Re: [PATCH]: latest netfilter+ipsec patches

[Alexander Samad <alex@samad.com.au>]

[-- Attachment #1: Type: text/plain, Size: 1866 bytes --]

Patrick 

I seem to have found a bug in your patches, but only when used in
conjuction with Herbert's mangle patch.

It seems like there is a loop caused when the packet traverses the
tablesi, in particular ip_route_me_harder.

I tested this on my laptop with debian 2.6.3-2 source with these patches
that you provided on this thread, as well as the Herbert mangle patch.

It seem like the packet on the way out gets encapsulated and then the
encrypted packets try to get re encrypted.

example ipsec.conf

conn wireless
	left=10.0.4.129
	leftsubnet=0/0
	authby=secret
	pfs=no
	auto=add
	right=%defaultroute

By the dump it looks like a loop, I added a printk("%d\n", iph->protocol); 
in ip_route_me_harder just before Herberts fix to test that.

When I changed the config to look like this


conn wireless
	left=10.0.4.129
	leftsubnet=10.6.0/24
	authby=secret
	pfs=no
	auto=add
	right=%defaultroute

It worked fine


Any other question ask, I have deb's of the image and headers too if you
want.

Alex


On Fri, Mar 05, 2004 at 03:00:07AM +0100, Patrick McHardy wrote:
> Alexander Samad wrote:
> >Q do I understand right that encrypted packets can or can't be acted
> >upon by the hooks in LOCAL_IN.
> >
> >Or another way of putting it does a packet travel the tables twice once
> >as an encrypted packet and once as a de crypted packet ?
> 
> Exactly, input looks like this:
> 
> (encrypted) PRE_ROUTING -> LOCAL_IN ->
> (plain) PRE_ROUTING -> LOCAL_IN/FORWARD
> 
> output looks like this:
> 
> (plain) FORWARD/LOCAL_OUT -> POST_ROUTING ->
> (encrypted) LOCAL_OUT -> POST_ROUTING
> 
> This is the same as with freeswan, only without the ipsec
> devices, the policy match can be used as a easy replacement
> for them (-m policy --pol ipsec).
> 
> Regards,
> Patrick
> 
> >
> >Alex
> >
> >

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]