Subject: [Mip6] [issue23] SPD entries illustration

From: Vijay Devarapalli <[email-masked]>
Date: Tue, 30 Aug 2005 01:24:52 +0000

New submission from Vijay Devarapalli <[email-masked]>:

This issue was raised by Francis Dupont. In his opinion, the SPD entries
should be depicted using ASN.1 as described in Appendix C. of 
raft-ietf-ipsec-rfc2401bis-06.txt

for example the following SPD entry 

            mobile node SPD-S:
              - IF source = home_address_1 & destination = home_agent_1 &
                   proto = MH & mh_type = BU
                Then use SA SA1

would appear as the following if ASN.1 is used.

SPDEntry = {
 iPsecEntry = {
  name = { passed = { rfc822 = user_1 }, ... },
  pFPs = 0,
  condition = {
   localAddr = { v6List = { ipv6Start = ipv6End = home_address_1 } },
   remoteAddr = { v6List = { ipv6Start = ipv6End = home_agent_1 } },
   protocol = { oneNext = { id = MH, nextLayer = { start = end = BU } } }
  },
  processing = {
    -- use SA1
    ...,
    algorithms = { esp = { both = ...} },
    tunnel = none
  }
 }
}

comments are welcome.

----------
category: Technical
draft: draft-ietf-mip6-ikev2-ipsec
messages: 86
nosy: vijay
priority: May fix
status: No discussion
title: SPD entries illustration

_________________________________________________
Mip6 issue tracker <[email-masked]>
<http://www.mip4.org/issues/tracker/mip6/issue23>
_________________________________________________

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: "Charles E. Perkins" <[email-masked]>
Date: Tue, 30 Aug 2005 17:25:37 +0300

Hello Vijay,

The example given is not a very persuasive argument.
I can easily figure out what the existing example text
is trying to say.  The ASN.1 causes one's eye to immediately
glaze over to avoid the pain.

Why is this a good idea?

Regards,
Charlie P.

---

From: Vijay Devarapalli <[email-masked]>
Date: Tue, 30 Aug 2005 11:28:07 -0700

hi Charlie,

I too prefer the current format. the current format is also
more familiar to MIPv6 implementors.

Francis raised this issue. Francis?

Vijay

---

From: Francis Dupont <[email-masked]>
Date: Wed, 31 Aug 2005 09:46:26 +0200

In your previous mail you wrote:

=> the issue is it has to be familiar to IPsec implementors...

=> here is an answer I sent:

 In his previous mail Vijay wrote:

   but this is ASN.1 representation of the SPD entry. we dont have to
   illustrate the SPD entries in this format. even rfc2401bis says
   
=> yes, this is not required but as it was done in order to provide
an uniform and clean way to describe concrete SPD entries I can't see
a good reason to not use it.

Thanks

[email-masked]

PS: BTW I believe that some implementations will really use it, for
instance in order to save pages of documentations.