Subject: Last Call on 2401bis issues 72, 73, 76, 79, 80, 83, 84

From: Barbara Fraser <[email-masked]>
Date: Thu, 09 Oct 2003 11:55:20 -0700

During our teleconference this week, we decided a number of the proposed 
2401 changes/issues are non-controversial and should be accepted.

Suggested no change to existing 2401:
79 Detection of dead peers and dead SAs

Clarifications:
72 Explain why ALL IP packets must be checked
73 IP Option & Ext Hdr handling in Tunnel Mode
76 More explanation re: ESPv3 TFC padding & dummy packets

Handled by IPSP working group:
80 Security gateway discovery - suggestion is to not do anything since IPSP 
wg is working on this.

Debugging Support:
83 DROP'd inbound packet -- missing required IPsec protection - debug support
84 DROP'd outbound packet - debug support

Please consider this a 48 hour last call on these issues.  If you have 
comments on one of these issues, please include the issue number in the 
subject of your email message.

Thanks,
Barb and Ted

---

From: Tero Kivinen <[email-masked]>
Date: Fri, 10 Oct 2003 11:09:58 +0300

> 84 DROP'd outbound packet - debug support

Both of these have text that says:

----------------------------------------------------------------------
To address this, the implementation SHOULD provide management controls
to allow an administrator to configure an IPsec implementation to send
or not send the above ICMP message, or to rate limit the transmission
of such ICMP responses.
----------------------------------------------------------------------

I.e either allow configuration option to disable or enable ICMP, *or*
rate limit them.

I think that even if there is option to disable ICMPs there SHOULD be
way to rate limit them, i.e if the implementation allows sending ICMPs
there must always way to rate limit them.

So the new text could be:
----------------------------------------------------------------------

To address this, the implementation SHOULD provide management controls
to allow an administrator to configure an IPsec implementation to send
or not send the above ICMP message, and to rate limit the transmission
of such ICMP responses.
----------------------------------------------------------------------
(i.e change or => and).
-- 
[email-masked]
SSH Communications Security                  http://www.ssh.fi/
SSH IPSEC Toolkit                            http://www.ssh.fi/ipsec/