Subject: [Ipsec] Minor comment/question on draft-ietf-ipsec-esp-v3-09.txt

From: Markku Savela <[email-masked]>
Date: Wed, 16 Feb 2005 15:59:05 +0200

Minor nit (or my misunderstanding of something), but in

2.3  Payload Data
   ...
   Note that the beginning of the next layer protocol header MUST be
   aligned relative to the beginning of the ESP header as follows. For
   IPv4, this alignment is a multiple of 4 bytes. For IPv6, the
   alignment is a multiple of 8 bytes.
   ...

I'm puzzled about what the "next layer protocol header" means? With
ESP, the packet really does not have any next layer header, that needs
alignment.

The paragraphah can be deleted?

[Of course, after inbound ESP processing we have the header and it
must be properly aligned, but that is a different matter.]

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Stephen Kent <[email-masked]>
Date: Wed, 16 Feb 2005 12:22:18 -0500

>must be properly aligned, but that is a different matter.]

Inside the ESP payload, after the optional IV, is the "next layer 
protocol header." It is referred to as "rest of payload data" in 
Figure 2. Typically, for transport mode this will be TCP or UDP. For 
tunnel mode, it is IP. This text is part of a discussion reminding 
folks that the IV, if present, must preserve the 4 or 8 byte 
alignment requirements for the relevant IP version. We assume that 
the ESP payload, overall, started on an appropriate boundary, so the 
addition of the 8 bytes of SPI plus sequence number preserved this 
alignment. But the IV, if present, could break the alignment.

Steve

---

From: Markku Savela <[email-masked]>
Date: Thu, 17 Feb 2005 00:12:33 +0200

> From: Stephen Kent <[email-masked]>

> alignment. But the IV, if present, could break the alignment.

I knew that, but I assumed the removal of the ESP headers from the
packet required shifting of data within the packet anyway, so the
aligment requirement seemed unnecessary.

I suppose, it might make some optimizations in the shifting
possible. However, this is a new requirement compared to RFC-2406? Can
it be "MUST"?

---

From: Paul Koning <[email-masked]>
Date: Wed, 16 Feb 2005 17:48:18 -0500

>>>>> "Markku" == Markku Savela <[email-masked]> writes:

 >> Figure 2. Typically, for transport mode this will be TCP or
 >> UDP. For tunnel mode, it is IP. This text is part of a discussion
 >> reminding folks that the IV, if present, must preserve the 4 or 8
 >> byte alignment requirements for the relevant IP version. We assume
 >> that the ESP payload, overall, started on an appropriate boundary,
 >> so the addition of the 8 bytes of SPI plus sequence number
 >> preserved this alignment. But the IV, if present, could break the
 >> alignment.

 Markku> I knew that, but I assumed the removal of the ESP headers
 Markku> from the packet required shifting of data within the packet
 Markku> anyway, so the aligment requirement seemed unnecessary.

No... you don't shift the data, you change the start of data pointer.
Then you reference header fields relative to that pointer.

If the alignment requirement isn't satisfied, then you can end up in
situations where the original alignment lets you do nice efficient
aligned memory loads, but after adjusting the pointer past the ESP
header you have to use unaligned load sequences.  Either that, or you
don't realize this and your box crashes on an unaligned load
fault... :-( 

	 paul