Subject: [Ipsec] forward to transport mode

From: Francis Dupont <[email-masked]>
Date: Mon, 19 Sep 2005 14:25:28 +0200

I'd like to know the common opinion about this problem:
Alice and Bob have a transport mode IPsec SA between them,
Alice is a router and a bad guy sends to Alice a packet with
Alice's address as the source and Bob's address at the destination.
Alice forwards the packet to Bob but it matches the SPD entry and
is protected by the IPsec SA.

I believe this must not happen because:
 a- only tunnel mode SAs may be applied to forwarded traffic
 b- implementations must explicitely avoid the application of
   transport mode SAs to forwarded traffic (same thing than a
   with a stronger wording).

What do you believe and do you know wrong implementations?

Regards

[email-masked]

PS: my arguments are the definition of the transport mode (explicitely
end-to-end) and the data origin authentication function (clearly not
provided in the example).

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Markku Savela <[email-masked]>
Date: Mon, 19 Sep 2005 16:17:21 +0300

> From: Francis Dupont <[email-masked]>
> 

One might argue

- if incoming packet has src address of the node self, shouldn't the
  packet be dropped as faked (or looped), even without IPsec?

- and, if the router code doesn't do this, one could have an IPsec
  policy that drops incoming packets with src=Alice.

>    with a stronger wording).

Thus, fixing the "problem" is configuration and policy issue. Not
something that IPsec specification needs to get involved. However, I
see that this may be a pitfall for some, so some warning about this in
some document could be considered.

Note, that the "problem" happens only if forwarded packet does have
src=some Alice's address. Anything else, and the transport mode really
does not work, as the src address doesn't match any SA.

---

From: Francis Dupont <[email-masked]>
Date: Mon, 19 Sep 2005 16:23:57 +0200

One might argue

   
=> both are variations about a standard anti-spoofing rule.
One can assume there is no such anti-spoofing on Alice...

   Thus, fixing the "problem" is configuration and policy issue. Not
   something that IPsec specification needs to get involved.

=> I am not sure: IPsec has inbound and outbound, not forward direction.
(at least in formal description).

   However, I see that this may be a pitfall for some, so some warning
   about this in some document could be considered.

=> one of my concerns is the data origin authentication is fooled
if the issue is not solved.

=> this doesn't really fix the issue: can a forwarded packet be given to
a transport mode SA? The RFC 2409 says the default policy is to refuse...

Thanks