RE: issue 34 proposal

Stephane Beaulieu (stephane) writes:
> Can't both be done?  If I notice that packets are coming in using a SPI
> for which the IP/port doesn't match what I expect, can't I just process
> them anyway, and update my sadb?  There doesn't appear anything
> interoperability wise to stop you from doing this.  If you update, you
> recover NOW.  If you wait for DPD/NAT-T, it will take longer, but still
> eventually update.

For ESP packets you could do that, but for IKE packets you need
separate path test exchange if you do that, as then you cannot probe
if the path is working with IKE packet, as the probe can break the
link (it would cause traffic to move to that address pair and if that
address pair was unidirectional the connection would be lost because
of that). 

> It means more code to write (since we have to be able to handle 2
> different ways of changing NAT mappings), but it does satisfy both
> camps.

Why would you want to write more code just to cover very corner case?

We do not expect the NATs be rebooted or loosing mappings regularly,
it might happen to some people every few months or so, and some people
will probably never see that.
-- 
[email protected]