[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: fast re-keying
Phil,
>>"I have not turned on Security or I am not USING Security at this node".
>How about an ICMP Protocol Unreachable message? This has the definite
>advantage of already being implemented both for the encapsulation
>protocol and for the UDP port used for key management...
Yes this would be better. A question.
The way this could work in an IPv6 BSD implementation is that when parsing
the IPv6 header and I see an ESP or AUTH Next Payload type I will know
at that point I need to send an ICMP unreachable message. If the UDP
data is encrypted or the plain text is authenticated I don't want have
to decipher it to get the UDP port. I would rather not invoke any of the
security routines or pass to the transport layer as I can know at the
ip6_input routine I am not using security for this user, unless an
application has overridden that with the API or socket option for a
particular socket (which right now I guess is implementation defined
with no standard yet).
Can we have a well known port to send the ICMP Unreachable to regardless
of the key management used? Or will they all use different ports do you
think?
Will this work for in-band keying too?
thanks
/jim