Re: 68 - minimal conformance requirements

[email protected] wrote:

>IMHO this is even more confusing than the original text...  Having
>a single address at any given time doesn't really have much to do
>with this paragraph. Even if a node has several addresses, it does
>not need to send ADDITIONAL_*_ADDRESS notifications if either
>
>(1) it doesn't want to use those addresses for IPsec traffic, or
>(2) the node is the initiator, and it does not want to use
>any other responder addresses.
>  
>
Yes.

>Furthermore, the responder does not have to understand
>ADDITIONAL_*_ADDRESS notifications (beyond treating them like any
>other unrecognized status notification; that is, ignoring them) 
>if it's not going to change its address.
>  
>
Yes -- as long as we are talking about a "responder"
and not a "gateway".

>How about rephrasing this as follows?
>
>    Note that both peers can have their own policies about what
>    addresses are acceptable to use, and certain types of policies
>    may simplify implementation. For instance, if the responder
>    has a single fixed address, it does need to process
>    ADDITIONAL_*_ADDRESS notifications it receives (beyond
>    ignoring unrecognized status notifications as already required
>    in [IKEv2]). Furthermore, if the initiator has a policy saying
>    that only the responder address specified in local
>    configuration is acceptable, it does not have to send its own
>    additional addresses to the responder (since the responder
>    does not need them except when changing its own address).
>  
>
Works for me. Thanks.

--Jari