(racoon 778) racoon alters proposed lifetime in phase 1

This is more along the lines of WinXP (initiator) to Mac OS X racoon
(responder) for Kerberos IKE.

In the phase 1 negotiation, WinXP as its first packet contains one SA
proposal, and all of its transforms have a lifetime of 7200. Racoon accepts
one of the transforms, but it was replying with a lifetime of 120 seconds,
and thus WinXP complains that it altered the policy and replies with a
notification with the NO-PROPOSAL-CHOSEN message, which racoon ignores and
keeps sending the response packet.

Now, my remote node specification had a lifetime time set to 10 minutes.
However the man pages seem to say that it only affects proposals, i.e., when
racoon is acting as the initiator. The proposal_check is set to "obey", but
the man pages suggest it only affects phase 2. If I set the lifetime time in
the remote node specification to 7200 seconds, then all is well*.

(* well, in that it gets to the next problem, which is that the Windows side
experiences an error 0x80090303 (SEC_E_TARGET_UNKNOWN))

It would seem that RFC 2408 section 4.2 suggests that the proposal and
transform selected by the responder and transmitted back to the receiver be
identical, and that the initiator MUST verify that it was indeed a
proposal/transform that had been sent. Altering the lifetime seems to be an
error. Does this seem correct?

Thanks,
Nathan Herring
MacBU SDE/Dev