[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: ICMP Security Failures
>I've found it useful to describe the possible combinations in terms of
>a regular expression consisting of IP, AH, and ESP.
Seems to me that any combination of these protocols is possible, if
not necessarily useful. All three have 8-bit protocol fields in their
headers that refer to one of the Internet transport protocols,
including IP (4), AH (51) and ESP (50).
>Suppose a sequence of headers involves several different identities;
>may a host have a local policy rejecting some or all such combinations
>and still be conforming?
Local policies can reject anything they want. But the implementation
itself can't be the cause of the rejection, i.e., if the policy is to
permit something, the implementation should allow it.
>Also, must/should the ip-in-ip protocol be supported?
That's tunnel mode. Yes, it should be supported, though the requirements
for its use are always subject to local policy.
Phil
Follow-Ups:
References: