Re: Netfilter+IPsec patches

[Alexander Samad <alex@samad.com.au>]

[-- Attachment #1: Type: text/plain, Size: 2691 bytes --]

On Thu, May 27, 2004 at 02:56:46AM +0200, Patrick McHardy wrote:
> Alexander Samad wrote:
> >Patrick
> >
> >whilst debugging a ipsec bug I noticed these problems
> >
> >when you do a tcpdump you the decrypted packet seems to show up
> > twice it seems to be the exact same packet.
> 
> Yes, this is a consequence of passing the packets though the stack again
> once we know decapsulation is finished. It will also cause statistics
> to account for the packet twice.
Understand that, but I see the unencapsulated packet twice (tcpdump
see's it 3 times enc + 2 x unencap)
> 
> >
> >I am running this on a debian 2.6.4 kernel with the netfilter patchs
> >applied
> >(up to date cvs)
> >
> >
> >tcpdump output
> >=========
> >13:23:05.868512 0:a:8b:6a:30:8c 0:5:5d:64:c6:4e 0800 150:
> >202.154.115.130 > 138.130.55.80: ESP(spi=0x6e3852ef,seq=0x29)
> >13:23:05.868512 0:a:8b:6a:30:8c 0:5:5d:64:c6:4e 0800 98: 192.168.5.1 >
> >192.168.10.1: icmp: echo request (DF)
> >13:23:05.868512 0:a:8b:6a:30:8c 0:5:5d:64:c6:4e 0800 98: 192.168.5.1 >
> >192.168.10.1: icmp: echo request (DF)
> >
> >
> >my other problem is when I ping across the ipsec tunnel  from the remote
> >end to the server end I see the packets come in the interface, I see
> >them in the INPUT table and in the mangle table, but it never seems to
> >get back to the application
> 
> Please give some more details on the configuration, like:
> 
> Are you using NAT ?
> Are you marking the packets in the mangle table ?
> Are the packets forwarded when they get out of the tunnel ?
> 
> When you see the packets in the INPUT chain, does their source- and
> destination address match your policy ?
> 
> Regards
> Patrick
I did some futher testing, I was in NAT-T mode, when I removed the
nat'ing it started to work.

I had not being doing anything in mangle, but I did put in some lines to
accept and to count the packets.

I did the same on the INPUT chain as well and then placed a LOG before
(lines 1&2 on INPUT) and it seemed to have the right information.

The packets are destined for the box that terminates the IPSEC tunnel.
I am presume it met the policy as the packets where decrypted.



> 
> >
> >
> >
> >from ipsec auto --status
> >====
> >000 "roadwarrior.internet.nat"[4]:
> >192.168.8.0/22===138.130.55.80:4500[C=AU, ST=NSW, L=Sydney, O=A.Samad
> >Pty Ltd, OU=Alfred St, CN=sydlxfw01,
> >E=sydlxfw01@samad.com.au]---138.130.52.1...144.137.104.46:4500[C=AU,
> >ST=NSW, L=Sydney, O=A.Samad Pty Ltd, OU=Alfred St,
> >CN=asamadlx.samad.com.au, E=asamadlx@samad.com.au]===192.168.8.2/32;
> >erouted; eroute owner: #30
> >
> >Thanks
> >Alex
> 
> 

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]