Subject: [IPSECKEY] reverse map usage

From: Michael Richardson <[email-masked]>
Date: Wed, 28 Jan 2004 16:16:06 -0500

-----BEGIN PGP SIGNED MESSAGE-----

Does this text make sense?

===

<section title="Use of reverse (in-addr.arpa) map">
<t>
Often a security gateway will only have access to the IP address to which
communication is desired. It will not know the forward name. As such, it
will frequently be the case that the IP address will be used an index into
the reverse map. 
</t>

<t>
The lookup is done in the usual fashion as for PTR records. The IP address'
octets (IPv4) or nibbles (IPv6) are reversed and looked up under the .arpa.
zone. Any CNAMEs or DNAMEs found SHOULD be followed.
</t>

<t>
Note: even when the IPsec function is the end-host, often only the application 
will know the forward name used. While the case where the application knows
the forward name is common, the user could easily have typed in a literal IP
address. This storage mechanism does not preclude using the forward name
when it is available, but does not require it.
</t>
</section>

]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson,    Xelerance Corporation, Ottawa, ON    |net architect[
] [email-masked]      http://www.sandelman.ottawa.on.ca/mcr/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [
-
This is the [email-masked] list.
Email to [email-masked] to be removed.

---

From: Jakob Schlyter <[email-masked]>
Date: Thu, 29 Jan 2004 10:36:07 +0100 (CET)

> will frequently be the case that the IP address will be used an index into

what else could be used as an index into the reverse map? if nothing, that
needs rewording I think.

	jakob
-

---

From: Michael Richardson <[email-masked]>
Date: Thu, 29 Jan 2004 12:13:24 -0500

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "Jakob" == Jakob Schlyter <[email-masked]> writes:
    >> Often a security gateway will only have access to the IP address to
    >> which communication is desired. It will not know the forward name. As
    >> such, it will frequently be the case that the IP address will be used
    >> an index into the reverse map.

    Jakob> what else could be used as an index into the reverse map? 

  1) one could use the IP address to find a PTR and the look for the key
     in the forward map. This fails for a number of reasons, but it has been
     suggested. 

  2) one could change the BSD sockets API to take forward names instead of
     struct sockaddr_in, and therefore keep the forward name all the way.
     
  3) HIP does something else, which I won't describe here.

    Jakob> if nothing, that needs rewording I think.

  As for rewording - I'm not sure how else to say it. Can you perhaps
help here?

-