From owner-freebsd-current@FreeBSD.ORG Sat Sep 25 02:59:21 2004 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 1C76B16A4CE for ; Sat, 25 Sep 2004 02:59:21 +0000 (GMT) Received: from fledge.watson.org (fledge.watson.org [204.156.12.50]) by mx1.FreeBSD.org (Postfix) with ESMTP id B315F43D53 for ; Sat, 25 Sep 2004 02:59:20 +0000 (GMT) (envelope-from robert@fledge.watson.org) Received: from fledge.watson.org (localhost [127.0.0.1]) by fledge.watson.org (8.13.1/8.13.1) with ESMTP id i8P2wXmr069703; Fri, 24 Sep 2004 22:58:33 -0400 (EDT) (envelope-from robert@fledge.watson.org) Received: from localhost (robert@localhost)i8P2wXqN069700; Fri, 24 Sep 2004 22:58:33 -0400 (EDT) (envelope-from robert@fledge.watson.org) Date: Fri, 24 Sep 2004 22:58:33 -0400 (EDT) From: Robert Watson X-Sender: robert@fledge.watson.org To: Hannes Mehnert In-Reply-To: <20040925001623.GC5307@mehnert.org> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII cc: freebsd-current@freebsd.org cc: Kris Kennaway Subject: Re: 5.3 IPSEC broken X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 Sep 2004 02:59:21 -0000 On Sat, 25 Sep 2004, Hannes Mehnert wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > On Fri, Sep 24, 2004 at 04:52:48PM -0700, Kris Kennaway wrote: > > On Sat, Sep 25, 2004 at 01:43:32AM +0200, Hannes Mehnert wrote: > > > in 5.3-BETA5 IPSec is broken. > > > > Please provide more details. > > As described in > http://lists.freebsd.org/pipermail/freebsd-current/2004-June/028442.html > http://lists.freebsd.org/pipermail/freebsd-current/2004-August/033554.html > the mbuma commit broke IPSec (ENOBUF) with default MSIZE (256). Setting > it to 512 is a workaround, maybe someone more in FreeBSD kernel hacking > should look at the problem. I'd like to take a look at this sometime in the next few days. Could you send me an appropriately censored version of your racoon configuration for each endpoint that I can use as a starting point? Robert N M Watson FreeBSD Core Team, TrustedBSD Projects robert@fledge.watson.org Principal Research Scientist, McAfee Research