Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1030900AbdD0I4d (ORCPT ); Thu, 27 Apr 2017 04:56:33 -0400 Received: from a.mx.secunet.com ([62.96.220.36]:56284 "EHLO a.mx.secunet.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754414AbdD0I43 (ORCPT ); Thu, 27 Apr 2017 04:56:29 -0400 Date: Thu, 27 Apr 2017 10:42:38 +0200 From: Steffen Klassert To: Cong Wang CC: Don Bowman , "linux-kernel@vger.kernel.org" , Herbert Xu , Linux Kernel Network Developers Subject: Re: ipsec doesn't route TCP with 4.11 kernel Message-ID: <20170427084238.GX2649@secunet.com> References: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.24 (2015-08-30) X-Originating-IP: [10.182.7.193] X-G-Data-MailSecurity-for-Exchange-State: 0 X-G-Data-MailSecurity-for-Exchange-Error: 0 X-G-Data-MailSecurity-for-Exchange-Sender: 23 X-G-Data-MailSecurity-for-Exchange-Server: d65e63f7-5c15-413f-8f63-c0d707471c93 X-EXCLAIMER-MD-CONFIG: 2c86f778-e09b-4440-8b15-867914633a10 X-G-Data-MailSecurity-for-Exchange-Guid: 5132F6B5-1A42-4FFE-8B30-2F675F454975 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1485 Lines: 44 On Wed, Apr 26, 2017 at 10:01:34PM -0700, Cong Wang wrote: > (Cc'ing netdev and IPSec maintainers) > > On Tue, Apr 25, 2017 at 6:08 PM, Don Bowman wrote: > > I'm not sure how to describe this. > > > > 4.11rc2 worked, after that, no. We had some recent IPsec GRO changes, this could influence TCP. But these changes were introduced before rc2. If I read this correct, the regression was introduced between rc2 and rc3, right? > > > > My ipsec tunnel comes up ok. When talking about IPsec, I guess you use ESP, right? > > ICMP works. UDP works. But TCP, the > > sender [which is the ipsec client] does not reach the destination. > > > > Its not a routing rule issue (since ICMP/UDP work). > > Its not a traffic selector just selecting TCP (I think) since ipsec > > status shows just a subnet, no protocol. > > > > Using tcpdump: > > # iptables -t mangle -I PREROUTING -m policy --pol ipsec --dir in -j > > NFLOG --nflog-group 5 > > # iptables -t mangle -I POSTROUTING -m policy --pol ipsec --dir out -j > > NFLOG --nflog-group 5 > > # tcpdump -s 0 -n -i nflog:5 > > > > I see that it thinks it is sending the TCP packet, but the server end > > does not receive. > > > > Does anyone have any suggestion to try? If it is a GRO issue, then it is on the receive side, could you do tcpdump on the receiving interface to see what you get there? What shows /proc/net/xfrm_stat? Can you do 'ip -s x s' to see if the SAs are used? Do you have INET_ESP_OFFLOAD enabled?