Re: [IPsec] WESP and reliability

[Yaron Sheffer <[e-mail]>]

Hi Ran,

I find the situation quite amusing, with fleeting little packets, timid 
engineers, and valiant standards people playing in this drama.

But seriously, could it be that you're confusing the (AFAIK) fully 
deterministic WESP (RFC 5840) with the non-deterministic heuristic 
method (RFC 5879)? Or else is there anything missing in WESP that we 
should pay attention to, for example, maybe it doesn't support specific 
IV or ICV sizes that those non IETF-goers are using?

Thanks,
Yaron

On 01/04/2012 08:59 PM, RJ Atkinson wrote:
> On 04  Jan 2012, at 13:46 , Paul Hoffman wrote:
>
>> On Jan 4, 2012, at 10:37 AM, RJ Atkinson wrote:
>>> Neither WESP nor the other document provide a 100% reliable way
>>> to parse-into/parse-past/deep-inspect ESP packets.  One might
>>> wish otherwise, but the reality is that there is no 100%
>>> reliable method today.
>> Can you give an example where WESP (a protocol that was
>> done in this WG) is not 100% reliable for parse-into
>> or parse-past? If we need to change the protocol, we should.
> Such packets have been encountered by prototype
> implementations in at least one firewall.  I will
> certainly encourage those folks to share a sample
> packet here, but they don't usually show up at IETF
> and can be very shy.
>
> I think WESP was a valiant try, and it seems to work
> most of the time.  It is just sad that the result
> just doesn't work in all cases.
>
> An entirely separate issue is that WESP is not generally
> available yet.  One hopes that WESP support will become
> available soon, but that's not generally true now.
>
> Yours,
>
> Ran
>
> _______________________________________________
> IPsec mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/ipsec