Subject: [Ipsec] Issue on Phase 2 handler

From: Park Lee <[email-masked]>
Date: Wed, 1 Dec 2004 01:15:43 -0800 (PST)

Hi,
   When we've unpacked the ipsec-tools-0.2.5.tar.gz, In ipsec-tools-0.2.5/src/racoon/handler.h, we can see something like the following:
 
/* Phase 2 handler */
/* allocated per a SA or SA bundles of a pair of peer's IP addresses. */
/*
 *      initiator               responder
 *  0   (---)                   (---)
 *  1   start                   start (1st msg received)
 *  2   acquire msg get         1st valid msg received
 *  3   getspi request sent     getspi request sent
 *  4   getspi done             getspi done
 *  5   1st msg sent            1st msg sent
 *  6   1st valid msg received  2nd valid msg received
 *  7   (commit bit)            (commit bit)
 *  8   SAs added               SAs added
 *  9   SAs established         SAs established
 * 10   SAs expired             SAs expired
 */
 
  Then, 
  1), Since the initiator only send one message (step 5), why should the responder receive two messages (step 2 and step 6)?
  2), We know that before initiator begins its negotiation with responder, it will send an SADB_GETSPI message from a user process to the kernel for an SPI. When it get the SPI, it can begins its negotiation. 
  But here, Why should the responder also send an SADB_GETSPI (step 3 and step 4)? Is it still send the message to its kernel? Why don't it use the SPI from the initiator? If the responder get its own SPI, then there will be two different SPI between the initiator and responder, which one will they finally use?
 
  Thank you.

--
Best Regards,
Park Lee <[email-masked]> 

---------------------------------
Do you Yahoo!?
 Meet the all-new My Yahoo! – Try it today! 

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Bill Sommerfeld <[email-masked]>
Date: Wed, 01 Dec 2004 10:33:27 -0500

On Wed, 2004-12-01 at 04:15, Park Lee wrote:
>   But here, Why should the responder also send an SADB_GETSPI (step 3 > and step 4)? Is it still send the message to its kernel? Why don't it > use the SPI from the initiator? If the responder get its own SPI, then > there will be two different SPI between the initiator and responder, > which one will they finally use?

AH/ESP SA's are unidirectional, but IKE establishes them in pairs. 

AH/ESP SPI's are chosen by the receiver.  

With PF_KEY, you thus need to do a getspi on each end to pick the SPI used for traffic to that node.

the getspi invoked by the initiator is used for responder->initiator traffic.

the getspi invoked by the responder is used for initiator->responder traffic.