netdev - Re: [PATCH] xfrm: Accept ESP packets regardless of UDP encapsulation mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 18 Dec 2008 15:14:19 +1100
From:	Herbert Xu <herbert@...dor.apana.org.au>
To:	David Miller <davem@...emloft.net>
Cc:	martin@...ongswan.org, netdev@...r.kernel.org
Subject: Re: [PATCH] xfrm: Accept ESP packets regardless of UDP
	encapsulation mode

On Thu, Dec 18, 2008 at 02:57:58PM +1100, Herbert Xu wrote:
>
> However, I can't see why you would ever need to switch between
> having UDP encapsulation and not having it, without negotiating
> it with the peer.  That is, the UDP encapsulation works whether
> you have NAT or not.
> 
> Do you have a specific quote that I can check against?

A quick google failed to reveal any specific requirements apart
from the need to move in and out of NAT environments.

That isn't actually an issue because when your addresses change
you have to renegotiate with the other side to ensure that this
isn't some kind of an attack.  Afterwards you have to recreate
the SAs at which point you can easily set the encapsulation to
whatever it should be.

The only time when you need this patch is if the other side
unilaterally switched from NAT-T to no NAT-T, or vice versa,
which does not sound like a sane thing to do.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@...dor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html