From owner-freebsd-net@FreeBSD.ORG Tue Oct 21 07:59:53 2014 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 7CD6699A for ; Tue, 21 Oct 2014 07:59:53 +0000 (UTC) Received: from forward10l.mail.yandex.net (forward10l.mail.yandex.net [IPv6:2a02:6b8:0:1819::a]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "forwards.mail.yandex.net", Issuer "Certum Level IV CA" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 0FBC41CE for ; Tue, 21 Oct 2014 07:59:52 +0000 (UTC) Received: from smtp4m.mail.yandex.net (smtp4m.mail.yandex.net [77.88.61.131]) by forward10l.mail.yandex.net (Yandex) with ESMTP id 0105ABA114B; Tue, 21 Oct 2014 11:59:48 +0400 (MSK) Received: from smtp4m.mail.yandex.net (localhost [127.0.0.1]) by smtp4m.mail.yandex.net (Yandex) with ESMTP id 702C2BE00D3; Tue, 21 Oct 2014 11:59:48 +0400 (MSK) Received: from unknown (unknown [2a02:6b8:0:c33::9a]) by smtp4m.mail.yandex.net (nwsmtp/Yandex) with ESMTPSA id EjGtaz42MR-xlPeJaC0; Tue, 21 Oct 2014 11:59:47 +0400 (using TLSv1.2 with cipher AES128-SHA (128/128 bits)) (Client certificate not present) X-Yandex-Uniq: dd649f31-5dba-4c23-a26b-10aceb8dcc05 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yandex.ru; s=mail; t=1413878387; bh=4kaHig99OTv44+2v+tQoBvwDyucScUCo61P/STj8bTU=; h=Message-ID:Date:From:User-Agent:MIME-Version:To:Subject: References:In-Reply-To:Content-Type:Content-Transfer-Encoding; b=ciMrSNCvDd2sbecTd7R7QRjrgwzbCXlNuX6ir9HXDlzyY5IPMetNJISkbAMo8wsGp J7ARXRZrDZfrXJw3W2CyP9ba2NaU3CF5PsSlGnpqDU2InUMpOrBUFSlmcGPIEj3Bvy lm93BFvyqW05UpVqTmOnrk0ltx+NsU5zQiVGJJv4= Authentication-Results: smtp4m.mail.yandex.net; dkim=pass header.i=@yandex.ru Message-ID: <544611F8.9070403@yandex.ru> Date: Tue, 21 Oct 2014 11:57:44 +0400 From: "Andrey V. Elsukov" User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:31.0) Gecko/20100101 Thunderbird/31.1.2 MIME-Version: 1.0 To: Matthew Grooms , freebsd-net@freebsd.org Subject: Re: Broken IPsec + enc +pf/ipfw References: <544535C2.9020301@shrew.net> <544566D2.40303@FreeBSD.org> <544569CF.2060905@shrew.net> <54457599.4060102@yandex.ru> <54458001.6000507@shrew.net> In-Reply-To: <54458001.6000507@shrew.net> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 8bit X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Oct 2014 07:59:53 -0000 On 21.10.2014 01:34, Matthew Grooms wrote: >>>>> https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=110959 >>>> >>>> Did you try the patch from last PR? It is small and should be >>>> applicable >>>> to stable/10. >>>> >>> >>> As I mentioned, it's not clear to me if the patch was intended to fix >>> the issue that I am describing. Is that the case? If so, I would be >>> happy to apply it and report back. These are production firewalls, so >>> I'd prefer to have some feedback before calculating that risk. >> >> This commit fixes similar problem with ipfw in 11.0-CURRENT. But I think >> it won't help you with pf in 10. I guess r266800 is what you need. >> > > From the commit message, it would appear that r266800 is intended to > correct issues related to IPv4-in-IPv6 or IPv6-in-IPv4 configurations. > I'm using the more traditional IPv4-in-IPv4 tunnel mode configuration. It also changes places from where pfil consumers are called. You may use dtrace script to see where is the problem. Try this: > kldload dtraceall > cat > ~/ipsec.d #!/usr/sbin/dtrace -s fbt::ipsec_filter:entry { m = *(struct mbuf **)arg0; ip = (struct ip *)m->m_hdr.mh_data; printf("%s: %s: %s->%s proto %d", (arg1 & 1) ? "in": "out", (arg2 & 1) ? "before": "after", inet_ntoa(&ip->ip_src.s_addr), inet_ntoa(&ip->ip_dst.s_addr), ip->ip_p); } ^D > chmod +x ~/ipsec.d > ~/ipsec.d This script will print messages when ipsec_filter function will be invoked. Can you show what it will print for your case? > Would a change to if_enc.c only effect the operation of ipfw? Unless I'm > misreading the man page, it only deals with traffic associated with the > IPSec processing path. In theory, I don't see why it would have an > effect on one pfil consumer and not the other. pf and ipfw deal differently when they want to determine incoming interface. > It looks like the last commit to 10.0-RELEASE is r255926, which is the > last real code change ( r257176 is just a header file include ) before > your commit of 272695 in CURRENT. So besides r272695, the driver in both > 10.x and CURRENT are essentially the same, are they not? No, they are not the same. -- WBR, Andrey V. Elsukov