#!/usr/bin/perl
#
# Copyright (C) 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009
# Yokogawa Electric Corporation.
# All rights reserved.
# 
# Redistribution and use of this software in source and binary
# forms, with or without modification, are permitted provided that
# the following conditions and disclaimer are agreed and accepted
# by the user:
# 
# 1. Redistributions of source code must retain the above copyright
#    notice, this list of conditions and the following disclaimer.
# 
# 2. Redistributions in binary form must reproduce the above copyright
#    notice, this list of conditions and the following disclaimer in
#    the documentation and/or other materials provided with
#    the distribution.
# 
# 3. Neither the names of the copyrighters, the name of the project
#    which is related to this software (hereinafter referred to as
#    "project") nor the names of the contributors may be used to
#    endorse or promote products derived from this software without
#    specific prior written permission.
# 
# 4. No merchantable use may be permitted without prior written
#    notification to the copyrighters.
# 
# 5. The copyrighters, the project and the contributors may prohibit
#    the use of this software at any time.
# 
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHTERS, THE PROJECT AND
# CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING
# BUT NOT LIMITED THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE, ARE DISCLAIMED.  IN NO EVENT SHALL THE
# COPYRIGHTERS, THE PROJECT OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
# INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
# STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
# IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
#
# $TAHI: ct-ikev2/2-EN-R/IKEv2-EN-R-1-1-6-7-A.seq,v 1.5 2009/09/09 08:58:06 doo Exp $
#
################################################################

BEGIN
{
	push(@INC, '..');
}

END { }

use IKEv2;
use strict;


my $remote	= 'common_remote_index';


my $session = undef;
my $ret = undef;
my $str = undef;

my $ike_sa_init_req_param = undef;
my $ike_sa_init_resp_param = undef;
my $ike_auth_req_param = undef;
my $ike_auth_resp_param = undef;
my $create_child_sa_req_param = undef;
my $create_child_sa_resp_param = undef;
my $material = undef;

my @local_create_child_sa_req = undef;
my @local_create_child_sa_resp = undef;


kLogHTML('<FONT COLOR="#FF0000" SIZE="+1"><U><B>TEST SETUP</B></U></FONT>');

#------------------------------#
# register IKEv2.pm            #
#------------------------------#
unless (IKEv2initialize('EN', 'EN')) {
	IKEv2exitFatal('<FONT COLOR="#ff0000">IKEv2 module initializing failure</FONT>');
}



#---------------------------------#
# switch Support or Not Support   #
#---------------------------------#
unless ($config_pl->{'advanced_support_pfs'}) {
       IKEv2exitNS('Not support ' . "'advanced_support_pfs'");
}

unless ($config_pl->{'advanced_support_invalid_ke_payload'}) {
	IKEv2exitNS('Not support ' . "'advanced_support_invalid_ke_payload'");
}



#------------------------------#
# configure TN                 #
#------------------------------#
unless (IKEv2setupTN()) {
	IKEv2exitFatal('<FONT COLOR="#ff0000">TN setup failure</FONT>');
}


#------------------------------#
# configure NUT                #
#------------------------------#
unless (IKEv2setupNUT()) {
	IKEv2exitFatal('<FONT COLOR="#ff0000">NUT setup failure</FONT>');
}

kLogHTML('<FONT COLOR="#FF0000" SIZE="+1"><U><B>TEST PROCEDURE</B></U></FONT>');


#------------------------------#
# prepare session handler      #
#------------------------------#
$session = IKEv2create_session('common_remote_index');
unless (defined($session)) {
	IKEv2exitFatal('<FONT COLOR="#ff0000">IKEv2 session creation failure</FONT>');
}



#--------------------------------------#
# send IKE_SA_INIT request to NUT      #
#--------------------------------------#
$str  = '<PRE>';
$str .= "    (R)             (I)\n";
$str .= "    NUT             TN1\n";
$str .= "     |               |\n";
$str .= "     |<--------------| IKE_SA_INIT request (HDR, SAi1, KEi, Ni)\n";
$str .= "     |               |\n";
$str .= "     V               V";
$str .= '</PRE>';

kLogHTML($str);


