Re: Issue 41: Mandate NAT prevention if not doing NAT-T?

First attempt:

IKE uses addresses it runs over, taken from IP headers, as
endpoint addresses for IPsec SAs it establishes. If the
addresses are left unprotected, an attacker can redirect the IPsec
traffic to a third party just modifying the IP header of some IKE messages.
Either NAT_DETECTION_*_IP or NO_NATS_ALLOWED detect the modification
of the IP header on the path, including this attack.

Regards

[email protected]