Subject: Re: [Ipsec] draft-ietf-ipsec-rfc2401bis-05.txt

From: Brian E Carpenter <[email-masked]>
Date: Tue, 01 Feb 2005 08:33:25 +0100

I am about to leave for 3 weeks so I have no time to check the text,
but it has always been considered wrong on security grounds to
copy bits from the outer (unprotected) header into the decapsulated
(protected) header. That is very clear in the IPsec RFCs and I hope
it remains clear in the new ones.

     Brian

Vishwas Manral wrote:
> Hi Steve/ Karen,
> 
> I am resending an older mail, in case it got missed in transit. 
> 
> Although the security architecture talks about how the outer header is
> generated from the inner header in tunnel mode while encapsulation, I
> think the document completely misses the part of fields being copied
> back into the inner header while decapsulation.
> 
> I am CC'ing Brian Carpenter too, as he would probably have the best view
> on this.
> 
> Thanks,
> Vishwas
> ________________________________________
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Vishwas Manral
> Sent: Monday, January 31, 2005 9:37 AM
> To: [email-masked]
> Subject: [Ipsec] draft-ietf-ipsec-rfc2401bis-05.txt
> 
> Hi Steve,
> 
> I think the security architecture does not specify copying of DSCP and
> ECN values from the outer header to the inner header in the case of
> decapsulation for tunnel mode for both IPv4 and IPv6.
> 
> DSCP values will not be copied directly however, depending on the change
> of domain.
> 
> Thanks,
> Vishwas
> 
> 
> 

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec