Typo - routes
> of ICMP to avoid this potential attack? This would sound like overkill
> to me, and there would be still enough other ways to generate retry packets
> left (e.g. with TCP).
Not really.
> Also the tunnel start point has to be secured anyways, otherwise
> all the encryption wouldn't make sense. Similar for the tunnel endpoint.
>
> Or do I miss something?
The DF frames are coming from hosts that the tunnel passes through, not
from inside the tunnel. That is the problem.
Frames from the tunnel itself are protected and encrypted, but any icmp
generated by the tunnel itself are unencrypted and unsigned so cannot be
trusted
Alan
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/