RE: Another NAT Traversal question

["Jayant Shukla" <jshukla@trlokom.com>]

> -----Original Message-----
> From: owner-ipsec@lists.tislabs.com
[mailto:owner-ipsec@lists.tislabs.com]
> On Behalf Of Francis Dupont
> 
> => my concern is that I believe the way you fix the checksum will give
> a correct checksum from a wrong one, i.e., you loose the detection
> of errors which is the purpose of the checksum.
> IMHO the checksum must be fixed using the original and new IP
addresses,
> i.e., you add the original addresses and substract the new addresses
> in an one-complement arithmetic (the checksum is the opposite of the
> sum of the pseudo-header and the transport message in one-complement.
> At the exception of UDP/IPv4, zero is normalized, i.e., +0 is used.
> What I propose is a direct application of RFC 1624 which requires
> the original addresses).
> 

I don't think you need to do what you have explained. Since you will
authenticate and decrypt the packet, it guarantees that you don't have
any flipped bits in the body of the encapsulated data.

If you want, test the checksum before you authenticate/decrypt the
packet.

Regards,
Jayant
www.trlokom.com