Subject: [anonsec] Automatic detection of BTNS capability

From: yogesh.swami at acm.org (Yogesh Prem Swami)
Date: Wed, 16 Mar 2005 11:57:36 -0800 (PST)

> > 
> > You can solve this by looking inside the IP in IP headers (but that could
> lead
> > to other kind of DoS attacks where you keep parsing IPeaders for no
> reason). I
> > don't recall if RFC2401 and 2402 bis, mention checking inner tunnels for
> > inbound processing. 
> 
> Tunnel mode does; transport mode does not when the inner header is IPIP 
> (see RFC3884).
> 

Right. Probably food for charter scope.

Yogesh

---

From: touch at ISI.EDU (Joe Touch)
Date: Wed, 16 Mar 2005 12:00:52 -0800

> Right. Probably food for charter scope.

How so? This is no different from in-tunnel attacks on other IPsec SAs; 
it's already checked, so should not be an issue.

Joe
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 254 bytes
Desc: OpenPGP digital signature
Url : http://www.postel.org/pipermail/anonsec/attachments/20050316/1fef19f2/signature.bin