Subject: [IPsec] IPv6 Routing Header and IKEv2

From: Chinh Nguyen <[email-masked]>
Date: Fri, 14 Sep 2007 11:27:20 -0400

If a type 0 Routing Header is present, then from IPv6's perspective, the 
final destination address is the last element in the Routing Header and 
not in the destination address of the IPv6 header (if you are not the 
final recipient).

If I'm selecting an SA to use by matching this packet's values versus my 
selectors, should I use the destination address of the IPv6 header or 
the final element of the Routing Header? For simplicity, I am (a local 
application is) the originator of the packet and not an intermediate node.

Regards,

Chinh
--
http://www.certicom.com

_______________________________________________
IPsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: "Vishwas Manral" <[email-masked]>
Date: Sun, 16 Sep 2007 10:37:42 +1000

Hi Chinh,

I guess you should look at the address in the Destination address of
the IPv6 address and not any address in the IPv6 Routing Header.
However for any firewalling we can check all remaining addresses.

On another note please read the draft
http://www.ietf.org/internet-drafts/draft-manral-ipv6-rh4-00.txt ,
which we are trying to make the new standard Routing Header for all
purposes. The RH0 is on the verge of being removed.

Thanks,
Vishwas

---

From: Francis Dupont <[email-masked]>
Date: Sun, 16 Sep 2007 22:24:35 +0200

In your previous mail you wrote:

   If I'm selecting an SA to use by matching this packet's values versus my 
   selectors, should I use the destination address of the IPv6 header or 
   the final element of the Routing Header?

   For simplicity, I am (a local application is) the originator of the
   packet and not an intermediate node.
   
=> in fact without this "for simplicity" the answer was simple: just ignore
the internal routing header and use the address currently in the IPv6
header...
 In the originator and final nodes, it is possible to deal with the "real"
address, i.e., the final element of the Routing Header, as it is done
for the type 2 Routing Header. IMHO it depends of the intention when
the packet is built, and as the routing header is more external (then
the IPsec one) and the situation is clearly an end-to-end one, I'd like
to idea to use the "real" address.

Regards

[email-masked]

---

From: Chinh Nguyen <[email-masked]>
Date: Tue, 18 Sep 2007 10:48:52 -0400

I've only skimmed through the new draft. Is RH4 simply RH0 in format but 
with some functional restrictions?

Back to issue regarding which destination address to use. Suppose I've 
established a transport mode (node to node) SA with ::1.2.3.4. So my SPD 
might look like this:
1. src = *, dst = ::1.2.3.4, proto=*, port=*, action=ESP/transport
2. src = *, dst = *, proto=*, port=*, action=none/bypass

If I just send an IPv6 packet without RH0 to ::1.2.3.4, then rule 1 applies.
packet = (src = me, dst = ::1.2.3.4) -> ESP

If I send an IPv6 packet with RH0 to ::1.2.3.4:
packet = (src = me, dst = ::1.2.3.1, RH0=::1.2.3.2,::1.2.3.3,::1.2.3.4)

If I use dst then rule 2 applies: no ESP. But since the ultimate 
destination is ::1.2.3.4, shouldn't I use the final element of RH0 as my 
dst (because ESP is the action that I want)?

Regards,

Chinh
--
http://www.certicom.com