[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: issues with IKE that need resolution
> What is the "proper" behaviour of the IPsec implementation upon receiving an
> IPsec-transformed packet for which there is no IPsec SA, but there is an SPD
> entry and/or IKE SA for the IP address of the sender...
> - Should the packet be discarded?
> - Should it trigger MM (or QM) initiation? - may be good for some recovery
> cases , but bad for denial-of-service or other attacks.
> - Should the sending end be notified?
I think the preferred answer is "yes". That is, the architecture
document's basic recommendation "drop packet and report this" is right,
but "report this" may well mean that other software hears about it and
initiates action (negotiation or notification) depending on local policy.
That said, there may be some issues here of interest to IPSECond. For
example, if notification is desirable, how is it done? Do we need a new
ICMP destination-unreachable subcode that means "SA Unreachable"? There
is "Protocol Unreachable", but that's not really right.
Henry Spencer
henry@spsystems.net
(henry@zoo.toronto.edu)
References: