0001 .. SPDX-License-Identifier: GPL-2.0
0002
0003 =====
0004 IPsec
0005 =====
0006
0007
0008 Here documents known IPsec corner cases which need to be keep in mind when
0009 deploy various IPsec configuration in real world production environment.
0010
0011 1. IPcomp:
0012 Small IP packet won't get compressed at sender, and failed on
0013 policy check on receiver.
0014
0015 Quote from RFC3173::
0016
0017 2.2. Non-Expansion Policy
0018
0019 If the total size of a compressed payload and the IPComp header, as
0020 defined in section 3, is not smaller than the size of the original
0021 payload, the IP datagram MUST be sent in the original non-compressed
0022 form. To clarify: If an IP datagram is sent non-compressed, no
0023
0024 IPComp header is added to the datagram. This policy ensures saving
0025 the decompression processing cycles and avoiding incurring IP
0026 datagram fragmentation when the expanded datagram is larger than the
0027 MTU.
0028
0029 Small IP datagrams are likely to expand as a result of compression.
0030 Therefore, a numeric threshold should be applied before compression,
0031 where IP datagrams of size smaller than the threshold are sent in the
0032 original form without attempting compression. The numeric threshold
0033 is implementation dependent.
0034
0035 Current IPComp implementation is indeed by the book, while as in practice
0036 when sending non-compressed packet to the peer (whether or not packet len
0037 is smaller than the threshold or the compressed len is larger than original
0038 packet len), the packet is dropped when checking the policy as this packet
0039 matches the selector but not coming from any XFRM layer, i.e., with no
0040 security path. Such naked packet will not eventually make it to upper layer.
0041 The result is much more wired to the user when ping peer with different
0042 payload length.
0043
0044 One workaround is try to set "level use" for each policy if user observed
0045 above scenario. The consequence of doing so is small packet(uncompressed)
0046 will skip policy checking on receiver side.
