Martin Willi
f27fb58ae0
As we now reuse the reqid for identical SAs, the behavior changes for transport connections to multiple peers behind the same NAT. Instead of rejecting the SA, we now have two valid SAs active. For the reverse path, however, sun sends traffic always over the newer SA, resembling the behavior before we introduced explicit SA conflicts for different reqids.
10 lines
717 B
Plaintext
10 lines
717 B
Plaintext
alice::ipsec status 2> /dev/null::nat-t.*ESTABLISHED.*[email protected].*sun.strongswan.org::YES
|
|
sun:: ipsec status 2> /dev/null::nat-t.*ESTABLISHED.*sun.strongswan.org.*[email protected]::YES
|
|
alice::ipsec status 2> /dev/null::nat-t.*INSTALLED, TRANSPORT, reqid 1::YES
|
|
venus::ipsec status 2> /dev/null::nat-t.*INSTALLED, TRANSPORT, reqid 1::YES
|
|
sun:: ipsec status 2> /dev/null::nat-t.*INSTALLED, TRANSPORT, reqid 1::YES
|
|
alice::ping -c 1 -W 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_req=1::NO
|
|
venus::ping -c 1 -W 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_req=1::YES
|
|
sun::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.*: UDP::YES
|
|
sun::tcpdump::IP sun.strongswan.org.* > moon.strongswan.org.*: UDP::YES
|