Date: Wed, 01 Aug 2007 16:31:37 +0800 From: blue <susan.lan@zyxel.com.tw> To: freebsd-net@freebsd.org Subject: IPsec AH tunneling pakcet mis-handling? Message-ID: <46B044E9.50404@zyxel.com.tw>
next in thread | raw e-mail | index | archive | help
Dear all:
I do not know the purpose of the following codes in the very beginning
in ip6_input():
#ifdef IPSEC
/*
* should the inner packet be considered authentic?
* see comment in ah4_input().
*/
if (m) {
m->m_flags &= ~M_AUTHIPHDR;
m->m_flags &= ~M_AUTHIPDGM;
}
#endif
Consider the case: a packet is encrypted as AH tunneled, and FreeBSD is
the end point of the tunnel. After it tore off the outer IPv6 header,
the mbuf will be inserted to NETISR again. Then ip6_forward() will be
called again to process the packet. However, in ipsec6_in_reject(), the
packet's source and destination will match the SP entry. Since
ip6_input() has truned off the flag M_AUTHIPHDR and M_AUTHIPDGM, the
packet will be dropped.
I don't think with the codes AH tunnel could work properly.
Best regards,
Yi-Wen
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?46B044E9.50404>