AW: IPv6 IPSec incompatibilities between 2.6.23 and 3.6.18 (and probably later)

Shanker,
as you suggested I have captured the ESP packets for 2.6.23, 3.6.18 and 4.6.4.
The capture took place on the sending interface. I can't see anything suspicious
in any of the three captures.

Regards
  Joerg

-----Ursprüngliche Nachricht-----
Von: Shanker Wang [mailto:shankerwangmiao@gmail.com]
Gesendet: Mittwoch, 20. Juli 2016 09:28
An: Pommnitz Jörg
Cc: Ilan Tayari; netdev@vger.kernel.org
Betreff: Re: IPv6 IPSec incompatibilities between 2.6.23 and 3.6.18 (and
probably later)

quoted

在 2016年7月19日，23:03，Ilan Tayari [off-list ref] 写道：

quoted

On the receiving side (e.g. fd01:1b10:1000::1) I see the decrypted
packets with the 2.6.23 kernel:
but NOT with the newer kernel:

Hi Joerg,

First steps to debug this would be:
cat /proc/net/xfrm_stat
ip -s xfrm state
ip -s xfrm policy

First command will show some error accounting, which can point to the

culprit code.

quoted

Second and third command will show existing objects, and some statistics

like when the last packet was used with them.

quoted

Last thing - for your safety you should keep those session keys private.

Ilan.

Hi Joerg,

I think maybe you can try tcpdump -w to write the captured packets into a
file
and use tools like Wireshark to analyze and see what is going wrong.

________________________________
Industrieanlagen-Betriebsgesellschaft mbH

Sitz der Gesellschaft: Ottobrunn, Registergericht: Amtsgericht München, HRB 5499
Geschäftsführung: Prof. Dr.-Ing. Rudolf F. Schwarz
Vorsitzender des Aufsichtsrats: RA Engelbert Kupka MdL a.D.