Subject: [Ipsec] lists of protocols in 2401-bis

From: Ashley Partis <[email-masked]>
Date: Thu, 29 Jul 2004 11:43:59 +1000

hi,

I am wondering if I can get some clarification on whether or not 
2401-bis mandates the support for lists of the protocol selector in the 
SPD and SAD.

In section 4.4.1.1 it mentions the protocol selector as:

          - Next Layer Protocol: Obtained from the IPv4 "Protocol" or the
          IPv6 "Next Header" fields.  This is an individual protocol
          number, or ANY. The Next Layer Protocol is whatever comes after
          any IP extension headers that are present.

It purposely seems to avoid mentioning that the protocol selector can be 
a list (as with other selectors).  However, later on in section 4.4.2 it 
has several tables which include:

       protocol  list of prot's*   0  prot. "P"    list of prot's*
                      or ANY**                          or ANY
                  list of prot's*   1  prot. "P"    "P"
                      or ANY**
                  OPAQUE            0  not avail.  "undefined"
                  OPAQUE            1  not avail.  ***

This table in section 4.4.2 implies that the protocol can be both a list 
and opaque, whereas section 4.4.1.1 directly implies that it can only be 
a singular discrete value, or "ANY".  (I assume that "ANY" implies that 
it must support the "OPAQUE" value, as "ANY" includes "OPAQUE". 
However, for IPv4 IPsec implementations the "OPAQUE" value for the 
protocol selector is not possible).

I am seeking clarification on two points:
  o Should implementations support lists of protocols as a selector?
  o If they should, then this logically places limitations on the port 
combinations possible (ie, if the list was TCP with UDP then port 
selectors are possible, but TCP with ICMP then port combinations would 
not be possible).

Cheers,
        Ashley Partis

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Stephen Kent <[email-masked]>
Date: Thu, 29 Jul 2004 16:28:53 -0400

It is intentional that the "next protocol" selector be an individual 
value (unlike IP addresses) in a selector set entry. this is 
consistent with how IKE v2 negotiates the TS values for an SA. it 
also makes sense because one may need to associate different port 
fields with different protocols.

It is possible to associate multiple protocols (and ports) with a 
single SA by specifying multiple selector sets for that SA. See 
4.4.1.2. The discussion in 4.4.1.1 defines the selectors to be used 
in each selector set.

The table in 4.4.2 is OK, because it is a SAD, not SPD, example, and, 
as noted above, multiple protocols can be associated with an SA, by 
enumerating each in a separate selector set as part of a single SPD 
entry.

Steve