Subject: [Ipsec] rfc2401bis-06: why ESP and AH SPIs are not considered as (potential) selectors?

From: Pekka Nikander <[email-masked]>
Date: Fri, 29 Apr 2005 15:43:35 +0300

Folks,

This has probably been discussed in the death before, but I was
not able to find the answer in the archives.  Consequently, I'd
appreciate if someone would enlighten me, perhaps by pointing out
to the relevant thread of previous discussion.  Please note too
that this question is more due to academic/architectural curiosity
rather than that I would be implementing this.

Anyway, while reading rfc2401bis-06 with fresh eyes, I was left
wondering why aren't the AH and ESP SPI fields considered as
selectors, similar to TCP/UDP ports, ICMP types/codes, and MH
message types?  Such support looks trivial to me (but perhaps
I am missing something), and would make supporting the (admittedly
dubious) nested SAs much easier.  In other words, if my 2401bis
implementation would route back outgoing IPsec packets to the protected
side and then again out, then how do I select the right enclosing
SA for it unless I can use the SPI?  Likewise, if I receive an
incoming packet that contains an AH or ESP header after IPsec
processing, how to I enforce anything on the SPIs before passing
it again out for nested processing?

So, what is the reason for the current state?

--Pekka Nikander

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec