself132 commented Jun 10, 2021

royhills commented Jun 10, 2021

Himself132 commented Jun 11, 2021

royhills commented Jun 12, 2021 • edited Loading

Zamanry commented Feb 22, 2022

Hoasd commented Jun 8, 2024 • edited Loading

royhills commented Jun 8, 2024

Hoasd commented Jun 8, 2024 • edited Loading

royhills commented Jun 8, 2024

Hoasd commented Jun 8, 2024

royhills commented Jun 9, 2024

Hoasd commented Jun 9, 2024

royhills commented Jun 9, 2024

Hoasd commented Jun 9, 2024

royhills commented Jun 9, 2024

royhills commented Jun 9, 2024

Hoasd commented Jun 9, 2024

Progress!!!

royhills commented Jun 9, 2024

Hoasd commented Jun 9, 2024 • edited Loading

royhills commented Jun 9, 2024

royhills commented Jun 12, 2021 •

edited

Loading

Hoasd commented Jun 8, 2024 •

edited

Loading

Hoasd commented Jun 8, 2024 •

edited

Loading

Hoasd commented Jun 9, 2024 •

edited

Loading