Subject: Re: [Bugme-new] [Bug 6430] New: ipsec tunnel : reply is not forwarded

From: Raphael Astier <[email-masked]>
Date: Wed, 28 Jun 2006 10:02:56 +0200

Sorry for being late, but I have made some tests -after hours-
in hope to help and having maximum information about this problem.

I tried to point out exactly the problem, my preceding description is 
a consequence of what exactly happen.
No need of isakmpd, nor Cisco on some side.

Resume :
hostA -- GW1 <==> GW2 -- hostB.

hostA (10.0.0.2), GW1 (10.0.0.1, 192.168.0.1), GW2 (192.168.0.2, 11.0.0.1),
      hostB (11.0.0.2)
  
On GW1 :
#setkey -f 
flush;
spdflush;
add 192.168.1.1 192.168.1.2 esp 1000 -m tunnel -E des-cbc "12345678";
spdadd 10.0.0.0/24 11.0.0.0/24 any -P out ipsec
esp/tunnel/192.168.1.1-192.168.1.2/require;

On GW2 : (only need to have SPI to decrypt packets coming from GW1) 
#!/usr/local/sbin/setkey -f
flush;
spdflush;
add -n 192.168.1.1 192.168.1.2 esp 1000 -m tunnel -E des-cbc "12345678";

>>From hostA (which have a route to 11.0.0.2 via gw 10.0.0.1, I try to ping 
hostB. Packets are correctly encrypted on GW1, transmitted to GW2, and the
problem is here : GW2 does not forward decrypted packets to hostB.
(of course net/ipv4/conf/all/forwarding = 1 on GW2).

I have tried the following kernels on GW2 (all with same conf, see attachements):

- 2.6.4, woody filesystem: no bug 
(I have compiled setkey myself for woody: ipsec-tools-0.6.1)
- 2.6.6, woody filesystem: no bug
- 2.6.8.1, woody and sarge filesystems: no bug
- 2.6.9 , woody : no bug (work), sarge filesystem: bug (not working) !!
- 2.6.10, 2.6.12, 2.6.14, 2.6.16.9, 2.6.17.1: woody AND sarge filesystems: bug.  

For kernel 2.6.9, the situation is very surprising. Same kernel, different
glibc... 

If I have some time I will look patches between 2.6.8.1 and 2.6.9 about
networking... But I had never look into kernel source code, so I will certainly 
not be efficient... If you can give me some hints where to look...

Note : I have made a lot of tests with UML (and tuntap), 
but I have also verify the same things with "real" ethernet with kernels 2.6.8,
2.6.14 and 2.6.16.9.   

Regards,

Raphael Astier.
--------------

On Sun, Apr 23, 2006 at 12:53:42PM -0700, Andrew Morton wrote:
> [email-masked] wrote:
> >
> > http://bugzilla.kernel.org/show_bug.cgi?id=6430
> > 
> >            Summary: ipsec tunnel : reply is not forwarded
> >     Kernel Version: 2.6.14.5
> >             Status: NEW
> >           Severity: normal
> >              Owner: [email-masked]
> >          Submitter: [email-masked]
> > 
> > 
> > Most recent kernel where this bug did not occur: 2.6.14
> > Distribution: debian sarge 3.1
> > Hardware Environment: 
> > Software Environment: isakmpd
> > Problem Description: 
> > The situation is the following :
> > hostA -- GW1 <==> GW2 -- hostB, with an ipsec tunnel between GW1 and GW2.
> > Encryption : des-cbc, Auth : hmac-md5, and automatic keyring with isakmpd
> > on GW1 and GW2. 
> > The tunnel is correctly mounted, with symmetrical spi on both sides GW1 and GW2.
> > (I have verified with setkey)
> > When hostA ping hostB, packets are correctly send to hostB, and returns
> > to GW1, and are decrypted here, but are not forwarded to hostA. 
> > (Symmetrically when hostB ping hostA packet returned on GW2 are not 
> > forwarded to hostB). I have verified with tcpdump.
> > I have try exactly the same configuration with standard kernel 2.6.8 from
> > sarge distrib. and it works perfectly.
> > I also try to echo 0 > /proc/...eth0/rp_filter where eth0 is the interface on
> > GW2  "connected" to GW1 but result is the same.
> > I have also try replacing GW2 by a Cisco PIX, and I have same result 
> > on linux (2.6.14.5) GW1.
> > 
> > Steps to reproduce:
> > Configure an ipsec tunnel between GW1 and GW2 as described above. I have done 
> > it with isakmpd, and with standard support of ipsec in kernel, not with 
> > freeswan.
> > 
> 
> That's quite an old kernel.  Are you able to test 2.6.16?

On Sun, Apr 23, 2006 at 12:53:42PM -0700, Andrew Morton wrote:
> [email-masked] wrote:
> >
> > http://bugzilla.kernel.org/show_bug.cgi?id=6430
> > 
> >            Summary: ipsec tunnel : reply is not forwarded
> >     Kernel Version: 2.6.14.5
> >             Status: NEW
> >           Severity: normal
> >              Owner: [email-masked]
> >          Submitter: [email-masked]
> > 
> > 
> > Most recent kernel where this bug did not occur: 2.6.14
> > Distribution: debian sarge 3.1
> > Hardware Environment: 
> > Software Environment: isakmpd
> > Problem Description: 
> > The situation is the following :
> > hostA -- GW1 <==> GW2 -- hostB, with an ipsec tunnel between GW1 and GW2.
> > Encryption : des-cbc, Auth : hmac-md5, and automatic keyring with isakmpd
> > on GW1 and GW2. 
> > The tunnel is correctly mounted, with symmetrical spi on both sides GW1 and GW2.
> > (I have verified with setkey)
> > When hostA ping hostB, packets are correctly send to hostB, and returns
> > to GW1, and are decrypted here, but are not forwarded to hostA. 
> > (Symmetrically when hostB ping hostA packet returned on GW2 are not 
> > forwarded to hostB). I have verified with tcpdump.
> > I have try exactly the same configuration with standard kernel 2.6.8 from
> > sarge distrib. and it works perfectly.
> > I also try to echo 0 > /proc/...eth0/rp_filter where eth0 is the interface on
> > GW2  "connected" to GW1 but result is the same.
> > I have also try replacing GW2 by a Cisco PIX, and I have same result 
> > on linux (2.6.14.5) GW1.
> > 
> > Steps to reproduce:
> > Configure an ipsec tunnel between GW1 and GW2 as described above. I have done 
> > it with isakmpd, and with standard support of ipsec in kernel, not with 
> > freeswan.
> > 
> 
> That's quite an old kernel.  Are you able to test 2.6.16?