From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S264655AbTFQLPV (ORCPT ); Tue, 17 Jun 2003 07:15:21 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S264659AbTFQLPV (ORCPT ); Tue, 17 Jun 2003 07:15:21 -0400 Received: from blackbird.intercode.com.au ([203.32.101.10]:3853 "EHLO blackbird.intercode.com.au") by vger.kernel.org with ESMTP id S264655AbTFQLPS (ORCPT ); Tue, 17 Jun 2003 07:15:18 -0400 Date: Tue, 17 Jun 2003 21:28:45 +1000 (EST) From: James Morris To: Julian Blake Kongslie cc: linux-kernel@vger.kernel.org, , "David S. Miller" , Subject: Re: IPSEC problems with GRE. In-Reply-To: <1055746871.2305.7.camel@festa.omgwallhack.org> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org On 16 Jun 2003, Julian Blake Kongslie wrote: > Hi there. > > I've been playing around with IPSec, and I came across a problem with > encrypting data sent directly by the kernel. > > Specifically, attempts to encrypt a GRE or IPIP tunnel with ipsec in > transport mode result in one of: > 1) No data sent. > 2) Data sent, ignored by peer. > 3) Kernel panic, with no SysRq. > > Numbers 1 and 2 might be configuration problems on my part, but I have > other ipsec setups running fine, and can't see anything different for > these. Number 3 is a big problem. I've not been able to reproduce the panic, but there is a potential issue with path mtu which could explain (1) and (2): the transport mode SAs between the gateways are not aware of the gre tunnel. You need to lower the mtu on the gre tunnel at each end to take the ipsec overhead into account. This will cause the gateways to generate appropriate icmp pmtu messages. This is handled automatically for tunnel mode ipsec configurations. - James -- James Morris