netdev - Re: [RFC] Fixing up TCP/UDP checksum for UDP encap. ESP4 packets in transport mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 7 Jul 2009 10:18:45 +0800
From:	Herbert Xu <herbert@...dor.apana.org.au>
To:	David Miller <davem@...emloft.net>
Cc:	christophe@...ut.de, netdev@...r.kernel.org
Subject: Re: [RFC] Fixing up TCP/UDP checksum for UDP encap. ESP4 packets
	in transport mode

On Mon, Jul 06, 2009 at 07:02:35PM -0700, David Miller wrote:
>
> Indeed, there is no way to handle checksums sanely.  The whole
> end-to-end protection of the checksum would be entirely subverted
> if we fixed it up.

Exactly, the only safe solution is to use natoa to fix up the
checksums properly (doable in theory, but almost no one actually
uses it in practice, as seen by the fact that it's not even
possible with the current spec of IKEv2), or better yet, use
tunnel mode.  20 bytes is small change on the Internet.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@...dor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html