From owner-freebsd-security@FreeBSD.ORG  Sat Jan 17 13:29:06 2004
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id B252716A4CE
	for <security@freebsd.org>; Sat, 17 Jan 2004 13:29:06 -0800 (PST)
Received: from ebb.errno.com (ebb.errno.com [66.127.85.87])
	by mx1.FreeBSD.org (Postfix) with ESMTP id B705743D2F
	for <security@freebsd.org>; Sat, 17 Jan 2004 13:29:05 -0800 (PST)
	(envelope-from sam@errno.com)
Received: from 66.127.85.91 ([66.127.85.91])
	(authenticated bits=0)
	by ebb.errno.com (8.12.9/8.12.9) with ESMTP id i0HLT4HQ054140
	(version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=NO);
	Sat, 17 Jan 2004 13:29:05 -0800 (PST)
	(envelope-from sam@errno.com)
From: Sam Leffler <sam@errno.com>
Organization: Errno Consulting
To: Mike Tancsa <mike@sentex.net>, <mhdz@tamaulipas.gob.mx>
Date: Sat, 17 Jan 2004 13:33:26 -0800
User-Agent: KMail/1.5.3
References: <6.0.1.1.0.20040116122719.05c75910@209.112.4.2>
	<OBEDIBLCPGDBKELHKALKGEBGCAAA.mhdz@tamaulipas.gob.mx>
	<6.0.1.1.0.20040116134753.03e16c08@209.112.4.2>
In-Reply-To: <6.0.1.1.0.20040116134753.03e16c08@209.112.4.2>
MIME-Version: 1.0
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <200401171333.26083.sam@errno.com>
X-Mailman-Approved-At: Mon, 19 Jan 2004 02:15:11 -0800
cc: security@freebsd.org
Subject: Re: HiFn  / FAST_IPSEC question
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 17 Jan 2004 21:29:06 -0000

On Friday 16 January 2004 10:48 am, Mike Tancsa wrote:
> I am more curious about what happens if you try 194 sessions on one or 65
> on the other, not why one is rated lower than the other.
>

When you try to allocate the SPI it will fail because you won't be able to 
create a crypto session (this is FAST_IPSEC only).  The right thing to do 
(probably) is to fallback to s/w crypto but I don't believe the existing 
crypto framework is smart enough.

	Sam