Open mixman68 opened 9 years ago
On Wed, 4 Mar 2015, djgreg13 wrote:
Hello, i have multiple NAT for attack my openswan server :+1: 10.0.1.201(my server) <> WAN Adress 1 <------> WAN Client1 <> Client1( 192.168.1.10)
Openswan crash after upgrade to 2.6.38 or later, downgrade to 2.6.37 resolve problem
it does not actually crash but it looks like what you see is the bad patch to the old/new style NAT-T detection that was added to openswan. So packet flow fails and the remote sends you a delete to hang up.
The broken patch was introduced by Simon
Paul
With 2.6.38, the OSX client proposal of using 192.168.1.18/32 as the remote subnet was accepted while it was previously ignored as bogus in 2.6.37.
This change in behaviour was introduced by commit b44418272c1fbd686cb4e7ca860494664270a04b
Could you tell us the OS X/iOS version that is ran by the client?
in both cases the connection establishes - nothing is rejected as bogus in either 2.6.37 or 2.6.38.
The pointed to commit is not the problem. The problem is most likely https://github.com/xelerance/Openswan/commit/3eb39709ac9dd78534f96e57204514bf22e69937
I assumed you were referring to that commit but since it's not part of 2.6.38 I started looking elsewhere.
The timing between the established IPsec SA (17:34:18) and the delete message (17:34:38) could indicate that the L2TP client was unhappy and hung up.
months ago i tested your patch to the nat style detection and it broke all NAT'ed clients. You can try it in one of your test cases. This has nothing to do with L2TP
I'm not debating if my patch is good or bad, I'm just saying that it can hardly be it because it is not part of 2.6.38. That said, my patch seems to pass our automated test suite but that doesn't involve clients that are not OSW.
Of course, before including it in a stable release, we'll test it with iPhone/OSX clients.
On Wed, 4 Mar 2015, Simon Deziel wrote:
I'm not debating if my patch is good or bad, I'm just saying that it can hardly be it because it is not part of 2.6.38. That said, my patch seems to pass our automated test suite but that doesn't involve clients that are not OSW.
At the time I ran openswan-klips + openswan-userland through our NAT test and it failed to interop with itself. Perhaps results are different if you were on < 2.6.23 kernels.
I run latest version of OSX and 8.1.3 for iOS
I will test ta evening with a fortigate 60
Gregory G
Le 5 mars 2015 à 00:04, Paul Wouters (libreswan) notifications@github.com a écrit :
On Wed, 4 Mar 2015, Simon Deziel wrote:
I'm not debating if my patch is good or bad, I'm just saying that it can hardly be it because it is not part of 2.6.38. That said, my patch seems to pass our automated test suite but that doesn't involve clients that are not OSW.
At the time I ran openswan-klips + openswan-userland through our NAT test and it failed to interop with itself. Perhaps results are different if you were on < 2.6.23 kernels.
— Reply to this email directly or view it on GitHub.
Libreswan-3.12 should work as a drop in replacement too
Sent from my iPhone
On Mar 5, 2015, at 01:10, djgreg13 notifications@github.com wrote:
I run latest version of OSX and 8.1.3 for iOS
I will test ta evening with a fortigate 60
Gregory G
Le 5 mars 2015 à 00:04, Paul Wouters (libreswan) notifications@github.com a écrit :
On Wed, 4 Mar 2015, Simon Deziel wrote:
I'm not debating if my patch is good or bad, I'm just saying that it can hardly be it because it is not part of 2.6.38. That said, my patch seems to pass our automated test suite but that doesn't involve clients that are not OSW.
At the time I ran openswan-klips + openswan-userland through our NAT test and it failed to interop with itself. Perhaps results are different if you were on < 2.6.23 kernels.
— Reply to this email directly or view it on GitHub.
— Reply to this email directly or view it on GitHub.
Libreswan works fine, switch to this fork while openswan not working
2015-03-05 7:44 GMT+01:00 Paul Wouters (libreswan) <notifications@github.com
:
Libreswan-3.12 should work as a drop in replacement too
Sent from my iPhone
On Mar 5, 2015, at 01:10, djgreg13 notifications@github.com wrote:
I run latest version of OSX and 8.1.3 for iOS
I will test ta evening with a fortigate 60
Gregory G
Le 5 mars 2015 à 00:04, Paul Wouters (libreswan) < notifications@github.com> a écrit :
On Wed, 4 Mar 2015, Simon Deziel wrote:
I'm not debating if my patch is good or bad, I'm just saying that it can hardly be it because it is not part of 2.6.38. That said, my patch seems to pass our automated test suite but that doesn't involve clients that are not OSW.
At the time I ran openswan-klips + openswan-userland through our NAT test and it failed to interop with itself. Perhaps results are different if you were on < 2.6.23 kernels.
— Reply to this email directly or view it on GitHub.
— Reply to this email directly or view it on GitHub.
— Reply to this email directly or view it on GitHub https://github.com/xelerance/Openswan/issues/116#issuecomment-77315168.
To the OP, were you able to test OpenSwan releases that were newer? Something like 2.6.42 or even 2.6.43-rc1?
Paul, thanks for pointing the problem with KLIPS and my patch, we'll make sure to look into this during QA. As for our testing, we don't test with such old kernels; 2.6.32 is the oldest kernel we test with.
At the future maintenance, i use open(libre)swan under production environment, and we don't have development environment
I got the same problem here. I am trying to build a L2TP server on ubuntu 14.4.1. So far, I have tested openswan: version 2.6.38 and before: Android 6.0: unable to connect, (stuck at " STATE_QUICK_R2: IPsec SA established transport mode" and eventually connection timed out)
version 2.6.43: Android 6.0: IT WORKED !!! mac OS 10.11.2 unable to connect (keep getting "received and ignored informational message") Windows 10: unable to connect (keep getting "received and ignored informational message")
version 2.6.44-UNSTABLE: Android 6.0: unable to connect, (keep getting "received and ignored informational message") mac OS 10.11.2 unable to connect, (keep getting "received and ignored informational message") Windows 10: unable to connect (keep getting "received and ignored informational message")
Hello, i have multiple NAT for attack my openswan server :+1: 10.0.1.201(my server) <> WAN Adress 1 <------> WAN Client1 <> Client1( 192.168.1.10)
Openswan crash after upgrade to 2.6.38 or later, downgrade to 2.6.37 resolve problem
On OpenSwan 2.6.37 :
On OpenSwan 2.6.38 :