$ike_sa_init_req_param = devel_IKEv2send_IKE_SA_INIT_request($session, $remote);
unless (defined($ike_sa_init_req_param)) {
	kLogHTML(kDump_Common_Error());
	IKEv2exitFatal('<FONT COLOR="#ff0000">Can\'t send IKE_SA_INIT request.</FONT>');
}


#--------------------------------------#
# receive IKE_SA_INIT response by NUT  #
#--------------------------------------#
$str  = '<PRE>';
$str .= "    (R)             (I)\n";
$str .= "    NUT             TN1\n";
$str .= "     |               |\n";
$str .= "     |-------------->| IKE_SA_INIT response (HDR, SAr1, KEr, Nr)\n";
$str .= "     |               |\n";
$str .= "     V               V";
$str .= '</PRE>';

kLogHTML($str);


$ike_sa_init_resp_param = devel_IKEv2receive_IKE_SA_INIT_response($session,
                                                                  $remote,
                                                                  $ike_sa_init_req_param);
unless (defined($ike_sa_init_resp_param)) {
	kLogHTML(kDump_Common_Error());
	kLogHTML('<FONT COLOR="#ff0000">Can\'t observe IKE_SA_INIT response.</FONT>');
	IKEv2exitFail();
}


#--------------------------------------#
# generate keying material             #
#--------------------------------------#
$material = devel_IKEv2gen_keymat(1, $ike_sa_init_req_param, $ike_sa_init_resp_param);
unless (defined($material)) {
	kLogHTML(kDump_Common_Error());
	IKEv2exitFatal('<FONT COLOR="#ff0000">Can\'t generate keying material.</FONT>');
}


#--------------------------------------#
# send IKE_AUTH request to NUT         #
#--------------------------------------#
$str  = '<PRE>';
$str .= "    (R)             (I)\n";
$str .= "    NUT             TN1\n";
$str .= "     |               |\n";
$str .= "     |<--------------| IKE_AUTH request (HDR, SK {IDi, AUTH, N(USE_TRANSPORT_MODE), SAi2, TSi, TSr})\n";
$str .= "     |               |\n";
$str .= "     V               V";
$str .= '</PRE>';

kLogHTML($str);


$ike_auth_req_param = devel_IKEv2send_IKE_AUTH_request($session,
                                                       $remote,
                                                       $ike_sa_init_req_param,
                                                       $ike_sa_init_resp_param,
                                                       $material);
unless (defined($ike_auth_req_param)) {
	kLogHTML(kDump_Common_Error());
	IKEv2exitFatal('<FONT COLOR="#ff0000">Can\'t send IKE_AUTH request.</FONT>');
}


#--------------------------------------#
# receive IKE_AUTH response by NUT     #
#--------------------------------------#
$str  = '<PRE>';
$str .= "    (R)             (I)\n";
$str .= "    NUT             TN1\n";
$str .= "     |               |\n";
$str .= "     |-------------->| IKE_AUTH response (HDR, SK {IDr, AUTH, N(USE_TRANSPORT_MODE), SAr2, TSi, TSr)\n";
$str .= "     |               |\n";
$str .= "     V               V";
$str .= '</PRE>';

kLogHTML($str);


$ike_auth_resp_param = devel_IKEv2receive_IKE_AUTH_response($session,
                                                            $remote,
                                                            $ike_sa_init_req_param,
                                                            $ike_sa_init_resp_param,
                                                            $ike_auth_req_param,
                                                            $material);
unless (defined($ike_auth_resp_param)) {
	kLogHTML(kDump_Common_Error());
	kLogHTML('<FONT COLOR="#ff0000">Can\'t observe IKE_AUTH response.</FONT>');
	IKEv2exitFail();
}



{
	#------------------------------#
	# send CREATE_CHILD_SA Request #
	#------------------------------#
	$str  = '<PRE>';
	$str .= "    (R)             (I)\n";
	$str .= "    NUT             TN1\n";
	$str .= "     |               |\n";
	$str .= "     |<--------------| CREATE_CHILD_SA Request (HDR, SK {N(REKEY_SA), N(USE_TRANSPORT), SA(DH#2, DH#14), Ni, KEi(DH#14), TSi, TSr})\n";
	$str .= "     |               |\n";
	$str .= "     V               V";
	$str .= '</PRE>';

	kLogHTML($str);

	# generete CREATE_CHILD_SA Request for IKE_SA
	my $req_notify_for_rekey =
	{       # Notify Payload
		 'self'		=> 'N',	# *** MUST BE HERE ***
		 'nexttype'	=> undef,	# Next Payload
		 'critical'	=> undef,	# Critical
		 'reserved'	=> undef,	# RESERVED
		 'length'	=> undef,	# Payload Length
		 'id'		=> '3',        # Protocol ID
		 'spiSize'	=> '4',	# SPI Size
		 'type'		=> 'REKEY_SA',	# Notify Message Type
		 'spi'		=> $ike_auth_req_param->{'spi'}[0], # SPI
		 'data'		=> undef # Notification Data
	};

	my $transform_dh2 = {
		'nexttype'	=> undef,		# 0 (last) or 3 (more)
		'reserved1'	=> undef,		# RESERVED
		'transformLen'	=> undef,		# Transform Length
		'type'		=> 'D-H',		# Transform Type
		'reserved2'	=> undef,		# RESERVED
		'id'		=> '1024 MODP Group',	# Transform ID
		'attributes' => [			# Transform Attributes
		],
	};
	my $transform_dh14 = {
		'nexttype'	=> undef,		# 0 (last) or 3 (more)
		'reserved1'	=> undef,		# RESERVED
		'transformLen'	=> undef,		# Transform Length
		'type'		=> 'D-H',		# Transform Type
		'reserved2'	=> undef,		# RESERVED
		'id'		=> '2048 MODP Group',	# Transform ID
		'attributes' => [			# Transform Attributes
		],
	};

	my $ke_payload = { # Key Exchange Payload
		'self'          => 'KE', # *** MUST BE HERE ***

		'nexttype'      => undef, # Next Payload
		'critical'      => undef, # Critical
		'reserved'      => undef, # RESERVED
		'length'        => undef, # Payload Length
		'group'         => '2048 MODP Group',	# DH Group #
		'reserved1'     => undef,		# RESERVED
		'publicKey'     => 'generate'	# Key Exchange Data
	};
	my $common_create_child_sa_req = IKEv2load_packet($gen_create_child_sa_req, $remote);
	@local_create_child_sa_req = @{$common_create_child_sa_req};
	for (my $i = 0; $i < scalar(@local_create_child_sa_req); $i++) {
		my $payload = $local_create_child_sa_req[$i];

		if (($payload->{'self'} eq 'E')) {
			splice(@local_create_child_sa_req, $i+1, 0, $req_notify_for_rekey);
		}
		elsif ($payload->{'self'} eq 'SA') {
			for (my $j = 0; $j < scalar(@{$payload->{'proposals'}}); $j++) {
				my $proposal = @{$payload->{'proposals'}}[$j];

				if (defined($proposal->{'transforms'})) {
					push(@{$proposal->{'transforms'}}, $transform_dh2);
					push(@{$proposal->{'transforms'}}, $transform_dh14);
				}
			}
		}
		elsif ($payload->{'self'} eq 'TSi') {
			splice(@local_create_child_sa_req, $i, 0, $ke_payload);
			$payload->{'group'} = '2048 MODP Group';   # set different group
			last;
		}
	}

	my $index = 'EN-R-1-1-6-7.1';
	$gen_create_child_sa_req->{$index} = \@local_create_child_sa_req;

	$create_child_sa_req_param = devel_IKEv2send_CREATE_CHILD_SA_request($session,
									     $index,
									     $ike_sa_init_req_param,
									     $ike_sa_init_resp_param,
									     $ike_auth_req_param,
									     $material);
	unless(defined($create_child_sa_req_param)) {
		kLogHTML(kDump_Common_Error());
		kLogHTML('<FONT COLOR="#ff0000">Can\'t send CREATE_CHILD_SA request.</FONT>');
		IKEv2exitFail();
	}
}



