Re: linux-ipsec: Latest IPsec and connecting two IP networks.... :-(

> Sep 1 21:27:40 sydney kernel: ahhmacmd5_init: incorrect key size: 56 --

Okay, we found what's going on here. There was a bug in the spi command (a complicated expression that got bitten by C's precedence rules), which fouled up memory allocation and generally made a mess of things in --ah. Fixed; updated snapshot is on its way to xs4all as I write this.

As mentioned earlier, you probably just want to use ESP's authentication and forget AH... but we're glad you didn't, since it led us to find this!

There is at least one more bug in using AH and ESP together, but we're not sure yet where it is -- it may be a Pluto problem and not something you'd run into with hand-keying.

                                                          Henry Spencer
                                                       henry@spsystems.net
                                                     (henry@zoo.toronto.edu)