Re: [strongSwan] udp packet size

2015-03-16 Thread Steffen Plotner
Hi Fred, -Original Message- On 12/03/2015 02:35, Steffen Plotner wrote: Hi, Strongswan 5.2.2 on linux (centos 6) IKEv2 configuration for windows clients I have the following problem: Initiator sends IKE_SA_INIT Server responds with IKE_SA_INIT Initiator sends IKE_AUTH

Re: [strongSwan] Kernel panic with VTI tunnel

2015-03-16 Thread André Valentin
Hi Mike, that's right. I had no time to take a deeper look. Perhaps you have;-) Kind regards, André Am 16.03.2015 um 10:30 schrieb Mike Noordermeer: Hi, In the mail conversation, Steffen mentions that the patch should never be necessary, since outer_mode should not become NULL. So I doubt

Re: [strongSwan] udp packet size

2015-03-16 Thread Fred
On 12/03/2015 02:35, Steffen Plotner wrote: Hi, Strongswan 5.2.2 on linux (centos 6) IKEv2 configuration for windows clients I have the following problem: Initiator sends IKE_SA_INIT Server responds with IKE_SA_INIT Initiator sends IKE_AUTH Server responds with a fragmented IP packet of 1514

Re: [strongSwan] Kernel panic with VTI tunnel

2015-03-16 Thread Mike Noordermeer
Hi, In the mail conversation, Steffen mentions that the patch should never be necessary, since outer_mode should not become NULL. So I doubt the patch would be the proper fix? It may fix this issue, but if the maintainer says the patch should not be necessary it seems like the wrong fix to me.

Re: [strongSwan] ikev2 strongswan IKE_SA_INIT not have RFC 3947 Specification Vendor ID payload

2015-03-16 Thread Emeric POUPON
Hello, Not sure this RFC is the correct one for IKEv2 implementations. You should read this one: https://tools.ietf.org/html/rfc5996#section-2.23 You will find what you have read in the strongswan's wiki. Regards, - Mail original - De: Deepak Khandelwal dazz...@gmail.com À:

Re: [strongSwan] Kernel panic with VTI tunnel

2015-03-16 Thread Mike Noordermeer
Hi, Do you happen to have any more specific info on this bugfix? I would rather not deviate from the Debian default kernels, so it would be nice if I could point the maintainers to a specific fix that should be backported. Thanks, Mike On 15 March 2015 at 17:02, Andre Valentin

Re: [strongSwan] Kernel panic with VTI tunnel

2015-03-16 Thread André Valentin
Hi, take a look at this thread: http://marc.info/?t=14249509271r=1w=2 The initial mail is attached. I couldn't verfy the error with vanilla, but your error looks like mine. Have fun;-) André Am 16.03.2015 um 09:18 schrieb Mike Noordermeer: Hi, Do you happen to have any more specific

Re: [strongSwan] Kernel panic with VTI tunnel

2015-03-16 Thread Mike Noordermeer
Thanks... that looks very much like the same bug indeed. I will diff the various files of the Debian kernel and 3.18 vanilla to see if I can spot the change that introduced it. Regards, Mike On 16 March 2015 at 09:42, André Valentin avalen...@marcant.net wrote: Hi, take a look at this

Re: [strongSwan] StrongSwan Mac OS X app questions

2015-03-16 Thread Martin Willi
Ken, Are there any issues with DNS StrongSwan Mac OS X app? The osx-attr plugin prepends the negotiated DNS servers to the currently configured ones. You may check with scutil if that works as expected. Not sure if keeping the current DNS servers installed is the best approach, maybe we

Re: [strongSwan] Kernel panic with VTI tunnel

2015-03-16 Thread André Valentin
Hi! Please try the patch which is attached to the initial email. That shoud fix it. There is another bug with IPv6 which at first I ahrought at, but that's only with NAT. So please ignore that. So diffinig vanilla isn't needed. Kind regards, André Am 16.03.2015 um 09:50 schrieb Mike

Re: [strongSwan] StrongSwan Mac OS X app questions

2015-03-16 Thread Fred
On 16/03/2015 08:23, Martin Willi wrote: Ken, Are there any issues with DNS StrongSwan Mac OS X app? The osx-attr plugin prepends the negotiated DNS servers to the currently configured ones. You may check with scutil if that works as expected. Not sure if keeping the current DNS servers