public inbox for netdev@vger.kernel.org 
 help / color / mirror / Atom feed

From: Michael Smith <msmith@cbnco•com>
To: netdev@vger•kernel.org
Subject: IPsec tunnel forwarding in net-next-2.6 since 452edd59
Date: Tue, 15 Mar 2011 14:30:44 -0400	[thread overview]
Message-ID: <4D7FB054.2090902@cbnco.com> (raw)

Hi,

I'm able to ping across a tunnel to a peer running net-next-2.6, but 
only to an interface on the peer; trying to ping a host behind the peer 
fails. The incoming packet shows up in encrypted and decrypted form in 
tcpdump, but it's not forwarded. None of the XFRM error counters are 
incremented; the packets just silently fail to be forwarded.

There are no iptables rules and net.ipv4.ip_forward=1. The same config 
works on 2.6.38-rc8. git bisect pointed me to commit 452edd59 from March 2:

     xfrm: Return dst directly from xfrm_lookup()

     Instead of on the stack.


ip xfrm policy:

src 192.168.136.0/24 dst 192.168.137.0/24
         dir out priority 2344 ptype main
         tmpl src 1.1.1.136 dst 1.1.1.137
                 proto esp reqid 16385 mode tunnel

src 192.168.137.0/24 dst 192.168.136.0/24
         dir fwd priority 2344 ptype main
         tmpl src 1.1.1.137 dst 1.1.1.136
                 proto esp reqid 16385 mode tunnel

src 192.168.137.0/24 dst 192.168.136.0/24
         dir in priority 2344 ptype main
         tmpl src 1.1.1.137 dst 1.1.1.136
                 proto esp reqid 16385 mode tunnel

net-next-2.6 host is at 1.1.1.136 and 192.168.136.1. 2.6.35.10 host is 
at 1.1.1.137 and 192.168.137.1. From that host:

ping -I 192.168.137.1 192.168.136.1 -> success
ping -I 192.168.137.1 192.168.136.2 -> silent failure

Thanks,
Mike

next             reply	other threads:[~2011-03-15 18:30 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2011-03-15 18:30 Michael Smith [this message]
2011-03-15 22:16 ` IPsec tunnel forwarding in net-next-2.6 since 452edd59 Eric Dumazet
2011-03-15 22:28   ` David Miller
2011-03-15 22:31     ` Eric Dumazet
2011-03-15 22:51   ` Michael Smith

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=4D7FB054.2090902@cbnco.com \
    --to=msmith@cbnco$(echo .)com \
    --cc=netdev@vger$(echo .)kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox