Subject: a question about tunnels

From: "marcelo bagnulo" <[email-masked]>
Date: Thu, 5 Feb 2004 19:18:49 +0100

Hi,

I have a very simple question about tunnels, but i am a bit confused by what
i have found in the specs, so perhaps someone could help me.

The question is: what is the behaviour of a host, that doesn't have any
configured tunnel, when it receives a tunneled packet addressed to him (both
destination addresses, inner and outer, are assigned to the host)?

Suppose that you have a host A with a single IP address IPA
The host receives a IP in IP encapsulated packet
The inner IP header contains destiantion address IPA and source address IPB
The outer IP header contains destiantion address IPA and source address IPC
The Host A has no configured tunnel With IPC

What does the host does with this packet?

I would expect that the packet is discarded. This IMHO would be the
behaviour coherent with the proposed processing of the HoA option of MIPv6.

However, in RFC 2003 (security considerations), it is stated that:

Host implementations that are capable of receiving encapsulated IP
datagrams SHOULD admit only those datagrams fitting into one or more
of the following categories:

[...]
    -  The encapsulated (inner) datagram is addressed to a network
       interface belonging to the decapsulator

So, RFC 2003 recomends that nodes should accept these packets...

Is this correct?
I mean, if this is so, the transport layer survivability problem could be
easier, i guess

Thanks, marcelo

---

From: Kurt Erik Lindqvist <[email-masked]>
Date: Mon, 9 Feb 2004 21:06:34 +0100

> I mean, if this is so, the transport layer survivability problem could 

I am guessing, but my guess is that the host accepts the packet but 
what happens then is up to the ULP in question.

- - kurtis -

---

From: Pekka Savola <[email-masked]>
Date: Tue, 10 Feb 2004 07:40:37 +0200 (EET)

> destination addresses, inner and outer, are assigned to the host)?

IPv6-in-IPv4 configured tunneling spec, 
draft-ietf-v6ops-mech-v2-02.txt, at least discards them.  And IMHO 
that's what should be done, unless one specifies a specific tunneling 
speudo-interface which is open to the whole world and accepts specific 
kind of packets (a bad idea, I think).

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

---

From: Kurt Erik Lindqvist <[email-masked]>
Date: Tue, 10 Feb 2004 08:29:37 +0100

> draft-ietf-v6ops-mech-v2-02.txt, at least discards them.

So, what you are saying is that IPv4-in-IPv4 and IPv6-in-IPv6 and 
IPv6-in-IPv4 all could behave differently? Wasn't someone to write a 
v6ops security document? Shouldn't this go in there? And aren't we on 
the wrong mailinglist then? :-)

>  And IMHO

Agreed.

- - kurtis -

---

From: "marcelo bagnulo" <[email-masked]>
Date: Tue, 10 Feb 2004 10:39:29 +0100

Pekka, Kurtis, Thanks for the answers...

> kind of packets (a bad idea, I think).

Yes, that what i expected, but i couldn't find it stated as a requirement in
any spec

Regards, marcelo