Date: Fri, 21 Nov 2014 11:27:57 +0000 From: "Bjoern A. Zeeb" <bzeeb-lists@lists.zabbadoz.net> To: John-Mark Gurney <jmg@funkthat.com> Cc: freebsd-net@FreeBSD.org, freebsd-security@FreeBSD.org Subject: Re: IPsec is very broken... Message-ID: <785031F3-7563-4314-A9A5-79666723C3E2@lists.zabbadoz.net> In-Reply-To: <20141120213526.GH24601@funkthat.com> References: <20141120213526.GH24601@funkthat.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On 20 Nov 2014, at 21:35 , John-Mark Gurney <jmg@funkthat.com> wrote:
> The first major issue I ran across was transport mode... ae@ has been
> nice enough to get ICMP working in transport mode for IPv4 and IPv6,
> but it looks like TCP is still broken. I haven't tested UDP yet...
> So, IPsec even w/o crypto is fundamentally broken here... It's clear
> that not many people run transport mode=85
Or that some people lately broke the code.
> If someone could create a good test suite that ensures makes sure =
basic
> IPsec traffic passes, that would be a huge win for us. The tests
> should test a complete cross product of: { tunnel, transport } x
> { TCP, UDP, ICMP, any others? } x { IPv4, IPv6 }. Please add to this
> list.
+ SCTP + IPcomp + IPv4/IPv6 mixes inside/outside + properly working =
enc(4)
If you get all that then add IPIP (gif) and GRE on the inside as well.
=97=20
Bjoern A. Zeeb "Come on. Learn, goddamn it.", WarGames, 1983
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?785031F3-7563-4314-A9A5-79666723C3E2>