Date: Wed, 12 Mar 2008 11:45:34 GMT From: Alexander Zagrebin <alexz@visp.ru> To: freebsd-gnats-submit@FreeBSD.org Subject: kern/121642: When using IPSec, tcpdump shows non-decapsulated packets on gif interface Message-ID: <200803121145.m2CBjYor067923@www.freebsd.org> Resent-Message-ID: <200803121150.m2CBo0tm043555@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 121642
>Category: kern
>Synopsis: When using IPSec, tcpdump shows non-decapsulated packets on gif interface
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Wed Mar 12 11:50:00 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator: Alexander Zagrebin
>Release: 7.0-RELEASE
>Organization:
>Environment:
FreeBSD hostname 7.0-RELEASE FreeBSD 7.0-RELEASE #0: Thu Mar 6 14:32:06 MSK 2008 alex@hostname:/usr/src/sys/i386/compile/KERNEL i386
>Description:
I'm using ipsec-protected tunnel between 2 hosts.
The first one (HostA) is running 6.3-RELEASE and second one (HostB) - 7.0-RELEASE.
The network topology:
------- public network -------
| |
| |
A.A.A.A B.B.B.B
Host A Host B
6.3-RELEASE 7.0-RELEASE
192.168.0.2 192.168.1.1
| |
| |
private private
net 192.168.0.0/24 net 192.168.1.0/24
After creating the tunnel using gif interfaces without IPSec, I can successfully
ping host 192.168.0.10 from 192.168.1.2.
tcpdump on gif interfaces shows:
HostA# tcpdump -ni gif0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on gif0, link-type NULL (BSD loopback), capture size 96 bytes
21:21:20.861465 IP 192.168.1.2 > 192.168.0.10: ICMP echo request, id 512, seq 49921, length 40
21:21:20.862060 IP 192.168.0.10 > 192.168.1.2: ICMP echo reply, id 512, seq 49921, length 40
HostB# tcpdump -ni gif0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on gif0, link-type NULL (BSD loopback), capture size 96 bytes
21:21:25.012390 IP 192.168.1.2 > 192.168.0.10: ICMP echo request, id 512, seq 49921, length 40
21:21:25.014457 IP 192.168.0.10 > 192.168.1.2: ICMP echo reply, id 512, seq 49921, length 40
All right.
Now I'm starting IPSec.
ipsec.conf on HostA:
spdadd B.B.B.B/32 A.A.A.A/32 ipencap
-P in ipsec esp/tunnel/B.B.B.B-A.A.A.A/require;
spdadd A.A.A.A/32 B.B.B.B/32 ipencap
-P out ipsec esp/tunnel/A.A.A.A-B.B.B.B/require;
ipsec.conf on HostB:
spdadd A.A.A.A/32 B.B.B.B/32 ipencap
-P in ipsec esp/tunnel/A.A.A.A-B.B.B.B/require;
spdadd B.B.B.B/32 A.A.A.A/32 ipencap
-P out ipsec esp/tunnel/B.B.B.B-A.A.A.A/require;
Pinging 192.168.0.10 from 192.168.1.2 is successful again, but
tcpdump shows:
HostA# tcpdump -ni gif0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on gif0, link-type NULL (BSD loopback), capture size 96 bytes
21:24:12.429778 IP 192.168.1.2 > 192.168.0.10: ICMP echo request, id 512, seq 51969, length 40
21:24:12.430246 IP 192.168.0.10 > 192.168.1.2: ICMP echo reply, id 512, seq 51969, length 40
HostB# tcpdump -ni gif0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on gif0, link-type NULL (BSD loopback), capture size 96 bytes
21:24:16.577374 IP 192.168.1.2 > 192.168.0.10: ICMP echo request, id 512, seq 51969, length 40
21:24:16.580876 IP 10.2.222.2 > 10.255.255.2: IP 192.168.0.10 > 192.168.1.2:
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
ICMP echo reply, id 512, seq 51969, length 40 (ipip-proto-4)
Oops!
tcpdump shows non-decapsulated packets, but tunnel works fine.
>How-To-Repeat:
See above
>Fix:
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200803121145.m2CBjYor067923>