[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: an SPD syntax example



It is better to make this as close to IKEv2 Traffic Selector as
possible. Based on that, each IP address range should be combined with
Protocol/Port Range. This ASN1 description seems to be creating a set with
multiple IP address ranges to a single Protocol and Port (Range).


Good point. I'll change the syntax, and the 2401bis text to align with the IKEv2 proposal format more closely. The effect is the same, ultimately, in terms of associating a set of values with the same SA.


AddrList ::= AddrOrRangeOrSubnet


 AddrOrList ::= CHOICE {
			iPAddr	IPaddr	-- individual IP address
			range	IPRange} -- IP address range


Above should become
AddrOrRangeOrSubnet ::= CHOICE {
                         ipAddr IPaddr
                         range IPRange
                         subnet subNet
                      }

I don't see a need to refer to subnets separately. ranges suffice.

> 
 IPaddr	::= CHOICE {
			v4Addr		INTEGER, -- 32 bits
			v6Addr [0]	INTEGER } -- 128 bits

 IPRange	::=	CHOICE {
			v4range		SEQUENCE {
						start	INTEGER, -- 32 bits
						end	INTEGER } -- 32 bits
			v6range [0]	SEQUENCE {
						start	INTEGER, -- 128 bits
						end	INTEGER } } -- 128 bits


Internally, subnet and IPAddr should be converted to range, if IKEv2 is
used for key management.

Yes, we ultimately convert to range for the selector payload.

Steve