netdev - IPsec tunnel forwarding in net-next-2.6 since 452edd59

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <4D7FB054.2090902@cbnco.com>
Date:	Tue, 15 Mar 2011 14:30:44 -0400
From:	Michael Smith <msmith@...co.com>
To:	netdev@...r.kernel.org
Subject: IPsec tunnel forwarding in net-next-2.6 since 452edd59

Hi,

I'm able to ping across a tunnel to a peer running net-next-2.6, but 
only to an interface on the peer; trying to ping a host behind the peer 
fails. The incoming packet shows up in encrypted and decrypted form in 
tcpdump, but it's not forwarded. None of the XFRM error counters are 
incremented; the packets just silently fail to be forwarded.

There are no iptables rules and net.ipv4.ip_forward=1. The same config 
works on 2.6.38-rc8. git bisect pointed me to commit 452edd59 from March 2:

     xfrm: Return dst directly from xfrm_lookup()

     Instead of on the stack.

ip xfrm policy:

src 192.168.136.0/24 dst 192.168.137.0/24
         dir out priority 2344 ptype main
         tmpl src 1.1.1.136 dst 1.1.1.137
                 proto esp reqid 16385 mode tunnel

src 192.168.137.0/24 dst 192.168.136.0/24
         dir fwd priority 2344 ptype main
         tmpl src 1.1.1.137 dst 1.1.1.136
                 proto esp reqid 16385 mode tunnel

src 192.168.137.0/24 dst 192.168.136.0/24
         dir in priority 2344 ptype main
         tmpl src 1.1.1.137 dst 1.1.1.136
                 proto esp reqid 16385 mode tunnel

net-next-2.6 host is at 1.1.1.136 and 192.168.136.1. 2.6.35.10 host is 
at 1.1.1.137 and 192.168.137.1. From that host:

ping -I 192.168.137.1 192.168.136.1 -> success
ping -I 192.168.137.1 192.168.136.2 -> silent failure

Thanks,
Mike
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html