Subject: [Ipsec] SPD Checks for IPsec Inbound Processing

From: "Narayanan, Vidya" <[email-masked]>
Date: Sat, 14 Oct 2006 10:37:29 -0700

Hi,
RFC2401 had SPD checks for inbound packet processing after processing
with a matching SA, while RFC4301 only advocates SPD checks for bypassed
or discarded inbound packets. Can anyone throw some light on why the SPD
checks on packets with a matching SA were not preserved? 

Thanks,
Vidya

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Stephen Kent <[email-masked]>
Date: Mon, 16 Oct 2006 11:31:49 -0400

>checks on packets with a matching SA were not preserved?

We now require the access control checking for inbound packets to 
make use of the SAD, consistent with the new processing model defined 
in 4301. (See Figure 3 on Page 60), and step 4 of the processing 
description on page 62.)

Because the new model assumes use of decorrelated SPD entries, it is 
now "safe" (and much easier) to perform the check against the SAD 
entry, vs. having to search the SPD.

Also, 4301 does not "advocate" SPD-I (cache) checks for bypassed and 
discarded packets, it mandates them.

Steve

---

From: "Narayanan, Vidya" <[email-masked]>
Date: Tue, 17 Oct 2006 22:15:02 -0700

Thanks, Steve. Apologies for missing the relevant text. 

Regards,
Vidya

> -----Original Message-----
> From: Stephen Kent [mailto:[email-masked]] 
> Sent: Monday, October 16, 2006 8:32 AM
> To: Narayanan, Vidya
> Cc: [email-masked]
> Subject: Re: [Ipsec] SPD Checks for IPsec Inbound Processing
> 
> >with a matching SA, while RFC4301 only advocates SPD checks for 
> >bypassed or discarded inbound packets. Can anyone throw some 
> light on 
> >why the SPD checks on packets with a matching SA were not preserved?
> >
> >Thanks,
> >Vidya
> 
> We now require the access control checking for inbound 
> packets to make use of the SAD, consistent with the new 
> processing model defined in 4301. (See Figure 3 on Page 60), 
> and step 4 of the processing description on page 62.)
> 
> Because the new model assumes use of decorrelated SPD 
> entries, it is now "safe" (and much easier) to perform the 
> check against the SAD entry, vs. having to search the SPD.
> 
> Also, 4301 does not "advocate" SPD-I (cache) checks for 
> bypassed and discarded packets, it mandates them.
> 
> Steve
>