netdev - Re: [RFC][PATCH][XFRM][0/5] extension for XFRM databases

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 03 Feb 2007 08:45:57 -0500
From:	jamal <hadi@...erus.ca>
To:	Shinta Sugimoto <shinta@....wide.ad.jp>
Cc:	netdev@...r.kernel.org, Francis Dupont <Francis.Dupont@...nt6.net>,
	Masahide Nakamura <nakam@...ux-ipv6.org>,
	usagi-core@...ux-ipv6.org
Subject: Re: [RFC][PATCH][XFRM][0/5] extension for XFRM databases

On Sat, 2007-03-02 at 09:28 +0900, Shinta Sugimoto wrote:

> Yes.  A XFRM_MSG_MIGRATE message can update an SPD entry and associated
> SAD entries (if any) at a time.
> 

Ok, you have convinced me on the need for the message.

> By "Mobile VPN", I meant a VPN scenario where clients roam around
> subnets and continue changing its attachment point to the Internet
> (aka roadwarrior).  In such case, both client and SGW need to update
> endpoint address of the security association.  When the endpoint address
> of client side is updated, instead of re-establishing the security
> association from scratch, the client may inform the SGW of its new
> endpoint address.  This is what MOBIKE (RFC4555) does.  So, just like
> in the case of Mobile IPv6, endpoint address management of IPsec
> databases is necessary and XFRM_MSG_MIGRATE message can be used.

makes a lot of sense.

Thanks for your patience Shinta.

cheers,
jamal

-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html