Subject: [Ipsec] Question of interpretation of RFC 4301

From: Scott C Moonen <[email-masked]>
Date: Tue, 14 Aug 2007 13:53:28 -0400

I have a question of interpretation of RFC 4301.  Section 6.2 reads:

   If no SA exists that would carry the outbound ICMP message in
   question, and if no SPD entry would allow carriage of this outbound
   ICMP error message, then an IPsec implementation MUST map the message
   to the SA that would carry the return traffic associated with the
   packet that triggered the ICMP error message.  This requires an IPsec
   implementation to detect outbound ICMP error messages that map to no
   extant SA or SPD entry, and treat them specially with regard to SA
   creation and lookup.  The implementation extracts the header for the
   packet that triggered the error (from the ICMP message payload),
   reverses the source and destination IP address fields, extracts the
   protocol field, and reverses the port fields (if accessible).  It
   then uses this extracted information to locate an appropriate, active
   outbound SA, and transmits the error message via this SA.  If no such
   SA exists, no SA will be created, and this is an auditable event.

The text "no SPD entry would allow carriage" suggests to me that we take 
this action even if the administrator has created an explicit SPD entry to 
deny this ICMP error.  However, the text "that map to no extant SA or SPD 
entry" suggests that we should take this action only if there are no 
applicable SPD entries whatsoever pertaining to the ICMP error.

Which interpretation is correct?  Because the first interpretation results 
in a loss of capability (rendering the administrator unable to actually 
deny the ICMP error), I am guessing that the second interpretation is 
correct, namely: take this action only if the ICMP matches no rule, and 
not if it matches an explicit DENY rule.

Thank you,

Scott Moonen ([email-masked])
http://scott.andstuff.org/
http://www.linkedin.com/in/smoonen

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Stephen Kent <[email-masked]>
Date: Thu, 16 Aug 2007 11:26:57 -0400

At 1:53 PM -0400 8/14/07, Scott C Moonen wrote:
>The text "no SPD entry would allow carriage" suggests to me that we 
>take this action even if the administrator has created an explicit 
>SPD entry to deny this ICMP error.  However, the text "that map to 
>no extant SA or SPD entry" suggests that we should take this action 
>only if there are no applicable SPD entries whatsoever pertaining to 
>the ICMP error.
>
>Which interpretation is correct?  Because the first interpretation 
>results in a loss of capability (rendering the administrator unable 
>to actually deny the ICMP error), I am guessing that the second 
>interpretation is correct, namely: take this action only if the ICMP 
>matches no rule, and not if it matches an explicit DENY rule.

Scott,

THe second interpretation is correct.  We viewed an SA Or an SPD 
entry) that discards the ICMP traffic as "carrying" the traffic, 
although the destination is not very interesting :-).  We probably 
have said something clearer, e.g., in terms of an SA  or an SPD entry 
to which the traffic would be mapped. If one considers the processing 
model in 4301, if I have an SPD entry that calls for discarding 
traffic, I would create an SPD cache entry that represents the SPD 
entry once I get traffic matching the selectors of the SPD entry. The 
SPD cache entry is equivalent to an SA at that point, from an 
outbound traffic processing perspective, although there would not be 
a corresponding SAD entry.

Steve