Netfilter+IPsec patches

[Alexander Samad <alex@samad.com.au>]

[-- Attachment #1: Type: text/plain, Size: 1321 bytes --]

Patrick

whilst debugging a ipsec bug I noticed these problems

when you do a tcpdump you the decrypted packet seems to show up
 twice it seems to be the exact same packet.

I am running this on a debian 2.6.4 kernel with the netfilter patchs
applied
(up to date cvs)


tcpdump output
=========
13:23:05.868512 0:a:8b:6a:30:8c 0:5:5d:64:c6:4e 0800 150:
202.154.115.130 > 138.130.55.80: ESP(spi=0x6e3852ef,seq=0x29)
13:23:05.868512 0:a:8b:6a:30:8c 0:5:5d:64:c6:4e 0800 98: 192.168.5.1 >
192.168.10.1: icmp: echo request (DF)
13:23:05.868512 0:a:8b:6a:30:8c 0:5:5d:64:c6:4e 0800 98: 192.168.5.1 >
192.168.10.1: icmp: echo request (DF)


my other problem is when I ping across the ipsec tunnel  from the remote
end to the server end I see the packets come in the interface, I see
them in the INPUT table and in the mangle table, but it never seems to
get back to the application



from ipsec auto --status
====
000 "roadwarrior.internet.nat"[4]:
192.168.8.0/22===138.130.55.80:4500[C=AU, ST=NSW, L=Sydney, O=A.Samad
Pty Ltd, OU=Alfred St, CN=sydlxfw01,
E=sydlxfw01@samad.com.au]---138.130.52.1...144.137.104.46:4500[C=AU,
ST=NSW, L=Sydney, O=A.Samad Pty Ltd, OU=Alfred St,
CN=asamadlx.samad.com.au, E=asamadlx@samad.com.au]===192.168.8.2/32;
erouted; eroute owner: #30

Thanks
Alex

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]