From owner-freebsd-bugs@FreeBSD.ORG Wed Mar 12 11:50:01 2008 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 2302E1065675 for ; Wed, 12 Mar 2008 11:50:01 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 0101C8FC52 for ; Wed, 12 Mar 2008 11:50:01 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.2/8.14.2) with ESMTP id m2CBo0pC043556 for ; Wed, 12 Mar 2008 11:50:00 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.2/8.14.1/Submit) id m2CBo0tm043555; Wed, 12 Mar 2008 11:50:00 GMT (envelope-from gnats) Resent-Date: Wed, 12 Mar 2008 11:50:00 GMT Resent-Message-Id: <200803121150.m2CBo0tm043555@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Alexander Zagrebin Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 3E0CB1065673 for ; Wed, 12 Mar 2008 11:48:51 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21]) by mx1.freebsd.org (Postfix) with ESMTP id 2EFD48FC32 for ; Wed, 12 Mar 2008 11:48:51 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.14.2/8.14.2) with ESMTP id m2CBjYGn067924 for ; Wed, 12 Mar 2008 11:45:34 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.14.2/8.14.1/Submit) id m2CBjYor067923; Wed, 12 Mar 2008 11:45:34 GMT (envelope-from nobody) Message-Id: <200803121145.m2CBjYor067923@www.freebsd.org> Date: Wed, 12 Mar 2008 11:45:34 GMT From: Alexander Zagrebin To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Cc: Subject: kern/121642: When using IPSec, tcpdump shows non-decapsulated packets on gif interface X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 12 Mar 2008 11:50:01 -0000 >Number: 121642 >Category: kern >Synopsis: When using IPSec, tcpdump shows non-decapsulated packets on gif interface >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Wed Mar 12 11:50:00 UTC 2008 >Closed-Date: >Last-Modified: >Originator: Alexander Zagrebin >Release: 7.0-RELEASE >Organization: >Environment: FreeBSD hostname 7.0-RELEASE FreeBSD 7.0-RELEASE #0: Thu Mar 6 14:32:06 MSK 2008 alex@hostname:/usr/src/sys/i386/compile/KERNEL i386 >Description: I'm using ipsec-protected tunnel between 2 hosts. The first one (HostA) is running 6.3-RELEASE and second one (HostB) - 7.0-RELEASE. The network topology: ------- public network ------- | | | | A.A.A.A B.B.B.B Host A Host B 6.3-RELEASE 7.0-RELEASE 192.168.0.2 192.168.1.1 | | | | private private net 192.168.0.0/24 net 192.168.1.0/24 After creating the tunnel using gif interfaces without IPSec, I can successfully ping host 192.168.0.10 from 192.168.1.2. tcpdump on gif interfaces shows: HostA# tcpdump -ni gif0 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on gif0, link-type NULL (BSD loopback), capture size 96 bytes 21:21:20.861465 IP 192.168.1.2 > 192.168.0.10: ICMP echo request, id 512, seq 49921, length 40 21:21:20.862060 IP 192.168.0.10 > 192.168.1.2: ICMP echo reply, id 512, seq 49921, length 40 HostB# tcpdump -ni gif0 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on gif0, link-type NULL (BSD loopback), capture size 96 bytes 21:21:25.012390 IP 192.168.1.2 > 192.168.0.10: ICMP echo request, id 512, seq 49921, length 40 21:21:25.014457 IP 192.168.0.10 > 192.168.1.2: ICMP echo reply, id 512, seq 49921, length 40 All right. Now I'm starting IPSec. ipsec.conf on HostA: spdadd B.B.B.B/32 A.A.A.A/32 ipencap -P in ipsec esp/tunnel/B.B.B.B-A.A.A.A/require; spdadd A.A.A.A/32 B.B.B.B/32 ipencap -P out ipsec esp/tunnel/A.A.A.A-B.B.B.B/require; ipsec.conf on HostB: spdadd A.A.A.A/32 B.B.B.B/32 ipencap -P in ipsec esp/tunnel/A.A.A.A-B.B.B.B/require; spdadd B.B.B.B/32 A.A.A.A/32 ipencap -P out ipsec esp/tunnel/B.B.B.B-A.A.A.A/require; Pinging 192.168.0.10 from 192.168.1.2 is successful again, but tcpdump shows: HostA# tcpdump -ni gif0 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on gif0, link-type NULL (BSD loopback), capture size 96 bytes 21:24:12.429778 IP 192.168.1.2 > 192.168.0.10: ICMP echo request, id 512, seq 51969, length 40 21:24:12.430246 IP 192.168.0.10 > 192.168.1.2: ICMP echo reply, id 512, seq 51969, length 40 HostB# tcpdump -ni gif0 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on gif0, link-type NULL (BSD loopback), capture size 96 bytes 21:24:16.577374 IP 192.168.1.2 > 192.168.0.10: ICMP echo request, id 512, seq 51969, length 40 21:24:16.580876 IP 10.2.222.2 > 10.255.255.2: IP 192.168.0.10 > 192.168.1.2: ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ICMP echo reply, id 512, seq 51969, length 40 (ipip-proto-4) Oops! tcpdump shows non-decapsulated packets, but tunnel works fine. >How-To-Repeat: See above >Fix: >Release-Note: >Audit-Trail: >Unformatted: