Subject: [Ipsec] Quick question about NAT-T (RFC 3948) keepalives

From: Dan McDonald <[email-masked]>
Date: Wed, 18 Jul 2007 12:44:51 -0400

RFC 3948 says the following about NAT-T Keepalives:

   The sender MUST use a one-octet-long payload with the value 0xFF.
   The receiver SHOULD ignore a received NAT-keepalive packet.

That's fine and well.

RFC 3948 doesn't precisely specify what to do when:

	* If the single-byte is not 0xFF

	* If a UDP packet arrives on the UDP-Encapsulation port with 2 or 3
	  bytes.

A four-byte-or-more UDP packet on the UDP-Encapsulation port reduces to the
known-problem of an ESP packet, malformed or not.

My gut, Postel's Law, and my STREAMS-free rewrite of NAT-Traversal in
OpenSolaris, all say treat 2 or 3 bytes received like any other keepalive -->
ignore.  (For the curious, code changes in question are at
http://cr.opensolaris.org/~danmcd/detangle/, especially strip_zero_spi() in
ip.c.)

My question to you folks is should we treat Keepalive-like packets that
aren't properly formed somehow different w.r.t. logging, stats, etc.?

Thanks,
Dan

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Michael Richardson <[email-masked]>
Date: Thu, 19 Jul 2007 18:04:12 -0400

> http://cr.opensolaris.org/~danmcd/detangle/, especially strip_zero_spi() in

   I agree.

> aren't properly formed somehow different w.r.t. logging, stats, etc.?

   Maybe you want a statistic for it.
   Logging? I don't think so, but if you did, you'd want it very much rate 
limited.  Does it indicate something broken on the way?

   Maybe it is interesting if there is in fact no other traffic.

   (Consider the path MTU blackhole situation...)