<div dir="ltr">Hello,<br><br>While working on the issue I observe that: in programs/pluto/demux.c<br>'complete_state_transition' calls 'nat_traversal_change_port_lookup' only if the state transition requested to send a reply packet.<br>
As in aggressive mode, there will be no reply packet in transition from STATE_AGGR_R1 to STATE_AGGR_R2, port floating will not happen for p1st (phase-1 SA).<br><br>The following patch calls 'nat_traversal_change_port_lookup' unconditional to sending reply packet.<br>
<br>--- demux.c.orig Wed Aug 27 17:51:48 2008<br>+++ demux.c Wed Aug 27 20:57:02 2008<br>@@ -2463,6 +2463,12 @@ complete_state_transition(struct msg_dig<br> /* free previous transmit packet */<br> freeanychunk(st->st_tpacket);<br>
<br>+#ifdef NAT_TRAVERSAL<br>+ if (nat_traversal_enabled) {<br>+ nat_traversal_change_port_lookup(md, md->st);<br>+ }<br>+#endif<br>+<br> /* if requested, send the new reply packet */<br>
if (smc->flags & SMF_REPLY)<br> {<br>@@ -2480,12 +2486,6 @@ complete_state_transition(struct msg_dig<br> clonetochunk(st->st_tpacket, md->reply.start<br> , pbs_offset(&md->reply), "reply packet");<br>
<br>-#ifdef NAT_TRAVERSAL<br>- if (nat_traversal_enabled) {<br>- nat_traversal_change_port_lookup(md, md->st);<br>- }<br>-#endif<br>-<br> /* actually send the packet<br>
* Note: this is a great place to implement "impairments"<br> * for testing purposes. Suppress or duplicate the<br><br>Although the patch is not thourouly tested, now phase-1 SA sends DPD_R_U_THERE_ACK using source port 4500, (as the NATbox has conntrack entry for client:4500 -> server:4500) peer receives the packet, and connection remains established.<br>
<br>Please share your views on this.<br><br>Thanks for your time.<br><br>Regards,<br>-hiren<br><br><br><div class="gmail_quote">On Tue, Jul 22, 2008 at 11:29 AM, hiren joshi <span dir="ltr"><<a href="mailto:joshihirenn@gmail.com">joshihirenn@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div dir="ltr">Filed a bug report: <a href="http://bugs.xelerance.com/view.php?id=972" target="_blank">http://bugs.xelerance.com/view.php?id=972</a><br>
<br>Thanks for all your answers on this.<br><font color="#888888"><br>-hiren</font><div><div></div><div class="Wj3C7c"><br><br><div class="gmail_quote">
On Tue, Jul 22, 2008 at 9:10 AM, Paul Wouters <<a href="mailto:paul@xelerance.com" target="_blank">paul@xelerance.com</a>> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div>On Fri, 18 Jul 2008, hiren joshi wrote:<br>
<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Is it the same for 2.4.12 also?<br>
I tested this on openswan-2.4.12.<br>
</blockquote>
<br></div>
No, DPD on openswan 2.4.12 or 2.4.13 should work fine.<br><font color="#888888">
<br>
Paul</font><div><div></div><div><br>
<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
On Fri, Jul 18, 2008 at 3:12 AM, Paul Wouters <<a href="mailto:paul@xelerance.com" target="_blank">paul@xelerance.com</a>> wrote:<br>
On Thu, 17 Jul 2008, hiren joshi wrote:<br>
<br>
openswan detects NAT-Traversal as "both are<br>
NATed" instead of "peer is<br>
NATed".<br>
<br>
Later on I receive,<br>
DPD: Serious: could not find newest phase 1 state<br>
DPD: Warning: received old or duplicate R_U_THERE<br>
<br>
After some time client breaks the connection due<br>
of not getting<br>
DPD_R_U_THERE_ACK<br>
<br>
<br>
DPD is broken on the 2.6.x series. We're looking into it.<br>
<br>
Paul<br>
<br>
<br>
<br>
<br>
</blockquote>
</div></div></blockquote></div><br></div></div></div>
</blockquote></div><br></div>