Re: proposed IPSEC changes/extensions

[David Wagner <[e-mail]>]

In article <v02130505ae9a8af26d4c@[128.89.30.6]>,
Stephen Kent  <[e-mail]> wrote:
>        The document explains the need to support AH and both transport and
> tunnel modes of ESP, based on the context (host vs. security gateway).
> However, what about nested combinations of these protocols?  It probably is
> not reasonable to require an implementation to support all possible
> combinations of these headers, nested to any depth.

While I don't know what the requirements ought to be, I thought I'd throw
in a brief word of implementation experience.

When I was implementing ipsec, I found that handling arbitrarily-nested
combinations was easy.  On inbound processing, just strip off an ipsec
header, and recurse: throw the packet back in the inbound queue.  (You
only have to maintain a bit of state for authentication.)

Certainly support for *sending* packets with arbitrarily-nested headers
is harder to implement.  But that's fine; either way, we ought to

    Be conservative in what you send and liberal in what you'll accept.