Subject: [Ipsec] ikev2 and internal_ipvn_address

From: Jari Arkko <[email-masked]>
Date: Wed, 15 Jun 2005 11:02:44 +0300

I'm trying to understand how IKEv2 is expected to process
internal address requests, if the client is interested in
getting both v4 and v6 addresses. The basic question
is if you can ask for both types of addresses, and if so,
if you can do that in a single request or in different ones,
and what happens if only one address type is available.
The scenario I'm looking at is a v4 & v6 capable client,
but without knowledge of what kind of support exists
in the security gateway or the network behind it.

Section 2.19:

   CP(CFG_REQUEST) MUST contain at least an INTERNAL_ADDRESS attribute
   (either IPv4 or IPv6) but MAY contain any number of additional
   attributes the initiator wants returned in the response.

Can an "additional attribute" be another "INTERNAL_ADDRESS" attribute,
of other type? (And what if its of the same type?) Tentative conclusion
from this text is that only one INTERNAL_IPvN_ADDRESS attribute
may appear, but that conflicts with 3.15.1 (further below).

Section 3.10.1:

        INTERNAL_ADDRESS_FAILURE                 36

            Indicates an error assigning an internal address (i.e.,
            INTERNAL_IP4_ADDRESS or INTERNAL_IP6_ADDRESS) during the
            processing of a Configuration Payload by a responder.  If
            this error is generated within an IKE_AUTH exchange no
            CHILD_SA will be created.

What if you requested both address types, but got just one?
Will this error code be used or not?

Section 3.15.1:

         Multiple internal addresses MAY be requested by requesting
         multiple internal address attributes.  The responder MAY only
         send up to the number of addresses requested. The

Is this referring to requests within the same message or as multiple
messages? If in the same, then its in conflict with my tentative
conclusion from Section 2.19.

--Jari

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Wed, 15 Jun 2005 10:46:36 -0700

Jari,

See the latest thread on"Configuration Payload usage", it looks like both IPv4 and IPv6
address can be requested within a single Configuration request message.

-mohan

---

From: Jari Arkko <[email-masked]>
Date: Thu, 16 Jun 2005 10:54:46 +0300

Thanks for the pointer! That was indeed a useful discussion
from the point of view of the questions I had. It seems that
there was some support for the idea that you can use multiple
internal address requests at the same time. But I didn't see
an answer to my question about what happens if there's
a failure in allocating one of the requested addresses.

And it would be really good to write all this down somewhere...

---

From: Mohan Parthasarathy <[email-masked]>
Date: Thu, 16 Jun 2005 10:41:16 -0700 (PDT)

In section 2.19, it says:

All returned values will be implementation dependent. 
As can be seen
   in the above example, the IRAS MAY also send other
attributes that
   were not included in CP(CFG_REQUEST) and MAY ignore
the non-
   mandatory attributes that it does not support.

>From this, no error is returned, just the attributes
that are not supported are not returned. The client
can still consider as an error if it does not see all
the attributes it requested.

Everyday you discover something new about
Configuration payload :-)

-mohan

---

From: Jari Arkko <[email-masked]>
Date: Thu, 16 Jun 2005 22:30:10 +0300

>Configuration payload :-)
This brings up a number of issues:

1) It seems that then the spec does not even say whether you
    can ignore an address assignment request or whether
    you should return internal address failure in the normal
    case. Section 2.19 talks about another error case, but not
    this:

    Under what conditions do you actually send this? Is a
    "minimal IPv4 implementation (Section 4) required to
    recognize an INTERNAL_IP6_ADDRESS and respond with the
    above error code? Or only if you do support it but can't
    allocate an address?

2) My original question was a special case of the above. If
    you have multiple requests, what if one of them fails?

3) What does "mandatory" mean in the 2.19 text "can
    ignore non-mandatory attributes"? Section 3.15.1
    does not define a mandatory/critical bit in the
    attribute format. Perhaps this means the list of
    attributes in Section 4 then? Or the text in 2.19
    that seems to imply that one only needs to support
    INTERNAL_ADDRESS attribute?

4) How does DAD (Duplicate Address Detection) work in the
    IPv6 case?

--Jari

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Thu, 16 Jun 2005 17:15:34 -0700

Jari,

There was another thread "Questions about internal address" where some of
your questions were answered. We should include a new section in the
clarification draft to address these questions.

Comments inline...
>     above error code? Or only if you do support it but can't
If you read the thread that i mentioned above, it is not clear what
was decided. Following are the options that i see.

1) Fail the request with INTERNAL_ADDRESS_FAILURE (this will fail
    the IPsec exchange also if it was done along with it) if you cannot complete
    the "whole" request.
2) Fail the request with INTERNAL_ADDRESS_FAILURE if you cannot
    process the mandatory attributes in the request.
3) Return whatever you have and leave the rest out. You still don't return
    error if you don't have anything to give.

In some cases, you may want to at least get an IPv4 address. So, failing
the request because you can't assign the IPv6 address seems harmful.
On the other hand, just giving an IP address alone might not be useful.
The client may have to know netmask or DNS to do some "useful" work.
(2) assumes that we can agree on what mandatory attributes are.

(3) seems like a good option because then the client can decide whether
it is an error or proceed further depending on what it received from IRAS.

>     you have multiple requests, what if one of them fails?
See above..

>     INTERNAL_ADDRESS attribute?
This is also not clear to me. 

The wording seems to be "CP(CFG_REQUEST MUST contain
at least an INTERNAL_ADDRESS attribute". If i already
have an address, i just need to know the DNS servers etc..
can i send a CFG_REQUEST without it ? I always assumed so.

> 4) How does DAD (Duplicate Address Detection) work in the
This also seems to be left open. We have to assume that the
IRAS does it. 

-mohan