Subject: [Pana] Issue 208 (AD-review, pana-fwk, section 7.3)

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 31 Oct 2005 16:59:09 -0500

>7.3  Filter Rule Installation
>
>   Filtering rules to be installed on EP generally include a device
>   identifier of PaC, and also cryptographic keying material (e.g., IKE
>   pre-shared key [RFC2409]) when cryptographic data traffic protection
>   is needed (See Section 6).  Each keying material is uniquely
>   identified with a keying material name (e.g., ID_KEY_ID in IKE
>   [RFC2409]) and has a lifetime for key management, accounting, access
>   control and security reasons in general.  In addition to the device
>   identifier and keying material, other filter rules, such as the IP
>   filter rules specified in NAS-Filter-Rule AVPs carried in Diameter
>   EAP application [I-D.ietf-aaa-eap] may be installed on EP.  When
>   IPsec is used the filter rules are applied to IP packets carried
>   inside the IPsec tunnel, otherwise, the filter rules are applied to
>   IP packets that are not protected with IPsec.
>
>
The above statement needs to be reviewed by someone very knowledgable
about IPsec. While it may be obvious to some that an IPsec stack should
have the ability to carry "was this packet decrypted by IPsec or not" to
later processing steps, this is not always the case (and has caused a
great deal of discussion in the past). I do not know the latest
consensus on this, but it should be researched as I think it could have
significant relevance here.

  Ohba: I think that rfc2401bis deals with the issue by having
  separate filtering steps for inbound unprotected traffic and
  protected traffic.  For unprotected traffic, SPD-I cache is used for
  filtering unprotected packets while inbound selectors are used for
  filtering protected traffic.  Comment from IPsec expert is needed
  anyways.

Regards,
Yoshihiro Ohba

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana