netdev - Re: [PATCH] xfrm: Accept ESP packets regardless of UDP encapsulation mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20081218035758.GA31610@gondor.apana.org.au>
Date:	Thu, 18 Dec 2008 14:57:58 +1100
From:	Herbert Xu <herbert@...dor.apana.org.au>
To:	David Miller <davem@...emloft.net>
Cc:	martin@...ongswan.org, netdev@...r.kernel.org
Subject: Re: [PATCH] xfrm: Accept ESP packets regardless of UDP
	encapsulation mode

On Wed, Dec 17, 2008 at 07:49:42PM -0800, David Miller wrote:
>
> IKEv2 daemon needs to be agnostic about this situation.  So we have to
> accept everything, regardless of configured encapsulation type.
> 
> At least that is my impression after reading the MOBIKE documents.

The NAT-T encapsulation is an SA-specific attribute, so it's
decided when the SA is negotiated.  There is a mechanism for
detecting changes in the peer's address and updating the SA.

However, I can't see why you would ever need to switch between
having UDP encapsulation and not having it, without negotiating
it with the peer.  That is, the UDP encapsulation works whether
you have NAT or not.

Do you have a specific quote that I can check against?

Thanks,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@...dor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html