Subject: [IPsec] Fw: Issue #26: Missing treatment of error cases

From: Keith Welter <[email-masked]>
Date: Fri, 4 Sep 2009 09:26:10 -0700

> >>> In an IKE_AUTH
> >>>    exchange, or in the subsequent INFORMATIONAL exchnage, only the
> >>>    following notifications cause the IKE SA to be deleted or not
> >>>    created, without a DELETE payload:
> >>>    o  UNSUPPORTED_CRITICAL_PAYLOAD
> >>>    o  INVALID_SYNTAX
> >>>    o  AUTHENTICATION_FAILED
> >>>
> >>>    Extension documents may define new error notifications with these
> >>>    semantics, but MUST NOT use them unless the peer is known to
> >>>    understand them.
> >>
> >> In subsequent INFORMATIONAL exchanges the 
UNSUPPORTED_CRITICAL_PAYLOAD
> >> should not be fatal. It only means that the responder ignored the
> >> whole message and replied with UNSUPPORTED_CRITICAL_PAYLOAD. That 
does
> >> not delete IKE SA.
> >>
> >> For the IKE_AUTH the UNSUPPORTED_CRITICAL_PAYLOAD can delete the IKE
> >> SA as IKE SA is not yet ready.
> >
> >That's what I meant. I will clarify this.
> I would not expect INVALID_SYNTAX to cause the IKE SA to be deleted 
either.
Actually, my last statement was overly simplistic.  I should have said 
that
there is at least one case when I would not expect INVALID_SYNTAX to cause 

the IKE SA to be deleted; specifically, when it is included in a 
CREATE_CHILD_SA exchange.  However, I wonder if it is sufficient for an 
INVALID_SYNTAX in an INFORMATIONAL exchange to cause an IKE SA to be 
deleted 
without including a delete payload for the IKE SA.  It seems potentially 
ambiguous what an implementation should do if an INFORMATIONAL message 
contains only INVALID_SYNTAX whereas the addition of a delete payload for 
the IKE SA makes the situation clear.

Keith Welter
IBM z/OS Communications Server Developer
1-415-545-2694 (T/L: 473-2694)

---

From: Yoav Nir <[email-masked]>
Date: Fri, 4 Sep 2009 22:09:17 +0300

Then I should have explained better.

If an initiator sees an error in the response, the exchange is already over, so the only way it can notify the responder of the error, is to create a new INFORMATIONAL exchange with an error notification.

All the text here discusses the one INFORMATIONAL exchange that immediately follows the IKE_AUTH exchange. If that contains an INVALID_SYNTAX, it relates to the response to the IKE_AUTH exchange, and it means that the creation of the IKE SA failed.

In any other place, such as a CCSA or an INFORMATIONAL,  or in an INFORMATIONAL that follows one of those exchanges, an INVALID_SYNTAX just means that the previous message was ignored.

On Sep 4, 2009, at 7:26 PM, Keith Welter wrote:

> >> In subsequent INFORMATIONAL exchanges the UNSUPPORTED_CRITICAL_PAYLOAD
> >> whole message and replied with UNSUPPORTED_CRITICAL_PAYLOAD. That does
> >> not delete IKE SA.
> >>
> I would not expect INVALID_SYNTAX to cause the IKE SA to be deleted either.
Actually, my last statement was overly simplistic.  I should have said that
there is at least one case when I would not expect INVALID_SYNTAX to cause
the IKE SA to be deleted; specifically, when it is included in a
CREATE_CHILD_SA exchange.  However, I wonder if it is sufficient for an
INVALID_SYNTAX in an INFORMATIONAL exchange to cause an IKE SA to be deleted
without including a delete payload for the IKE SA.  It seems potentially
ambiguous what an implementation should do if an INFORMATIONAL message
contains only INVALID_SYNTAX whereas the addition of a delete payload for
the IKE SA makes the situation clear.

Keith Welter

Scanned by Check Point Total Security Gateway.

_______________________________________________
IPsec mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Keith Welter <[email-masked]>
Date: Fri, 4 Sep 2009 12:24:56 -0700

> Re: [IPsec] Fw:  Issue #26: Missing treatment of error cases
> 
> If an initiator sees an error in the response, the exchange is already 
over, so the
> only way it can notify the responder of the error, is to create a new 
INFORMATIONAL
> exchange with an error notification.
> 
> All the text here discusses the one INFORMATIONAL exchange that 
immediately follows
> the IKE_AUTH exchange. If that contains an INVALID_SYNTAX, it relates to 
the 
> response to the IKE_AUTH exchange, and it means that the creation of the 
IKE SA failed.
In this case, the INVALID_SYNTAX could relate to the SA, TSi or TSr 
payload in the 
IKE_AUTH response which would would mean that creation of the CHILD SA 
failed, 
not the IKE SA.  I think INVALID_SYNTAX is ambiguous here without an 
explicit delete 
payload for either the IKE SA or the CHILD SA.

> 
> In any other place, such as a CCSA or an INFORMATIONAL,  or in an 
INFORMATIONAL 
> that follows one of those exchanges, an INVALID_SYNTAX just means that 
the previous
> message was ignored.

does 
either. 
that 
deleted 

> [email-masked]

---

From: Raj Singh <[email-masked]>
Date: Sun, 6 Sep 2009 06:39:00 +0530

Hi Keith,

It has been already discussed on the list that each exchange has some
mandatory payload types.
Firstly, the exchange packet should be checked that it contains all
mandatory payload for that exchnage
then it should check each payload before actually processing the packet.

In your example of is because of SA2, TSi or TSr, then IKE SA should be
processed and INVALID_SYNTAX notify should be send.

Thanks & Regards,
Raj

On Sat, Sep 5, 2009 at 12:54 AM, Keith Welter <[email-masked]> wrote:

> In this case, the INVALID_SYNTAX could relate to the SA, TSi or TSr payload
> in the

---

From: Raj Singh <[email-masked]>
Date: Sun, 6 Sep 2009 13:17:01 +0530

Sorry for typos.
Please find re-phrased sentance below:

In your example, there is error in construction of SA2, TSi or TSr payloads
in IKE_AUTH response.
Which also means either the implementation is not RFC compliant or system in
bad state at responder.
As explained below, in this case mandatory payload check for IKE_AUTH will
pass, but individual payload verification check will fail.
So IKE SA should *NOT* be processed and INVALID_SYNTAX notify should be
send.
The responder which is not RFC compliant will DELETE its IKE SA, after it's
lifetimes expiry or liveness check.

Thanks & Regards,
Raj

---

From: Tero Kivinen <[email-masked]>
Date: Mon, 7 Sep 2009 15:58:58 +0300

> payload for either the IKE SA or the CHILD SA.

For normal errors in the SA payload there is NO_PROPOSAL_CHOSEN error
and for TSi and TSr there is TS_UNACCEPTABLE error.

If INVALID_SYNTAX is generated from for example SA payload because the
payload lengths inside the SA / Proposal / Transform payload
substructure is wrong (or there is other payload type inside SA
payload than what is allowed) then that again means the one end is
broken and there is no point of continuing creating the IKE SA as most
likely all future exchanges will fail in similar way.

It is clear for me that if INVALID_SYNTAX is ever returned to IKE_AUTH
exchange, that means the IKE SA was not successfully created (as we
do now know whether the other end for example verified the AUTH
payload). In that case when IKE SA was not created there is no IKE SA
to send delete payload to.

If INVALID_SYNTAX is returned after that as response to INFORMATIONAL
or CREATE_CHILD exchange, then it is not clear whether other deleted
the SA or not, but as I said earlier that can only happen if there is
bugs in implementations, so better to cut the discussion short to
limit attack options. 
-- 
[email-masked]