Subject: more ipsp-config-policy-mode-02 Q's/comments

From: Michael Baer <[email-masked]>
Date: 27 Jun 2001 17:38:04 -0700

Looking over the DoActionLogging and DoPacketLogging properties in the
SAAction class, I think the description for DoActionLogging should be
re-phrased from 'when the action is performed' to something like 'when
an attempt is made to establish the SA'. 

I believe this more explicitly what is really meant anyway.  My
understanding of the IPsec spec, RFC 2401, is that the action being
performed may not just be the creation of the SA, but could also be
the routing of a packet through an existing SA (although an
implementation might handle this differently for efficiency). Assuming
that the desired logging for DoActionLogging is just for the attempted
creation of the SA, the re-phrase would be clearer.

-- 
Michael Baer
[email-masked]
NAI Labs

---

From: Eric Vyncke <[email-masked]>
Date: Thu, 28 Jun 2001 14:32:08 +0200

Michael,

Some comments:

1) the DoActionLogging controls whether a single log event is generated 
(either upon success or failure). If I understood correctly your proposal, 
at least two log events would be generated: one when starting/attempting 
the action and another one upon success or failure. While I do see benefits 
in your proposal, I wonder whether it is really useful.

2) the point about generating a log event when a packet is forwarded 
through an IPSec, actually this is the purpose of the DoPacketLogging.

Comments are of course welcome

Regards

-eric

---

From: Michael Baer <[email-masked]>
Date: 28 Jun 2001 09:16:06 -0700

Eric> Michael, Some comments:

    Eric> 1) the DoActionLogging controls whether a single log event
    Eric>    is
    Eric>    generated (either upon success or failure). If I understood
    Eric>    correctly your proposal, at least two log events would be
    Eric>    generated: one when starting/attempting the action and another one
    Eric>    upon success or failure. While I do see benefits in your proposal,
    Eric>    I wonder whether it is really useful.

No, that's not quite what I meant. I'm not proposing adding more
logging events. I don't think I'm actually proposing changing the
intended meaning of DoActionLogging at all, just re-wording the
description to make the meaning clearer. The description of
DoActionLogging in the 02 draft is to log 'when an action is
performed'. But in my understanding of the IPsec RFC 2401, an action
could be either routing through an existing SA or attempting SA
creation. (Although some implementations may always have the action be
SA creation). So if you logged 'when the action is performed' and that
action was to route to an existing SA, DoActionLogging and
DoPacketLogging would be redundant. I don't think this is the intended
meaning of DoActionLogging though.

In order to make it more explicit, I'm suggesting changing the wording
in the description of DoActionLogging from 'when an action is
performed' to something like, ' when an attempt is made to establish
the SA', which I think is what is really meant by DoActionLogging.

Hope I was clearer

Mike

-- 
Michael Baer
[email-masked]
NAI Labs