(racoon2 51) inbound selectors

IKEv2 and 2401bis I-Ds use only symmetrical SPD IPsec (called SPD-S)
when racoon2 has still the old style inbound/outbound selectors,
using in iked only outbound selectors (the two occurences of DIR_INBOUND
are in defined out pieces of code in ike_conf.c!).
One can suggest to automatically generate the inbound counterpart of
any defined outbound selectors but this can work only for the current
code which has no support for opaque/icmp/mh:
draft-ietf-ipsec-rfc2401bis-06.txt 4.4.1.3, IPsec mailing list and
draft-eronen-ipsec-ikev2-clarifications-06.txt give some examples
where OPAQUE is used to have asymmetrical behavior for SPD-S entries.
So the inbound selector issue needs to be solved before the support
of ICMP or MH, i.e., before the implementation of next_header_including.

Regards

[email protected]

PS: in draft-ietf-mip6-ikev2-ipsec-04.txt 6.1:

        mobile node SPD-S:
          - IF source = home_address_1 & destination = home_agent_1 &
               proto = MH & local_mh_type =BU & remote_mh_type =
               BAck
            Then use SA SA1 (OUT) and SA2 (IN)

means the entry matches for outgoing BUs and incoming BAck only.
This feature is critical for:

        mobile node SPD-S:
          - IF source = home_address_1 & destination = any &
            proto = MH & local_mh_type = HoTi & remote_mh_type = HoT
            Then use SA SA3 (OUT) and SA4 (IN)

because only a MN in visit can send HoTis and receive HoTs so
the SPD entry can be made permanent.