Subject: [anonsec] Automatic detection of BTNS capability

From: yogesh.swami at acm.org (Yogesh Prem Swami)
Date: Wed, 16 Mar 2005 12:07:49 -0800 (PST)

--- Joe Touch <touch at ISI.EDU> wrote:
> 
> 
> Yogesh Prem Swami wrote:
> >>>You can solve this by looking inside the IP in IP headers (but that could
> >>
> >>lead
> >>
> >>>to other kind of DoS attacks where you keep parsing IPeaders for no
> >>
> >>reason). I
> >>
> >>>don't recall if RFC2401 and 2402 bis, mention checking inner tunnels for
> >>>inbound processing. 
> >>
> >>Tunnel mode does; transport mode does not when the inner header is IPIP 
> >>(see RFC3884).
> >>
> > 
> > 
> > Right. Probably food for charter scope.
> 
> How so? This is no different from in-tunnel attacks on other IPsec SAs; 
> it's already checked, so should not be an issue.
> 

Ah! Misread tunnel for transport. I haven't read 3884 so can't really comment
on what's there. 

Yogesh