[anonsec] A note about connection latchin.
kent at bbn.com
Mon Sep 10 10:44:32 PDT 2007
At 5:07 PM -0500 9/7/07, Nicolas Williams wrote:
>The connection latching I-D puts forward two informative models. The
>next version, which I'm working on right now, will make one of those
>The two models, you might recall, are:
>a) ULPs interface with IPsec via "template" PAD and SPD entries that get
> "cloned" upon triggering events.
> For example, a TCP connect() would create a template PAD entry with
> the connection's 5-tuple as child SA constraints, prior to sending
> the TCP SYN packet. A TCP listen() would create a template PAD entry
> with the listener's 3-tuple as child SA constraints, prior to
> accepting any TCP SYN packets.
For SPD entries, the applicable term is "populate from packet" and we
have a flag for that. PAD entries don't have 5-tuples, so did you
mean SPD above? If so, do you want to specify the template PAD entry
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the ANONSEC