netdev - RE: IPv6 IPSec incompatibilities between 2.6.23 and 3.6.18/4.6.4

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 21 Jul 2016 14:40:57 +0000
From:	Ilan Tayari <ilant@...lanox.com>
To:	Pommnitz Jörg <Pommnitz@...g.de>,
	Shanker Wang <shankerwangmiao@...il.com>
CC:	"netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: RE: IPv6 IPSec incompatibilities between 2.6.23 and 3.6.18/4.6.4

> Node 1: fd01:1b10:1000::1 is running 4.6.4
> 14:21:50.737092 IP6 fd01:1b10:1000::3 > ff0e::1:
> ESP(spi=0x00000001,seq=0x100), length 136
> 14:21:51.737155 IP6 fd01:1b10:1000::3 > ff0e::1:
> ESP(spi=0x00000001,seq=0x101), length 136
...
> ip -s xfrm state
> src fd01:1b10:1000::1 dst ff0e::1
>         proto esp spi 0x00000001(1) reqid 0(0x00000000) mode tunnel
...
>           add 2016-07-21 14:18:08 use -
...
>         dir out ...
...
>           add 2016-07-21 14:18:08 use -
...
>         dir fwd ...
>           add 2016-07-21 14:18:08 use -
...
>         dir in ...
>           add 2016-07-21 14:18:08 use -

Hi Joerg,

See the "use -" instead of a date/time of last usage (like in your output from 2.6)
Packets are received, but nothing is matched to your xfrm states and policies.

Are you sure this is the full output of "ip -s xfrm policy"? I feel like something is missing.

At first glance I'd say it looks like src+dst doesn't match the packets.
Packet source-ip is ::3, while xfrm-state source ip matches::1

Ilan.