From: Blair Steven <Blair.Steven@alliedtelesis.co.nz>
To: Steffen Klassert <steffen.klassert@secunet.com>
Cc: "netdev@vger.kernel.org" <netdev@vger.kernel.org>
Subject: Re: [PATCH] IPsec NAT-T issue
Date: Wed, 15 Jun 2016 00:44:54 +0000 [thread overview]
Message-ID: <5760A501.3070504@alliedtelesis.co.nz> (raw)
In-Reply-To: <20160613102024.GX7698@gauss.secunet.com>
The restoration is happening - but being actioned on the wrong location.
The destination IP address is being saved and restored, and the SPI
being written directly after the destination IP address. From my
understanding though, the ESN shuffling should have saved and restored
the UDP source / dest ports + SPI.
-Blair
On 06/13/2016 10:20 PM, Steffen Klassert wrote:
> On Mon, Jun 13, 2016 at 11:48:13AM +1200, Blair Steven wrote:
>> During testing we have discovered an issue with IPsec NAT-T where the SPI
>> is over writing the source and dest ports of the UDP header.
> The headers should be restored after the crypto operation in
> esp_restore_header(). Does this not happen in your case? What
> kind of problem do you experience?
>
next prev parent reply other threads:[~2016-06-15 0:44 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-06-12 23:48 [PATCH] IPsec NAT-T issue Blair Steven
2016-06-12 23:48 ` [PATCH] esp: correct offset for ESN when using NAT-T Blair Steven
2016-06-14 21:12 ` David Miller
2016-06-13 10:20 ` [PATCH] IPsec NAT-T issue Steffen Klassert
2016-06-15 0:44 ` Blair Steven [this message]
2016-06-17 10:24 ` Steffen Klassert
2016-06-18 5:03 ` esp: Fix ESN generation under UDP encapsulation Herbert Xu
2016-06-20 10:59 ` Steffen Klassert
2016-06-23 4:25 ` Blair Steven
2016-06-23 10:40 ` Steffen Klassert
2016-06-23 15:52 ` David Miller
2016-06-24 1:52 ` Herbert Xu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5760A501.3070504@alliedtelesis.co.nz \
--to=blair.steven@alliedtelesis.co.nz \
--cc=netdev@vger.kernel.org \
--cc=steffen.klassert@secunet.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.