IPsec is very broken...

[Bjoern A. Zeeb]

On 20 Nov 2014, at 21:35 , John-Mark Gurney <jmg at funkthat.com> wrote:

> The first major issue I ran across was transport mode...  ae@ has been
> nice enough to get ICMP working in transport mode for IPv4 and IPv6,
> but it looks like TCP is still broken.  I haven't tested UDP yet...
> So, IPsec even w/o crypto is fundamentally broken here... It's clear
> that not many people run transport mode…

Or that some people lately broke the code.


> If someone could create a good test suite that ensures makes sure basic
> IPsec traffic passes, that would be a huge win for us.  The tests
> should test a complete cross product of: { tunnel, transport } x
> { TCP, UDP, ICMP, any others? } x { IPv4, IPv6 }.  Please add to this
> list.

 + SCTP + IPcomp + IPv4/IPv6 mixes inside/outside + properly working enc(4)

If you get all that then add IPIP (gif) and GRE on the inside as well.

— 
Bjoern A. Zeeb             "Come on. Learn, goddamn it.", WarGames, 1983