netdev - Re: [devel-ipsec] [RFC PATCH ipsec-next] udpencap: Remove Obsolete UDP_ENCAP_ESPINUDP_NON

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 24 Oct 2023 13:31:51 -0400 (EDT)
From: Paul Wouters <paul@...ats.ca>
To: Willem de Bruijn <willemdebruijn.kernel@...il.com>
cc: antony.antony@...unet.com, devel@...ux-ipsec.org, 
    Andreas Gruenbacher <agruenba@...hat.com>, netdev@...r.kernel.org
Subject: Re: [devel-ipsec] [RFC PATCH ipsec-next] udpencap: Remove Obsolete
 UDP_ENCAP_ESPINUDP_NON_IKE Support

On Tue, 24 Oct 2023, Willem de Bruijn via Devel wrote:

> I don't know how important this is, but a quick online search brought
> up one package: https://github.com/rdratlos/racoon-ipsec-tools.git
>
> Behind #if defined(ENABLE_NATT_00) || defined(ENABLE_NATT_01), so
> probably there unused too.

Also: https://ipsec-tools.sourceforge.net/

 	Important Note
 	The development of ipsec-tools has been ABANDONED.

 	ipsec-tools has security issues, and you should not use it. Please
 	switch to a secure alternative!

There are known unfixed CVEs in that codebase.

While Apple and Android have their own clones of this code for IKEv1,
even basically all 20+ year old IKEv1 clients support the draft 02/03/05
versions that obsoletes the 00/01 draft code.

Paul