Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1164325AbdD0W35 (ORCPT ); Thu, 27 Apr 2017 18:29:57 -0400 Received: from mail-it0-f46.google.com ([209.85.214.46]:35786 "EHLO mail-it0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1162212AbdD0W3s (ORCPT ); Thu, 27 Apr 2017 18:29:48 -0400 MIME-Version: 1.0 In-Reply-To: References: From: Don Bowman Date: Thu, 27 Apr 2017 18:29:47 -0400 Message-ID: Subject: Re: ipsec doesn't route TCP with 4.11 kernel To: Joseph Salisbury Cc: "linux-kernel@vger.kernel.org" Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2213 Lines: 67 On 26 April 2017 at 15:06, Joseph Salisbury wrote: > Hi Don, > > Can you see if this bug started happening in v4.11-rc3? Since your > running Ubuntu, a kernel is already available here: > http://kernel.ubuntu.com/~kernel-ppa/mainline/v4.11-rc3/ It appears I was incorrect about where this was introduced. 4.10.1-041001-generic works correctly. 4.11.0-041100rc1-generic does not THese are both from the kernel-mainline ubuntu. > > If v4.11-rc2 is good and -rc3 is bad, I can help you bisect between the two. > > Thanks, > > Joe > > > > On 04/25/2017 09:08 PM, Don Bowman wrote: >> I'm not sure how to describe this. >> >> 4.11rc2 worked, after that, no. >> >> My ipsec tunnel comes up ok. ICMP works. UDP works. But TCP, the >> sender [which is the ipsec client] does not reach the destination. >> >> Its not a routing rule issue (since ICMP/UDP work). >> Its not a traffic selector just selecting TCP (I think) since ipsec >> status shows just a subnet, no protocol. >> >> Using tcpdump: >> # iptables -t mangle -I PREROUTING -m policy --pol ipsec --dir in -j >> NFLOG --nflog-group 5 >> # iptables -t mangle -I POSTROUTING -m policy --pol ipsec --dir out -j >> NFLOG --nflog-group 5 >> # tcpdump -s 0 -n -i nflog:5 >> >> I see that it thinks it is sending the TCP packet, but the server end >> does not receive. >> >> Does anyone have any suggestion to try? >> >> strongswan is 5.5.1 [on ubuntu 17.04] >> kernel is 4.11.0-041100rc8-generic >> >h> My rightsubnet is >> rightsubnet = 192.168.128.0/17,10.0.0.0/8 >> >> so no specific protocol selected, the result is: >> CHILD_SA sv{1} established with SPIs c05f1b6c_i 0d58815a_o and TS >> 192.168.130.4/32 === 10.0.0.0/8 192.168.128.0/17 >> >> I tried changing charondebug net=3, but i'm not sure how to interpret >> the output: >> >> Apr 25 21:06:34 office charon: 04[NET] received packet: from >> 64.7.137.180[4500] to 172.16.0.8[4500] (80 bytes) >> Apr 25 21:06:34 office charon: 04[ENC] parsed INFORMATIONAL request 4 [ ] >> Apr 25 21:06:34 office charon: 04[ENC] generating INFORMATIONAL response 4 [ ] >> Apr 25 21:06:34 office charon: 04[NET] sending packet: from >> 172.16.0.8[4500] to 64.7.137.180[4500] (80 bytes) > >