On Thu, 5 Jul 2018, Qiuyu Xiao wrote:
I recently encountered a problem when running Libreswan in Fedora 28.
I though it might be a bug so I just post it here.
Basically, I was deploying transport mode IPsec between two hosts.
After I set up Libreswan in Fedora 28 with 4.14.0 kernel, I found that
the packet cannot be sent out and /proc/net/xfrm_stat shows
XfrmOutNoStates errors. But the host can receive and process ESP
packets (I tested this with a Fedora 27 host where Libreswan can
correctly run).
Below is some detailed information:
Host version:
Fedora 28 with kernel 4.14.0-1.fc28.x86_64
Libreswan version:
3.23-2.fc28
There have been some issues with transport mode being broken in upstream
kernels. It might be worth seeing if the f28 kernel is broken or not.
I also just pushed 3.25-2 into fedora28, if you want to check if
upgrading libreswan helps.
ip xfrm policy
------------------
src 10.33.78.167/32 dst 10.33.79.184/32
dir out priority 2080 ptype main
tmpl src 0.0.0.0 dst 0.0.0.0
proto esp reqid 16389 mode transport
src 10.33.79.184/32 dst 10.33.78.167/32
dir in priority 2080 ptype main
tmpl src 0.0.0.0 dst 0.0.0.0
proto esp reqid 16389 mode transport
ip xfrm state
-----------------
src 10.33.79.184 dst 10.33.78.167
proto esp spi 0xd16f9fd1 reqid 16389 mode transport
replay-window 32
aead rfc4106(gcm(aes))
0x6d15bb854f28069891f40905320cc0debcc93e46eb6093b4cd6bff65dee5fbebd4fa1aaf
128
anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000
sel src 10.33.79.184/32 dst 10.33.78.167/32
src 10.33.78.167 dst 10.33.79.184
proto esp spi 0x1bd4d970 reqid 16389 mode transport
replay-window 32
aead rfc4106(gcm(aes))
0xb874dedc137d202b502c03ead3f3cc1a565ed680b25832d4ac3dd7d1ea1ab37b2fc27599
128
anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000
sel src 10.33.78.167/32 dst 10.33.79.184/32
This all looks okay.
Paul
_______________________________________________
Swan-dev mailing list
[email protected]
https://lists.libreswan.org/mailman/listinfo/swan-dev
