netdev - RE: IPv6 IPSec incompatibilities between 2.6.23 and 3.6.18 (and probably later)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 19 Jul 2016 15:03:33 +0000
From:	Ilan Tayari <ilant@...lanox.com>
To:	Pommnitz Jörg <Pommnitz@...g.de>
CC:	"netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: RE: IPv6 IPSec incompatibilities between 2.6.23 and 3.6.18 (and
 probably later)

 > On the receiving side (e.g. fd01:1b10:1000::1) I see the decrypted packets with
> the 2.6.23 kernel:
> but NOT with the newer kernel:

Hi Joerg,

First steps to debug this would be:
cat /proc/net/xfrm_stat
ip -s xfrm state
ip -s xfrm policy

First command will show some error accounting, which can point to the culprit code.
Second and third command will show existing objects, and some statistics like when the last packet was used with them.

Last thing - for your safety you should keep those session keys private.

Ilan.