Subject: Re: [IPsec] [Ipsec] RFC 4301 and ICMP processing

From: "He, Wenxiao" <[email-masked]>
Date: Mon, 1 Dec 2008 21:43:53 +0000

Hi Dan,

Thanks for sharing that OpenSolaris has that feature. And sorry for late response (I am just back from vacation).

Regards,
Wenxiao

> -----Original Message-----
> From: Dan McDonald [mailto:[email-masked]]
> Sent: Monday, November 24, 2008 11:29 AM
> To: He, Wenxiao
> Cc: [email-masked]
> Subject: Re: [IPsec] [Ipsec] RFC 4301 and ICMP processing
>
> On Mon, Nov 24, 2008 at 07:10:24PM +0000, He, Wenxiao wrote:
> > > Now, consider a simple end-to-end case between host A and host B.
> > > The SPD between A and B only specifies a SA for UDP, and
> there is no
> > > SPD to cover ICMP traffic. When host A sends a UDP
> message to host
> > > B, a SA pair is negotiated. And the
> > > A->B UDP message triggers host B to send back an ICMP
> error message.
>
> So far, so good.
>
> > > A) If I apply section 6.2 "Processing Protected, Transit
> ICMP Error
> > > Messages" to the B->A ICMP error message, the icmp error message
> > > will be carried by the extant SA pair generated by UDP message.
> > >
> > > B) If I donot apply the process specified in section 6.2,
> then the
> > > ICMP ERROR message will be discarded because no SPD is found.
> >
> > > Which of the above two approaches is the expected behavior for an
> > > IPsec end host? Does section 6 apply to IPsec end host?
>
> I can't say what everyone else does, but in {,Open}Solaris
> we've always had ICMP errors reflect back with the same
> policy (and SA) used by the traffic.
> It makes sense from a not-leaking-information point-of-view.
>
> In fact, you've helped me find a bug with inbound ICMP
> processing -- if an SA is tied to a protocol or port, ICMP
> SPD checking needs to apply the *inner* packet selectors.
>
> Dan
>
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec