* Issue with ipv6 icmp reply after dnat over ipsec
@ 2023-02-24 18:44 Satyavani Namala
2023-02-24 18:50 ` Florian Westphal
0 siblings, 1 reply; 2+ messages in thread
From: Satyavani Namala @ 2023-02-24 18:44 UTC (permalink / raw)
To: netdev
We are facing an issue while testing ICMP v6 (NAT) with ipsec tunnel,
where ping was not working , as policy is not matching (returning with
LINUX_MIB_XFRMINNOPOLS).
When we investigated and compared with IPv4 , it was found that,
nf_reset is happening before xfrm6_policy_check in case of IPV6
compared to IPV4 in which nf_reset is done after xfrm4_policy_check.
Due to nf_reset, skb->_nfct is NULL and __xfrm_policy_check is returning error.
Can we know if there is any fix in this area, and why it’s different from IPv4.
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: Issue with ipv6 icmp reply after dnat over ipsec
2023-02-24 18:44 Issue with ipv6 icmp reply after dnat over ipsec Satyavani Namala
@ 2023-02-24 18:50 ` Florian Westphal
0 siblings, 0 replies; 2+ messages in thread
From: Florian Westphal @ 2023-02-24 18:50 UTC (permalink / raw)
To: Satyavani Namala; +Cc: netdev
Satyavani Namala <vani.namala@gmail.com> wrote:
> We are facing an issue while testing ICMP v6 (NAT) with ipsec tunnel,
> where ping was not working , as policy is not matching (returning with
> LINUX_MIB_XFRMINNOPOLS).
>
> When we investigated and compared with IPv4 , it was found that,
> nf_reset is happening before xfrm6_policy_check in case of IPV6
> compared to IPV4 in which nf_reset is done after xfrm4_policy_check.
>
> Due to nf_reset, skb->_nfct is NULL and __xfrm_policy_check is returning error.
Looks like a bug, can you submit a fix?
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2023-02-24 18:51 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-02-24 18:44 Issue with ipv6 icmp reply after dnat over ipsec Satyavani Namala
2023-02-24 18:50 ` Florian Westphal
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).