IPsec tunnel mode bug - malformed, misaddressed packets

There is an ipsec bug in FC2 kernel 2.6.8-1.521 for ipsec tunnel mode. I have proven with a packet trace that some packets are misaddressed. Specifically it constructs a packet of the form:
IP header1 | AH header | IP header2 | ESP
The IP header1 has an incorrect destination address of the host in the remote tunneled subnet instead of the remote vpn partner, whereas IP header2 has the correct destination address of the remote vpn partner.

For an host in local ipsec subnet contacting a web server in remote ipsec subnet the initial syn and response of syn,ack are tunnelled successfuly, but the encrypted ack goes out malformed as indicated above, thus is never delivered.

Packet trace and setkey config are attached to bugzilla entry at http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=132832

Your help in resolving this bug so ipsec is usable would be appreciated greatly.

Chris

This is purely a user-space error. The Linux IPsec stack is very flexible. In particular, you can configure it to generate non-sense such as the above quite easily.

In this case, racoon needs to be taught that only the inner SA should be marked as tunnel mode.

Cheers,

Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

I updated the vpn peers to ipsec-tools-0.3.3-1 from fedora core development and the problem is the same. I captured a packet trace to verify. Any takers for an ipsec-tools bug? I'll gladly provide more details off-list.

Thanks.

They hang out at [email protected]

Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt