Re: [Softwires] WG last call on the security document

When I was talking about IPsec transport mode NAT-T with some other
people (i.e. what to say about transport mode and NAT-T in the
ikev2bis), we noticed another problem with the current PAD / SPD
entries. The problem is that if the client is coming from behind NAT
we cannot know the SI_address. We could know the NAT_SI_address,
provided the initiator is using some kind of static nat system, but
with the roaming cases, we do not know anything about the source
address.

This means that PAD on the SC should be:

   SC PAD:
    - IF remote_identity = user_1
         Then authenticate (shared secret/certificate/EAP)
         and authorize CHILD_SAs for symbolic name "l2tp_spd_entry"

And the SPD-S would be:

   - IF name="l2tp_spd_entry"
	local_address=IPv4-SC
        remote_address=ANY (PFP=1)
        next_layer_protocol=UDP
        local_port=1701
        remote_port=ANY (PFP=1)
     Then use SA ESP transport mode

I.e. we create symbolic name in the PAD which says that user_1 can
create SAs as specified by the SPD entry matching that name. Then we
add that name to the SPD entry, so user_1 can only use that specific
SPD entry. In normal case we of course have lots of different PAD
entries (or just one, using for example partial distinguished name
matching) but they can each map to the same SPD entry only allowing
them to use L2TP. 
-- 
kivinen@safenet-inc.com

_______________________________________________
Softwires mailing list
Softwires@ietf.org
https://www1.ietf.org/mailman/listinfo/softwires