{
	#----------------------------------#
	# receive CREATE_CHILD_SA Response #
	#---------------------------------#
	$str  = '<PRE>';
	$str .= "    (R)             (I)\n";
	$str .= "    NUT             TN1\n";
	$str .= "     |               |\n";
	$str .= "     |-------------->| CREATE_CHILD_SA Response (HDR, SK {INVALID_KE_PAYLOAD(DH#2)})\n";
	$str .= "     |               |\n";
	$str .= "     V               V";
	$str .= '</PRE>';

	kLogHTML($str);

	#-----------------------------------------------------#
	# prepare CREATE_CHILD_SA resp include Notify payload #
	#-----------------------------------------------------#
	my $tmp_notify_payload =
	{	# Notify Payload
		'self'		=> 'N',
		'nexttype'	=> '0',		# Next Payload
		'critical'	=> '0',		# Critical
		'reserved'	=> '0',		# RESERVED
		'length'	=> '10',		# Payload Length
		'id'		=> '0',		# Protocol ID
		'spiSize'	=> '0',		# SPI Size
		'type'		=> 'INVALID_KE_PAYLOAD',# Notify Type
		'spi'		=> undef,	# SPI
		'data'		=> '0002',	# Notification Data
	};
	my $common_create_child_sa_resp = IKEv2load_packet($exp_create_child_sa_resp, $remote);
	@local_create_child_sa_resp = @{$common_create_child_sa_resp};
	# remove payload without HDR and E
	@local_create_child_sa_resp = grep {
		my $ret = 0;
		if ($_->{'self'} eq 'HDR' || $_->{'self'} eq 'E') { $ret = 1; }
		$ret;
	} @local_create_child_sa_resp;
	# add Notify payload 
	for (my $i = 0; $i < scalar(@local_create_child_sa_resp); $i++) {
		my $payload = $local_create_child_sa_resp[$i];

		if ($payload->{'self'} eq 'E') {
			$payload->{'innerPayloads'} = [
						       $tmp_notify_payload,
						      ];
			$payload->{'innerType'} = $tmp_notify_payload->{'self'};
			last;
		}
	}
	#set correct nexttype
	for (my $i = 0; $i < scalar(@local_create_child_sa_resp); $i++) {
		my $payload = $local_create_child_sa_resp[$i];

		if ($payload->{'self'} eq 'HDR') {
			my $next = $local_create_child_sa_resp[$i+1];
			unless (defined($next)) {
				$payload->{'nexttype'} = '0';
				next;
			}
			if ($payload->{'nexttype'} eq $next->{'self'}) {
				next;
			}
			$payload->{'nexttype'} = $next->{'self'};
		}
	}
	my $index = 'EN-R-1-1-6-7.2';
	$exp_create_child_sa_resp->{$index} = \@local_create_child_sa_resp;

	$create_child_sa_resp_param = devel_IKEv2receive_CREATE_CHILD_SA_response($session,
										  $index,
										  $ike_sa_init_req_param,
										  $ike_sa_init_resp_param,
										  $create_child_sa_req_param,
										  $material);
	unless (defined($create_child_sa_resp_param)) {
		kLogHTML(kDump_Common_Error());
		kLogHTML('<FONT COLOR="#ff0000">Can\'t observe CREATE_CHILD_SA Response.</FONT>');
		IKEv2exitFail();
	}
}



{
	#------------------------------#
	# send CREATE_CHILD_SA Request #
	#------------------------------#
	$str  = '<PRE>';
	$str .= "    (R)             (I)\n";
	$str .= "    NUT             TN1\n";
	$str .= "     |               |\n";
	$str .= "     |<--------------| CREATE_CHILD_SA Request (HDR, SK {N(REKEY_SA), N(USE_TRANSPORT), SA(DH#2, DH#14), Ni, KEi(DH#2), TSi, TSr})\n";
	$str .= "     |               |\n";
	$str .= "     V               V";
	$str .= '</PRE>';

	kLogHTML($str);

	# generete CREATE_CHILD_SA Request for IKE_SA
	my $req_notify_for_rekey =
	{       # Notify Payload
		 'self'		=> 'N',	# *** MUST BE HERE ***
		 'nexttype'	=> undef,	# Next Payload
		 'critical'	=> undef,	# Critical
		 'reserved'	=> undef,	# RESERVED
		 'length'	=> undef,	# Payload Length
		 'id'		=> '3',        # Protocol ID
		 'spiSize'	=> '4',	# SPI Size
		 'type'		=> 'REKEY_SA',	# Notify Message Type
		 'spi'		=> $ike_auth_req_param->{'spi'}[0], # SPI
		 'data'		=> undef # Notification Data
	};

	my $transform_dh2 = {
		'nexttype'	=> undef,		# 0 (last) or 3 (more)
		'reserved1'	=> undef,		# RESERVED
		'transformLen'	=> undef,		# Transform Length
		'type'		=> 'D-H',		# Transform Type
		'reserved2'	=> undef,		# RESERVED
		'id'		=> '1024 MODP Group',	# Transform ID
		'attributes' => [			# Transform Attributes
		],
	};
	my $transform_dh14 = {
		'nexttype'	=> undef,		# 0 (last) or 3 (more)
		'reserved1'	=> undef,		# RESERVED
		'transformLen'	=> undef,		# Transform Length
		'type'		=> 'D-H',		# Transform Type
		'reserved2'	=> undef,		# RESERVED
		'id'		=> '2048 MODP Group',	# Transform ID
		'attributes' => [			# Transform Attributes
		],
	};

	my $ke_payload = { # Key Exchange Payload
		'self'          => 'KE', # *** MUST BE HERE ***

		'nexttype'      => undef, # Next Payload
		'critical'      => undef, # Critical
		'reserved'      => undef, # RESERVED
		'length'        => undef, # Payload Length
		'group'         => '1024 MODP Group',	# DH Group #
		'reserved1'     => undef,		# RESERVED
		'publicKey'     => 'generate'	# Key Exchange Data
	};
	my $common_create_child_sa_req = IKEv2load_packet($gen_create_child_sa_req, $remote);
	@local_create_child_sa_req = @{$common_create_child_sa_req};
	for (my $i = 0; $i < scalar(@local_create_child_sa_req); $i++) {
		my $payload = $local_create_child_sa_req[$i];

		if (($payload->{'self'} eq 'E')) {
			splice(@local_create_child_sa_req, $i+1, 0, $req_notify_for_rekey);
		}
		elsif ($payload->{'self'} eq 'SA') {
			for (my $j = 0; $j < scalar(@{$payload->{'proposals'}}); $j++) {
				my $proposal = @{$payload->{'proposals'}}[$j];

				if (defined($proposal->{'transforms'})) {
					push(@{$proposal->{'transforms'}}, $transform_dh2);
					push(@{$proposal->{'transforms'}}, $transform_dh14);
				}
			}
		}
		elsif ($payload->{'self'} eq 'TSi') {
			splice(@local_create_child_sa_req, $i, 0, $ke_payload);
			$payload->{'group'} = '2048 MODP Group';   # set different group
			last;
		}
	}

	my $index = 'EN-R-1-1-6-7.1';
	$gen_create_child_sa_req->{$index} = \@local_create_child_sa_req;

	$create_child_sa_req_param = devel_IKEv2send_CREATE_CHILD_SA_request($session,
									     $index,
									     $ike_sa_init_req_param,
									     $ike_sa_init_resp_param,
									     $create_child_sa_req_param,
									     $material);
	unless(defined($create_child_sa_req_param)) {
		kLogHTML(kDump_Common_Error());
		kLogHTML('<FONT COLOR="#ff0000">Can\'t send CREATE_CHILD_SA request.</FONT>');
		IKEv2exitFail();
	}
}



{
	#----------------------------------#
	# receive CREATE_CHILD_SA Response #
	#---------------------------------#
	$str  = '<PRE>';
	$str .= "    (R)             (I)\n";
	$str .= "    NUT             TN1\n";
	$str .= "     |               |\n";
	$str .= "     |-------------->| CREATE_CHILD_SA Response (HDR, SK {N(USE_TRANSPORT), SA(DH#2), Nr, KEr(DH#2), TSi, TSr)})\n";
	$str .= "     |               |\n";
	$str .= "     V               V";
	$str .= '</PRE>';

	kLogHTML($str);

