Subject: [IPsec] Question: Inconsistent statements about what the node shall do when receving ESP packets with unknown SPI.

From: Pål Dammvik <[email-masked]>
Date: Tue, 3 Apr 2018 11:09:35 +0000

Think I have discovered a small inconsistency in RFC 7296 with regards to the actions a node shall take if it received ESP packets with an unknown SPI.
In section 1.5 it’s stated:

“In the first case, if the receiving node has an active IKE SA to the IP address from whence the packet came, it MAY send an INVALID_SPI notification of the wayward packet over that IKE SA in an INFORMATIONAL exchange.”

The works “In the first case” refers to a case where the node received an ESP packet with unknown SPI.

Thus in this case it’s a MAY statement to initiate the INFORMATIONAL exchange.

In section 2.21.4 it’s stated:

“If an error occurs outside the context of an IKE request (e.g., the node is getting ESP messages on a nonexistent SPI), the node SHOULD initiate an INFORMATIONAL exchange with a Notify payload describing the problem.”

So in this case it’s a SHOULD statement to initiate the INFORMATIONAL exchange.

To me these statement are a bit confusing, is it a SHOULD or MAY to initiate an INFORMATIONAL exchange when receiving ESP packets with unknown SPI? (assuming an IKE SA is established).

In my humble opinion section 2.21.4 should be updated to say MAY but I might have missed something 😊

---

From: Tero Kivinen <[email-masked]>
Date: Wed, 4 Apr 2018 02:23:36 +0300

Pål Dammvik writes:
> Think I have discovered a small inconsistency in RFC 7296 with
> regards to the actions a node shall take if it received ESP packets
> with an unknown SPI.

Those cases are not exactly same. I.e., the section 1.5 explictly
talks about receiving ESP packet with unknown SPI. The section 2.21.4
talks about errors outside the context of an IKE request, and gives
one example of such case, which happens to be the ESP messages on
nonexisting SPI.

On the hand, I am not sure if there are any other errors outside of
IKE request than invalid SPIs...

> To me these statement are a bit confusing, is it a SHOULD or MAY to initiate
> an INFORMATIONAL exchange when receiving ESP packets with unknown SPI?
> (assuming an IKE SA is established).

Note, that SHOULD includes MAY. I.e., if some text says you SHOULD do
something, and other text say you MAY do that, they are not
conflicting, the MAY is included as part of SHOULD.

So when you implement the SHOULD you also happen to implement the MAY
too... 

> In my humble opinion section 2.21.4 should be updated to say MAY but I might
> have missed something 

We did discussed about this in 2008-2010 before publishing RFC5996.
The section 2.21 got written at that point, as we wanted to expand the
text covering the error cases.

Then I did point out before publication that the text is bit confusing
and that sections 1.5 and 2.21.4 should be combined, as we same rules
in two different places. The editor responded that he didn't want to
do that big change in that late phases [2].

[1] https://trac.ietf.org/trac/ipsecme/ticket/26
[2] https://www.ietf.org/mail-archive/web/ipsec/current/msg05669.html

When we were making RFC7296 we could have combined those two sections
but never got to do that even then.

Anyways I think SHOULD is good there, as those messages are rate
limited, and sending information to the other end that you are sending
me stuff, I do not know anything about is good thing, as then it can
do some actions to fix things. 
-- 
[email-masked]