Re: [PATCH] Fix ESP SA loading (by default)

[Alexey Dobriyan <adobriyan@gmail.com>]

On Sat, Nov 01, 2008 at 01:04:58PM +0800, Herbert Xu wrote:
> On Sat, Nov 01, 2008 at 07:37:37AM +0300, Alexey Dobriyan wrote:
> > digest_null algorithm is now mandatory for ESP.
> > 
> > Steps to reproduce:
> > 
> > 	kernel with CONFIG_CRYPTO_NULL=n
> > 
> > 	#!/usr/sbin/setkey -f
> > 	flush;
> > 	spdflush;
> > 	add 192.168.0.1 192.168.0.42 esp 15701 -E 3des-cbc "123456789012123456789012";
> 
> You do realise that this is totally insecure against man-in-the-
> middle attacks, right?

It's a cut down example. This won't work either:

#!/usr/sbin/setkey -f
flush;
spdflush;

add 192.168.0.1 192.168.0.42 ah 15700 -A hmac-md5 "1234567890123456";
add 192.168.0.1 192.168.0.42 esp 15701 -E 3des-cbc "123456789012123456789012";

add 192.168.0.42 192.168.0.1 ah 24500 -A hmac-md5 "1234567890123456";
add 192.168.0.42 192.168.0.1 esp 24501 -E 3des-cbc "123456789012123456789012";

spdadd 192.168.0.42 192.168.0.1 any -P out ipsec
	esp/transport//require
	ah/transport//require;

spdadd 192.168.0.1 192.168.0.42 any -P in ipsec
	esp/transport//require
	ah/transport//require;