Subject: [Ipsec] draft-ietf-ipsec-esp-v3-10.txt

From: "Vishwas Manral" <[email-masked]>
Date: Wed, 7 Dec 2005 03:45:33 -0800

Hi Steve,

(CC'ing Pekka for IPv6 inputs) 
Sorry for getting this late. I noticed in section 3.3.4 it is stated
that: -

   NOTE: For IPv6 -- For bump-in-the-stack and bump-in-the-wire
   implementations, it will be necessary to examine all the extension
   headers to determine if there is a fragmentation header and hence
   that the packet needs reassembling prior to IPsec processing.

However I do not think having a fragment header itself means the packet
is a fragment. Only if the offset field or the more fragment field is
set to non-zero, only then is a packet a fragment. 

The fragment header is also used to signal to an IPv4-to-IPv6 translator
that the packet can be fragmented, DF bit setting in the outer IPv4
header (SIIT - RFC2765). I think the same text is there for AH draft
draft-ietf-ipsec-rfc2402bis-11.txt too.

We could change the text to 

   NOTE: For IPv6 -- For bump-in-the-stack and bump-in-the-wire
   implementations, it will be necessary to examine all the extension
   headers to determine if there is a fragmentation header, and either
   the More flag or the Fragment Offset is non-zero. If so that packet
   needs reassembling prior to IPsec processing.

We can bounce the text off the IPv6 list too if we desire.

Thanks,
Vishwas

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Stephen Kent <[email-masked]>
Date: Wed, 7 Dec 2005 16:40:07 -0500

Vishwas,

Sorry, but it's too late to consider any more changes to this text.

All of the authors have responded to the RFC Editor, and made final 
edits for the IPsec RFCs. They should be published in a few days.

Steve