From mboxrd@z Thu Jan  1 00:00:00 1970
From: Paul Moore <paul.moore@hp.com>
Subject: RFC4303 (IPsec/ESP) auditing requirements
Date: Wed, 5 Dec 2007 14:45:12 -0500
Message-ID: <200712051445.13051.paul.moore@hp.com>
Mime-Version: 1.0
Content-Type: text/plain;
  charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
Content-Disposition: inline
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit@redhat.com
Cc: Joy Latten <latten@us.ibm.com>
List-Id: linux-audit@redhat.com

Hello all,

I'm looking at RFC4303 at some of the auditing requirements and one of the 
gaps between what the specification requires and what we currently provide 
involves the SA's sequence number and the IPv6 flow ID.  According the list 
of existing audit fields[1] there doesn't appear to any fields which are a 
good match.  With that in mind I'd like to propose two new fields:

 * seqno - sequence number
 * flowid - flow id

Any comments, objections, suggestions?

[1] http://people.redhat.com/sgrubb/audit/audit-parse.txt
-- 
paul moore
linux security @ hp