Re: SAs that carry fragments Was: Re: Some IKEv2 issues

[Markku Savela <msa@burp.tkv.asdf.org>]

Answering to my own mail, and bringing the issue back to topic...

> The H must now be prepared to handle all combinations EQUALLY with
> the same dataflow
> 
>   - full packets protected with IPSEC
>   - full IPSEC:ed packets fragmented
>   - fragments with IPSEC applied individually to them

My suggestion is:

  IPSEC SA negotiation is based on full packet, and the same SA
  is applied to both full packet and fragments.

This is logical, because fragmentation, whether it happens or not,
should not in any way affect the security of the protected connection.

Thus, it is no concern of IKEv2, whether IPSEC is applied to fragments
or not. It should be left to the IPSEC implementation how they deal
with the fragment issue. It is not an issue for key management.

For example, if your SG does not support (or does not currently have)
port selectors in policy, you can just process packets individually,
whether they are whole or fragments.

If your SG wants to support port selector, it must at minimum buffer
the fragments until the first is received. And if it prepares to do
this, it could also assemble the packet in full and not apply IPSEC
to fragments at all.