Re: Remove tunnel mode from ipsec-tunnels-02?

[Pekka Savola <pekkas@netcore.fi>]

I reordered the response to get the most important bits first.  As I 
suspected, we've been in full agreement about the issue all along, but 
have disagreed about what "tunnel mode" means,

On Sun, 10 Sep 2006, Fred Baker wrote:
> As RFC 4303 uses the terms, I don't think you can support the claim that 
> Transport Mode can be implemented by positioning an interior IP header. It 
> may be that the thing that you are trying to excise is in fact that usage - 
> transport mode being applied between tunnel endpoints around other kinds of 
> tunnels.
>
> In any event, I don't expect people to stop using L2TP to provide a tunnel 
> service, or GRE as a way to overlay CE-CE VPNs.

I don't expect either, which is why we're describing how to protect 
such tunnels with IPsec using transport mode.  That's actually why GRE 
and L2TP specifications either mandate supporting transport mode 
(while tunnel mode is a MAY) or specify that transport mode SHOULD be 
used.  See e.g. RFC4023 section 8.1 and RFC 3193.

And the rest, if it's still relevant,

> > I think we're in full agreement about the fundamental issue: there should 
> > be an inner IP header that's protected by IPsec.  The point is that it can 
> > be provided either by transport or tunnel mode, and based on our analysis 
> > 'tunnel mode' is a more constrained way of making such a tunnel and 
> > therefore less preferred.
>
> I would encourage you to not look at presentations, but at the controlling 
> specifications, for the use of the term. Specifically I'm thinking about RFC 
> 4303, which very explicitly defines tunnel mode as having an interior IP 
> header (section 3.1.2) and transport mode as proceeding end to end without 
> using an interior header (section 3.1.1).
> [...]

That misses the point.  Transport mode is applied "end to end" but the 
endpoints of a transport mode-protected tunnel are the tunnel 
endpoints so it is in end-to-end (with encapsulator/decapsulator being 
the endpoints).  Also, while one could correctly say "The next-header 
of an IPsec ESP header is an interior IP header if the IPsec SA is 
tunnel mode" you cannot substitute "if" with "if and only if".

--
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings