<!doctype html public "-//W3C//DTD W3 HTML//EN">
<html><head><style type="text/css"><!--
blockquote, dl, ul, ol, li { padding-top: 0 ; padding-bottom: 0 }
--></style><title>Re: [anonsec] A note about connection
latchin.</title></head><body>
<div>At 5:07 PM -0500 9/7/07, Nicolas Williams wrote:</div>
<blockquote type="cite" cite>The connection latching I-D puts forward
two informative models. The<br>
next version, which I'm working on right now, will make one of
those<br>
models normative.<br>
<br>
The two models, you might recall, are:<br>
<br>
a) ULPs interface with IPsec via "template" PAD and SPD
entries that get<br>
"cloned" upon triggering events.<br>
</blockquote>
<blockquote type="cite" cite> For example, a TCP connect()
would create a template<b> PAD</b> entry with</blockquote>
<blockquote type="cite" cite> the connection's<b>
5-tuple</b> as child SA constraints, prior to sending</blockquote>
<blockquote type="cite" cite> the TCP SYN packet. A
TCP listen() would create a template<b> PAD</b> entry</blockquote>
<blockquote type="cite" cite> with the listener's 3-tuple
as child SA constraints, prior to</blockquote>
<blockquote type="cite" cite> accepting any TCP SYN
packets.</blockquote>
<div><br></div>
<div>For SPD entries, the applicable term is "populate from
packet" and we have a flag for that. PAD entries don't have
5-tuples, so did you mean SPD above? If so, do you want to specify the
template PAD entry separately above?</div>
<div><br></div>
<div>Steve</div>
</body>
</html>