From owner-freebsd-bugs@FreeBSD.ORG Sat Feb 6 00:30:07 2010 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id CFF4D106568D for ; Sat, 6 Feb 2010 00:30:07 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 947838FC18 for ; Sat, 6 Feb 2010 00:30:07 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.3/8.14.3) with ESMTP id o160U7Ak012602 for ; Sat, 6 Feb 2010 00:30:07 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.3/8.14.3/Submit) id o160U7HF012599; Sat, 6 Feb 2010 00:30:07 GMT (envelope-from gnats) Resent-Date: Sat, 6 Feb 2010 00:30:07 GMT Resent-Message-Id: <201002060030.o160U7HF012599@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Vadim Fedorenko Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id B0F9A1065670 for ; Sat, 6 Feb 2010 00:25:15 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21]) by mx1.freebsd.org (Postfix) with ESMTP id 86DA18FC1C for ; Sat, 6 Feb 2010 00:25:15 +0000 (UTC) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.14.3/8.14.3) with ESMTP id o160PEnc003825 for ; Sat, 6 Feb 2010 00:25:14 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.14.3/8.14.3/Submit) id o160PEda003824; Sat, 6 Feb 2010 00:25:14 GMT (envelope-from nobody) Message-Id: <201002060025.o160PEda003824@www.freebsd.org> Date: Sat, 6 Feb 2010 00:25:14 GMT From: Vadim Fedorenko To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Cc: Subject: kern/143593: When using IPSec, tcpdump doesn't show outgoing packets on gif interface X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 06 Feb 2010 00:30:08 -0000 >Number: 143593 >Category: kern >Synopsis: When using IPSec, tcpdump doesn't show outgoing packets on gif interface >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Sat Feb 06 00:30:06 UTC 2010 >Closed-Date: >Last-Modified: >Originator: Vadim Fedorenko >Release: 7.2-STABLE >Organization: >Environment: FreeBSD hostname 7.2-STABLE FreeBSD 7.2-STABLE #1: Sat Jan 16 14:11:41 MSK 2010 junk@hostname:/usr/obj/usr/src/sys/PFKERNEL i386 >Description: I'm using ipsec tunnels between 2 hosts. The first one (Host1) is running 7.2-STABLE and the second one (Host2) 6.2-RELEASE. The network topology: Host1: public A.A.A.A private 192.168.1.114 net 192.168.1.0/24 Host2: public B.B.B.B private 192.168.4.254 net 192.168.4.0/24 The tunnel configuration for Host1: gif0 tunnel A.A.A.A B.B.B.B inet 192.168.1.114 192.168.4.254 netmask 255.255.255.255 ipsec.conf: spdadd 192.168.1.0/24 192.168.4.0/24 any -P out ipsec esp/tunnel/A.A.A.A-B.B.B.B/require; spdadd 192.168.4.0/24 192.168.1.0/24 any -P in ipsec esp/tunnel/B.B.B.B-A.A.A.A/require; The tunnel configuration for Host2: gif0 tunnel B.B.B.B A.A.A.A inet 192.168.4.254 192.168.1.114 netmask 255.255.255.255 ipsec.conf: spdadd 192.168.4.0/24 192.168.1.0/24 any -P out ipsec esp/tunnel/B.B.B.B-A.A.A.A/require; spdadd 192.168.1.0/24 192.168.4.0/24 any -P in ipsec esp/tunnel/A.A.A.A-B.B.B.B/require; Pinging 192.168.1.114 from 192.168.4.254 successful: [root@Host2 /etc]# ping 192.168.1.114 PING 192.168.1.114 (192.168.1.114): 56 data bytes 64 bytes from 192.168.1.114: icmp_seq=0 ttl=64 time=19.257 ms 64 bytes from 192.168.1.114: icmp_seq=1 ttl=64 time=19.443 ms 64 bytes from 192.168.1.114: icmp_seq=2 ttl=64 time=19.709 ms but tcpdump on host1 doesn't show outgoing packets on gif0: [root@Host1 /etc]# tcpdump -ni gif0 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on gif0, link-type NULL (BSD loopback), capture size 96 bytes 03:16:49.915662 IP 192.168.4.254 > 192.168.1.114: ICMP echo request, id 61598, seq 0, length 64 03:16:50.916994 IP 192.168.4.254 > 192.168.1.114: ICMP echo request, id 61598, seq 1, length 64 03:16:51.918189 IP 192.168.4.254 > 192.168.1.114: ICMP echo request, id 61598, seq 2, length 64 03:16:52.922871 IP 192.168.4.254 > 192.168.1.114: ICMP echo request, id 61598, seq 3, length 64 >How-To-Repeat: See above >Fix: >Release-Note: >Audit-Trail: >Unformatted: