Subject: Re: [IPsec] Issue #26: Missing treatment of error cases

From: Keith Welter <[email-masked]>
Date: Thu, 3 Sep 2009 13:52:31 -0700

>    If the error occurs on the
>    initiator, the notification MUST be returned in a separate
>    INFORMATIONAL exchange, with no other payloads.
Should an implementation be prohibited from sending an empty delete 
payload
in this case?  I would prefer wording like the following:
"with no other payloads except an optional empty delete payload".

Keith Welter
IBM z/OS Communications Server Developer
1-415-545-2694 (T/L: 473-2694)

---

From: Yoav Nir <[email-masked]>
Date: Fri, 4 Sep 2009 00:14:46 +0300

Yes, I will soften the language a bit, but I won't mention a DELETE payload. If some implementations do it. others may come to expect it. We don't want to encourage that by suggesting that it's a good idea.

>    INFORMATIONAL exchange, with no other payloads.
Should an implementation be prohibited from sending an empty delete payload
in this case?  I would prefer wording like the following:
"with no other payloads except an optional empty delete payload".

Keith Welter

---

From: David Wierbowski <[email-masked]>
Date: Fri, 4 Sep 2009 10:53:57 -0400

>Yes, I will soften the language a bit, but I won't mention a DELETE
payload. If some implementations do it.
>others may come to expect it. We don't want to encourage that by
suggesting that it's a good idea.

Yoav, Why is it a a bad idea to include a DELETE payload in this case?

Dave Wierbowski

---

From: Yoav Nir <[email-masked]>
Date: Fri, 4 Sep 2009 22:10:19 +0300

On Sep 4, 2009, at 5:53 PM, David Wierbowski wrote:

>Yes, I will soften the language a bit, but I won't mention a DELETE payload. If some implementations do it.
>others may come to expect it. We don't want to encourage that by suggesting that it's a good idea.

Because the IKE SA was not really created, so there is no IKE SA to delete. It's a bad idea because it is superfluous, and we don't want to risk anyone relying on this.

---

From: David Wierbowski <[email-masked]>
Date: Tue, 8 Sep 2009 12:22:51 -0400

Yoav,

You are sending an informational notification, so how could you say the SA
does not exist and no delete should be sent?

If  an authentication error is discovered when processing the IKE_AUTH
response then responder thinks an IKE SA exists and the initiator intends
to delete that SA.  In this case it seems clean for the initiator to send
an INFORMATIONAL exchange containing AUTHENTICATION_FAILED and treating the
SA as being deleted.  I do not see the harm in including a DELETE in this
case and it seems to be a more appropriate action than sending the
AUTHENTICATION_FAILED.

I'm fine with not requiring the DELETE, but I don't think including the
DELETE is bad and should be discouraged.  I think it reinforces the
initiator's intentions and is unambiguous.

Dave Wierbowski

  From:       Yoav Nir <[email-masked]>                                                        
                                                                                                    
  To:         David Wierbowski/Endicott/IBM@IBMUS                                                   
                                                                                                    
  Cc:         "[email-masked]" <[email-masked]>, Keith Welter/Raleigh/IBM@IBMUS                     
                                                                                                    
  Date:       09/04/2009 03:25 PM                                                                   
                                                                                                    
  Subject:    Re: [IPsec] Issue #26: Missing treatment of error cases                               
                                                                                                    
  Sent by:    [email-masked]                                                                

      Yoav, Why is it a a bad idea to include a DELETE payload in this
      case?

Because the IKE SA was not really created, so there is no IKE SA to delete.
It's a bad idea because it is superfluous, and we don't want to risk anyone
relying on this._______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Tero Kivinen <[email-masked]>
Date: Tue, 8 Sep 2009 23:30:46 +0300

> does not exist and no delete should be sent?

The IKE SA is NOT up and valid in the initiator. It is halfway up
as the other end has not been authenticated, and that IKE SA cannot be
used in general.

> initiator's intentions and is unambiguous.

If you use that kind of halfway up IKE SA for sending INFORMATIONAL
message to other end (who thinks the IKE SA is up and valid), then I
agree that sending both N(AUTHENTICATION_FAILED) and DELETE would be
the correct way to do it. DELETE only would also be ok. Sending only
N(AUTHENTICATION_FAILED) would be bit ambiquous, and I would not
recommend that, but as initiator still do not have IKE SA up but has
only halfway up SA, for initiator it does not matter what other end
does for the INFORMATIONAL exchange anyways... 
-- 
[email-masked]