Re: [IPsec] Some thoughts regarging draft-hopps-ipsecme-iptfs-01

[Steffen Klassert <[e-mail]>]

Hi Valery,

On Mon, Dec 02, 2019 at 11:28:16AM +0300, Valery Smyslov wrote:
> Hi Steffen,
> 
> > >     It seems to me that it can be done pretty easy by linking the reassembly logic
> > >     with replay protection window.
> > 
> > While it looks like doing the reassembling based on ESP sequence numbers
> > might be an easy approach, it could be also dangerous.
> > 
> > Consider a system that encapsulates two flows on different cpus
> > with the same SA. This system can TX packets in the following
> > order:
> > 
> > TX cpu0 inner flow0 SA0:
> > 
> >       Offset: 0                               Offset: 100
> >       [ ESP1  (1500) ]                        [ ESP3  (1500) ]
> >       [--800--][--800-                        -][-----1400---]
> > 
> > --------------------------------------------------------------------------------------
> > TX cpu1 inner flow1 SA0:
> >                           Offset: 0                                Offset: 100
> >                           [ ESP2  (1500) ]                        [ ESP4  (1500) ]
> >                           [--800--][--800-                        -][----1400----]
> > 
> > 
> > On the receive side, it is not that clear how to reassemble the fragments
> > from ESP3 and ESP4 into the fragments from ESP1 and ESP2. Maybe some
> > packet ID in the IP-TFS header could help to identify related fragments.
> 
> I'm probably missing something here, but I think that sending side assigns 
> every outgoing IP packet to some SA. Then the packet is added to the ESP message 
> (that may already contain previous packets). If the packet cannot fit into the
> left space, it is split and the rest of the packet is sent in the next
> ESP message of the same SA.

All packets are sent over the same SA, but on different cpus. This means
that the 'rest' might not be in the next ESP message. The other cpu
could have TXed some ESP packets before, it is a race.

In this example, flow0 is encapsulated on cpu0, flow1 is encapsulated on cpu1,
both on the same SA.

ESP1 contains flow0, but ESP2 contains flow1. The 'rest' from flow0 is
encapsulated in ESP3, the 'rest' from flow1 is encapsulated in ESP4. 
So I think it is not clear how to do a correct reassembling here.

Steffen