1. 27 Aug, 2007 1 commit
    • Nick Bowler's avatar
      [IPSEC] AH4: Update IPv4 options handling to conform to RFC 4302. · 96fe1c02
      Nick Bowler authored
      In testing our ESP/AH offload hardware, I discovered an issue with how
      AH handles mutable fields in IPv4.  RFC 4302 (AH) states the following
      on the subject:
      
              For IPv4, the entire option is viewed as a unit; so even
              though the type and length fields within most options are immutable
              in transit, if an option is classified as mutable, the entire option
              is zeroed for ICV computation purposes.
      
      The current implementation does not zero the type and length fields,
      resulting in authentication failures when communicating with hosts
      that do (i.e. FreeBSD).
      
      I have tested record route and timestamp options (ping -R and ping -T)
      on a small network involving Windows XP, FreeBSD 6.2, and Linux hosts,
      with one router.  In the presence of these options, the FreeBSD and
      Linux hosts (with the patch or with the hardware) can communicate.
      The Windows XP host simply fails to accept these packets with or
      without the patch.
      
      I have also been trying to test source routing options (using
      traceroute -g), but haven't had much luck getting this option to work
      *without* AH, let alone with.
      Signed-off-by: default avatarNick Bowler <nbowler@ellipticsemi.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      96fe1c02
  2. 25 Aug, 2007 39 commits