From owner-freebsd-security@FreeBSD.ORG Tue Apr 27 11:44:26 2004 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 1C11016A4CE for ; Tue, 27 Apr 2004 11:44:26 -0700 (PDT) Received: from rwcrmhc12.comcast.net (rwcrmhc12.comcast.net [216.148.227.85]) by mx1.FreeBSD.org (Postfix) with ESMTP id DEEFD43D53 for ; Tue, 27 Apr 2004 11:44:25 -0700 (PDT) (envelope-from cristjc@comcast.net) Received: from blossom.cjclark.org (c-24-6-187-112.client.comcast.net[24.6.187.112]) by comcast.net (rwcrmhc12) with ESMTP id <2004042718442401400i59vse>; Tue, 27 Apr 2004 18:44:24 +0000 Received: from blossom.cjclark.org (localhost. [127.0.0.1]) by blossom.cjclark.org (8.12.9p2/8.12.8) with ESMTP id i3RIiN8B088612; Tue, 27 Apr 2004 11:44:23 -0700 (PDT) (envelope-from cristjc@comcast.net) Received: (from cjc@localhost) by blossom.cjclark.org (8.12.9p2/8.12.9/Submit) id i3RIiMxc088611; Tue, 27 Apr 2004 11:44:22 -0700 (PDT) (envelope-from cristjc@comcast.net) X-Authentication-Warning: blossom.cjclark.org: cjc set sender to cristjc@comcast.net using -f Date: Tue, 27 Apr 2004 11:44:22 -0700 From: "Crist J. Clark" To: Greg Troxel Message-ID: <20040427184422.GA88369@blossom.cjclark.org> References: <40885ECF.22456.1C68F42E@localhost> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4.2.1i X-URL: http://people.freebsd.org/~cjc/ cc: freebsd-security@FreeBSD.org cc: Dan Langille Subject: Re: IPsec - got ESP going, but not AH X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: "Crist J. Clark" List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Apr 2004 18:44:26 -0000 On Fri, Apr 23, 2004 at 08:02:15AM -0400, Greg Troxel wrote: > While this should probably work, it's more straightforward to use ESP > with integrity protection. That is, use a -A hmac-sha1 argument also > to ESP. (hmac-md5 is probably still fine, but sha1 goes better > strength-wise with rijndael-cbc.) > > I believe that in tunnel mode AH and ESP integrity are essentially > identical - but read RFC2401 and rfc2401bis (i-d from ipsec wg) if you > really want to understand. Not true. ESP integrity does not cover the IP header, only the ESP payload. Look at the diagrams in section 3.1 of RFC2406. > In transport mode, AH protects parts of > the original (and only) IP header. Not true. AH protects the entire datagram, including payload. Again hop down to section 3.1 of RFC2402 for that RFC-ASCII art we all love so much. As for the original problem. I've seen AH problems before. Follow the "Single IP host and IPsec tunnel mode experience" thread from -hackers from last year about this time. -- Crist J. Clark | cjclark@alum.mit.edu | cjclark@jhu.edu http://people.freebsd.org/~cjc/ | cjc@freebsd.org