5.3 IPSEC broken

Robert Watson rwatson at freebsd.org
Sat Sep 25 10:39:57 PDT 2004

On Sat, 25 Sep 2004, Hannes Mehnert wrote:

> On Fri, Sep 24, 2004 at 10:58:33PM -0400, Robert Watson wrote:
> > I'd like to take a look at this sometime in the next few days.  Could you
> > send me an appropriately censored version of your racoon configuration for
> > each endpoint that I can use as a starting point?
> Sure, my config files are available at https://berlin.ccc.de/~hannes/racoon/
> I use a /30 subnet for IPSec,

So an interesting first observation for anyone else following this is that
under mbuma, the number of bytes available in an mbuf has changed by four
due (presumably) to the use of extra space by mbuma:


 MSIZE:     256
 MLEN:      236
 MHLEN:     212
 sizeof(struct m_hdr):  20
 sizeof(struct pkthdr): 24

 MSIZE:     256
 MLEN:      232
 MHLEN:     208
 sizeof(struct m_hdr):  24
 sizeof(struct pkthdr): 24

So presumably something in pfkey was carefully (or accidentally) designed
to assume that some object/content would fit in MLEN or MHLEN that no
longer does.

Robert N M Watson             FreeBSD Core Team, TrustedBSD Projects
robert at fledge.watson.org      Principal Research Scientist, McAfee Research

More information about the freebsd-current mailing list