netdev - Re: IPsec PMTUD problem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20070405120425.GC10972@gondor.apana.org.au>
Date:	Thu, 5 Apr 2007 22:04:25 +1000
From:	Herbert Xu <herbert@...dor.apana.org.au>
To:	Patrick McHardy <kaber@...sh.net>
Cc:	Linux Netdev List <netdev@...r.kernel.org>
Subject: Re: IPsec PMTUD problem

On Tue, Apr 03, 2007 at 06:32:07PM +0200, Patrick McHardy wrote:
> 
> I'm not sure I understand how this would work, the ICMP message
> looks the same in both cases. Or are you suggesting to
> differentiate based on the source of the ICMP message?

Actually you're right, this can't work in the general case.  Even
if we had real devices for IPsec tunnels, there is still no way to
reliably figure out which device we should attribute a given MTU
event to if the same address appears on more than one device.

> Yes, that would work as a workaround, but it still seems like
> something worth fixing.

One possible solution is to not send MTU errors to ourselves since
we it wouldn't give us any new information.  We'd need to audit the
users of icmp_send to make sure that there isn't a legitimate case
where we'd want to do that.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@...dor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html