Subject: RE: [Ipsec] IKEv2: invalid SPI in DELETE payload

From: "Yoav Nir" <[email-masked]>
Date: Wed, 18 Jan 2006 15:30:22 +0200

Host A requested that SPIb be deleted, and B acknowledged. That should be
enough for A to conclude that host B no longer has its half of the SA. It
can safely set a timer (for say, 10 seconds) and then silently delete the
other half of the SA.

I don't think in the real world SAs are so numerous that complying with the
section 1.4 requirement is any problem. 

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] 
> Sent: Wednesday, January 18, 2006 2:30 PM
> To: [email-masked]
> Subject: RE: [Ipsec] IKEv2: invalid SPI in DELETE payload
> 
> Yoav Nir wrote:
> 
> > Agree. INVALID_SPI is not expected in response to a DELETE.
> > Besides, the initiator wanted this SPI to no longer exist. It
> > doesn't exist. Mission accomplished. Receiving this empty response
> > is enough of an indication that the states are our of sync that the
> > initiator can silently delete (and log) the other half of the SA.
> 
> Well, host A still thinks both halves of the SA exist, and thus host B
> cannot completely forget the situation. In addition to perhaps logging
> the situation, Section 1.4 requires that host B must not re-use the
> same SPIs for some other SA (at least with the same peer).
> 
> Best regards,
> Pasi
> 

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Tero Kivinen <[email-masked]>
Date: Mon, 23 Jan 2006 15:22:13 +0200

> Host A requested that SPIb be deleted, and B acknowledged. That should be

Actually it was host B requested SPIb to be deleted, and host A which
received that request didn't know anything about the SPIb at that
point. If host A replies with ack, then host B will delete the SPIb
(his inbound SA), but will keep the outbound SA as it was not deleted
by the reply DELETE as normally would.

Host B does not have any way to clean up the state after that, except
to delete the IKE SA and recreate all SAs. Host A will create the SPIb
as outbound SPI after he gets retransmissions of the packets, and host
A thinks he has SA that is up and working, but B does not accept any
data to it, but drops those packets. The host B will then start
sending INVALID_SPI when host A sends him packets using SPIb, so host
A can detect the situation and delete send delete to SPIa. After that
host B is happy as he has deleted the both SPIs, but he will reply
with empty ack again, as he does not have the SPIb anymore, thus host
A still will have half closed SA. 

This does require quite a lot of special code just to do detect those
situations and recover from them.

If the host A sends any kind of error message back to the delete
indicating that the delete could not be performed, then no special
code is needed, as they both stay in sync all the time. It does not
have have to  be INVALID_SPI, it could even be some other error notify,
but as the SPI is invalid for the host A INVALID_SPI matches quite
well to that. 
-- 
[email-masked]