Re: Addresses in traffic selectors in IKEv2

[Mike Ditto <ford@incog.com>]

> >There is no advantage to having multiple types in this case, so we should
> >ditch the less generic ones.
> 
> Paul makes a good point.
> 
> Ranges can be used to express what masks can express and so we should 
> probably do away with masks. We should also prohibit trivial ranges 
> that define a single address.

I disagree; that seems to miss Paul's point.  Ranges are necessary and
sufficient, and an address set should be composed of a list of ranges.
(I sugggest that "address set" is the superior term rather than range,
list, "multiple addresses" or other often used terms for this concept --
a set is unordered, possibly empty, and can not have duplicate members.)
One can define a normal form of address set representation comprising
zero or more mutually discontiguous ranges listed in increasing
numerical order.  The normal form can be memcmp-compared for
equivalence, or binary searched for membership.

					-=] Mike [=-

Sun Microsystems
Solaris Security Technologies