[saag] IPsec spec problems

[Pekka Savola <pekkas at netcore.fi>]

On Tue, 25 Apr 2006, Tero Kivinen wrote:
> So is the draft-bonica-tcp-auth is already implemented by routers
> without any extra effort then?

It is not generally implemented.

IPsec for control plane protection has been implemented (e.g., for 
OSPFv3 protection), but I'm not sure how widely.

Below is a digress on IPsec spec shortcomings..

> If it requires new implementations to support draft-bonica-tcp-auth
> then I think it would be more beneficial to fix their IPsec
> implementations to support protecting control traffic. There are
> implementations out there that can do that, there are toolkits out
> there to do that, I would guess it would be much faster to take
> existing implementation and fix that, or replace the implementation
> with one that support protecting control traffic, than to implement
> completely new protocol.

How about "fix the IPsec spec"? :-)

I actually read RFC 4301 for the first time on a plane (for the 
record, I had not read any IPsec RFCs previously).  The situation was 
much worse than I thought.  One could say that the IPsec spec is not 
optimized for control plane protection with all of its crazy talk 
about protected/unprotected interfaces, non-native implementations, 
etc.

My perception is that IPsec spec tries to address too many problems 
(minimal firewall policing through SPDs; control traffic protection; 
VPN protection), and the result is too complex that it isn't useful 
for anything except VPNs, and even that's pretty complicated due to 
all the baggage.

I was also boggled by the notion that an IPsec implementation at a 
router would have to inspect ALL packets it forwards (whether IPsec or 
not) against SPD.  That means IPsec would need to be implemented on 
all the linecards even if all you wanted is to protect the control 
plane.

Saner alternative: whether to look for SPDs for particular packet 
should be keyed off from the routing table entries. That way IPsec is 
only consulted when it needs to be consulted.

--
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings