From owner-freebsd-bugs@FreeBSD.ORG Mon Jan 1 08:20:15 2007 Return-Path: X-Original-To: freebsd-bugs@hub.freebsd.org Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 5BF1C16A403 for ; Mon, 1 Jan 2007 08:20:15 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [69.147.83.40]) by mx1.freebsd.org (Postfix) with ESMTP id 3CEAD13C442 for ; Mon, 1 Jan 2007 08:20:15 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.4/8.13.4) with ESMTP id l018KFFe032663 for ; Mon, 1 Jan 2007 08:20:15 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.13.4/8.13.4/Submit) id l018KFKh032662; Mon, 1 Jan 2007 08:20:15 GMT (envelope-from gnats) Resent-Date: Mon, 1 Jan 2007 08:20:15 GMT Resent-Message-Id: <200701010820.l018KFKh032662@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Eugene Grosbein Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 39ADE16A407; Mon, 1 Jan 2007 08:12:38 +0000 (UTC) (envelope-from sa@nkz.delikates-nk.ru) Received: from nkz.delikates-nk.ru (nkz.delikates-nk.ru [81.16.143.102]) by mx1.freebsd.org (Postfix) with ESMTP id 8326D13C465; Mon, 1 Jan 2007 08:12:37 +0000 (UTC) (envelope-from sa@nkz.delikates-nk.ru) Received: from nkz.delikates-nk.ru (localhost [127.0.0.1]) by nkz.delikates-nk.ru (8.13.8/8.13.8) with ESMTP id l017mDef048766; Mon, 1 Jan 2007 14:48:13 +0700 (KRAT) (envelope-from sa@nkz.delikates-nk.ru) Received: (from root@localhost) by nkz.delikates-nk.ru (8.13.8/8.13.8/Submit) id l017mC48048765; Mon, 1 Jan 2007 14:48:12 +0700 (KRAT) (envelope-from sa) Message-Id: <200701010748.l017mC48048765@nkz.delikates-nk.ru> Date: Mon, 1 Jan 2007 14:48:12 +0700 (KRAT) From: Eugene Grosbein To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Cc: bms@FreeBSD.org Subject: bin/107392: [patch] setkey does not recognize esp as protocol name for spdadd X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 01 Jan 2007 08:20:15 -0000 >Number: 107392 >Category: bin >Synopsis: [patch] setkey does not recognize esp as protocol name for spdadd >Confidential: no >Severity: serious >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Mon Jan 01 08:20:13 GMT 2007 >Closed-Date: >Last-Modified: >Originator: Eugene Grosbein >Release: FreeBSD 6.1-STABLE i386 >Organization: Svyaz Service JSC >Environment: System: FreeBSD nkz.delikates-nk.ru 6.1-STABLE FreeBSD 6.1-STABLE #1: Thu Sep 7 13:31:53 KRAST 2006 root@nkz.delikates-nk.ru:/home/obj/home/src/sys/NKZ i386 >Description: This PR is very similar to bin/63616 and the fix is nearly identical. The following spdadd line cannot be parsed by setkey(8) currently: spdadd 1.1.1.1/32 2.2.2.2/32 esp -P out none; However, such functionality is required as workaround for a kernel desing problem: if outgoing packet encrypted with IPSEC is passed to the TCP/IP stack second time with IPDIVERT of DUMMYNET (when net.inet.ip.fw.one_pass=0), it may be encrypted with IPSEC second time that breaks PMTUD. See kern/103135 for details. The spdadd line shown above prevents IPSEC from this logic error and presents a workaround. But setkey does not parse this. >How-To-Repeat: Try to process spdadd shown above with setkey(8). >Fix: This patch is very like parse.y,1.5 that fixed the same issue for tcp. parse.y is located in sbin/setkey/ for recent versions and the same file is in usr.sbin/setkey/ for RELENG_4. --- parse.y.orig Mon Jan 1 14:31:55 2007 +++ parse.y Mon Jan 1 14:32:04 2007 @@ -683,6 +683,7 @@ : DECSTRING { $$ = $1; } | ANY { $$ = IPSEC_ULPROTO_ANY; } | PR_TCP { $$ = IPPROTO_TCP; } + | PR_ESP { $$ = IPPROTO_ESP; } | STRING { struct protoent *ent; I'd be glad to see this trivial patch backported to RELENG_5 and RELENG_4 :-) Eugene Grosbein >Release-Note: >Audit-Trail: >Unformatted: