Herbert Xu wrote:
On Sun, Oct 17, 2004 at 11:52:21AM +0000, Christopher K. Johnson wrote:
There is an ipsec bug in FC2 kernel 2.6.8-1.521 for ipsec tunnel mode.
I have proven with a packet trace that some packets are
misaddressed. Specifically it constructs a packet of the form:
IP header1 | AH header | IP header2 | ESP
In this case, racoon needs to be taught that only the inner SA
should be marked as tunnel mode.
I updated the vpn peers to ipsec-tools-0.3.3-1 from fedora core
development and the problem is the same. I captured a packet trace to
verify. Any takers for an ipsec-tools bug? I'll gladly provide more
details off-list.
Thanks.
|