(racoon 896) Re: "DOI value of CONNECTED Notify Message has problem"

On Fri, 14 Jan 2005 19:36:45 +0900
"Haoda" <[email protected]> wrote:

> I think the 4th message sent from responder to initiator is not correct.
> Because according to RFC, when the responder receive the 3rd message, it
> will wait for the next Notify payload from initiator and don't send any 
> packet. I think maybe racoon sent the improperly packet after it received
> the 3rd message.
> 
> How about you think about this?

My understanding of CONNECTED notification goes like this;

   Initiator                        Responder
  -----------                      -----------
   HDR*, HASH(1), SA, Ni
     [, KE ] [, IDci, IDcr ] -->
                             <--    HDR(commit)*, HASH(2), SA, Nr
                                          [, KE ] [, IDci, IDcr ]
   HDR*, HASH(3)             -->
                             <--    CONNECTED

Commit bit is used to signal the use of CONNECTED notification by the
sending entity, Responder in this case. Initiator waits for CONNECTED
notification, IPsec SAs are established after the receipt and
processing of this notification. IMHO, only the AM/QM responders get
the advantage of this functionality, i.e. not much use for initiators
to set the commit bit.