Date: Fri, 21 Nov 2014 01:20:33 +0300 From: "Andrey V. Elsukov" <ae@FreeBSD.org> To: freebsd-net@FreeBSD.org, freebsd-security@FreeBSD.org Subject: Re: IPsec is very broken... Message-ID: <546E6931.20406@FreeBSD.org> In-Reply-To: <20141120213526.GH24601@funkthat.com> References: <20141120213526.GH24601@funkthat.com>
next in thread | previous in thread | raw e-mail | index | archive | help
This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--09FKR9v2hpJiJmT7vEP5u19xTMXe8to3d
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: quoted-printable
On 21.11.2014 00:35, John-Mark Gurney wrote:
> As I'm about to commit my AES-GCM work, I've been trying to do
> some testing to make sure I didn't break IPsec.
>=20
> The first major issue I ran across was transport mode... ae@ has been
> nice enough to get ICMP working in transport mode for IPv4 and IPv6,
> but it looks like TCP is still broken. I haven't tested UDP yet...
> So, IPsec even w/o crypto is fundamentally broken here... It's clear
> that not many people run transport mode...
>=20
> If someone could create a good test suite that ensures makes sure basic=
> IPsec traffic passes, that would be a huge win for us. The tests
> should test a complete cross product of: { tunnel, transport } x
> { TCP, UDP, ICMP, any others? } x { IPv4, IPv6 }. Please add to this
> list.
I usually do tests for both transport and tunnel modes with and without
gif(4)/gre(4). So, just tried between two CURRENT hosts and it works.
I use racoon and isakmpd for IKE. ICMP, TCP (ssh) and UDP (ike) works
for me. How do you test? Do you use software crypto or aesni?
--=20
WBR, Andrey V. Elsukov
--09FKR9v2hpJiJmT7vEP5u19xTMXe8to3d
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQEcBAEBAgAGBQJUbmk1AAoJEAHF6gQQyKF6lhQIALjov+pssuB8eYB3YTCIo02q
RN9OzxW4nwbbEs82q3UqAxRR+oZlgEwDkVvORieJeWguBA0uhaILegiQGnG4WhXD
TTITHC0upzoSKJ/mcEglCmBZcBTZX4CQ9lgSrNShgRwHPlrihmARz3PlxtswtXqE
zioNtUaKAcC0aBRDiMbAK1/ODgoJvp4GCfKYlhkUxsoG3GiGM2uxstHXSzPh8hwZ
ev4K0YmVgPUdB0orlQ6GpYIii3nclllNyi7hHnYqfkMupsDJ2EqH8WYYOMvUAhuy
eInkcULgx67euruZ+enxtMlf2PxmZFVOxTDS+vfqqRdLN8tZE1/BYa+zhvviRb0=
=x6EG
-----END PGP SIGNATURE-----
--09FKR9v2hpJiJmT7vEP5u19xTMXe8to3d--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?546E6931.20406>