	$create_child_sa_resp_param = devel_IKEv2receive_CREATE_CHILD_SA_response($session,
										  $remote,
										  $ike_sa_init_req_param,
										  $ike_sa_init_resp_param,
										  $create_child_sa_req_param,
										  $material);
	unless (defined($create_child_sa_resp_param)) {
		kLogHTML(kDump_Common_Error());
		kLogHTML('<FONT COLOR="#ff0000">Can\'t observe CREATE_CHILD_SA Response.</FONT>');
		IKEv2exitFail();
	}
}



#--------------------------------------#
# exit with cleanup                    #
#--------------------------------------#
IKEv2exitPass();

#
# perldoc
#
########################################################################
__END__

=head1 Title
    
  Test IKEv2.EN.R.1.1.6.7: Sending INVALID_KE_PAYLOAD
  Part A: (ADVANCED)

=head1 Purpose

  To verify an IKEv2 device properly handles an invalid KE payload which has different D-H
  Group # from proposed D-H Group #.

=head1 References

  * [RFC 4306] - Sections 2.7, 3.4 and 3.10.1
  * [RFC 4718] - Sections 2.1 and 2.2

=head1 Test Setup
    
  * Network Topology
      Connect the devices according to the Common Topology.
  * Configuration
      In each part, configure the devices according to the Common Configuration. Enable
      PFS.
  * Pre-Sequence and Cleanup Sequence
      IKEv2 on the NUT is disabled after each part.

=head1 Procedure

=begin html

<BLOCKQUOTE>
<PRE>

   NUT                  TN1
(End-Node)           (End-Node)
    |                    |
    |<-------------------| IKE_SA_INIT request (HDR, SAi1, KEi, Ni)
    |                    | (Packet #1)
    |------------------->| IKE_SA_INIT response (HDR, SAr1, KEr, Nr)
    |                    | (Judgement #1)
    |                    |
    |<-------------------| IKE_AUTH request (HDR, SK {IDi, AUTH, N+, SAi2, TSi, TSr})
    |                    | (Packet #2)
    |------------------->| IKE_AUTH response (HDR, SK {IDr, AUTH, N+, SAr2, TSi, TSr})
    |                    | (Judgement #2)
    |                    |
    |<-------------------| CREATE_CHILD_SA request (HDR, SK {N, N+, SA(DH#2, DH#14), Ni, KEi(DH#14), TSi, TSr})
    |                    | (Packet #3)
    |------------------->| CREATE_CHILD_SA Response (HDR, SK {N(INVALID_KE_PAYLOAD(DH#2))})
    |                    | (Judgement #3)
    |                    |
    |<-------------------| CREATE_CHILD_SA request (HDR, SK {N, N+, SA(DH#2, DH#14), Ni, KEi, TSi, TSr})
    |                    | (Packet #4)
    |------------------->| CREATE_CHILD_SA Response (HDR, SK {N+, SA(DH#2), Ni, KEi(DH#2), TSi, TSr})
    |                    | (Judgement #4)
    |                    |
    V                    V<br>
<br>
 N: REKEY_SA
 N+: USE_TRANSPORT_MODE
<br>
</BLOCKQUOTE>

<BLOCKQUOTE>
<TABLE BORDER>
<TR>
<TD><TT>Packet #1</TT></TD>
<TD><TT>See Common Packet #1</TT></TD>
</TR>
<TR>
<TD><TT>Packet #2</TT></TD>
<TD><TT>See Common Packet #3</TT></TD>
</TR>
<TR>
<TD><TT>Packet #3</TT></TD>
<TD><TT>See below</TT></TD>
</TR>
</TABLE>
</BLOCKQUOTE>
<br>

