From: Serguei Ivantsov <me@2gw.net>
To: netdev@vger.kernel.org
Subject: IPSec tunnels with compression are broken since 4.14
Date: Sun, 24 Dec 2017 23:20:34 +0200 [thread overview]
Message-ID: <649412da69e9f89340085af638f88f3d@gsc-game.com> (raw)
Hi,
Found weird issue starting from 4.14 kernels.
IPSec tunnels with IPComp enabled are not working.
There are a couple of similar reports in strongSwan's wiki and mailing
list.
Resolution is simple - disable compression.
I have tested all kernels from 4.14 to 4.14.8 - does not work. But works
fine with any earlier kernel like 4.13.x
Both ikev1 and ikev2 are affected.
According to ipsec statusall, connection was established, but no traffic
routed - can't ping, etc.
rt6-center[6]: ESTABLISHED 3 minutes ago,
XX.XX.XX.XX[rt6]...YY.YY.YY.YY[center]
rt6-center[6]: IKEv2 SPIs: d7bd02a630bcd9b9_i 676e1ad3da512c68_r*,
rekeying in 2 hours
rt6-center[6]: IKE proposal:
AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/CURVE_25519
rt6-center{2}: INSTALLED, TUNNEL, reqid 2, ESP in UDP SPIs: c1b5ec2b_i
ce572160_o, IPCOMP CPIs: 2c8c_i 0ca7_o
rt6-center{2}: AES_CBC_128/HMAC_SHA2_256_128, 0 bytes_i, 0 bytes_o,
rekeying in 35 minutes
rt6-center{2}: XX.XX.XX.XX/32 === 10.1.0.1/32
Regards,
Serguei
reply other threads:[~2017-12-24 21:48 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=649412da69e9f89340085af638f88f3d@gsc-game.com \
--to=me@2gw.net \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox