Subject: [IPsec] Issue #10 Specific Protocol ID values in REKEY_SA notify

From: Tero Kivinen <[email-masked]>
Date: Tue, 23 Sep 2008 14:27:07 +0300

> >  1.3.3.  Rekeying CHILD_SAs with the CREATE_CHILD_SA Exchange
> ...
> >     {{ 3.10.1-16393 }} The REKEY_SA notification MUST be included in a
> >     CREATE_CHILD_SA exchange if the purpose of the exchange is to replace
> >     an existing ESP or AH SA. {{ Clarif-5.4 }} The SA being rekeyed is
> >     identified by the SPI field in the Notify payload; this is the SPI
> >     the exchange initiator would expect in inbound ESP or AH packets.
> >     There is no data associated with this Notify type.
> 
> Add clarification here specifying the value of the Protocol ID field:
> 
>      The Protocol ID field of REKEY_SA notify is set accordingly to ESP
>      (3) or AH (2).
> 
> ===Not done. Disagree. There may be additional protocol IDs in the future.

One of the most common issues we have had in the interops has been the
confusions about what protocol ID values to use in which notify
fields. Most of them has where people have used protocol ID value of
non-zero when zero should have been used. REKEY_SA is one of those 2
notifies which actually use non-zero Protocol ID values, and it would
be very important to point that out (it is already mentioned in the
section 3.10).

Also the text 3.10 already says we can have only protocol IDs to
indicate AH and 3 to indicate ESP. If we add new protocol IDs in the
future, we are most likely not going to modify this document, but
write new document, and that will then point out what protocol ID
numbers are used where and when.

If we are trying to keep the description of notifies in one place,
then we should also copy this fact of protocol IDs here too. Before
the text describing REKEY_SA and Protocol IDs was in section 3.10, but
now the text about REKEY_SA is in 1.3.3, but the text describing the
protocol ID use is in 3.10. 

If you do not want to mention the actal protocol numbers here that is
ok, but just saying that "The Protocol ID field of REKEY_SA notify is
set match the protocol of the SA we are rekeying.", but then
implementors might use IP-protocol numbers (50, 51) instead of the
correct values 2 and 3. 
-- 
[email-masked]
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Yoav Nir <[email-masked]>
Date: Tue, 23 Sep 2008 14:36:23 +0300

> implementors might use IP-protocol numbers (50, 51) instead of the

How about:
    The Protocol ID field of the REKEY_SA notification is
    set to match the protocol of the SA we are rekeying, for
    example, 3 for ESP and 2 for AH.

---

From: Tero Kivinen <[email-masked]>
Date: Tue, 23 Sep 2008 17:24:47 +0300

>     example, 3 for ESP and 2 for AH.

That would be perfect for me. 
-- 
[email-masked]
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 23 Sep 2008 09:13:35 -0700

>That would be perfect for me.

That works for me too. I thought Tero was trying to limit it to 2 and 
3, not use them as examples.

--Paul Hoffman, Director
--VPN Consortium