Subject: RE: [Ipsec] ICMP and MH TSs for IKEv2

From: [email-masked]
Date: Tue, 13 Sep 2005 09:11:51 +0300

Markku Savela wrote:
> I fail to see how this trickery of putting ICMP/MH type/code
> into remote and/or local port selectors SPD relates to
> controlling whether such traffic is allowed only in, out or
> both ways?
> 
> Doesn't seem to be needed at all (at least I don't). If you
> want to allow only inbound ICMP of specific type, you just
> write a selector that specifies this type code and has
> destination address that matches inbound. Same logic for
> outbound.

Yes, you don't need this if you have a 2401-style SPD with
separate entries for inbound and outbound traffic (or separate
SPDs for inbound and outbound). But in 2401bis a single SPD entry
covers both inbound and outbound (that's why it has "local/remote
address/port" instead of "source/destination address/port").

> Seems to derive from some specific implementation. Specifying
> asymmetric SPD for specific ICMP type is very simple in my
> implementation, just writing a selector logically as
>
>   "outbound proto=ICMP type=X"
>
> I don't think 2401bis needs to tell how to impelemnt this
> internally.

Well, both 2401 and 2401bis stress the SAD/SPD/PAD model is only
conceptual; the data structures in an actual implementation don't
have to resemble it if you don't want to...

Best regards,
Pasi

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Markku Savela <[email-masked]>
Date: Tue, 13 Sep 2005 10:11:35 +0300

> From: <[email-masked]>
> Markku Savela wrote:

I have always had the local/remote notation in SPD even with 2401. I
definitely don't need separate SPD's for inbound and outbound, unless
you explicitly want to have asymmetric policy.

The inbound/outbound status is a property of a packet. You need to
know this to choose how to map packets src/dst into local/remote.

One can see that the suggested trickery with type/code is bogus, or at
least illogical, by just condidering the protocol selector. Surely,
you should be able to specify a policy selector for a specific
protocol, that applies only to outbound or inbound? But, I don't see
the equivalent hack for the protocol field in the specification.

Note, I fully agree with the idea of packing the type/code into port
selector. I have no problem with that. I just think, as I suggested,
that the value should always be in both remote and local selector
(just like the protocol value is). This is totally unrelated with the
asymmetric policy issue, with which I have never had any problems.

Finally, I think 2401 was (and is) great work. It only needed little
clarifications. The new draft goes way too far into implementation
details, IMHO. However, I do like

- PFP flags
- TS in SA