[IPsec] Use of SPD in verifying incoming packets
Joy Latten <latten@austin.ibm.com> Fri, 09 November 2007 18:22 UTC
Return-path: <ipsec-bounces@ietf.org>
Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IqYUl-0008Rq-O7; Fri, 09 Nov 2007 13:22:19 -0500
Received: from ipsec by megatron.ietf.org with local (Exim 4.43) id 1IqYUk-0008If-OR for ipsec-confirm+ok@megatron.ietf.org; Fri, 09 Nov 2007 13:22:18 -0500
Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IqYUk-0008H5-CJ for ipsec@ietf.org; Fri, 09 Nov 2007 13:22:18 -0500
Received: from e5.ny.us.ibm.com ([32.97.182.145]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IqYUj-0005ub-Vs for ipsec@ietf.org; Fri, 09 Nov 2007 13:22:18 -0500
Received: from d01relay04.pok.ibm.com (d01relay04.pok.ibm.com [9.56.227.236]) by e5.ny.us.ibm.com (8.13.8/8.13.8) with ESMTP id lA9IMHQx006214 for <ipsec@ietf.org>; Fri, 9 Nov 2007 13:22:17 -0500
Received: from d01av01.pok.ibm.com (d01av01.pok.ibm.com [9.56.224.215]) by d01relay04.pok.ibm.com (8.13.8/8.13.8/NCO v8.5) with ESMTP id lA9IMGfL129790 for <ipsec@ietf.org>; Fri, 9 Nov 2007 13:22:16 -0500
Received: from d01av01.pok.ibm.com (loopback [127.0.0.1]) by d01av01.pok.ibm.com (8.12.11.20060308/8.13.3) with ESMTP id lA9IMGi8015199 for <ipsec@ietf.org>; Fri, 9 Nov 2007 13:22:16 -0500
Received: from austin.ibm.com (netmail2.austin.ibm.com [9.41.248.176]) by d01av01.pok.ibm.com (8.12.11.20060308/8.12.11) with ESMTP id lA9IMGBB015175 for <ipsec@ietf.org>; Fri, 9 Nov 2007 13:22:16 -0500
Received: from faith.austin.ibm.com (faith.austin.ibm.com [9.53.40.35]) by austin.ibm.com (8.13.8/8.12.10) with ESMTP id lA9IMCDP043148 for <ipsec@ietf.org>; Fri, 9 Nov 2007 12:22:16 -0600
Received: from faith.austin.ibm.com (localhost.localdomain [127.0.0.1]) by faith.austin.ibm.com (8.13.4/8.12.8) with ESMTP id lA9IHGfw012985 for <ipsec@ietf.org>; Fri, 9 Nov 2007 12:17:16 -0600
Received: (from jml@localhost) by faith.austin.ibm.com (8.13.4/8.13.4/Submit) id lA9IHCE9012984 for ipsec@ietf.org; Fri, 9 Nov 2007 12:17:12 -0600
X-Authentication-Warning: faith.austin.ibm.com: jml set sender to latten@austin.ibm.com using -f
From: Joy Latten <latten@austin.ibm.com>
To: ipsec@ietf.org
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
Date: Fri, 09 Nov 2007 12:17:12 -0600
Message-Id: <1194632232.2477.636.camel@faith.austin.ibm.com>
Mime-Version: 1.0
X-Mailer: Evolution 2.2.3 (2.2.3-2.fc4)
X-Spam-Score: 0.0 (/)
X-Scan-Signature: 798b2e660f1819ae38035ac1d8d5e3ab
Subject: [IPsec] Use of SPD in verifying incoming packets
X-BeenThere: ipsec@ietf.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Discussion of IPsec protocols <ipsec.ietf.org>
List-Unsubscribe: <https://www1.ietf.org/mailman/listinfo/ipsec>, <mailto:ipsec-request@ietf.org?subject=unsubscribe>
List-Post: <mailto:ipsec@ietf.org>
List-Help: <mailto:ipsec-request@ietf.org?subject=help>
List-Subscribe: <https://www1.ietf.org/mailman/listinfo/ipsec>, <mailto:ipsec-request@ietf.org?subject=subscribe>
Errors-To: ipsec-bounces@ietf.org
RFC 4301 Section 5.2 describes processing inbound IP traffic. After applying AH or ESP processing, the packet is matched against the selectors of SA used to verify appropriate SA was used. Then handed up to transport model, forwarded, etc.. There is no mention of SPD needing to be consulted also for this verification. RFC's 2401 description of inbound processing found in section 5.2.1 included finding an incoming policy in SPD that matched the packet as part of verification process. In rfc 4301 in section 13 describing differences from 2401, I did not see anything stating this difference. Thus I am not sure if I am interpreting correctly and would like some clarification so I'll know if I need to modify existing implementation to comply? regards, Joy _______________________________________________ IPsec mailing list IPsec@ietf.org https://www1.ietf.org/mailman/listinfo/ipsec
- [IPsec] Use of SPD in verifying incoming packets Joy Latten
- Re: [IPsec] Use of SPD in verifying incoming pack… Dan McDonald
- Re: [IPsec] Use of SPD in verifying incoming pack… Joy Latten
- Re: [IPsec] Use of SPD in verifying incoming pack… Stephen Kent
- Re: [IPsec] Use of SPD in verifying incoming pack… Joy Latten
- RE: [IPsec] Use of SPD in verifying incoming pack… Inger.Bohlbro
- RE: [IPsec] Use of SPD in verifying incoming pack… Stephen Kent