Pekka Savola writes: > > The model described below is nominal; implementations need not > > match details of this model as presented, but the external behavior > > of implementations MUST correspond to the externally observable > > characteristics of this model in order to be compliant. > > That's nice -- unfortunately, unless the motivation of IPsec folks was > to make it more difficult to create new (competing) implementations, > leaving out important details on what the spec actually means and > what's the best way to implement things may be an issue. I do not think it is IETFs work to design software architecture for the implementations. The current specification is high level enough that vendors can do software architecture in multiple different ways, but can still be compatible with the IPsec architecture document. For example in our implementations the old IPsec Express toolkit and the newer Quicksec toolkit used completely different software architecture. Neither one of those used the exact model described in the architecture draft, but both of them should be compatible with it, i.e. matching the external behavior of the architecture document. Those two toolkits were designed for quite different scenarios in mind so that do affect the high level architecture, although both of them can also be used to do the same basic things described in the IPsec architecture. If the architecture document would go in to more detailed level, then doing those kind different software architectures would be harder and harder. Anyways, there has been multiple vendors who have managed to make internoperable implementations of the IPsec, so I think that proves that the documents are matching the requirements set by the IETF. At least I think that IETFs job is not to provide detailed software architectures how to implement things, but to provide good enough documentation that people can implement interoperable implementations of the protocols. The issues in the interoperability meetings have mostly been in the bits on the wire level or just normal software bugs, I do not think there have been that many problems in the architecture issues there. Of course testing there has mostly concentrated on the bits on the wire, not to the architecture... -- kivinen at safenet-inc.com
Note Well: Messages sent to this mailing list are the opinions of the senders and do not imply endorsement by the IETF.