Subject: Re: [Ipsec] Question of interpretation of RFC 4301

From: "DIPANJAN DATTA" <[email-masked]>
Date: 15 Aug 2007 08:29:21 -0000

Hi Scott,
I believe you are correct about the second interpretation. If we anyhow have a SPD entry with an explicit DENY and the outbound ICMP packet matches that rule then it satisfies the condition of Section 6.2 that the ICMP error message maps to an extant SA or SPD entry and hence the ICMP error packet will be dropped.

Regards
Dipanjan Datta  

On Tue, 14 Aug 2007 Scott C Moonen wrote :
>I have a question of interpretation of RFC 4301.  Section 6.2 reads:
>
>    If no SA exists that would carry the outbound ICMP message in
>    question, and if no SPD entry would allow carriage of this outbound
>    ICMP error message, then an IPsec implementation MUST map the message
>    to the SA that would carry the return traffic associated with the
>    packet that triggered the ICMP error message.  This requires an IPsec
>    implementation to detect outbound ICMP error messages that map to no
>    extant SA or SPD entry, and treat them specially with regard to SA
>    creation and lookup.  The implementation extracts the header for the
>    packet that triggered the error (from the ICMP message payload),
>    reverses the source and destination IP address fields, extracts the
>    protocol field, and reverses the port fields (if accessible).  It
>    then uses this extracted information to locate an appropriate, active
>    outbound SA, and transmits the error message via this SA.  If no such
>    SA exists, no SA will be created, and this is an auditable event.
>
>The text "no SPD entry would allow carriage" suggests to me that we take
>this action even if the administrator has created an explicit SPD entry to
>deny this ICMP error.  However, the text "that map to no extant SA or SPD
>entry" suggests that we should take this action only if there are no
>applicable SPD entries whatsoever pertaining to the ICMP error.
>
>Which interpretation is correct?  Because the first interpretation results
>in a loss of capability (rendering the administrator unable to actually
>deny the ICMP error), I am guessing that the second interpretation is
>correct, namely: take this action only if the ICMP matches no rule, and
>not if it matches an explicit DENY rule.
>
>Thank you,
>
>
>Scott Moonen ([email-masked])
>http://scott.andstuff.org/
>http://www.linkedin.com/in/smoonen
>_______________________________________________
>Ipsec mailing list
>[email-masked]
>https://www1.ietf.org/mailman/listinfo/ipsec
_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec