Subject: [MEXT] [gmane.ietf.announce] I-D Action:draft-ebalard-mext-pfkey-enhanced-migrate-00.txt

From: [email-masked] (Arnaud Ebalard)
Date: Mon, 18 Aug 2008 11:41:20 +0200

Hi,

for those interested by the topic ...

Subject: I-D Action:draft-ebalard-mext-pfkey-enhanced-migrate-00.txt
From: [email-masked]
To: [email-masked]
Date: Mon, 18 Aug 2008 01:30:01 -0700 (PDT)
Newsgroups: gmane.ietf.announce
List-Id: Internet Draft Announcements only <i-d-announce.ietf.org>

A New Internet-Draft is available from the on-line Internet-Drafts directories.

	Title           : PF_KEY Extension as an Interface between Mobile IPv6 and IPsec/IKE
	Author(s)       : A. Ebalard, S. Decugis
	Filename        : draft-ebalard-mext-pfkey-enhanced-migrate-00.txt
	Pages           : 21
	Date            : 2008-08-18

This document describes the need for an interface between Mobile IPv6
and IPsec/IKE and show how the two protocols can interwork.  An
extension of the PF_KEY framework is proposed which allows smooth and
solid operation of IKE in a Mobile IPv6 environment.

This document is heavily based on a previous draft [MIGRATE] written
by Shinta Sugimoto, Masahide Nakamura and Francis Dupont.  It simply
reuses the MIGRATE mechanism defined in the expired document, removes
a companion extension (SADB_X_EXT_PACKET) based on implementation
feedback (complexity, limitations, ...) and fills the gap by very
simple changes to MIGRATE mechanism.  This results in a more simple
and consistent mechanism, which also proved to be easier to
implement.  This document is expected to serve as a continuation of
[MIGRATE] work.  For that reason, the name of the extension has been
kept.

PF_KEY MIGRATE message serves as a carrier for updated address
information for both the in-kernel IPsec structures (SP/SA) and those
maintained by the key managers.  This includes in-kernel SP/SA
endpoints, key manager maintained equivalents and addresses used by
IKE_SA (current and to be negotiated).  The extension is helpful for
assuring smooth internetworking between Mobile IPv6 and IPsec/IKE for
the bootstrapping of mobile nodes and their movements.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ebalard-mext-pfkey-enhanced-migrate-00.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.
_______________________________________________
MEXT mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mext

---

From: [email-masked] (Arnaud Ebalard)
Date: Mon, 18 Aug 2008 12:43:42 +0200

Hi,                              [Replying to the first *broken* mail]

> implementation to automatically retrieve the ASCII version of the

If you have comments/questions, do not hesitate.

As posted previously, if you are interested by implementation/test
details, there is more on the topic here: http://natisbad.org/MIPv6/

Cheers,

a+

---

From: "Sri Gundavelli" <[email-masked]>
Date: Mon, 18 Aug 2008 22:59:09 -0700

Hi Arnaud,

A quick review of the draft, its well written. Good work !!!
this is needed. Just one basic question. Does this or existing
PF_KEY interface allow the MIP process to learn Dead Peer
Detection events from the IKE process ? Does this already exist
in PF_KEY or its extensions ? I guess, I'm looking at the way
for MIP process to leverage peer termination events that are
learnt from the IKE layer. Any pointer ?

Regards
Sri

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Arnaud Ebalard
> Sent: Monday, August 18, 2008 3:44 AM
> To: IETF MEXT WG
> Subject: Re: [MEXT] [gmane.ietf.announce] 
> I-DAction:draft-ebalard-mext-pfkey-enhanced-migrate-00.txt
> 
> > 	Filename        : 
> draft-ebalard-mext-pfkey-enhanced-migrate-00.txt
> > 	Pages           : 21
> > 	Date            : 2008-08-18
> >

---

From: [email-masked] (Arnaud Ebalard)
Date: Tue, 19 Aug 2008 09:33:21 +0200

Hi,

"Sri Gundavelli" <[email-masked]> writes:

> this is needed.

Thanks for reading it!

> Just one basic question. Does this 

MIGRATE does not. It flows in the reverse direction (from MIPv6 module
to kernel to IKE daemon)

> or existing PF_KEY interface allow the MIP process to learn Dead Peer
> Detection events from the IKE process ?

AFAIK, nope.

> Does this already exist in PF_KEY or its extensions ?

AFAIK, it does not.

> I guess, I'm looking at the way for MIP process to leverage peer
> termination events that are learnt from the IKE layer. Any pointer ?

Sorry but I have no pointer to provide on that topic. You may have more
luck by asking on IETF ipsec or pfkey ML. There may be other people,
apps or protocols that already had such a need and a draft may have been
written at some point.

Cheers,

a+

---

From: <[email-masked]>
Date: Wed, 20 Aug 2008 12:29:24 +0300

Hi:

Really interesting draft.

#Sri

Although this is not within the scope subjected draft but this will make
BU/BAck to be carried within IKE exchange isn't it? If so then it may
need  some additional - configuration types for BU/Back. I think DPD
very much resembles the view of binding revocation and Ack in MIP. Isn'
it? Is there any other signalling (except BU/BAck) of MIP can leverage
DPE? 

Regds
Preeti 

>Behalf Of ext Sri Gundavelli
>Sent: 19 August, 2008 08:59
>To: 'Arnaud Ebalard'; 'IETF MEXT WG'
>Subject: Re: [MEXT] 
>[gmane.ietf.announce]I-DAction:draft-ebalard-mext-pfkey-enhance
d-migrate-00.txt
>Detection events from the IKE process ? Does this already 
>exist in PF_KEY or its extensions ? I guess, I'm looking at 
>the way for MIP process to leverage peer termination events 
>that are learnt from the IKE layer. Any pointer ?
>
>Regards
>Sri
>
>
>
>
>
>
>
> 
>
>> From: [email-masked] [mailto:[email-masked]] On Behalf 
>> Of Arnaud Ebalard