Subject: [IPsec] Clarifying what happens with INITIAL_CONTACT

From: Paul Hoffman <[email-masked]>
Date: Sun, 27 Dec 2009 19:05:46 -0800

IKEv2bis doesn't say what actually happens when you get a INITIAL_CONTACT notification. In specific, it doesn't say what to do when you have to throw away SAs. I propose to add the following to section 2.4:

If an initiator receives an INITIAL_CONTACT notification in
response to its IKE_AUTH request, it MUST internally delete any IKE
SAs and associated Child SAs for that responder without sending any
notifications to the responder. If a responder receives an
INITIAL_CONTACT notification in an IKE_AUTH request, it MUST
internally delete any IKE SAs and associated Child SAs for that
initiator without sending any notifications to the initiator.

--Paul Hoffman, Director
--VPN Consortium

---

From: Yaron Sheffer <[email-masked]>
Date: Mon, 28 Dec 2009 17:28:11 +0200

Hi Paul,

You are adding two MUSTs, which we SHOULD NOT do unless we have very good reasons, such as interop problems, security issues, or major functionality problems (like memory leaks). I'm not sure any of these apply, so I suggest that you change the wording to be non-normative.

Thanks,
	Yaron

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Paul Hoffman
Sent: Monday, December 28, 2009 5:06
To: IPsecme WG
Subject: [IPsec] Clarifying what happens with INITIAL_CONTACT

--Paul Hoffman, Director
--VPN Consortium
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

Scanned by Check Point Total Security Gateway.

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 28 Dec 2009 07:36:06 -0800

>You are adding two MUSTs, which we SHOULD NOT do unless we have very good reasons, such as interop problems, security issues, or major functionality problems (like memory leaks). I'm not sure any of…

Whoops, all good points. I got carried away. How about:

When an initiator receives an INITIAL_CONTACT notification in
response to its IKE_AUTH request, it silently deletes any IKE SAs and
associated Child SAs for that responder without sending any
notifications to the responder. If a responder receives an
INITIAL_CONTACT notification in an IKE_AUTH request, it silently
deletes any IKE SAs and associated Child SAs for that initiator
without sending any notifications to the initiator.

--Paul Hoffman, Director
--VPN Consortium

---

From: Yaron Sheffer <[email-masked]>
Date: Mon, 28 Dec 2009 18:08:09 +0200

Looks good to me.

	Yaron

-----Original Message-----
From: Paul Hoffman [mailto:[email-masked]] 
Sent: Monday, December 28, 2009 17:36
To: Yaron Sheffer; IPsecme WG
Subject: Re: [IPsec] Clarifying what happens with INITIAL_CONTACT

--Paul Hoffman, Director
--VPN Consortium

---

From: Scott C Moonen <[email-masked]>
Date: Mon, 28 Dec 2009 12:44:53 -0500

> Looks good to me.

Agreed.

Scott Moonen ([email-masked])
z/OS Communications Server TCP/IP Development
http://www.linkedin.com/in/smoonen

From:
Yaron Sheffer <[email-masked]>
To:
Paul Hoffman <[email-masked]>, IPsecme WG <[email-masked]>
Date:
12/28/2009 11:08 AM
Subject:
Re: [IPsec] Clarifying what happens with INITIAL_CONTACT

Looks good to me.

                 Yaron

-----Original Message-----
From: Paul Hoffman [mailto:[email-masked]] 
Sent: Monday, December 28, 2009 17:36
To: Yaron Sheffer; IPsecme WG
Subject: Re: [IPsec] Clarifying what happens with INITIAL_CONTACT

At 5:28 PM +0200 12/28/09, Yaron Sheffer wrote:
>You are adding two MUSTs, which we SHOULD NOT do unless we have very good 
reasons, such as interop problems, security issues, or major functionality 
problems (like memory leaks). I'm not sure any of these apply, so I 
suggest that you change the wording to be non-normative.

--Paul Hoffman, Director
--VPN Consortium

---

From: Tero Kivinen <[email-masked]>
Date: Tue, 29 Dec 2009 13:08:06 +0200

Paul Hoffman writes:
> > You are adding two MUSTs, which we SHOULD NOT do unless we have
> > very good reasons, such as interop problems, security issues, or
> > major functionality problems (like memory leaks). I'm not sure any
> > of these apply, so I suggest that you change the wording to be
> > non-normative. 
> 

I would actually keep the keyword we have in the RFC4306, i.e. "MAY".
It says "... recipient MAY use this information to delete any other
IKE_SAs ...". I am not sure what you say above and the MAY are really
same. For me the text above says you need to do it, even when it does
not have word "MUST" in it, as it only gives you exactly one option.

As implementations are not required to understand (or send)
INITIAL_CONTACT notifications writing text like you have is bit
dangerous, as some people might still read that recipient of
INITIAL_CONTACT needs to silently delete any IKE SAs when it receives
INITIAL_CONTACT. 
-- 
[email-masked]