From: Sowmini Varadhan <sowmini.varadhan@oracle.com>
To: Paul Wouters <paul@nohats.ca>
Cc: steffen.klassert@secunet.com, borisp@mellanox.com,
swan@lists.libreswan.org, netdev@vger.kernel.org,
ilant@mellanox.com, linux-crypto@vger.kernel.org,
herbert@gondor.apana.org.au
Subject: Re: IPsec PFP support on linux
Date: Tue, 2 May 2017 10:05:26 -0400 [thread overview]
Message-ID: <20170502140526.GF5843@oracle.com> (raw)
In-Reply-To: <B4EE88ED-B403-42C3-A6D8-1A2526F1DA67@nohats.ca>
On (05/02/17 09:58), Paul Wouters wrote:
> I think you want to use Opportunistic IPsec, eg see
> https://libreswan.org/wiki/HOWTO:_Opportunistic_IPsec
I dont think that what I want is opportunistic ipsec..
taking an extreme example, I can set up the ipsec tunnels with
esp-null for *.5001 and 5001.* (and that's how I'm able to
trigger quick mode in my experiment).
But I want each 5-tuple to/from 5001 to get its own SPI. That
is not happening in my case.
If I used OE, I would *never* get a per-5-tuple SPI, right?
(I can give this a try later today but the rfc definition of OE is
not what I have in mind- I really want PFP, not OE).
> Note that IKEv2 also allows you to define one connection and instantiate
> a connection based on the trigger packet whose src/dst proto/port are
> included in the IKEv2 packet as traffic selectors. See RFC7296 and
> "narrowing".
yes, the rfc's permit this, I'm not sure how to set up my
SPD for this though.
prev parent reply other threads:[~2017-05-02 14:05 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-05-02 12:32 IPsec PFP support on linux Sowmini Varadhan
2017-05-02 13:58 ` Paul Wouters
2017-05-02 14:05 ` Sowmini Varadhan [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170502140526.GF5843@oracle.com \
--to=sowmini.varadhan@oracle.com \
--cc=borisp@mellanox.com \
--cc=herbert@gondor.apana.org.au \
--cc=ilant@mellanox.com \
--cc=linux-crypto@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=paul@nohats.ca \
--cc=steffen.klassert@secunet.com \
--cc=swan@lists.libreswan.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).