From owner-freebsd-bugs@FreeBSD.ORG Wed Mar 5 00:20:02 2008 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id EC3991065672 for ; Wed, 5 Mar 2008 00:20:02 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id CA2858FC23 for ; Wed, 5 Mar 2008 00:20:02 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.2/8.14.2) with ESMTP id m250K2dS006939 for ; Wed, 5 Mar 2008 00:20:02 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.2/8.14.1/Submit) id m250K2bQ006932; Wed, 5 Mar 2008 00:20:02 GMT (envelope-from gnats) Resent-Date: Wed, 5 Mar 2008 00:20:02 GMT Resent-Message-Id: <200803050020.m250K2bQ006932@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Cyrus Rahman Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id D66A0106566C for ; Wed, 5 Mar 2008 00:12:20 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21]) by mx1.freebsd.org (Postfix) with ESMTP id C63728FC24 for ; Wed, 5 Mar 2008 00:12:20 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.14.2/8.14.2) with ESMTP id m2509K0M059050 for ; Wed, 5 Mar 2008 00:09:20 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.14.2/8.14.1/Submit) id m2509KVj059049; Wed, 5 Mar 2008 00:09:20 GMT (envelope-from nobody) Message-Id: <200803050009.m2509KVj059049@www.freebsd.org> Date: Wed, 5 Mar 2008 00:09:20 GMT From: Cyrus Rahman To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Cc: Subject: kern/121373: New IPSEC & IPV6 & AH+ESP Broken X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Mar 2008 00:20:03 -0000 >Number: 121373 >Category: kern >Synopsis: New IPSEC & IPV6 & AH+ESP Broken >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Wed Mar 05 00:20:02 UTC 2008 >Closed-Date: >Last-Modified: >Originator: Cyrus Rahman >Release: 7.0-RELEASE >Organization: >Environment: FreeBSD snowfall.signetica.com 7.0-RELEASE FreeBSD 7.0-RELEASE #6: Tue Mar 4 16:27:33 MST 2008 cr@snowfall.signetica.com:/usr/src/sys/i386/compile/SIGNETICA i386 >Description: One can't run ipsec with both esp + ah on 7.0-RELEASE with ipv6. Trying to will produce the kernel printf: kernel: ip6_output (ipsec): error code 22 and no output from the interface. The problem looks to be here, in ipsec_output.c, ipsec_process_done(): /* * If there's another (bundled) SA to apply, do so. * Note that this puts a burden on the kernel stack size. * If this is a problem we'll need to introduce a queue * to set the packet on so we can unwind the stack before * doing further processing. */ if (isr->next) { ipsec4stat.ips_out_bundlesa++; return ipsec4_process_packet(m, isr->next, 0, 0); } So for the second SA we try to apply it with ipsec4_process_packet(), which fails when handed an ipv6 packet. By the way, things work fine with ipv4. >How-To-Repeat: Set up an association between two ipv6 hosts that calls for esp+ah. >Fix: >Release-Note: >Audit-Trail: >Unformatted: