Subject: [Ipsec] handling delete payloads

From: Tom Stiemerling <[email-masked]>
Date: Thu, 17 Mar 2005 17:59:21 -0500

Soliciting opinions on the issue of deleting IKE SA's. The spec says
that:

   " To delete an SA,
   an INFORMATIONAL Exchange with one or more delete payloads is sent
   listing the SPIs (as they would be expected in the headers of inbound
   packets) of the SAs to be deleted. The recipient MUST close the
   designated SAs. Normally, the reply in the INFORMATIONAL Exchange
   will contain delete payloads for the paired SAs going in the other
   direction. "

In the bakeoff I noticed some implementations actually sent an
empty INFORMATIONAL response, and then initiated their own
INFORMATIONAL exchange containing the paired SAs to be deleted.

My question is whether this is considered to be compliant
with the spec? The reason I want to know is whether I can consider
the SAs to have been deleted when I receive the empty INFORMATIONAL
or whether I have to wait to receive the INFORMATIONAL with the
delete payloads to make that decision.

Thanks, Tom

ps. I am not considering the special case, where delete payloads are
crossing in the network.
_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Paul Hoffman <[email-masked]>
Date: Thu, 17 Mar 2005 18:07:45 -0800

At 5:59 PM -0500 3/17/05, Tom Stiemerling wrote:
>with the spec?

That is acceptable by the unfortunately-loose wording of "Normally, 
the reply...".

In fact, Charlie described to me the reasoning for having the 
response being the delete payload for the opposite direction. It 
involves a race condition that would take at least a long paragraph 
to explain. But, the upshot is that:

- The initiator's Informational exchange should only have one of the 
two parts of the SA pair

- The responder's response really, really SHOULD include the other 
part of the SA pair

- At the moment that the initiator receives the response, tear down 
both sides of the SA.

>The reason I want to know is whether I can consider

That's another good question, and one which helps explain why doing 
it the way explained above prevents that question.

>ps. I am not considering the special case, where delete payloads are

But that is where the race condition can come in, so we want to avoid it.

--Paul Hoffman, Director
--VPN Consortium

---

From: "Subha" <[email-masked]>
Date: Thu, 17 Mar 2005 19:23:32 -0800

Hi,

Since it is not made mandatory in the specification, that the response
SHOULD have an DELETE payload, an empty INFORMATIONAL
Response should be considered compliant. 

IMO, When the Empty INFORMATIONAL Response arrives, the Initiator
of the DELETE Payload Noficiation can consider that its side SA has
been torn down by the peer. Initiator should however wait for an explicit
DELETE Payload Notification from the Peer to delete the Peer side SA.

However, an implementation should not always send an Empty 
INFORMATIONAL Response. It should send it only if the DELETE 
Payload Notification has already been sent from its side. 
(To avoid any potential race condition).

I think IKEv2 draft  should be updated with details to avoid
ambiguity.

Thanks,
Subha
  ----- Original Message ----- 
  From: Tom Stiemerling 
  To: [email-masked] 
  Sent: Thursday, March 17, 2005 2:59 PM
  Subject: [Ipsec] handling delete payloads

     " To delete an SA, 

  Thanks, Tom 

------------------------------------------------------------------------------