Subject: ICMP Parameter Problem Message.

From: [email-masked]
Date: Mon, 25 Aug 2003 19:44:37 -0500

Hi,

Let say a gateway has a loadable ipsec module and it loads it 
only when it has a IPsec policy configured. This gateway receives
an IPv6 ESP packet. As the IPsec module is not loaded, the IPv6 
stack doesn't recongnize the next header type ESP and reply with
ICMP Parameter Problem (unrecognized next header type).

The question is:

should this ICMP message be sent in this case or should the ESP
packet be dropped silently ?
because the gateway does recognize next header type ESP.

regards
Mukesh

---

From: Michael Richardson <[email-masked]>
Date: Mon, 25 Aug 2003 23:55:32 -0400

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "Mukesh" == Mukesh Gupta <[email-masked]> writes:

    Mukesh> Let say a gateway has a loadable ipsec module and it loads it 
    Mukesh> only when it has a IPsec policy configured. This gateway receives
    Mukesh> an IPv6 ESP packet. As the IPsec module is not loaded, the IPv6 
    Mukesh> stack doesn't recongnize the next header type ESP and reply with
    Mukesh> ICMP Parameter Problem (unrecognized next header type).

    Mukesh> The question is:

    Mukesh> should this ICMP message be sent in this case or should the ESP
    Mukesh> packet be dropped silently ?
    Mukesh> because the gateway does recognize next header type ESP.

  Assuming that the module was loaded, an ICMP SPI unknown might be sent
by some implementations. Most drop it. 
  So, what is the concern exactly?

]      Out and about in Ottawa.    hmmm... beer.                |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email-masked] http://www.sandelman.ottawa.on.ca/ |device driver[
] panic("Just another Debian/notebook using, kernel hacking, security guy");  [