Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
For bugs related to Red Hat Enterprise Linux 5 product line. The current stable release is 5.10. For Red Hat Enterprise Linux 6 and above, please visit Red Hat JIRA https://issues.redhat.com/secure/CreateIssue!default.jspa?pid=12332745 to report new issues.

Bug 435445

Summary: IPSec ifup script doesn't allow to leave AH transformation out
Product: Red Hat Enterprise Linux 5 Reporter: Aleksander Adamowski <bugs-redhat>
Component: initscriptsAssignee: initscripts Maintenance Team <initscripts-maint-list>
Status: CLOSED DUPLICATE QA Contact: Brock Organ <borgan>
Severity: low Docs Contact:
Priority: low    
Version: 5.3   
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2008-02-29 15:16:13 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Aleksander Adamowski 2008-02-29 12:10:05 UTC 
The ifup-ipsec script has the presence of AH transtormation hardcoded into
itself. Its presence is not configurable - it always generates policies that
contain both ESP and AH transformations.

This is bad for two reasons:

1) AH is superfluous in presence of ESP - ESP sufficiently serves both
authentication (like AH) and encryption
2) The set of transformations should be configurable since there might be
different combinations of them on the other side (e.g. Cisco hardware, othre
systems) and the policies need to match strictly on both sides in order for the
security association to be established.
Comment 1 Aleksander Adamowski 2008-02-29 13:39:23 UTC 
I've also found this:

http://bugs.centos.org/view.php?id=2264

which corresponds to bug 251494. Seems like my bug is a duplicate of bug 251494,
which in addition contains a proposed fix to the scripts.
Comment 2 Bill Nottingham 2008-02-29 15:16:13 UTC 

*** This bug has been marked as a duplicate of 251494 ***