[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <270203ee-e1a8-7dfa-5ac2-d8b0ee392ff0@nohats.ca>
Date: Tue, 24 Oct 2023 13:31:51 -0400 (EDT)
From: Paul Wouters <paul@...ats.ca>
To: Willem de Bruijn <willemdebruijn.kernel@...il.com>
cc: antony.antony@...unet.com, devel@...ux-ipsec.org,
Andreas Gruenbacher <agruenba@...hat.com>, netdev@...r.kernel.org
Subject: Re: [devel-ipsec] [RFC PATCH ipsec-next] udpencap: Remove Obsolete
UDP_ENCAP_ESPINUDP_NON_IKE Support
On Tue, 24 Oct 2023, Willem de Bruijn via Devel wrote:
> I don't know how important this is, but a quick online search brought
> up one package: https://github.com/rdratlos/racoon-ipsec-tools.git
>
> Behind #if defined(ENABLE_NATT_00) || defined(ENABLE_NATT_01), so
> probably there unused too.
Also: https://ipsec-tools.sourceforge.net/
Important Note
The development of ipsec-tools has been ABANDONED.
ipsec-tools has security issues, and you should not use it. Please
switch to a secure alternative!
There are known unfixed CVEs in that codebase.
While Apple and Android have their own clones of this code for IKEv1,
even basically all 20+ year old IKEv1 clients support the draft 02/03/05
versions that obsoletes the 00/01 draft code.
Paul
Powered by blists - more mailing lists