Subject: Re: IPSec broken in 2.6.18-rc4-mm3

From: Patrick McHardy <[email-masked]>
Date: Sat, 09 Sep 2006 18:22:52 +0200

Gnome42 wrote:
> src 34.34.36.1 dst 34.34.36.6
>        proto esp spi 0x0dc3aba4(230927268) reqid 0(0x00000000) mode tunnel
>        replay-window 4 seq 0x00000001 flag  (0x00000000)
>        auth hmac(md5) 0xfea9e3e8d324265d8b7e17ec42d69b15 (128 bits)
>        enc cbc(aes) 0x21ca0a9677ff0225acd0d3f4a9bdcf61 (128 bits)
>        lifetime config:
>          limit: soft (INF)(bytes), hard (INF)(bytes)
>          limit: soft (INF)(packets), hard (INF)(packets)
>          expire add: soft 23040(sec), hard 28800(sec)
>          expire use: soft 0(sec), hard 0(sec)
>        lifetime current:
>          4560(bytes), 30(packets)
>          add 2006-09-09 10:21:41 use 2006-09-09 10:21:46
>        stats:
>          replay-window 0 replay 0 failed 0

> src 34.34.36.1 dst 34.34.36.6
>        proto esp spi 0x0dc3aba4(230927268) reqid 0(0x00000000) mode tunnel
>        replay-window 4 seq 0x991250886 flag  (0x00000000)
>        auth md5 0xfea9e3e8d324265d8b7e17ec42d69b15 (128 bits)
>        enc aes 0x21ca0a9677ff0225acd0d3f4a9bdcf61 (128 bits)
>        lifetime config:
>          limit: soft (INF)(bytes), hard (INF)(bytes)
>          limit: soft (INF)(packets), hard (INF)(packets)
>          expire add: soft 23040(sec), hard 28800(sec)
>          expire use: soft 0(sec), hard 0(sec)
>        lifetime current:
>          0(bytes), 0(packets)
>          add 2006-09-09 10:21:41 use 2006-09-09 10:21:46
>        stats:
>          replay-window 0 replay 0 failed 30

                                           ^^
This seems to be the problem, the sequence-numbers are outside the valid
window. I can't find anything that would cause this, please post a
tcpdump of the packets so we can see which values get used.