Subject: (IPng 7497) Re: Last Call: IPv6 Jumbograms to Proposed Standard

From: [email-masked] (Marc Hasson)
Date: Mon, 10 May 1999 17:27:16 -0700

Cast our (Mentat) lot in with the incremental IPSec header approach,
when applying our policy we build a complete packet from the innermost
IPSec header on out.

I guess we know MSR, KAME, NRL, and Mentat approaches now.  I read the
score as 3-1 so far.

Anyone else ready to close down or open the gap further?

   -- Marc --

 > From [email-masked] Mon May 10 11:30:54 1999
 > To: "Aaron Griggs" <[email-masked]>
 > cc: [email-masked]
 > Subject: (IPng 7491) Re: Last Call: IPv6 Jumbograms to Proposed Standard 
 > X-Copyright: Copyright 1999, Craig Metz, All Rights Reserved.
 > X-Reposting: With explicit permission only
 > Date: Mon, 10 May 1999 14:23:48 -0400
 > From: Craig Metz <[email-masked]>
 > 
 > In message <[email-masked]>, you write:
 > >Which specs are you referring.  None of the IPSec specs, rule out arbitary
 > >combos of IPSec headers.
 > 
 >   RFC 1826 did, though subtly (see section three). RFC 2402's rewording makes
 > it much more fuzzy; its wording can be interpeted either way.
 > 
 > >Are you talking about arbitary extension headers including IPSec?  We handle
 > >that fine although we don't implement them all yet.
 > >
 > >I basically want to find out what other implementations do with regards to
 > >nested IPSec headers.  As Itojun pointed out, his stack has problems with
 > >nested AH_AH and jumbograms.  And his stack will not interoperate with ours
 > >if AH_AH is done since he does the IPSec incrementally.
 > 
 >   We (NRL) always do them incrementally.
 > 
 > 									-Craig
 > --------------------------------------------------------------------
 > IETF IPng Working Group Mailing List
 > IPng Home Page:                      http://playground.sun.com/ipng
 > FTP archive:                      ftp://playground.sun.com/pub/ipng
 > Direct all administrative requests to [email-masked]
 > --------------------------------------------------------------------
 > 
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Craig Metz <[email-masked]>
Date: Mon, 10 May 1999 21:04:25 -0400

>Anyone else ready to close down or open the gap further?

  Marc, I think you're doing it the same way NRL does it, which makes things
2-2.

  Of course, I'll also observe that this and many other problems and
ambiguities with the IPsec specs are a direct result of the design-by-
democracy approach. A dictatorial edict that we aren't supporting bump-in-the-
wire and we're modelling the assembly of the headers a certain way would solve
the problem.

  In practice, though, I don't think either method of assembling the packet
within the stack necessarily precludes writing the bits with the appearance
that they were assembled the other way. For example, I can build a two-pass
mechanism that lets me figure out what the total length is, then put that
length in all the AHs' pseudo-headers. Similarly, the KAME or MSR people could
build a mechanism that inserts the running "virtual length" into the pseudo-
header.

  Hmm. Hmm... pseudo-headers... bump-in-the-wire... I smell another reason why
I don't like bumps in the wire.

									-Craig

---

From: [email-masked]
Date: Tue, 11 May 1999 10:27:07 +0900

>  Marc, I think you're doing it the same way NRL does it, which makes things

	????  I believed NRL and KAME are doing the same thing, and it makes
	3(Mentat/NRL/KAME)-1(MSR).

itojun