netdev - Re: [PATCH] xfrm: Accept ESP packets regardless of UDP encapsulation mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20081218205406.GA451@gondor.apana.org.au>
Date:	Fri, 19 Dec 2008 07:54:06 +1100
From:	Herbert Xu <herbert@...dor.apana.org.au>
To:	Martin Willi <martin@...ongswan.org>
Cc:	davem@...emloft.net, netdev@...r.kernel.org
Subject: Re: [PATCH] xfrm: Accept ESP packets regardless of UDP
	encapsulation mode

On Thu, Dec 18, 2008 at 01:36:56PM +0100, Martin Willi wrote:
> 
> >From the key manager perspective, I can enable or disable UDP
> encapsulation, fine. I decide locally what I'll use for outgoing
> packets. But how should I know what the peer uses? I can't, it isn't
> negotiated. It is, by the standard, perfectly valid to send UDP
> encapsulated packets if the peer wants to do so. And there is no need to
> communicate this to the key manager, there is actually no such mechanism
> in IKEv2. Therefore I need the kernel to accept packet, encapsulated or
> not.

Even if the kernel did accept such packets, there is no guarantee
that your return traffic will make it back to the other side because
stateful firewalls may be present.

Responding with unencapsulated ESP traffic when the peer is sending
you UDP-encapsulated traffic is just not going to fly.

BTW I think the IKEv2 draft has stuffed it up on this one (though
luckily it hasn't made it to RFC yet).  I'll open a report on it.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@...dor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html