From owner-freebsd-hackers@FreeBSD.ORG Tue Apr 15 22:23:40 2003 Return-Path: Delivered-To: freebsd-hackers@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id AA8E737B401; Tue, 15 Apr 2003 22:23:40 -0700 (PDT) Received: from sccrmhc01.attbi.com (sccrmhc01.attbi.com [204.127.202.61]) by mx1.FreeBSD.org (Postfix) with ESMTP id BCCC143F93; Tue, 15 Apr 2003 22:23:39 -0700 (PDT) (envelope-from crist.clark@attbi.com) Received: from blossom.cjclark.org (12-234-159-107.client.attbi.com[12.234.159.107]) by sccrmhc01.attbi.com (sccrmhc01) with ESMTP id <2003041605233800100ohj9se>; Wed, 16 Apr 2003 05:23:38 +0000 Received: from blossom.cjclark.org (localhost. [127.0.0.1]) by blossom.cjclark.org (8.12.8p1/8.12.3) with ESMTP id h3G5Nbki002795; Tue, 15 Apr 2003 22:23:37 -0700 (PDT) (envelope-from crist.clark@attbi.com) Received: (from cjc@localhost) by blossom.cjclark.org (8.12.8p1/8.12.8/Submit) id h3G5NZew002794; Tue, 15 Apr 2003 22:23:35 -0700 (PDT) X-Authentication-Warning: blossom.cjclark.org: cjc set sender to crist.clark@attbi.com using -f Date: Tue, 15 Apr 2003 22:23:35 -0700 From: "Crist J. Clark" To: "Jacques A. Vidrine" , freebsd-hackers@FreeBSD.org Message-ID: <20030416052335.GA2519@blossom.cjclark.org> References: <20030410161511.GA25681@madman.celabo.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20030410161511.GA25681@madman.celabo.org> User-Agent: Mutt/1.4.1i X-URL: http://people.freebsd.org/~cjc/ Subject: Re: Single IP host and IPsec tunnel mode experience X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: "Crist J. Clark" List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 16 Apr 2003 05:23:41 -0000 On Thu, Apr 10, 2003 at 11:15:11AM -0500, Jacques A. Vidrine wrote: [snip] > router1 > spdadd 10.3.14.0/24 173.173.173.173 any > -P out esp/tunnel/223.223.223.223-173.173.173.173/require; > spdadd 173.173.173.173 10.3.14.0/24 any > -P in esp/tunnel/173.173.173.173-223.223.223.223/require; > > server1 > spdadd 10.3.14.0/24 173.173.173.173 any > -P in esp/tunnel/223.223.223.223-173.173.173.173/require; > spdadd 173.173.173.173 10.3.14.0/24 any > -P out esp/tunnel/173.173.173.173-223.223.223.223/require; > > However, this does not work :-) Outbound packets are encapsulated as > expected, i.e. packets leave `router1' looking like this: [snip] > but they are dropped by `server1', and the `inbound packets violated > process security policy' counter is incremented. > > > If one relaxes the inbound policies given above by changing `require' > to `use', then the packets are no longer dropped and everything works > as (I) expected. Packets in both directions are properly encapsulated. > > However, `use' is not the policy desired, of course :-) > > The fact that `use' works, and `require' does not leads me to believe > that when a packet is received and processed in tunnel mode, that the > de-encapsulated packet (the internal one) is AGAIN matched against the > SPD, causing the `violated process security policy'. > > > So, KAME/IPsec experts ... have I gone atray with my configuration? > Or is this simply not doable within the KAME framework? > Or is this a bug (assuming my theory that packets are matched against > the SPD again after de-encapsulation is correct)? 'uname -a'? I can't reproduce this on a 4.8 to 4.7 tunnel. On 192.168.64.70, spdadd 192.168.64.70/32 10.0.0.0/24 any -P out ipsec esp/tunnel/192.168.64.70-192.168.64.20/require; spdadd 10.0.0.0/24 192.168.64.70/32 any -P in ipsec esp/tunnel/192.168.64.20-192.168.64.70/require; And on 192.168.64.20, the gateway to 10.0.0.0/24, spdadd 192.168.64.70/32 10.0.0.0/24 any -P in ipsec esp/tunnel/192.168.64.70-192.168.64.20/require; spdadd 10.0.0.0/24 192.168.64.70/32 any -P out ipsec esp/tunnel/192.168.64.20-192.168.64.70/require; Works fine. -- Crist J. Clark | cjclark@alum.mit.edu | cjclark@jhu.edu http://people.freebsd.org/~cjc/ | cjc@freebsd.org