linux-kernel - Re: ipsec doesn't route TCP with 4.11 kernel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <d1493c97-0b2e-b9fa-5559-04f8214f466f@canonical.com>
Date:   Mon, 1 May 2017 09:53:42 -0400
From:   Joseph Salisbury <joseph.salisbury@...onical.com>
To:     Don Bowman <db@...bowman.ca>
Cc:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: ipsec doesn't route TCP with 4.11 kernel

On 04/27/2017 06:29 PM, Don Bowman wrote:
> On 26 April 2017 at 15:06, Joseph Salisbury
> <joseph.salisbury@...onical.com> wrote:
>> Hi Don,
>>
>> Can you see if this bug started happening in v4.11-rc3?  Since your
>> running Ubuntu, a kernel is already available here:
>> http://kernel.ubuntu.com/~kernel-ppa/mainline/v4.11-rc3/
> It appears I was incorrect about where this was introduced.
> 4.10.1-041001-generic works correctly.
> 4.11.0-041100rc1-generic does not
>
> THese are both from the kernel-mainline ubuntu.
Just to confirm, -rc8 still exhibits the bug?  If so, I can bisect and
build some test kernels if you can test them.


>> If v4.11-rc2 is good and -rc3 is bad, I can help you bisect between the two.
>>
>> Thanks,
>>
>> Joe
>>
>>
>>
>> On 04/25/2017 09:08 PM, Don Bowman wrote:
>>> I'm not sure how to describe this.
>>>
>>> 4.11rc2 worked, after that, no.
>>>
>>> My ipsec tunnel comes up ok. ICMP works. UDP works. But TCP, the
>>> sender [which is the ipsec client] does not reach the destination.
>>>
>>> Its not a routing rule issue (since ICMP/UDP work).
>>> Its not a traffic selector just selecting TCP (I think) since ipsec
>>> status shows just a subnet, no protocol.
>>>
>>> Using tcpdump:
>>> # iptables -t mangle -I PREROUTING -m policy --pol ipsec --dir in -j
>>> NFLOG --nflog-group 5
>>> # iptables -t mangle -I POSTROUTING -m policy --pol ipsec --dir out -j
>>> NFLOG --nflog-group 5
>>> # tcpdump -s 0 -n -i nflog:5
>>>
>>> I see that it thinks it is sending the TCP packet, but the server end
>>> does not receive.
>>>
>>> Does anyone have any suggestion to try?
>>>
>>> strongswan is 5.5.1 [on ubuntu 17.04]
>>> kernel is 4.11.0-041100rc8-generic
>>>
>> h> My rightsubnet is
>>> rightsubnet = 192.168.128.0/17,10.0.0.0/8
>>>
>>> so no specific protocol selected, the result is:
>>> CHILD_SA sv{1} established with SPIs c05f1b6c_i 0d58815a_o and TS
>>> 192.168.130.4/32 === 10.0.0.0/8 192.168.128.0/17
>>>
>>> I tried changing charondebug net=3, but i'm not sure how to interpret
>>> the output:
>>>
>>> Apr 25 21:06:34 office charon: 04[NET] received packet: from
>>> 64.7.137.180[4500] to 172.16.0.8[4500] (80 bytes)
>>> Apr 25 21:06:34 office charon: 04[ENC] parsed INFORMATIONAL request 4 [ ]
>>> Apr 25 21:06:34 office charon: 04[ENC] generating INFORMATIONAL response 4 [ ]
>>> Apr 25 21:06:34 office charon: 04[NET] sending packet: from
>>> 172.16.0.8[4500] to 64.7.137.180[4500] (80 bytes)
>>