IETF Logo Mail Archive

Re: [IPsec] New Version Notification for draft-smyslov-ipsecme-tcp-guidelines-00.txt

"Valery Smyslov" <smyslov.ietf@gmail.com> Fri, 07 September 2018 14:19 UTC

Return-Path: <smyslov.ietf@gmail.com>
X-Original-To: ipsec@ietfa.amsl.com
Delivered-To: ipsec@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DA5CE128766; Fri, 7 Sep 2018 07:19:14 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.5
X-Spam-Level:
X-Spam-Status: No, score=-0.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_SORBS_WEB=1.5, SPF_PASS=-0.001] autolearn=no autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IQaFzLqfHN2D; Fri, 7 Sep 2018 07:19:12 -0700 (PDT)
Received: from mail-lf1-x12d.google.com (mail-lf1-x12d.google.com [IPv6:2a00:1450:4864:20::12d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0EF4D126CB6; Fri, 7 Sep 2018 07:19:12 -0700 (PDT)
Received: by mail-lf1-x12d.google.com with SMTP id e23-v6so12141886lfc.13; Fri, 07 Sep 2018 07:19:11 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:references:in-reply-to:subject:date:message-id :mime-version:content-transfer-encoding:thread-index :content-language; bh=o5isiscANTwtQM6+gsWYwOt3FX+8ARHGYgWErVtlWd0=; b=HMXf1nnomT5HOMhFULQpejgW+ya+8tqM9LCv5H1zIF9uOh2xcvS0mM8nh3u0dvqLe9 kHrQ1XFbZhNh+ERc6WmYTAJa8y8fOgIhLQ0BAz0+beTup8ySNa+NDnvImQcuE/kIPIi8 FqkVlp4PMi3V0iz0zYWc7XU6Br3r0s7aiq1/4zo7R8s9lBVwOxZyVPJCSpt4CNz0I/5z 5bZYk4tzp3fBcUcOaauQrDQX2Jzn23eI0fr6fR86l9zNmPwrNPpykON2fzVn8U9dAzB+ dcaRRY3NtP5bxR6vuoFZ7TA6LV5n2EF8b/U7v+74LdUW8klRXXspIn8V2AaDIb93PCqY rc8w==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:references:in-reply-to:subject:date :message-id:mime-version:content-transfer-encoding:thread-index :content-language; bh=o5isiscANTwtQM6+gsWYwOt3FX+8ARHGYgWErVtlWd0=; b=Z1gza+Uz2racOPiGlrB67pHR6b5y4kX8Qc6RU3YFzinK/rLWQKSkL+di5k0Nz2gYTG 5SOe8scPDqCNM+rnPGdAuzX2h+nuUqU6T15JUgWvt+TvdU0zHPzcFSlAQ9i0A92X9hVP jgdzfQpeVd0L1sSqMJjTAimWABBhY/6NJKKKJK4GM+d3PLkdZBhZg4gy7Se4q2H6sWfI 657AvZxb6e1Y2TsxjI0ZOodDJEavlhWuQuydG8AqXh/R8SgS4IZT9sJFaXxfYIMAKQLT UmaEhwHHpSm9VP6nCqXcl/uoj3//jeI5hpmhaZn7SocsFIkyFrsPCXdfbw7Xro0Um1/7 ATFA==
X-Gm-Message-State: APzg51DpZ/Pv6wsaljHYfjpgVVujAN70WS89biZPdDvi0iXLhPhLfzLG 2mw4NVCRx5vLXE8M0TMVkJkzfrQU
X-Google-Smtp-Source: ANB0Vdbrci5vfU27mUWl/rTc6Zc3v509YUNVpoz4gBK4yjSlQget4FFAGRMkrmnsRKP1kRRh0Bg9Lw==
X-Received: by 2002:a19:7118:: with SMTP id m24-v6mr5202569lfc.6.1536329950038; Fri, 07 Sep 2018 07:19:10 -0700 (PDT)
Received: from buildpc ([82.138.51.4]) by smtp.gmail.com with ESMTPSA id y16-v6sm1322585lje.30.2018.09.07.07.19.08 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Fri, 07 Sep 2018 07:19:09 -0700 (PDT)
From: Valery Smyslov <smyslov.ietf@gmail.com>
To: 'Paul Wouters' <paul@nohats.ca>, 'Valery Smyslov' <svan@elvis.ru>
Cc: 'IPsecME WG' <ipsec@ietf.org>, draft-ietf-ipsecme-tcp-encaps@ietf.org
References: <153632409170.28963.3858352353321879475.idtracker@ietfa.amsl.com> <058901d446ad$fd78b5a0$f86a20e0$@elvis.ru> <alpine.LRH.2.21.1809070957170.20905@bofh.nohats.ca>
In-Reply-To: <alpine.LRH.2.21.1809070957170.20905@bofh.nohats.ca>
Date: Fri, 07 Sep 2018 17:18:58 +0300
Message-ID: <059d01d446b5$b85610a0$290231e0$@gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Outlook 14.0
Thread-Index: AQJcXB691A5/IRakRUGL31dObam09AIk+U4iAZLUdFujtvI14A==
Content-Language: ru
Archived-At: <https://mailarchive.ietf.org/arch/msg/ipsec/4C_p5mRLUvtWBOQlWYDF20ma49k>
Subject: Re: [IPsec] New Version Notification for draft-smyslov-ipsecme-tcp-guidelines-00.txt
X-BeenThere: ipsec@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Discussion of IPsec protocols <ipsec.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ipsec>, <mailto:ipsec-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ipsec/>
List-Post: <mailto:ipsec@ietf.org>
List-Help: <mailto:ipsec-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ipsec>, <mailto:ipsec-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 07 Sep 2018 14:19:15 -0000

Hi Paul,

> > I've posted a draft with clarifications and implementation guidelines
> > for RFC8229. These clarifications and recommendations are based
> > on experience of implementing TCP encapsulation and testing it in
> > various IKEv2 scenarios.
> >
> > Feedback of any sort is highly appreciated.
> 
> I would cut a lot of the introduction / abstract and come straight to
> the point. Simiarly, further one not provide as much details and just
> come to the point faster.

I tried to be pedant :-) 

> I don't see any consideration in the document about deployments that
> use a TCP proxy in front of the IKE daemon. In those scenarios, the
> daemon might not even know TCP is used or the proxy code is written in
> a way that only minimal changes to the IKEv2 core are needed. 

Is it ever possible? My experience shows that adding TCP encapsulation
influences IKEv2 code pretty highly.

> So a lot of decisions you specify, such as not sending retransmits, might not
> be possible for those kind of implementations, and so this document
> dictating them for make interop harder, not easier.

Why? Can you clarify in which cases interop will be harder?

> As this also touches on message IDs, and I think we might have some
> msgid deadlocks even in the UDP only case, perhaps a clarifying

If you mean MOBIKE, I agree with you that deadlocks seem to be possible.

> document could add some non-TCP items as well? And the TCP part could
> be part of the new clarification draft ?

Not sure it's worth to mix them. 

Regards,
Valery.

> 
> Paul
> 
> _______________________________________________
> IPsec mailing list
> IPsec@ietf.org
> https://www.ietf.org/mailman/listinfo/ipsec

v2.23.0 | Report a Bug | By Email