Subject: Re: IPsec tunnel mode bug - malformed, misaddressed packets

From: "Christopher K. Johnson" <[email-masked]>
Date: Mon, 18 Oct 2004 19:17:50 -0400

Herbert Xu wrote:

>On Sun, Oct 17, 2004 at 11:52:21AM +0000, Christopher K. Johnson wrote:
>  
>
>>There is an ipsec bug in FC2 kernel 2.6.8-1.521 for ipsec tunnel mode.
>>I have proven with a packet trace that some packets are
>>misaddressed.  Specifically it constructs a packet of the form:
>>IP header1 | AH header | IP header2 | ESP
>>    
>>
>In this case, racoon needs to be taught that only the inner SA
>should be marked as tunnel mode.
>  
>
I updated the vpn peers to ipsec-tools-0.3.3-1 from fedora core 
development and the problem is the same.  I captured a packet trace to 
verify.  Any takers for an ipsec-tools bug?  I'll gladly provide more 
details off-list.

Thanks.