Re: IPsec tunnel mode bug - malformed, misaddressed packets

[Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>]

On Sun, Oct 17, 2004 at 11:52:21AM +0000, Christopher K. Johnson wrote:
> There is an ipsec bug in FC2 kernel 2.6.8-1.521 for ipsec tunnel mode.
> I have proven with a packet trace that some packets are
> misaddressed.  Specifically it constructs a packet of the form:
> IP header1 | AH header | IP header2 | ESP

This is purely a user-space error.  The Linux IPsec stack is
very flexible.  In particular, you can configure it to generate
non-sense such as the above quite easily.

In this case, racoon needs to be taught that only the inner SA
should be marked as tunnel mode.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@xxxxxxxxxxxxxxxxxxx>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt