Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1632421

Re: ipsec doesn't route TCP with 4.11 kernel

Show all headers | View raw

On 26 April 2017 at 15:06, Joseph Salisbury
<joseph.salisbury@canonical.com> wrote:
> Hi Don,
>
> Can you see if this bug started happening in v4.11-rc3?  Since your
> running Ubuntu, a kernel is already available here:
> http://kernel.ubuntu.com/~kernel-ppa/mainline/v4.11-rc3/

It appears I was incorrect about where this was introduced.
4.10.1-041001-generic works correctly.
4.11.0-041100rc1-generic does not

THese are both from the kernel-mainline ubuntu.
>
> If v4.11-rc2 is good and -rc3 is bad, I can help you bisect between the two.
>
> Thanks,
>
> Joe
>
>
>
> On 04/25/2017 09:08 PM, Don Bowman wrote:
>> I'm not sure how to describe this.
>>
>> 4.11rc2 worked, after that, no.
>>
>> My ipsec tunnel comes up ok. ICMP works. UDP works. But TCP, the
>> sender [which is the ipsec client] does not reach the destination.
>>
>> Its not a routing rule issue (since ICMP/UDP work).
>> Its not a traffic selector just selecting TCP (I think) since ipsec
>> status shows just a subnet, no protocol.
>>
>> Using tcpdump:
>> # iptables -t mangle -I PREROUTING -m policy --pol ipsec --dir in -j
>> NFLOG --nflog-group 5
>> # iptables -t mangle -I POSTROUTING -m policy --pol ipsec --dir out -j
>> NFLOG --nflog-group 5
>> # tcpdump -s 0 -n -i nflog:5
>>
>> I see that it thinks it is sending the TCP packet, but the server end
>> does not receive.
>>
>> Does anyone have any suggestion to try?
>>
>> strongswan is 5.5.1 [on ubuntu 17.04]
>> kernel is 4.11.0-041100rc8-generic
>>
>h> My rightsubnet is
>> rightsubnet = 192.168.128.0/17,10.0.0.0/8
>>
>> so no specific protocol selected, the result is:
>> CHILD_SA sv{1} established with SPIs c05f1b6c_i 0d58815a_o and TS
>> 192.168.130.4/32 === 10.0.0.0/8 192.168.128.0/17
>>
>> I tried changing charondebug net=3, but i'm not sure how to interpret
>> the output:
>>
>> Apr 25 21:06:34 office charon: 04[NET] received packet: from
>> 64.7.137.180[4500] to 172.16.0.8[4500] (80 bytes)
>> Apr 25 21:06:34 office charon: 04[ENC] parsed INFORMATIONAL request 4 [ ]
>> Apr 25 21:06:34 office charon: 04[ENC] generating INFORMATIONAL response 4 [ ]
>> Apr 25 21:06:34 office charon: 04[NET] sending packet: from
>> 172.16.0.8[4500] to 64.7.137.180[4500] (80 bytes)
>
>

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

ipsec doesn't route TCP with 4.11 kernel Don Bowman <db@donbowman.ca> - 2017-04-26 03:10 +0200
  Re: ipsec doesn't route TCP with 4.11 kernel Joseph Salisbury <joseph.salisbury@canonical.com> - 2017-04-26 21:10 +0200
    Re: ipsec doesn't route TCP with 4.11 kernel Don Bowman <db@donbowman.ca> - 2017-04-28 00:40 +0200
      Re: ipsec doesn't route TCP with 4.11 kernel Joseph Salisbury <joseph.salisbury@canonical.com> - 2017-05-01 16:00 +0200
  Re: ipsec doesn't route TCP with 4.11 kernel Cong Wang <xiyou.wangcong@gmail.com> - 2017-04-27 07:10 +0200
    Re: ipsec doesn't route TCP with 4.11 kernel Steffen Klassert <steffen.klassert@secunet.com> - 2017-04-27 11:00 +0200
      Re: ipsec doesn't route TCP with 4.11 kernel Don Bowman <db@donbowman.ca> - 2017-04-28 00:20 +0200
      Re: ipsec doesn't route TCP with 4.11 kernel Steffen Klassert <steffen.klassert@secunet.com> - 2017-04-28 10:30 +0200
        Re: ipsec doesn't route TCP with 4.11 kernel Eric Dumazet <eric.dumazet@gmail.com> - 2017-04-28 18:50 +0200
          Re: ipsec doesn't route TCP with 4.11 kernel Steffen Klassert <steffen.klassert@secunet.com> - 2017-05-03 10:30 +0200
        Re: ipsec doesn't route TCP with 4.11 kernel Don Bowman <db@donbowman.ca> - 2017-04-30 02:50 +0200
          Re: ipsec doesn't route TCP with 4.11 kernel Steffen Klassert <steffen.klassert@secunet.com> - 2017-05-03 10:20 +0200

csiph-web