Subject: [Ipsec] UDP-Encapsulating and PMTU

From: Oscar Mateo <[email-masked]>
Date: Fri, 5 Nov 2004 10:37:49 +0100

Hi everybody,

I have the folllowing problem implementing ICMP Processing (RFC 2401,
section 6) and UDP Encapsulation: In case the ICMP MTU message only
contains only the internet header plus the first 64 bits of the
original datagram's data, it is impossible to recover the
corresponding SPI, how should I perform the processing then? Any
thoughts appreciated!!

Best Regards,
Oscar Mateo
Teldat S.A.

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Stephen Kent <[email-masked]>
Date: Fri, 12 Nov 2004 13:06:16 -0500

>corresponding SPI, how should I perform the processing then? Any

Oscar,

Your message did not indicate the context in which the ICMP message 
is received by an IPsec implementation.

In order to respond to your question I have to make some assumptions. 
I will assume that you are referring to an IMCP generatde by a router 
on the ciphertext side of the IPsec boundary, since you make 
reference to an SPI, and SPIs appear ONLY in ciphertext packets. I 
also will assume that you are referring to an inbound packet, 
arriving on the ciphertext side of the boundary.  In that case, the 
SPI will be available, because it is within the first 64 bits of the 
AH and ESP headers. So, I don't really understand the question you 
raised.

Steve

---

From: Stephen Kent <[email-masked]>
Date: Mon, 15 Nov 2004 10:53:31 -0500

At 9:58 AM +0100 11/15/04, Oscar Mateo wrote:
>Hi Stephen,
>Sorry for not being precise in specifying my scenario. Anyway, your
>assumtions are right, except for the fact that I´m encapsulating in
>UDP, so the first 64 bits of the returning ICMP packet do not contain
>the ESP header, but the UDP one.

Ah, you are using UDP encapsulation to get 
through a NAT. Yes, in that case, the receiver of 
the ICMP error message will have no way to know 
what to do, based on 2401bis processing rules. 
This may be an unfortunate side effect of dealing 
with NAT traversal via an add-on RFC.

>Also, I have another doubt in respect to calculation of PMTU from an
>ICMP/PMTU when IPComp is being used. In the same scenario than above,
>how do I asses the effect of compresion in order to propagate the
>ICMP/PMTU message to the protected host?
>Thanks in advance for your help and best regards,

You generally cannot tell how much space savings 
a compression algorithm will yield, so there is 
no precise way to report an appropriate PMTU 
value in that case.

Steve