I am using 2.6.0-test kernel. Sachin Sant wrote: > > I am trying to use IPSEC [ AH / hmac-md5 algo ] with IPv6. I don't see > any problem with the ICMP and UDP traffic with IPsec enabled. But i am > having trouble making the TCP traffic work. Everytime i use a TCP > application i get lots of "ipsec AH Authentication error" in my > /var/log/messages . I also find that the packets containing TCP data are > getting fragmented. > > After some debugging it seems that in tcp_v6_connect(), np->opt is NULL > therefore ext_header_len is 0. Thus AH header doesn't get accounted for. > Then, later in tcp_v6_xmit(), np->opt which is still NULL, is passed to > ip6_xmit(). Because opt is NULL in ip6_xmit(), head_room does not get > calculated for extension headers, i.e. AH, nor does ipv6_pushfrag_opts() > get done to add AH header to packet being built. Only the ipv6 header > gets added in ip6_xmit() and accounted for in TCP. TCP believes it has > completed its job and everything is accounted for space-wise in the > packet. Thus, later, when the output function gets run, it ends up > adding AH header and fragmenting packet. > > I am not sure what is suppose to set the ipv6_txoptions on the socket, > such that np->opt actually contains the info that is needed. Or if > np->opt is NULL then perhaps something else is suppose to be done to > obtain the information? > > Any ideas ?? > > Thanks > -Sachin > - > : send the line "unsubscribe linux-net" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html - : send the line "unsubscribe linux-net" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
