Subject: [Ipsec] Configuration payloads in draft-hoffman-ikev2bis-01.txt

From: <[email-masked]>
Date: Mon, 25 Jun 2007 13:40:15 +0200

Section 2.19, last paragraph, states clearly, that the responder 
must not include a CFG_REPLY if it did not receive a CFG_REQUEST.
I think this holds for all use of CP payloads, not just when 
requesting an internal address on a remote network.  If the
responder nevertheless still adds a CFG_REPLY without having
received a CFG_REQUEST, shall the initiator consider this a 
failure of the exchange?  (The alternative is that the
initiator just ignores the extraneous CFG_REPLY.)
 
The following uncertainty relates to section 2.19.1, sixth paragraph.
Is it possible for an attribute in a CFG_REQUEST to be recognized
but not supported?  My first impression would be to say no.
Thus if the responder receives a CFG_REQUEST containing an
INTERNAL_IP6_ADDRESS, and the responder does not recognize IPv6,
it doesn't matter whether the attribute payload has length 0, 17, or
any other value--the attribute is ignored.  However, if recognition
and support are different things, then what is the appropriate 
response to an INTERNAL_IP6_ADDRESS with length 16?
Does the wrong length lead the responder to answer INVALID_SYNTAX,
or does the lack of support for IPv6 lead the responder to ignore
the attribute?
 
Finally, in section C.4, CP should be added as optional
payload (at least for the case of creating a CHILD SA, it may
not be that relevant for rekeying a CHILD SA).
 
Christian

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec