[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: fast re-keying
>Can we have a well known port to send the ICMP Unreachable to regardless
>of the key management used? Or will they all use different ports do you
>think?
In IP4 (don't know IPv6), ICMP Unreachables don't have "port"
numbers. ICMP messages do include the IP header of the offending
packet, plus 8 bytes of the transport header. This is sufficient in
ESP for the original sender to identify the security association in
question and to take appropriate action, such as possibly clearing
the security association and creating a new one.
The denial-of-service opportunities are apparent here, so this needs
some more thought. Yet we need a way to clear out half-open security
associations to recover from system crashes.
Phil