Subject: A comment on draft-ietf-l2tpext-security-02.txt

From: "Wang, Cliff" <[email-masked]>
Date: Wed, 14 Feb 2001 22:08:30 -0000

In section 7.5 of the draft:

Anytime IKE receives a phase 1 or phase 2 delete message, IKE should
notify L2TP this event has occurred.

The word here is "should", but I think that a "MUST" should be used instead
since the IPsec tunnel is to protect the L2TP tunnel. If such protection is
gone, the L2TP should be torn down as well. This view is supported by
Section 7.7 of this draft, which mandates a "MUST" for IPsec tunnel
protection of a L2TP tunnel.

In Section 7.7
7.7.  Per-packet Security Checks

When a packet arrives from a tunnel which requires security, L2TP MUST:

1) check to ensure that the packet was decrypted and/or authenticated by
IPsec.  Since IPsec already verifies that the packet arrived in the
correct SA, L2TP can be assured that the packet was indeed sent by a
trusted peer and that it did not arrive in the clear.

2) verify that the IP addresses and UDP port values in the packet match
the socket information which was used to setup the L2TP tunnel.  This
step prevents malicious peers from spoofing packets into other tunnels.

---

From: Skip Booth <[email-masked]>
Date: Wed, 14 Feb 2001 22:10:04 -0500

> protection of a L2TP tunnel.

Just because the SA has been deleted, doesn't imply that the protection
provided by IPsec has disappeared.  Even after the SA has been deleted, the
implementation still should have the policy and corresponding L2TP packet
filters to guarentee that any L2TP traffic is protected and new SA's are
kicked off if needed.  Since the work which results from a delete message
is somewhat implementation dependent this was a SHOULD versus a MUST.

As long as the L2TP tunnel is established, the security checks outlined in
section 7.7 should be in place.  I don't perceive any dependency on section
7.5 for this requirement.

-Skip