netdev - Re: 2.6.25-rc8 regression with openswan

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 03 Apr 2008 14:06:11 +0200
From:	Patrick McHardy <kaber@...sh.net>
To:	Marco Berizzi <pupilla@...mail.com>
CC:	netdev@...r.kernel.org
Subject: Re: 2.6.25-rc8 regression with openswan

Marco Berizzi wrote:
> Patrick McHardy wrote:
> 
>>> openswan 2.4.12 doesn't work anymore
>>> with 2.6.25-rc8: quick mode is failing
>>> with this error:
>>>
>>> ERROR: netlink response for Add SA esp.8a56fa21@....1.1 included
> errno
>>> 93: Protocol not supported
>>>
>>> I have tried both with des3 and aes but
>>> I get always the same error.
>> What does your policy look like?
> 
> Here is output from ip -s x s and ip -s x p
> 
> root@...imero:/var/log# ip -s x s
> src 85.36.106.213 dst 85.36.106.210
>         proto esp spi 0xabbf0fe3(2881425379) reqid 16401(0x00004011)
> mode tunnel
>         replay-window 0 seq 0x00000000 flag  (0x00000000)
>         sel src 85.36.106.213/32 dst 85.36.106.210/32 uid 0
>         lifetime config:
>           limit: soft (INF)(bytes), hard (INF)(bytes)
>           limit: soft (INF)(packets), hard (INF)(packets)
>           expire add: soft 0(sec), hard 30(sec)
>           expire use: soft 0(sec), hard 0(sec)
>         lifetime current:
>           0(bytes), 0(packets)
>           add 2008-04-03 13:48:46 use -
>         stats:
>           replay-window 0 replay 0 failed 0
> 
> root@...imero:/var/log# ip -s x p
> src 0.0.0.0/0 dst 0.0.0.0/0 uid 0
>         dir in action allow index 755 priority 0 share any flag
> (0x00000000)


I'm not seeing any policies that actually specify IPsec. I'm
guessing that is something openswan-specific. Anyway, there
haven't been much patches in this area since -rc4, does
reverting commit df9dcb458 help?


--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html