netdev - RE: xfrm selector generating IKE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 24 Feb 2009 09:23:39 -0800
From:	"Paul Moore" <paul.moore@...trify.com>
To:	"Herbert Xu" <herbert@...dor.apana.org.au>
Cc:	<kaber@...sh.net>, <davem@...emloft.net>, <netdev@...r.kernel.org>
Subject: RE: xfrm selector generating IKE

are you sure that works. the xfrm code in the kernel does not look at
the policy selector when checking port numbers to see if it should reuse
an existing SA. It only looks at the selector on the SA - this is why
racoon has a problem. The policy selector has the correct portness in it
but the SA does not. I have not tested it but I suspect openswan has the
same issue since it passes in an empty SA selector

-----Original Message-----
From: Herbert Xu [mailto:herbert@...dor.apana.org.au] 
Sent: Monday, February 23, 2009 6:09 PM
To: Paul Moore
Cc: kaber@...sh.net; davem@...emloft.net; netdev@...r.kernel.org
Subject: Re: xfrm selector generating IKE

On Mon, Feb 23, 2009 at 05:31:29PM -0800, Paul Moore wrote:
> Do you know which version of *swan generates xfrm selectors when it
does
> an SA ADD or UPDATE. I downloaded openswan 2.6.19 and it does not

The selector logic doesn't work very well with nested tunnels
which is why I didn't use it for the original Openswan port.
We rely on the policy selector instead to do the job.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@...dor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html