Subject: IPsecAction granularity again

From: [email-masked]
Date: Wed, 14 Feb 2001 12:56:26 -0600

Hi,

I think the ietf IPsec information model uses the granularity in a different
way and that is the way I like. Correct me Jamie if I mis-understand the
intention. The granularity is used to indicate the following function
specified in Section 4.4.1. RFC2401:

"For each selector, the policy entry specifies how
   to derive the corresponding values for a new Security Association
   Database (SAD, see Section 4.4.3) entry from those in the SPD and the
   packet (Note that at present, ranges are only supported for IP
   addresses; but wildcarding can be expressed for all selectors):

           a. use the value in the packet itself -- This will limit use
              of the SA to those packets which have this packet's value
              for the selector even if the selector for the policy entry
              has a range of allowed values or a wildcard for this
              selector.
           b. use the value associated with the policy entry -- If this
              were to be just a single value, then there would be no
              difference between (b) and (a).  However, if the allowed
              values for the selector are a range (for IP addresses) or
              wildcard, then in the case of a range,(b) would enable use
              of the SA by any packet with a selector value within the
              range not just by packets with the selector value of the
              packet that triggered the creation of the SA.  In the case
              of a wildcard, (b) would allow use of the SA by packets
              with any value for this selector."

In the ietf IPsec info model, the granularity is in the filter list and has
two choices: narrow and wide that correspond to (a) and (b).

Man Li
Nokia 
5 Wayside Road, Burlington, MA 01803
[email-masked]
phone 1-781-993-3923
GSM 1-781-492-2850 

-----Original Message-----
From: ext Lee Rafalow [mailto:[email-masked]]
Sent: Wednesday, January 10, 2001 10:46 AM
To: [email-masked]
Cc: tm-ipsec
Subject: Re: IPsecAction granularity

Ricky, Here's the reasoning for its location in the model.

The conditions (filters) are used to determine which rule applies to a
packet (for which there's currently no SA).  As with other action
properties, the granularity is used to determine how to negotiate and build
the SA.  In this case, the granularity is used (in conjunction with the
filters) to determine the selector for a given IPsec SA.

So, the same rule can be evaluated (i.e., filter) and yield different
selectors.

IHTH.  Lee

----- Original Message -----
From: "Ricky Charlet" <[email-masked]>
To: ".ipsec-policy" <[email-masked]>
Sent: Tuesday, January 09, 2001 7:30 PM
Subject: ICIM: IPsecAction granularity

> Howdy,
>
> I dislike the granularity property of IPsecActions. It purports to be
> controlling whether subnet mask, or protocol, or port fields should be
> wild-carded in SA Proposals. And this makes the granularity property
> part of a selector. I think any property of a selector should be over on
> the Filter Entry side and not in an IPsecAction.
>
>
> --
>   Ricky Charlet   : Redcreek Communications   : usa (510) 795-6903

---

From: "Jason, Jamie" <[email-masked]>
Date: Fri, 16 Feb 2001 16:41:41 -0800

I agree with Lee's argument (pasted below) for inclusion in the action.  In
the model, the condition is used for matching to determine if rules apply.
Creating the selector that will be given to the negotiating peer, in my
opinion, is part of the application the negotiation action.

<Lee Rafalow>
> filters) to determine the selector for a given IPsec SA.
</Lee Rafalow>

As for the contention that putting the granularity in the action is
confusing, I personally find it clearer to keep it with the action
information.

Jamie

> From: Ricky Charlet [mailto:[email-masked]]
> Sent: Friday, February 16, 2001 3:01 PM
> Cc: [email-masked]
> Subject: Re: IPsecAction granularity again
> 
> 
> Howdy,
> 
> 	I still content that granularity does not belong over 
> in the Action
> side of the house. It is confusing. Someone should be able to justify
> the value of putting a part of the selector definition over with the
> actions or we should move it back into the conditions.
> 
> --
> Ricky Charlet
>