Subject: [Ipsec] Minor comment on draft-ietf-ipsec-rfc2402bis-10.txt (AH)

From: Markku Savela <[email-masked]>
Date: Wed, 16 Feb 2005 16:43:16 +0200

There is a strange sentence in:

3.3.3.1  Handling Mutable Fields
   ...
                          ...  If the IP (v4 or v6) implementation
   encounters an extension header that it does not recognize, it will
   discard the packet and send an ICMP message.  IPsec will never see
   the packet. 
   ...

There is no such thing as "unrecognized extension header". There are
only "recognized extension headers" and "transport protocol". Thus, if
a stack receives a header that it does not recognize as an extension
header, it must assume that it is a transport protocol. This protocol
may have receiver or may not (in Unix receiver may be using the raw
socket). If no receiver, it may result a protocol unreachable ICMP.

However, IPsec will see such packets (and actually have a policy
selector for it). Hence, the two sentences above could/should be
deleted.

Other that above editorial[?] issue(s), the text seem OK by me (same
applies to the ESP draft, which I forgot to state in my previous
comment).

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Markku Savela <[email-masked]>
Date: Wed, 16 Feb 2005 17:02:46 +0200

[Ok, I have to revice my comment a bit...]

> only "recognized extension headers" and "transport protocol".

Above is true, but in connection with AH, the draft sentences are sort
of correct, perhaps the following was intended: Assume send is using
extension header "EX" that receiver does not recognize, and builds an
IP packet as follows:

   IP EX AH ...

The receiver does not recognize EX as extension header, and treats it
as some transport protocol. As the draft says, AH processing is never
called. However, IPsec does get to see this packet as transport EX
packet (of course, the two nodes really won't communicate
correctly...)