On Friday 11 May 2007 19:13:41 Patrick McHardy wrote:
> Joakim Koskela wrote:
> > I'm running a system where there might be multiple simultenously
> > active ipsec states between two hosts (ipv6, but guess it applies to
> > v4 as well) where the outer ip is the same for all states, but the
> > inner differ (using beet mode).
> >
> > The problem is that after establishing these states, it seems that the
> > one associated with outgoing traffic is selected solely by the outer
> > address (the first state matching the outer ip-pairs is used), which
> > usually results in the wrong spi and the packet being dropped at the
> > receiver.
>
> This should only pick states matching the flow:
>
> if (x->km.state == XFRM_STATE_VALID) {
>
>
> if (!xfrm_selector_match(&x->sel, fl, family) ||
> !security_xfrm_state_pol_flow_match(x, pol, fl))
> continue;
> ...
>
> I'm probably misunderstanding your configuration, could you post the
> SA selectors and addresses that result in an incorrect state being
> picked?
>
> -
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to [EMAIL PROTECTED]
> More majordomo info at http://vger.kernel.org/majordomo-info.html
Oh, your right. I wasn't setting the netmask correctly (zero) for the
selectors, making them match anything. Sorry for the waste of time!
br, j
--
Joakim Koskela
Helsinki Institute for Information Technology (HIIT)
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
