From owner-freebsd-bugs@FreeBSD.ORG  Tue Feb 25 22:24:10 2014
Return-Path: <owner-freebsd-bugs@FreeBSD.ORG>
Delivered-To: freebsd-bugs@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
 (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id AC3A0F3D;
 Tue, 25 Feb 2014 22:24:10 +0000 (UTC)
Received: from mail-pa0-x242.google.com (mail-pa0-x242.google.com
 [IPv6:2607:f8b0:400e:c03::242])
 (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits))
 (No client certificate requested)
 by mx1.freebsd.org (Postfix) with ESMTPS id 6B10B1254;
 Tue, 25 Feb 2014 22:24:10 +0000 (UTC)
Received: by mail-pa0-f66.google.com with SMTP id fa1so22978pad.1
 for <multiple recipients>; Tue, 25 Feb 2014 14:24:10 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;
 h=mime-version:in-reply-to:references:date:message-id:subject:from:to
 :content-type; bh=cTND5ACpSetHmspVM5HAfzDjcS5kKrSnDoswr75E7QE=;
 b=onvqVc5kMn4ZNy958jc6au+8fcqo9QJhE+25KUZnYMBZgS8Ew95iiEsO7gUyaxq0mF
 E2FOwdUtcTwVZOQs+NvO1h5R/5ndoqPIypFqQL13nC/7I49cmon/0GbGQt/fluthakcs
 o8rQzWUvnc9MoSwH/r8DKauDCtSsKDXescGC+J1F+27BOhmS6iHdlQOQBcRaBVvV+WbU
 PNYqDOu7FaQ4bfgOFHhrfHk7NMb8uWa/C1PcZ1kONteloflUsQUJ395RkwRSVW7swekT
 DO0FwQnsWvhIighxFWrJNozgG96gQcItFywu+Qv17D18tRFtQtdETi0pkNj+eBvqlP6r
 0Z/g==
MIME-Version: 1.0
X-Received: by 10.66.164.104 with SMTP id yp8mr4236828pab.25.1393367050016;
 Tue, 25 Feb 2014 14:24:10 -0800 (PST)
Received: by 10.68.29.41 with HTTP; Tue, 25 Feb 2014 14:24:09 -0800 (PST)
In-Reply-To: <CACvFP_g4L=pK3ZmZ_kSq=OO+aZANA9k--n7Uhi1Tp6ULO0JHdw@mail.gmail.com>
References: <CACvFP_g4L=pK3ZmZ_kSq=OO+aZANA9k--n7Uhi1Tp6ULO0JHdw@mail.gmail.com>
Date: Tue, 25 Feb 2014 23:24:09 +0100
Message-ID: <CACvFP_hUOjNJ69MH7Lj5thvPjCtA_81+j-YbJMFqk6VfQbg2LQ@mail.gmail.com>
Subject: Re: kern/185876: ipfw not matching incoming packets decapsulating
 ipsec. example l2tp/ipsec
From: Georgios Amanakis <gamanakis@gmail.com>
To: bug-followup@freebsd.org, 
 =?KOI8-U?B?4czFy9PBzsTSIPfPzM/C1cXX?= <a.v.volobuev@gmail.com>, 
 andre@freebsd.org, melifaro@freebsd.org, freebsd-bugs@freebsd.org, 
 Nicolas DEFFAYET <nicolas@deffayet.com>
Content-Type: text/plain; charset=ISO-8859-1
X-Content-Filtered-By: Mailman/MimeDel 2.1.17
X-BeenThere: freebsd-bugs@freebsd.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Bug reports <freebsd-bugs.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-bugs>,
 <mailto:freebsd-bugs-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-bugs/>
List-Post: <mailto:freebsd-bugs@freebsd.org>
List-Help: <mailto:freebsd-bugs-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-bugs>,
 <mailto:freebsd-bugs-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 25 Feb 2014 22:24:10 -0000

> Index: netipsec/xform_ipip.c
> ===================================================================
> --- netipsec/xform_ipip.c       (revision 262492)
> +++ netipsec/xform_ipip.c       (working copy)
> @@ -181,6 +181,7 @@
>         IPIPSTAT_INC(ipips_ipackets);
>
>         m_copydata(m, 0, 1, &v);
> +       m_clrprotoflags(m);
>
>         switch (v >> 4) {
>  #ifdef INET

That one does not resolve it correctly, i.e. not all ipsec packets are
captured. Furthermore, the captured packets have both directions, in and
out (as captured by: allow ip from any to any in, allow ip from any to any
out)