>Number:         27084
>Category:       kern
>Synopsis:       ipsec_proxy functionality was broken by other IP changes
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Sep 30 00:46:01 UTC 2004
>Closed-Date:
>Last-Modified:
>Originator:     Geoff C. Wing
>Release:        NetBSD 2.0H
>Organization:
>Environment:
System: NetBSD g.primenet.com.au 2.0H NetBSD 2.0H (G) #0: Tue Sep 28 17:40:08 EST 2004 gcw@g.primenet.com.au:/usr/netbsd/src/sys/arch/i386/compile/G i386
Architecture: i386
Machine: i386
>Description:
	Sometime late August or early September, changes to IP or UDP code
	broke the IPSEC proxy.  ipnat lists:

	MAP 192.168.1.5    500   <- -> 203.51.166.96   500   [203.43.15.55 500]
		proxy ipsec/17 use 1 flags 0
			proto 17 flags 0 bytes 1044 pkts 4 data YES size 328
		IPSec Proxy:
			ICookie 335d631f180abf04 RCookie 0000000000000000 (Not set)

>How-To-Repeat:
	e.g. set up an IPNAT rule(1) on a gateway machine and try to set up
	an MSWin L2TP connection over it.

	(1) map pppoe0 192.168.1.0/24 -> 0/32 proxy port isakmp ipsec/udp
>Fix:
	?
>Release-Note:
>Audit-Trail:
>Unformatted: