[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: IKEv2 traffic selector subsetting.
> From: Henry Spencer <henry@spsystems.net>
> If the responder says "yes" to the initiator's request, then it should set
> up selectors which match the initiator's request! Anything else is a bug.
> If the responder cannot comply *fully* with the request, its answer should
> be "no".
Hmm.. then, any sensible responder will have to say "NO" to any other
selectors, except at most the one that specifies exactly one pair of
hosts (initiator - responder).
As a responder, I wouldn't want a random initiator to dictate my
security requirements for any other host. (If I did that, someone
could just declare itself as a security gateway for 192/8 (any any
random range of addreses) and get all my traffict routed to itself...)
I must be missing something? What?
Follow-Ups:
References: