Subject: [IPsec] NON_FIRST_FRAGMENTS_ALSO question

From: Scott C Moonen <[email-masked]>
Date: Tue, 30 Sep 2008 15:22:18 -0400

RFC 4301 states the following:

   IPsec MUST perform the following steps when processing outbound 
packets:

   1.  . . . invoke the SPD selection function . . .
   . . .
   3a. . . . Note that the SA PMTU value, plus the value of
       the stateful fragment checking flag (and the DF bit in the IP
       header of the outbound packet) determine whether the packet can
       (must) be fragmented prior to or after IPsec processing, or if it
       must be discarded and an ICMP PMTU message is sent.

>From this text it is clear that outbound SPD lookup occurs before 
fragmentation.  In the case of locally originated traffic, this means that 
if a packet is fragmented, all of these locally originated fragments will 
be filtered with the benefit of knowing their upper-layer selectors 
(ports, type, code).  In other words, if there is a tunnel-mode tunnel for 
a specific port pair, and if the PMTU dictates fragmentation before 
encapsulation, these fragments will normally all be sent over that tunnel 
rather than split between that tunnel and a port=OPAQUE tunnel.

Based on the following text from RFC 4718, this indicates to me that, even 
if an implementation does not generally perform stateful fragment checking 
on forwarded traffic, NON_FIRST_FRAGMENTS_ALSO must be sent in this case 
for local traffic:

   [RFC4301] says "Implementations that will transmit non-initial
   fragments on a tunnel mode SA that makes use of non-trivial port (or
   ICMP type/code or MH type) selectors MUST notify a peer via the IKE
   NOTIFY NON_FIRST_FRAGMENTS_ALSO payload.

Even though this text is from RFC 4301, I mention RFC 4718 because it has 
an important clarification about NON_FIRST_FRAGMENTS_ALSO being a 
negotiated behavior rather than a unilateral declaration.  And that 
relates to some questions I have for IKEv2 implementors:

  1) Does your implementation perform stateful fragment checking?

  2) Regardless of the answer to #1, does your implementation correctly 
recognize that in this case there is a pseudo stateful fragment checking 
going on even though the traffic at your endpoint is not forwarded?

  3) How do you handle this case?  Do you send NON_FIRST_FRAGMENTS_ALSO? 
Or do you mark the SA as stateful-fragment-checking=false, perhaps 
discarding those non-first fragments?  Or do you have additional logic to 
perform a second SPD lookup for these non-first fragments after they have 
been produced, so that they can be sent on the appropriate port=ALL or 
port=OPAQUE SA?

  4) If you treat this as a NON_FIRST_FRAGMENTS_ALSO case, what do you do 
in the event that NON_FIRST_FRAGMENTS_ALSO is not also sent by the peer? 
Do you delete the SA and document that a port=ALL SA must be established 
instead (e.g., by setting the port PFP flags to false)?  Or do you revert 
to any of the behaviors suggested in the previous question?

Thanks in advance for your answers (and for any additional thoughts or 
opinions you have),

Scott Moonen ([email-masked])
z/OS Communications Server TCP/IP Development
http://scott.andstuff.org/
http://www.linkedin.com/in/smoonen

_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec