From: bert hubert <ahu@ds9a.nl>
To: kuznet@ms2.inr.ac.ru
Cc: davem@redhat.com, gem@asplinux.ru, netdev@oss.sgi.com
Subject: Re: off by one error in 3des cbc keying
Date: Mon, 11 Nov 2002 11:01:09 +0100 [thread overview]
Message-ID: <20021111100109.GB18677@outpost.ds9a.nl> (raw)
In-Reply-To: <200211110151.EAA26095@sex.inr.ac.ru>
[alexey's nameserver is off, cc to netdev@oss.sgi.com, perhaps he sees it
there]
On Mon, Nov 11, 2002 at 04:51:36AM +0300, kuznet@ms2.inr.ac.ru wrote:
> Yes, connect() is broken... The patch is enclosed. Alternatively, you
> could allow connections to remote isakmp ports via policy.
Ok, with careful tuning, it will work now. But not for the general case.
If a policy is setup that only applies to ICMP, IKE converges and works (as
it works over UDP).
I wonder, is 'incoming bypass' implemented yet? If there is an incoming
policy, racoon does not see any traffic.
Key refreshing/updating doesn't appear to work either, after they key has
expired, all bets are off.
Regards,
bert
--
http://www.PowerDNS.com Versatile DNS Software & Services
http://lartc.org Linux Advanced Routing & Traffic Control HOWTO
next parent reply other threads:[~2002-11-11 10:01 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20021110111507.GA31188@outpost.ds9a.nl>
[not found] ` <200211110151.EAA26095@sex.inr.ac.ru>
2002-11-11 10:01 ` bert hubert [this message]
2002-11-11 11:41 ` off by one error in 3des cbc keying bert hubert
2002-11-11 17:18 ` kuznet
2002-11-11 20:03 ` bert hubert
2002-11-11 21:35 ` kuznet
2002-11-11 21:51 ` bert hubert
2002-11-12 13:55 ` kuznet
2002-11-12 15:16 ` bert hubert
2002-11-12 15:29 ` kuznet
2002-11-12 19:06 ` bert hubert
2002-11-12 22:36 ` David S. Miller
2002-11-13 1:04 ` kuznet
2002-11-13 8:45 ` David S. Miller
2002-11-13 1:09 ` kuznet
2002-11-13 8:55 ` automatic keying works! " bert hubert
[not found] ` <200211132046.XAA12943@sex.inr.ac.ru>
2002-11-13 22:03 ` bert hubert
2002-11-13 22:35 ` kuznet
2002-11-18 19:56 ` bert hubert
2002-11-18 20:04 ` kuznet
2002-11-18 20:10 ` David S. Miller
2002-11-18 20:20 ` kuznet
2002-11-18 20:23 ` David S. Miller
2002-11-18 20:32 ` kuznet
2002-11-18 21:25 ` bert hubert
2002-11-18 23:17 ` David S. Miller
2002-11-18 20:22 ` bert hubert
2002-11-18 20:22 ` David S. Miller
2002-11-18 20:08 ` David S. Miller
2002-11-14 16:51 ` David S. Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20021111100109.GB18677@outpost.ds9a.nl \
--to=ahu@ds9a.nl \
--cc=davem@redhat.com \
--cc=gem@asplinux.ru \
--cc=kuznet@ms2.inr.ac.ru \
--cc=netdev@oss.sgi.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).