Bug#859611: linux-image-4.9.0-0.bpo.2-amd64: ipsec gre tunnel not receiving packets

From	Ben Hutchings <ben@decadent.org.uk>
Newsgroups	linux.debian.bugs.dist, linux.debian.kernel
Subject	Bug#859611: linux-image-4.9.0-0.bpo.2-amd64: ipsec gre tunnel not receiving packets
Date	2017-04-07 21:50 +0200
Message-ID	<ttI3o-3uy-21@gated-at.bofh.it> (permalink)
References	<tsONz-kg-7@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Cross-posted to 2 groups.

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Control: tag -1 moreinfo

On Wed, 2017-04-05 at 18:22 +1000, Russell Stuart wrote:
> Package: src:linux
> Version: 4.9.13-1~bpo8+1
> Severity: normal
> 
> Dear Maintainer,
> 
> We have a IPSec tunnel.  It works under 3.16, and doesn't work under
> 4.9.13.  Under 4.9.13 racoon reports the isakmp setup is successfull.
> Looking at it with tcdump (I've got captures, with xfrm keys) 
> under 4.9.13 I see ESP packets going out, but none coming in.
[...]

Does the affected system have a firewall?  If so, you might need to
load nf_conntrack_proto_gre explicitly now (explained in
<https://home.regit.org/netfilter-en/secure-use-of-helpers/>).
Although it isn't obvious why only some of the GRE tunnels would be
affected.

Ben.

-- 
Ben Hutchings
Never attribute to conspiracy what can adequately be explained by
stupidity.

Back to linux.debian.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#859611: linux-image-4.9.0-0.bpo.2-amd64: ipsec gre tunnel not receiving packets Ben Hutchings <ben@decadent.org.uk> - 2017-04-07 21:50 +0200
  Bug#859611: linux-image-4.9.0-0.bpo.2-amd64: ipsec gre tunnel not receiving packets Russell Stuart <russell-debian@stuart.id.au> - 2017-04-18 13:30 +0200
    Bug#859611: linux-image-4.9.0-0.bpo.2-amd64: ipsec gre tunnel not receiving packets Russell Stuart <russell-debian@stuart.id.au> - 2017-04-19 14:00 +0200

csiph-web