Date: Tue, 21 Oct 2014 11:57:44 +0400 From: "Andrey V. Elsukov" <bu7cher@yandex.ru> To: Matthew Grooms <mgrooms@shrew.net>, freebsd-net@freebsd.org Subject: Re: Broken IPsec + enc +pf/ipfw Message-ID: <544611F8.9070403@yandex.ru> In-Reply-To: <54458001.6000507@shrew.net> References: <544535C2.9020301@shrew.net> <544566D2.40303@FreeBSD.org> <544569CF.2060905@shrew.net> <54457599.4060102@yandex.ru> <54458001.6000507@shrew.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On 21.10.2014 01:34, Matthew Grooms wrote: >>>>> https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=110959 >>>> >>>> Did you try the patch from last PR? It is small and should be >>>> applicable >>>> to stable/10. >>>> >>> >>> As I mentioned, it's not clear to me if the patch was intended to fix >>> the issue that I am describing. Is that the case? If so, I would be >>> happy to apply it and report back. These are production firewalls, so >>> I'd prefer to have some feedback before calculating that risk. >> >> This commit fixes similar problem with ipfw in 11.0-CURRENT. But I think >> it won't help you with pf in 10. I guess r266800 is what you need. >> > > From the commit message, it would appear that r266800 is intended to > correct issues related to IPv4-in-IPv6 or IPv6-in-IPv4 configurations. > I'm using the more traditional IPv4-in-IPv4 tunnel mode configuration. It also changes places from where pfil consumers are called. You may use dtrace script to see where is the problem. Try this: > kldload dtraceall > cat > ~/ipsec.d #!/usr/sbin/dtrace -s fbt::ipsec_filter:entry { m = *(struct mbuf **)arg0; ip = (struct ip *)m->m_hdr.mh_data; printf("%s: %s: %s->%s proto %d", (arg1 & 1) ? "in": "out", (arg2 & 1) ? "before": "after", inet_ntoa(&ip->ip_src.s_addr), inet_ntoa(&ip->ip_dst.s_addr), ip->ip_p); } ^D > chmod +x ~/ipsec.d > ~/ipsec.d This script will print messages when ipsec_filter function will be invoked. Can you show what it will print for your case? > Would a change to if_enc.c only effect the operation of ipfw? Unless I'm > misreading the man page, it only deals with traffic associated with the > IPSec processing path. In theory, I don't see why it would have an > effect on one pfil consumer and not the other. pf and ipfw deal differently when they want to determine incoming interface. > It looks like the last commit to 10.0-RELEASE is r255926, which is the > last real code change ( r257176 is just a header file include ) before > your commit of 272695 in CURRENT. So besides r272695, the driver in both > 10.x and CURRENT are essentially the same, are they not? No, they are not the same. -- WBR, Andrey V. Elsukov
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?544611F8.9070403>