Re: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

["Bhatia, Manav (Manav)" <[e-mail]>]

Yes, this is what i had meant. I agree that i don't see a use case for this, but there is really nothing that precludes the possibility of having ESP-NULL in WESP.

Cheers, Manav

________________________________
From: QIU Ying [mailto:[e-mail]]
Sent: Thursday, July 16, 2009 1.01 PM
To: QIU Ying; Bhatia, Manav (Manav); Grewal, Ken; Yaron Sheffer; [e-mail]
Subject: Re: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

Oh, maybe I misunderstood Manav's thought.

Perhaps Manav's meaning is that WESP carries an ESP-null packet which trailer next header is happened ESP. It will cause the conflict. But I do not think this assumption were practical.

Regards
Qiu Ying



----- Original Message -----
From: QIU Ying<mailto:[e-mail]>
To: Bhatia, Manav (Manav)<mailto:[e-mail]> ; Grewal, Ken<mailto:[e-mail]> ; Yaron Sheffer<mailto:[e-mail]> ; [e-mail]<mailto:[e-mail]>
Sent: Thursday, July 16, 2009 3:11 PM
Subject: Re: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

Hi, Manav

0xFF (255) is reserved by IANA. Maybe you are correct that IANA  would never release the special number to a document. But it is risk for a long term RFC.

If I am not wrong, Ken's meaning is to set the next header as ESP if carrying an ESP packet inside it. Otherwise, still use the same value of the next header in ESP trailer. So it seems acceptable.

Regards
Qiu Ying


----- Original Message -----
From: Bhatia, Manav (Manav)<mailto:[e-mail]>
To: Grewal, Ken<mailto:[e-mail]> ; QIU Ying<mailto:[e-mail]> ; Yaron Sheffer<mailto:[e-mail]> ; [e-mail]<mailto:[e-mail]>
Sent: Thursday, July 16, 2009 2:27 PM
Subject: RE: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

We can use ESP as the next header to denote encryption being used as long as we are sure that we will never have an ESP packet inside the WESP encapsulation. In my view there is nothing that precludes that from happening, which means that we may have some corner cases where WESP may actually be carrying an ESP packet inside it. Given this, i would rather that we don't use the ESP value to denote encryption being used.

I am also not a big fan of the encryption bit as that takes away one bit from the already limited number of bits that we have at our disposal in the flags field.

Given that a packet will never carry a protocol ID of 0xFF i propose to use this value in the next-header to denote encryption being used. Would this work?

Cheers, Manav

________________________________
From: [e-mail] [mailto:[e-mail]] On Behalf Of Grewal, Ken
Sent: Wednesday, July 15, 2009 8.57 PM
To: QIU Ying; Yaron Sheffer; [e-mail]
Subject: Re: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

Qiu Ying,
Copying the value of the ESP next header to the WESP next header is useful for efficient HW parsing when using ESP-NULL.
You are correct that in the case of encrypted traffic, we can set this value to 'ESP', which could denote that the payload is encrypted.
Having said that, some people in the past have mentioned that it may be cleaner to have a dedicated bit to denote whether the payload is encrypted or using ESP-NULL.

Either way works, as long as there is a discrete, unambiguous way to denote this.

Thanks,
- Ken

________________________________
From: QIU Ying [mailto:[e-mail]]
Sent: Tuesday, July 14, 2009 7:42 PM
To: Grewal, Ken; Yaron Sheffer; [e-mail]
Subject: Re: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

Hi, Ken

Agree that Option 1 is better as it applies lesser new IANA numbers. But in this case, it seems redundancy to copy the value of Next Header field in the ESP trailer to here. How about simply setting the value as ESP here? I think it more meet the original concept of Next Header.

Maybe I am missing something

Regards
Qiu Ying

----- Original Message -----
From: Grewal, Ken<mailto:[e-mail]>
To: QIU Ying<mailto:[e-mail]> ; Yaron Sheffer<mailto:[e-mail]> ; [e-mail]<mailto:[e-mail]>
Sent: Wednesday, July 15, 2009 1:31 AM
Subject: RE: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

Thanks Qiu Ying - great observation.

We had originally proposed using a bit from the WESP flags (integrity only) for differentiating between ESP-encrypted and ESP-NULL traffic, but changed this to using a value of zero in the next header for efficient encoding, although this is overloading the meaning of next header.
With your observation, the current definition is not practical so we have the following options:


 1.  Revert back to using a bit in the flags to differentiate between encrypted / NULL traffic.
 2.  Allocate a new protocol value for the next header field to indicate encrypted data, which seems like an overkill.

As we are already asking for a new protocol value for WESP, option 1 seems to be the better choice.

Other opinions?

Thanks,
- Ken

________________________________
From: [e-mail] [mailto:[e-mail]] On Behalf Of QIU Ying
Sent: Tuesday, July 14, 2009 12:37 AM
To: QIU Ying; Yaron Sheffer; [e-mail]
Subject: Re: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

Since the zero of next header value is used for HOPOPT already, maybe applying a new value for this intention is better to avoid the confliction.

Regards
Qiu Ying

----- Original Message -----
From: QIU Ying<mailto:[e-mail]>
To: Yaron Sheffer<mailto:[e-mail]> ; [e-mail]<mailto:[e-mail]>
Sent: Tuesday, July 14, 2009 3:30 PM
Subject: Re: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

Regarding the Next Header in section 2, what will be happened if the value of Next Header is zero (i.e. IPv6 Hop-by-Hop option) and the packet is not encrypted?

Regards
Qiu Ying

----- Original Message -----
From: Yaron Sheffer<mailto:[e-mail]>
To: [e-mail]<mailto:[e-mail]>
Sent: Sunday, July 05, 2009 3:48 AM
Subject: [IPsec] WG Last Call: draft-ietf-ipsecme-traffic-visibility-05

This is the beginning of a two-week WG Last Call, which will end July 18. The target status for this document is Proposed Standard. The current document is at http://tools.ietf.org/html/draft-ietf-ipsecme-traffic-visibility-05.

If you have not read the document before now, please do so. Having fresh eyes on the document often brings up important issues. If you HAVE read it before, please note that there have been several revisions since San Francisco, so you might want to read it again (plus it's a short document). Send any comments to the list, even if they are as simple as "I read it and it seems fine".

Please clearly indicate the position of any issue in the Internet Draft, and if possible provide alternative text. Please also indicate the nature or severity of the error or correction, e.g. major technical, minor technical, nit, so that we can quickly judge the extent of problems with the document.

Thanks,
            Yaron
________________________________
_______________________________________________
IPsec mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/ipsec
Institute for Infocomm Research disclaimer: "This email is confidential and may be privileged. If you are not the intended recipient, please delete it and notify us immediately. Please do not copy or use it for any purpose, or disclose its contents to any other person. Thank you."
Institute for Infocomm Research disclaimer: "This email is confidential and may be privileged. If you are not the intended recipient, please delete it and notify us immediately. Please do not copy or use it for any purpose, or disclose its contents to any other person. Thank you."
Institute for Infocomm Research disclaimer: "This email is confidential and may be privileged. If you are not the intended recipient, please delete it and notify us immediately. Please do not copy or use it for any purpose, or disclose its contents to any other person. Thank you."

________________________________

_______________________________________________
IPsec mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/ipsec
Institute for Infocomm Research disclaimer: "This email is confidential and may be privileged. If you are not the intended recipient, please delete it and notify us immediately. Please do not copy or use it for any purpose, or disclose its contents to any other person. Thank you."