The offset for calculating ESN was not taking into account the new UDP header created for NAT-T. --- net/ipv4/esp4.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c index 4779374..c84d1fc 100644 --- a/net/ipv4/esp4.c +++ b/net/ipv4/esp4.c @@ -223,6 +223,8 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb) uh->len = htons(skb->len - skb_transport_offset(skb)); uh->check = 0; + skb_set_transport_header(skb, skb_transport_offset(skb) + sizeof(struct udphdr)); + switch (encap_type) { default: case UDP_ENCAP_ESPINUDP: -- 2.8.3