requirement008.tex

FREESWAN VPN源代码包

\subsection{008: decouple SA retrieval from DADDR (don't care how it arrived)}

\subsubsection{008: Definition of requirement }

The desire is that the SA lookup by SPI should not depend upon destination
address. This is in contradiction to IPsec requirements, but an
implementation that assigns unique SPI numbers to all protocols can satisfy
both requirements.

This requirement also helps NAT traversal in some cases.

\subsubsection{008: response}

As SPI values are assigned by the receiver for unicast, we can in general
accomplish this by allocating all SPI values from a single pool. This is
committed to.

This is neutral towards Opportunistic Encryption.