[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: ICMP Security Failures
>Tunnelling is a very useful mode. It's most useful for routers,
>bump-in-the-stack encryptors, IP forwarding (e.g. IP ``remailers''),
>and perhaps also firewalls...but I don't think the utility is limited
>to those situations.
Absolutely!
>It's important that implementors realize they must support this mode
>of operation. The tunnel/transport modes aren't orthogonal, from
>the implementation perspective: to support tunnel-mode, the IPSEC
>modules must be re-entrant, and must deal with remembered security
>state when processing IP headers. Implementors probably won't think
>to support all this if it's not described explicitly in the spec.
Again, I agree. Your point about re-entrancy is well taken. Perhaps we
could word the requirement that way. We should specifically require
that receiving implementations accept packets with arbitrarily nested
AH/ESP/tunnel headers, even if they can't generate them. Exact
language is open to discussion.
Phil