From owner-freebsd-security@FreeBSD.ORG Thu Nov 20 22:21:13 2014 Return-Path: Delivered-To: freebsd-security@FreeBSD.org Received: from mx2.freebsd.org (mx2.freebsd.org [IPv6:2001:1900:2254:206a::19:2]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 7AA475D9; Thu, 20 Nov 2014 22:21:13 +0000 (UTC) Received: from butcher-nb.yandex.net (hub.freebsd.org [IPv6:2001:1900:2254:206c::16:88]) by mx2.freebsd.org (Postfix) with ESMTP id C16AC1F7A; Thu, 20 Nov 2014 22:21:12 +0000 (UTC) Message-ID: <546E6931.20406@FreeBSD.org> Date: Fri, 21 Nov 2014 01:20:33 +0300 From: "Andrey V. Elsukov" User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:31.0) Gecko/20100101 Thunderbird/31.2.0 MIME-Version: 1.0 To: freebsd-net@FreeBSD.org, freebsd-security@FreeBSD.org Subject: Re: IPsec is very broken... References: <20141120213526.GH24601@funkthat.com> In-Reply-To: <20141120213526.GH24601@funkthat.com> Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="09FKR9v2hpJiJmT7vEP5u19xTMXe8to3d" X-Mailman-Approved-At: Thu, 20 Nov 2014 23:43:48 +0000 X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Nov 2014 22:21:13 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --09FKR9v2hpJiJmT7vEP5u19xTMXe8to3d Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable On 21.11.2014 00:35, John-Mark Gurney wrote: > As I'm about to commit my AES-GCM work, I've been trying to do > some testing to make sure I didn't break IPsec. >=20 > The first major issue I ran across was transport mode... ae@ has been > nice enough to get ICMP working in transport mode for IPv4 and IPv6, > but it looks like TCP is still broken. I haven't tested UDP yet... > So, IPsec even w/o crypto is fundamentally broken here... It's clear > that not many people run transport mode... >=20 > If someone could create a good test suite that ensures makes sure basic= > IPsec traffic passes, that would be a huge win for us. The tests > should test a complete cross product of: { tunnel, transport } x > { TCP, UDP, ICMP, any others? } x { IPv4, IPv6 }. Please add to this > list. I usually do tests for both transport and tunnel modes with and without gif(4)/gre(4). So, just tried between two CURRENT hosts and it works. I use racoon and isakmpd for IKE. ICMP, TCP (ssh) and UDP (ike) works for me. How do you test? Do you use software crypto or aesni? --=20 WBR, Andrey V. Elsukov --09FKR9v2hpJiJmT7vEP5u19xTMXe8to3d Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBAgAGBQJUbmk1AAoJEAHF6gQQyKF6lhQIALjov+pssuB8eYB3YTCIo02q RN9OzxW4nwbbEs82q3UqAxRR+oZlgEwDkVvORieJeWguBA0uhaILegiQGnG4WhXD TTITHC0upzoSKJ/mcEglCmBZcBTZX4CQ9lgSrNShgRwHPlrihmARz3PlxtswtXqE zioNtUaKAcC0aBRDiMbAK1/ODgoJvp4GCfKYlhkUxsoG3GiGM2uxstHXSzPh8hwZ ev4K0YmVgPUdB0orlQ6GpYIii3nclllNyi7hHnYqfkMupsDJ2EqH8WYYOMvUAhuy eInkcULgx67euruZ+enxtMlf2PxmZFVOxTDS+vfqqRdLN8tZE1/BYa+zhvviRb0= =x6EG -----END PGP SIGNATURE----- --09FKR9v2hpJiJmT7vEP5u19xTMXe8to3d--