Subject: [Hipsec] Suresh Krishnan's Discuss on draft-ietf-hip-dex-13: (with DISCUSS)

From: Suresh Krishnan via Datatracker <[email-masked]>
Date: Tue, 03 Mar 2020 20:47:23 -0800

Suresh Krishnan has entered the following ballot position for
draft-ietf-hip-dex-13: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-hip-dex/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

This should be pretty straightforward to resolve.

* Section 5.4.:

The ICMPv6 Parameter Problem messages to be sent need a Code field to be set in
addition to the Pointer. What Code should be used in this message? Please
specify this.

---

From: Robert Moskowitz <[email-masked]>
Date: Wed, 4 Mar 2020 08:19:09 -0500

This looks more like an RFC 7401 problem than a HIP-DEX problem; as DEX 
inherits this from 7401.  In fact it is an RFC 5201 problem!

It looks like Suresh is correct that a code is needed and in sec 3.4 of 
RFC 2463 a code is need..

I looked at:

https://www.iana.org/assignments/icmpv6-parameters/icmpv6-parameters.xhtml#icmpv6-parameters-codes-5

And nothing there that looks right.

So what is done in HIP BEX implementations?  Both v1 and v2?

And should this be fixed in DEX or an errata for 5201 and 7401?  And if 
we do an errata, do we still specify the code in DEX?

Nothing is ever "straightforward to resolve" ...

-- 
Standard Robert Moskowitz
Owner
HTT Consulting
C:248-219-2059
F:248-968-2824
E:[email-masked]

There's no limit to what can be accomplished if it doesn't matter who 
gets the credit

---

From: Jeff Ahrenholz <[email-masked]>
Date: Wed, 4 Mar 2020 15:53:15 +0000

> So what is done in HIP BEX implementations?  Both v1 and v2?

For our HIPv1 implementation:
IPv4 packets - we send ICMPv4-in-UDP with type 12 "parameter problem" code 0 "pointer indicates the error" and point to the first bytes of UDP payload. (https://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml#icmp-parameters-codes-12)

IPv6 packets - we send ICMPv6-in-UDP with type 4 "parameter problem" code 0 "erroneous header field encountered" and point to the first bytes of UDP payload. 

Normally this would be if the SPI is unknown (e.g. one side forcefully reboots while the other continues to send it ESP-in-UDP data.) The pointer includes the first 8 bytes of the UDP payload so that the SPI is included in the ICMP message.

For IPv6 you could consider the "erroneous header field" to be the invalid SPI number, which is the bytes we point to.

-Jeff

---

From: Robert Moskowitz <[email-masked]>
Date: Wed, 4 Mar 2020 11:09:04 -0500

> For IPv6 you could consider the "erroneous header field" to be the invalid SPI number, which is the bytes we point to.

Suresh,

How would you recommend handling this?  It seems the text in all docs 
(5201, 7401, and DEX) might be:

In most cases, the ICMP packet has the Parameter Problem type (12 for 
ICMPv4, 4 with code=0 for ICMPv6),

Please advise.

---

From: Suresh Krishnan <[email-masked]>
Date: Wed, 4 Mar 2020 18:11:16 +0000

Hi Bob/Jeff,

> On Mar 4, 2020, at 11:09 AM, Robert Moskowitz <[email-masked]> wrote:
> 
> 
> 
> How would you recommend handling this?  It seems the text in all docs (5201, 7401, and DEX) might be:
> 
> In most cases, the ICMP packet has the Parameter Problem type (12 for ICMPv4, 4 with code=0 for ICMPv6),

I am happy with the Code being set to 0 for ICMPv6 and the Pointer being set as Jeff proposed above.

Regards
Suresh

---

From: Robert Moskowitz <[email-masked]>
Date: Thu, 5 Mar 2020 11:04:22 -0500

Here is the text I put together for revising sec 5.4 (see below).

> https://datatracker.ietf.org/doc/draft-ietf-hip-dex/

5.4.  ICMP Messages

    When a HIP implementation detects a problem with an incoming packet,
    and it either cannot determine the identity of the sender of the
    packet or does not have any existing HIP association with the sender
    of the packet, it MAY respond with an ICMP packet.  Any such reply
    MUST be rate-limited as described in [RFC4443].  In most cases, the
    ICMP packet has the Parameter Problem type (12 for ICMPv4, 4 for
    ICMPv6) and Code of 0.  The Pointer field pointing to the field that
    caused the ICMP message to be generated, for example to the first 8
    bytes of a UDP payload for "SPI is Unknown".  The problem cases
    specified in Section 5.4. of [RFC7401] also apply to HIP DEX.

---

From: Jeff Ahrenholz <[email-masked]>
Date: Thu, 5 Mar 2020 16:13:28 +0000

>  Here is the text I put together for revising sec 5.4 (see below).

It seems good to me.

-Jeff

---

From: Suresh Krishnan <[email-masked]>
Date: Thu, 5 Mar 2020 19:00:22 +0000

Hi Bob,
  This text works for me. I will clear as soon as the new revision hits.

Regards
Suresh

> On Mar 5, 2020, at 11:04 AM, Robert Moskowitz <[email-masked]> wrote:
>

---

From: Robert Moskowitz <[email-masked]>
Date: Fri, 13 Mar 2020 14:43:16 -0400

Suresh,

Your text appeared in ver 14.  Please check it out.

thank you.

Bob