RE: Is IP address spoofing possible with ESP transport

Thanks Stephen and others for helpful answers!

Especially the reference to section 5.2.1 of RFC2401 was very useful.

Br, Son
================= 
Stephen J. Bevan <[email protected]> writes:

> Son Phan writes:
> [snip]
>  > Question:
> [snip]
>  > -There is a source address field in SA. Is it mandatory 
to check
>  > this value against the source IP address to protect the 
above case?
> 
> In general for transport mode the packet's source address 
must match
> the SA selector value for the SA indicated by the packet's 
SPI value.
> See See RFC 2401 section 5.2.1 step 2 for the gory details 
and
> exceptions.
> 
>  > I have some doubt about it as it can be wildcast in 
many cases.
>  > 
>  > -Is there any measure to protect the case described 
here?
> 
> Your scenario left out how Bob's SA was created (manually, 
via IKE,
> via some other keying protocol) and what values it 
contains so I don't
> know if there is a specific case or you are interested in 
or all
> variations.  Either way, if spoofing is something you want 
to avoid
> then don't use a wildcard or range in an SA.  This doesn't 
mean you
> can't have wildcards in any templates that are used to 
generate an SA,
> just not in the SA.  See for example RFC 2401 section 4.4.
1 which
> mentions how a SA with a single source address can result 
from a SPD
> entry with a wildcard address.
>