Subject: RE: [Hipsec] Re: Requirement keyword for VIA_RVS

From: "Henderson, Thomas R" <[email-masked]>
Date: Tue, 5 Jul 2005 11:54:38 -0700

> -----Original Message-----
> From: Pekka Nikander [mailto:[email-masked]] 
> Sent: Tuesday, July 05, 2005 2:10 AM
> To: Julien Laganier
> Cc: Lars Eggert; [email-masked]
> Subject: [Hipsec] Re: Requirement keyword for VIA_RVS
> 
> > What requirement keyword should we use about the responder 
> adding the
> > VIA_RVS to an R1 when I1 was relayed. The current text has MUST, but
> > I am now confused. Should it be only SHOULD?
> 
> I think it should be "MUST", as leaving it out might make the
> system vulnerable to certain kind of reflection attacks.
> That is, if the R1 is sent to a different address than what I1
> was received from, the source address of I1 MUST be included in
> the R1.  VIA_RVS is there exactly for this purpose.
> 

I agree with this enforcement on the Responder behavior.  On the
initiator side, it seems like things would interoperate fine with an
initiator that ignored the VIA_RVS parameter, so that seems fine too.
(The base draft does not require that the IP addresses be checked on
incoming R1s).

Tom

_______________________________________________
Hipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/hipsec