Re: SAs that carry fragments Was: Re: Some IKEv2 issues

[Tero Kivinen <kivinen@iki.fi>]

Stephen Kent writes:
> >Or just drop non-initial fragments arriving before their corresponding
> >initial fragments (or so much later that the corresponding initial
> >fragments have fallen off the cache).
> >
> >IP can lose packets.  Sometimes it's good to excercise this feature.
> 
> yes, sometimes taking advantage of this "feature" can make our lives 
> easier as designers ;-)

Yes, but as vendors shipping code, it would be quite unacceptable to
tell that sorry, any linux n.y box you have in the network cannot get
any fragmented packets through your SGW. Some linux kernel versions
used to send all fragments in reverse order, meaning that for all
fragmented packets all the other fragments than the non-first would be
dropped. 

> >In transport mode scenarios (IPv4) this doesn't apply either since the
...
> In a BITS implementation the host could have fragmented prior to 
> IPsec receiving the packet, but one would certainly expect that the 
> first fragment would arrive at the BITS first in that case.

I think you have no other way than to reassemble the packet in those
cases. The rfc2401 and rfc2401bis both say that you cannot apply IPsec
using transport mode to IPv4 packets that are fragments. I.e. if the
BITS implementation receives a fragmented packet and the SA is in
transport mode, it must first reassemble the packet, then apply IPsec
and then fragment the packet again. 
-- 
kivinen@safenet-inc.com