Re: [dhcwg] DHCP hackathon in Prague: SeDHCPv6

[Ted Lemon <[e-mail]>]

On Jun 7, 2017, at 5:58 PM, Francis Dupont <[e-mail]> wrote:
> => the theory of IPsec operations is very simple: you have two databases:
> - the Security Association DataBase
> - the Security Policy Database.
> When you have a packet you see in the SPD what to do. If the policy is
> to do some IPsec processing on the packet you look for the parameters
> in the SADB and if there is no SA when there should be one then you ask
> IKE to create one (in fact a pair).
> So the configuration consists into populating the SPD (e.g. by setkey)
> and to say to IKE what to do (define peers, credentials, a zillion of
> options).

Right.  That's what I mean.   The encrypted payload is going to the host where the relay agent is running, which doesn't have the key to decrypt the payload.   And so the packet is never delivered to the relay agent, and hence never forwarded to the DHCP server.