netdev - Re: [PATCH] AH4: Update IPv4 options handling to conform to RFC 4302.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20070822.123444.108812154.davem@davemloft.net>
Date:	Wed, 22 Aug 2007 12:34:44 -0700 (PDT)
From:	David Miller <davem@...emloft.net>
To:	nbowler@...ipticsemi.com
Cc:	netdev@...r.kernel.org
Subject: Re: [PATCH] AH4: Update IPv4 options handling to conform to RFC
 4302.

From: Nick Bowler <nbowler@...ipticsemi.com>
Date: Wed, 22 Aug 2007 10:22:53 -0400

> In testing our ESP/AH offload hardware, I discovered an issue with how AH
> handles mutable fields in IPv4.  RFC 4302 (AH) states the following on the
> subject:
> 
>         For IPv4, the entire option is viewed as a unit; so even
>         though the type and length fields within most options are immutable
>         in transit, if an option is classified as mutable, the entire option
>         is zeroed for ICV computation purposes.
> 
> The current implementation does not zero the type and length fields, resulting
> in authentication failures when communicating with hosts that do (i.e. FreeBSD).
> 
> I have tested record route and timestamp options (ping -R and ping -T) on a
> small network involving Windows XP, FreeBSD 6.2, and Linux hosts, with one
> router.  In the presence of these options, the FreeBSD and Linux hosts (with
> the patch or with the hardware) can communicate.  The Windows XP host simply
> fails to accept these packets with or without the patch.
> 
> I have also been trying to test source routing options (using traceroute -g),
> but haven't had much luck getting this option to work *without* AH, let alone
> with.
> 
> Signed-off-by: Nick Bowler <nbowler@...ipticsemi.com>

Patch applied, thanks a lot Nick.
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html