Re: IPsec PFP support on linux

[Sowmini Varadhan <sowmini.varadhan@oracle.com>]

On (05/02/17 09:58), Paul Wouters wrote:
>    I think you want to use Opportunistic IPsec, eg see 
>    https://libreswan.org/wiki/HOWTO:_Opportunistic_IPsec

I dont think that what I want is opportunistic ipsec..

taking an extreme example, I can set up the ipsec tunnels with 
esp-null for *.5001 and 5001.* (and that's how I'm able to
trigger quick mode in my experiment).

But I want each 5-tuple to/from 5001 to get its own SPI. That
is not happening in my case. 

If I used OE, I would *never* get a per-5-tuple SPI, right?
(I can give this a try later today but the rfc definition of OE is
not what I have in mind- I really want PFP, not OE).

>    Note that IKEv2 also allows you to define one connection and instantiate
>     a connection based on the trigger packet whose src/dst proto/port are
>    included in the IKEv2 packet as traffic selectors. See RFC7296 and
>    "narrowing".

yes, the rfc's permit this, I'm not sure how to set up my 
SPD for this though.