<BLOCKQUOTE>
Packet #3: CREATE_CHILD_SA request for rekeying CHILD_SA
<TABLE BORDER>
<TR>
<TD>IPv6 Header</TD>
<TD colspan="2">Same as the common packet #13</TD>
</TR>
<TR>
<TD>UDP Header</TD>
<TD colspan="2">Same as the common packet #13</TD>
</TR>
<TR>
<TD>IKEv2 Header</TD>
<TD colspan="2">Same as the common packet #13</TD>
</TR>
<TR>
<TD>E Payload</TD>
<TD colspan="2">Same as the common packet #13</TD>
</TR>
<TR>
<TD>N Payload</TD>
<TD colspan="2">Same as the common packet #13</TD>
</TR>
<TR>
<TD>N Payload</TD>
<TD colspan="2">Same as the common packet #13</TD>
</TR>
<TR>
<TD>SA Payload</TD>
<TD colspan="2">Same as the common packet #13</TD>
</TR>
<TR>
<TD rowspan="2">Ni, Nr Payload</TD>
<TD colspan="2">Other fields are same as the Common Packet #13</TD>
</TR>
<TR>
<TD>Next Payload</TD>
<TD>34 (KE)</TD>
</TR>
<TR>
<TD rowspan="7">KEi Payload</TD>
<TD>Next Payload</TD>
<TD>44 (TSi)</TD>
</TR>
<TR>
<TD>Critical</TD>
<TD>0</TD>
</TR>
<TR>
<TD>Reserved</TD>
<TD>0</TD>
</TR>
<TR>
<TD>Payload Length</TD>
<TD>264</TD>
</TR>
<TR>
<TD>DH Group #</TD>
<TD>14</TD>
</TR>
<TR>
<TD>Reserved</TD>
<TD>0</TD>
</TR>
<TR>
<TD>Key Exchange Data</TD>
<TD>any</TD>
</TR>
<TR>
<TD>TSi Payload</TD>
<TD colspan="2">Same as the common packet #13</TD>
</TR>
<TR>
<TD>TSr Payload</TD>
<TD colspan="2">Same as the Common Packet #13</TD>
</TR>
</TABLE>
</BLOCKQUOTE>

=end html 

  Part A: (ADVANCED)
     1. TN1 starts to negotiate with NUT by sending IKE_SA_INIT request.
     2. Observe the messages transmitted on Link A.
     3. After a reception of IKE_SA_INIT response from the NUT, TN1 transmits IKE_AUTH
         request to the NUT.
     4. Observe the messages transmitted on Link A.
     5. After reception of IKE_AUTH response from the NUT, TN1 transmits
         CREATE_CHILD_SA request to the NUT to rekey CHILD_SAs. The
         CREATE_CHILD_SA contains a D-H Group transform to use D-H Group 2 and a Key
         Exchange payload which contains 14 (D-H Group 14) as DH Group # field and the Key
         Exchage Data.
     6. Observe the messages transmitted on Link A.
     7. After reception of CREATE_CHILD_SA response indicating INVALID_KE_PAYLOAD
        CHILD_SAs. The CREATE_CHILD_SA contains a D-H Group transform to use D-H
        Group 2 or D-H Group 14, and a Key Exchage payload which contains 2 (D-H Group 2) as
        DH Group # field and the Key Exchange Data.
     8. Observe the messages transmitted on Link A.

=head1 Observable Result

  Part A
       Step 2: Judgment #1
       The NUT transmits an IKE_SA_INIT response including "ENCR_3DES",
       "PRF_HMAC_SHA1", "AUTH_HMAC_SHA1_96" and "D-H group 2" as accepted
       algorithms.

       Step 4: Judgment #2
       The NUT transmits an IKE_AUTH response including "ENCR_3DES",
       "AUTH_HMAC_SHA1_96" and "No Extended Sequence Numbers" as accepted algorithms.

       Step 6: Judgment #3
       The NUT does not transmits any packets or transmits a CREATE_CHILD_SA response
       including a Notify payload of type INVALID_KE_PAYLOAD which contains 2 (D-H Group
       2) as Notification Data.

       Step 8: Judgment #4
       The NUT transmits a CREATE_CHILD_SA response including "ENCR_3DES",
       "AUTH_HMAC_SHA1_96", "No Extended Sequence Numbers" and "D-H Group 2" as
       proposed algorithms.

=head1 Possible Problems

  * None.

=cut


