Date: Sun, 12 May 2002 12:06:15 +0200 From: quak@mydiax.ch To: freebsd-security@FreeBSD.org Subject: IPSEC: is ipcomp broken in 4.5-stable ? Message-ID: <200205121006.g4CA6FM01637@dubb05h07-0.dplanet.ch>
next in thread | raw e-mail | index | archive | help
Greetings, Is there anyone who have gotten the ipsec compression (ipcomp) working in the 4.5-stable ?? We try to establish a transport compression between 2 machines with following setkey setup Box 1 (192.168.20.1) add 192.168.20.1 192.168.10.1 ipcomp 2010 -C deflate; add 192.168.10.1 192.168.20.1 ipcomp 1020 -C deflate; spdadd 192.168.20.1 192.168.10.1 any -P out ipsec ipcomp/transport//require; spdadd 192.168.10.1 192.168.20.1 any -P in ipsec ipcomp/transport//require; Box 2 (192.168.10.1) add 192.168.20.1 192.168.10.1 ipcomp 2010 -C deflate; add 192.168.10.1 192.168.20.1 ipcomp 1020 -C deflate; spdadd 192.168.10.1 192.168.20.1 any -P out ipsec ipcomp/transport//require; spdadd 192.168.20.1 192.168.10.1 any -P in ipsec ipcomp/transport//require; Now we can ping both machines, but as soon as we begin doing a simple ftp transfer from box1 to box2, the transfer will *always* hang up at the 34816 bytes transferred. There seems to be some mess in the compression / decompression mechanism, because if we add a racoon to this mix (Default configuration, no changes to racoon.conf, just psk.txt entries on both boxes) the transfers suddenly begin to work better, that is: we infact get some major speed boost, but it comes in waves, time to time boxes will spit out something like ipcomp_decompress: inflate(Z_FINISH): unknown error (-2) and transfer will stall for 3-6 seconds, the proceed again. Also, the setkey does not accept lzs as an compression option. man setkey says that it should. What is going on ? Regards Kirill To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200205121006.g4CA6FM01637>