netdev - Re: Influencing triggering of xfrm acquire messages?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20110811.073645.142128983331087817.davem@davemloft.net>
Date:	Thu, 11 Aug 2011 07:36:45 -0700 (PDT)
From:	David Miller <davem@...emloft.net>
To:	david.martin.mailbox@...glemail.com
Cc:	netdev@...r.kernel.org
Subject: Re: Influencing triggering of xfrm acquire messages?

From: David Martin <david.martin.mailbox@...glemail.com>
Date: Thu, 11 Aug 2011 16:21:07 +0200

> As long as it exists no additional acquire will be triggered which is a problem,
> for example when shortly after an exchange the daemon is restarted and needs to
> start another exchange with the same peer host.
> 
> Is this state supposed to be set up? Is it supposed to be removed automatically
> once we set up our own SA? Is there a way to remove it manually to
> trigger another acquire? Any input is welcome, thanks a lot in advance.

The usage model is that the IPSEC daemon, like a routing daemon, manages
all IPSEC state.  And therefore it flushes all IPSEC state when it starts
up.

If you want the acquire messages, you need to flush the entries for which
you want the acquire to trigger when you startup.

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html