From: Nick Bowler <[EMAIL PROTECTED]> Date: Wed, 22 Aug 2007 10:22:53 -0400
> In testing our ESP/AH offload hardware, I discovered an issue with how AH > handles mutable fields in IPv4. RFC 4302 (AH) states the following on the > subject: > > For IPv4, the entire option is viewed as a unit; so even > though the type and length fields within most options are immutable > in transit, if an option is classified as mutable, the entire option > is zeroed for ICV computation purposes. > > The current implementation does not zero the type and length fields, resulting > in authentication failures when communicating with hosts that do (i.e. > FreeBSD). > > I have tested record route and timestamp options (ping -R and ping -T) on a > small network involving Windows XP, FreeBSD 6.2, and Linux hosts, with one > router. In the presence of these options, the FreeBSD and Linux hosts (with > the patch or with the hardware) can communicate. The Windows XP host simply > fails to accept these packets with or without the patch. > > I have also been trying to test source routing options (using traceroute -g), > but haven't had much luck getting this option to work *without* AH, let alone > with. > > Signed-off-by: Nick Bowler <[EMAIL PROTECTED]> Patch applied, thanks a lot Nick. - To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html
