diff options
| author | christos <christos@NetBSD.org> | 2022-10-19 21:28:02 +0000 |
|---|---|---|
| committer | christos <christos@NetBSD.org> | 2022-10-19 21:28:02 +0000 |
| commit | c5773417a18d6370143270d029cde975db12d812 (patch) | |
| tree | b22cdd7924d18c38fca14f1101b63694bc64ebb8 /sys/dev/microcode/wi | |
| parent | d3c12a4c36017e704719184026c448a26ab4f2cd (diff) | |
PR/56836: Andrew Cagney: IPv6 ESN tunneling IPcomp has corrupt header
Always always send / expect CPI in IPcomp header
Fixes kern/56836 where an IPsec interop combining compression and
ESP|AH would fail.
Since fast ipsec, the outgoing IPcomp header has contained the
compression algorithm instead of the CPI. Adding the
SADB_X_EXT_RAWCPI flag worked around this but ...
The IPcomp's SADB was unconditionally hashed using the compression
algorithm instead of the CPI. This meant that an incoming packet with
a valid CPI could never match its SADB.
Diffstat (limited to 'sys/dev/microcode/wi')
0 files changed, 0 insertions, 0 deletions
