Subject: RE: [tcpm] new internet draft - drafft-touch-anonsec

From: [email-masked]
Date: Thu, 6 May 2004 16:15:46 -0500

> >>
> >> What you are saying is that one cannot really protect TCP with
> >> tunnel-mode IPSEC. Duh. Use transport mode.
> >>
> >> -- Christian Huitema
> > 
> > 
> > Even tunnel mode is supposed to check the outer packet 
> headers. IPsec AH 
> > authenticates the outer IP header regardless.
>                      ^^^^^
>                      inner
> 

Which only means one more IP tunnel on part of Trudy. She has nothing to
lose by putting 10 IP tunnels if that suits her needs.

> Presuming, as Christian also observes, reasonable policies.
> 

I will wait to see the right policies in the next draft (I couldn't come
up with any reasonable policy myself :-)).

Yogesh

_______________________________________________
tcpm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tcpm

---

From: Joe Touch <[email-masked]>
Date: Thu, 06 May 2004 14:26:53 -0700

> lose by putting 10 IP tunnels if that suits her needs.

That presumes that Bob is willing to either

1. accept non-IPsec'd tunnel'ed packets
	which he should not, once IPsec is enabled, by the rules
	in RFC2401 anyway - DENY any packets not IPsec'd as a
	catchall rule
or

2. accept new SAs in which the source address of the inner or outer 
header is Alice, from Trudy
	any inner source that isn't Trudy ought to be invalid for
	any packet from Trudy, or Bob is ASKING to be spoofed

> up with any reasonable policy myself :-)).

As per my other post, the right policies are easy. DENY:

	1) wildcards in the protocol field of transport-mode

	2) wildcards in the source field of the encapsulated
	packets in tunnel mode

	3) wildcards in the source field of the outer packet
	in either transport or tunnel mode

	3) non-matching outer and inner source addresses

I.e., if you want to deny spoofing, DENY spoofing ;-)

Joe