Subject: Re: [Pana] Issue 208 (AD-review, pana-fwk, section 7.3)

From: "Mohan Parthasarathy" <[email-masked]>
Date: Thu, 5 Jan 2006 14:14:55 -0800

> >7.3  Filter Rule Installation
> >
> >   Filtering rules to be installed on EP generally include a device
> >   identifier of PaC, and also cryptographic keying material (e.g., IKE
> >   pre-shared key [RFC2409]) when cryptographic data traffic protection
> >   is needed (See Section 6).  Each keying material is uniquely
> >   identified with a keying material name (e.g., ID_KEY_ID in IKE
> >   [RFC2409]) and has a lifetime for key management, accounting, access
> >   control and security reasons in general.  In addition to the device
> >   identifier and keying material, other filter rules, such as the IP
> >   filter rules specified in NAS-Filter-Rule AVPs carried in Diameter
> >   EAP application [I-D.ietf-aaa-eap] may be installed on EP.  When
> >   IPsec is used the filter rules are applied to IP packets carried
> >   inside the IPsec tunnel, otherwise, the filter rules are applied to
> >   IP packets that are not protected with IPsec.
> >
> >
> The above statement needs to be reviewed by someone very knowledgable
> about IPsec. While it may be obvious to some that an IPsec stack should
> have the ability to carry "was this packet decrypted by IPsec or not" to
> later processing steps, this is not always the case (and has caused a
> great deal of discussion in the past). I do not know the latest
> consensus on this, but it should be researched as I think it could have
> significant relevance here.
> 
>   Ohba: I think that rfc2401bis deals with the issue by having
>   separate filtering steps for inbound unprotected traffic and
>   protected traffic.  For unprotected traffic, SPD-I cache is used for
>   filtering unprotected packets while inbound selectors are used for
>   filtering protected traffic.  Comment from IPsec expert is needed
>   anyways.
> 
Yes, as part of IPsec processing, the policy checks happen and that
should take care of the filter rule verification mentioned in the text.

-mohan

> Regards,
> Yoshihiro Ohba
> 
> 
> _______________________________________________
> Pana mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/pana

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana