lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 24 Feb 2009 09:23:39 -0800 From: "Paul Moore" <paul.moore@...trify.com> To: "Herbert Xu" <herbert@...dor.apana.org.au> Cc: <kaber@...sh.net>, <davem@...emloft.net>, <netdev@...r.kernel.org> Subject: RE: xfrm selector generating IKE are you sure that works. the xfrm code in the kernel does not look at the policy selector when checking port numbers to see if it should reuse an existing SA. It only looks at the selector on the SA - this is why racoon has a problem. The policy selector has the correct portness in it but the SA does not. I have not tested it but I suspect openswan has the same issue since it passes in an empty SA selector -----Original Message----- From: Herbert Xu [mailto:herbert@...dor.apana.org.au] Sent: Monday, February 23, 2009 6:09 PM To: Paul Moore Cc: kaber@...sh.net; davem@...emloft.net; netdev@...r.kernel.org Subject: Re: xfrm selector generating IKE On Mon, Feb 23, 2009 at 05:31:29PM -0800, Paul Moore wrote: > Do you know which version of *swan generates xfrm selectors when it does > an SA ADD or UPDATE. I downloaded openswan 2.6.19 and it does not The selector logic doesn't work very well with nested tunnels which is why I didn't use it for the original Openswan port. We rely on the policy selector instead to do the job. Cheers, -- Visit Openswan at http://www.openswan.org/ Email: Herbert Xu ~{PmV>HI~} <herbert@...dor.apana.org.au> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists