Re: Why can't ESP authenticate IP header?

[Francis Dupont <Francis.Dupont@enst-bretagne.fr>]

 In your previous mail you wrote:

   We bind the SA to the source address.
   
   repeating myself:
   
   We do a COMPARE between the packet's source address and the SA's
   source address (if it has one).
   
=> this is in RFC 2401 5.2.1 step 2 mandatory checks for inbound traffic.
But for tunnel mode, do you perform the check on the right source address,
the wrong one or on both (cf RFC 2401 r.1.2.1 note 3)?

Thanks

Francis.Dupont@enst-bretagne.fr

PS: the thread is about transport mode where there is only one header so
one source address (which MUST be checked against the SA selector which
can be a wildcard).

---

References:

• Re: Why can't ESP authenticate IP header?
• From: Bill Sommerfeld <sommerfeld@East.Sun.COM>

---

• Prev by Date: need a pointer
• Next by Date: Re: Why can't ESP authenticate IP header?
• Prev by thread: Re: Why can't ESP authenticate IP header?
• Next by thread: Re: Why can't ESP authenticate IP header?
• Index(es):
  • Main
  • Thread