Re: IPsec tunnel mode bug - malformed, misaddressed packets

["Christopher K. Johnson" <ckjohnson@xxxxxxx>]

Herbert Xu wrote:

> On Sun, Oct 17, 2004 at 11:52:21AM +0000, Christopher K. Johnson wrote:
>  
>
> > There is an ipsec bug in FC2 kernel 2.6.8-1.521 for ipsec tunnel mode.
> > I have proven with a packet trace that some packets are
> > misaddressed.  Specifically it constructs a packet of the form:
> > IP header1 | AH header | IP header2 | ESP
> >    
> In this case, racoon needs to be taught that only the inner SA
> should be marked as tunnel mode.
>  
I updated the vpn peers to ipsec-tools-0.3.3-1 from fedora core 
development and the problem is the same.  I captured a packet trace to 
verify.  Any takers for an ipsec-tools bug?  I'll gladly provide more 
details off-list.
Thanks.