Strange break with kernel 6.8.0

[hgshoggins]

I just started to have an issue I can't really put my finger on.
We have Strongswan running on a (fairly old) Fedora system.
Both Strongswan and the kernel are manually compiled and installed. Strongswan version is 5.9.13 and kernel is 6.6.8.

Recently we compiled kernel 6.8.0 on that machine, everything works fine, except... now the site-to-site connection peers cannot ping each other although the tunnel is established.

If we roll back to kernel 6.6.8, everything is fine again.

I don't have the info that there were major changes in kernel 6.8.0 regarding packet filtering and/or IPSec processing and so on, I'm confused.

Any ideas?

ipsec statusall gives:

Connections:
net-net-remote:  host.fqdn...%any  IKEv2
net-net-remote:   local:  [host.fqdn] uses public key authentication
net-net-remote:    cert:  "C=FR, O=ORG, CN=host.fqdn"
net-net-remote:   remote: [remoterouter] uses public key authentication
net-net-remote:   child:  192.168.22.0/24 192.168.35.0/24 192.168.250.0/24 192.168.220.0/24 192.168.12.0/24 10.200.0.0/16 === 192.168.17.0/24 TUNNEL
net-net-remote[1]: ESTABLISHED 26 minutes ago, X.X.X.X[host.fqdn]...Y.Y.Y.Y[remoterouter]
net-net-remote[1]: IKEv2 SPIs: 046cbe10ade3db04_i bab4c4bc813d1ad1_r*, rekeying in 7 hours
net-net-remote[1]: IKE proposal: AES_CBC_128/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_3072
net-net-remote{1}:  INSTALLED, TUNNEL, reqid 1, ESP in UDP SPIs: c7a1624c_i cbd6709d_o
net-net-remote{1}:  AES_CBC_256/HMAC_SHA1_96, 0 bytes_i, 0 bytes_o, rekeying in 28 minutes
net-net-remote{1}:   10.200.0.0/16 192.168.22.0/24 192.168.220.0/24 192.168.250.0/24 === 192.168.17.0/24

This output is the same no matter the kernel version is used. Only in one case traffic is flowing normally, and in the other case we cannot ping each other.

[tobiasbrunner]

Any ideas?

No, sorry. v6.8 works fine in our testing environment (the only known issue is sending packets via IPv4 raw sockets, but that currently affects all kernels since v6.4).