netdev - [RFC] mark MD5 as broken in older (stable) kernels

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080709095851.1f9da054@speedy>
Date:	Wed, 9 Jul 2008 09:58:51 -0700
From:	Stephen Hemminger <stephen.hemminger@...tta.com>
To:	"Adam Langley" <agl@...erialviolet.org>
Cc:	davem@...emloft.net, netdev@...r.kernel.org
Subject: [RFC] mark MD5 as broken in older (stable) kernels

The following should probably be sent to stable kernel tree to disable
MD5 in older kernels. It will avoid problems for all those vendor
kernels.

--- a/net/ipv4/Kconfig	2008-07-09 09:52:50.000000000 -0700
+++ b/net/ipv4/Kconfig	2008-07-09 09:54:27.000000000 -0700
@@ -622,7 +622,7 @@ config DEFAULT_TCP_CONG
 
 config TCP_MD5SIG
 	bool "TCP: MD5 Signature Option support (RFC2385) (EXPERIMENTAL)"
-	depends on EXPERIMENTAL
+	depends on EXPERIMENTAL && BROKEN
 	select CRYPTO
 	select CRYPTO_MD5
 	---help---
@@ -631,6 +631,8 @@ config TCP_MD5SIG
 	  on the Internet.
 
 	  If unsure, say N.
+	  The current version is broken for case of TCP SACK and devices that
+          use TSO or Scatter/Gather.
 
 source "net/ipv4/ipvs/Kconfig"
 
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html