From owner-freebsd-net@FreeBSD.ORG Fri Jun 16 17:43:59 2006 Return-Path: X-Original-To: freebsd-net@freebsd.org Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 0DE9816A474 for ; Fri, 16 Jun 2006 17:43:59 +0000 (UTC) (envelope-from andre@freebsd.org) Received: from c00l3r.networx.ch (c00l3r.networx.ch [62.48.2.2]) by mx1.FreeBSD.org (Postfix) with ESMTP id 97B9143D48 for ; Fri, 16 Jun 2006 17:43:57 +0000 (GMT) (envelope-from andre@freebsd.org) Received: (qmail 13453 invoked from network); 16 Jun 2006 17:44:12 -0000 Received: from c00l3r.networx.ch (HELO [127.0.0.1]) ([62.48.2.2]) (envelope-sender ) by c00l3r.networx.ch (qmail-ldap-1.03) with SMTP for ; 16 Jun 2006 17:44:12 -0000 Message-ID: <4492EDDA.6080406@freebsd.org> Date: Fri, 16 Jun 2006 19:43:54 +0200 From: Andre Oppermann User-Agent: Thunderbird 1.5.0.4 (Windows/20060516) MIME-Version: 1.0 To: Max Laier References: <20060615225312.GB64552@heff.fud.org.nz> <200606161735.33801.max@love2party.net> <200606161805.06651.max@love2party.net> In-Reply-To: <200606161805.06651.max@love2party.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: freebsd-net@freebsd.org, freebsd-arch@freebsd.org, Andrew Thompson , Scott Ullrich Subject: Re: enc0 patch for ipsec X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Jun 2006 17:43:59 -0000 Max Laier wrote: > On Friday 16 June 2006 17:41, Scott Ullrich wrote: >> On 6/16/06, Max Laier wrote: >>> I think it should get a "device enc" on its own. Some people might >>> consider enc(4) to be a security problem so getting it with FAST_IPSEC >>> automatically isn't preferable. >> You have to specifically create the enc0 interface (ifconfig enc0 >> create) before it becomes active. Otherwise it will not hit the enc >> code path unless the device is created. > > The issue is, if an attacker manages to get root on your box they are > automatically able to read your IPSEC traffic ending at that box. If you > don't have enc(4) compiled in, that would be more difficult to do. Same > reason you don't want SADB_FLUSH on by default. *If* someone manages to get root on you IPSEC endpoint you've lost anyway. The availability of enc(4) then is no longer of importance. -- Andre