Subject: Re: [v6ops] comment on draft-ietf-v6ops-cpe-simple-security-12

From: Tina TSOU <[email-masked]>
Date: Mon, 27 Sep 2010 12:09:14 +0800

Good to know it:)

P.s. WG v6ops has been moved to [email-masked] rather than [email-masked].

Tina

  ----- Original Message ----- 
  From: james woodyatt 
  To: IPv6 Operations 
  Cc: [email-masked] ; Tina TSOU 
  Sent: Monday, September 27, 2010 11:47 AM
  Subject: Re: comment on draft-ietf-v6ops-cpe-simple-security-12

  On Sep 26, 2010, at 18:41, Tina TSOU wrote:

  > One comment on draft-ietf-v6ops-cpe-simple-security-12 is below.
  > REC 16/28, for endpoint-independent filter (for UDP and TCP), the filter state record should include only the interior source address and protocol.
  > It might be useful to add the "2-tuples" information in the draft.
  > While in REC 11 it requires that filter state record MUST be indexable by 3-tuples, which conflict with REC 16/28.

  Good catch!  And just in time, too.

  I believe this is a technical error in the draft.  The intent of the design team, I'm nearly certain, is for endpoint-independent vs. address-dependent filtering to be consistent throughout.  I am fixing for the forthcoming -13 revision.

  (p.s. the Encapsulated Security Payload upper-layer transport is a special case, and its language calling for a fixed policy of what amounts to address-dependent filtering is consistent with the purpose of the ESP protocol.)

  --
  james woodyatt <[email-masked]>
  member of technical staff, communications engineering