Re: IPsec thing with REAP

[Pekka Savola <pekkas@netcore.fi>]

On Mon, 10 Mar 2008, Iljitsch van Beijnum wrote:
> To protect against spoofed keepalive packets, a host implementing both shim6 
> and IPsec MAY ignore incoming REAP keepalives if it has good reason to assume 
> that the other side will be sending IPsec-protected return traffic. I.e., if 
> a host is sending TCP data, it can reasonably expect to receive TCP ACKs in 
> return. If no IPsec-protected ACKs come back but unprotected keepalives do, 
> this could be the result from an attacker trying to hide broken connectivity.

I wonder how actionable this is from an implementor point of view.

Does a REAP implementor have access to the IPsec and TCP data and 
state in example you gave?  How?` Even if there was such access, it's 
not obvious to make what kind of algorithm could be applied that would 
be reliable.

--
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings