lkml.org 
[lkml]   [2004]   [Sep]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectMinor IPSec bug + solution
From
Date
Hi,

I was setting up an VPN via IPSec in kernel 2.6.x on IPv4 and found the
following bug. It is not possible to set up an IPComp/ESP tunnel with
IPComp set as mandatory. The following setup works fine for me:

spdadd 192.168.1.0/24 192.168.2.0/24 any -P out ipsec
ipcomp/tunnel/192.168.1.100-192.168.2.212/use
esp/tunnel/192.168.1.100-82.99.145.1/require;

(IPs are little bit confusing, because computers are behing NAT and the
pair SP is not shown, because it is not important)

But the following one is not working:

spdadd 192.168.1.0/24 192.168.2.0/24 any -P out ipsec
ipcomp/tunnel/192.168.1.100-192.168.2.212/require
esp/tunnel/192.168.1.100-82.99.145.1/require;



Of course it is possible to use the first setup, but I found that
problem was in "require" for IPComp only after quite a while of
debugging. :-)

The later setup is not working, because all IP-IP packets are droped by
__xfrm_policy_check function, because of error in xfrm_state_ok
function. For tunnels it returns

tmpl->optional && !xfrm_state_addr_cmp(tmpl, x, family);

but it should return

tmpl->optional || !xfrm_state_addr_cmp(tmpl, x, family);

The packet should pass policy check if either the policy is optional OR
the source address match. The code says that check pass if policy is
optional AND the address match, which is obviously wrong. IMHO it is the
reason, why I have to set this "use" for IPComp tunnel.

So the problem is in file "net/xfrm/xfrm_policy.c" in function
"xfrm_state_ok" - on line 868 in 2.6.8.1 kernel. It seems to me to
trivial change to create a patch.


I am not sure where I shall send this mail. As I said, it is a minnor
bug, and it is possible to set up things working even with it.
Nevertheless it would be nice to have it fixed. Can somebody help me,
where I shall send it?

Thanks.
- Martin Bouzek
- martin.bouzek@radas-atc.cz


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 14:06    [W:0.065 / U:0.208 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site