From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S969128AbdEANxx (ORCPT ); Mon, 1 May 2017 09:53:53 -0400 Received: from youngberry.canonical.com ([91.189.89.112]:45646 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S967082AbdEANxo (ORCPT ); Mon, 1 May 2017 09:53:44 -0400 Subject: Re: ipsec doesn't route TCP with 4.11 kernel To: Don Bowman References: Cc: "linux-kernel@vger.kernel.org" From: Joseph Salisbury Message-ID: Date: Mon, 1 May 2017 09:53:42 -0400 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 04/27/2017 06:29 PM, Don Bowman wrote: > On 26 April 2017 at 15:06, Joseph Salisbury > wrote: >> Hi Don, >> >> Can you see if this bug started happening in v4.11-rc3? Since your >> running Ubuntu, a kernel is already available here: >> http://kernel.ubuntu.com/~kernel-ppa/mainline/v4.11-rc3/ > It appears I was incorrect about where this was introduced. > 4.10.1-041001-generic works correctly. > 4.11.0-041100rc1-generic does not > > THese are both from the kernel-mainline ubuntu. Just to confirm, -rc8 still exhibits the bug? If so, I can bisect and build some test kernels if you can test them. >> If v4.11-rc2 is good and -rc3 is bad, I can help you bisect between the two. >> >> Thanks, >> >> Joe >> >> >> >> On 04/25/2017 09:08 PM, Don Bowman wrote: >>> I'm not sure how to describe this. >>> >>> 4.11rc2 worked, after that, no. >>> >>> My ipsec tunnel comes up ok. ICMP works. UDP works. But TCP, the >>> sender [which is the ipsec client] does not reach the destination. >>> >>> Its not a routing rule issue (since ICMP/UDP work). >>> Its not a traffic selector just selecting TCP (I think) since ipsec >>> status shows just a subnet, no protocol. >>> >>> Using tcpdump: >>> # iptables -t mangle -I PREROUTING -m policy --pol ipsec --dir in -j >>> NFLOG --nflog-group 5 >>> # iptables -t mangle -I POSTROUTING -m policy --pol ipsec --dir out -j >>> NFLOG --nflog-group 5 >>> # tcpdump -s 0 -n -i nflog:5 >>> >>> I see that it thinks it is sending the TCP packet, but the server end >>> does not receive. >>> >>> Does anyone have any suggestion to try? >>> >>> strongswan is 5.5.1 [on ubuntu 17.04] >>> kernel is 4.11.0-041100rc8-generic >>> >> h> My rightsubnet is >>> rightsubnet = 192.168.128.0/17,10.0.0.0/8 >>> >>> so no specific protocol selected, the result is: >>> CHILD_SA sv{1} established with SPIs c05f1b6c_i 0d58815a_o and TS >>> 192.168.130.4/32 === 10.0.0.0/8 192.168.128.0/17 >>> >>> I tried changing charondebug net=3, but i'm not sure how to interpret >>> the output: >>> >>> Apr 25 21:06:34 office charon: 04[NET] received packet: from >>> 64.7.137.180[4500] to 172.16.0.8[4500] (80 bytes) >>> Apr 25 21:06:34 office charon: 04[ENC] parsed INFORMATIONAL request 4 [ ] >>> Apr 25 21:06:34 office charon: 04[ENC] generating INFORMATIONAL response 4 [ ] >>> Apr 25 21:06:34 office charon: 04[NET] sending packet: from >>> 172.16.0.8[4500] to 64.7.137.180[4500] (80 bytes) >>