I am trying to use IPSEC [ AH / hmac-md5 algo ] with IPv6. I don't see any problem with the ICMP and UDP traffic with IPsec enabled. But i am having trouble making the TCP traffic work. Everytime i use a TCP application i get lots of "ipsec AH Authentication error" in my /var/log/messages . I also find that the packets containing TCP data are getting fragmented. After some debugging it seems that in tcp_v6_connect(), np->opt is NULL therefore ext_header_len is 0. Thus AH header doesn't get accounted for. Then, later in tcp_v6_xmit(), np->opt which is still NULL, is passed to ip6_xmit(). Because opt is NULL in ip6_xmit(), head_room does not get calculated for extension headers, i.e. AH, nor does ipv6_pushfrag_opts() get done to add AH header to packet being built. Only the ipv6 header gets added in ip6_xmit() and accounted for in TCP. TCP believes it has completed its job and everything is accounted for space-wise in the packet. Thus, later, when the output function gets run, it ends up adding AH header and fragmenting packet. I am not sure what is suppose to set the ipv6_txoptions on the socket, such that np->opt actually contains the info that is needed. Or if np->opt is NULL then perhaps something else is suppose to be done to obtain the information? Any ideas ?? Thanks -Sachin - : send the line "unsubscribe linux-net" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
