Re: [documentation] Re: [LARTC] IPSEC FIRST LIGHT! (by non-kernel developer :-))

bert hubert (ahu@ds9a.nl)
Fri, 8 Nov 2002 12:15:29 +0100

On Fri, Nov 08, 2002 at 01:52:30AM -0800, David S. Miller wrote:
> From: bert hubert <ahu@ds9a.nl>
> Date: Fri, 8 Nov 2002 10:41:22 +0100
>
> Perhaps dave can re-diff?
>
> This is against current BK-2.5

Dave,

This code locks up solid on any ipsec TCP traffic outgoing with this
configuration:

add 10.0.0.11 10.0.0.216 ah 15700 -A hmac-md5 "1234567890123456";
add 10.0.0.216 10.0.0.11 ah 24500 -A hmac-md5 "1234567890123456";

# ESP
add 10.0.0.11 10.0.0.216 esp 15701 -E 3des-cbc "123456789012123456789012";
add 10.0.0.216 10.0.0.11 esp 24501 -E 3des-cbc "123456789012123456789012";

spdadd 10.0.0.216 10.0.0.11 any -P out ipsec
esp/transport//require
ah/transport//require;

spdadd 10.0.0.11 10.0.0.216 any -P in ipsec
esp/transport//require
ah/transport//require;

ICMP traffic is fine however. I'm now investigating how far it gets before
locking up.

Regards,

bert

-- 
http://www.PowerDNS.com          Versatile DNS Software & Services
http://lartc.org           Linux Advanced Routing & Traffic Control HOWTO
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/