From owner-freebsd-net  Fri Aug  3 10:53:32 2001
Delivered-To: freebsd-net@freebsd.org
Received: from mail-green.research.att.com (H-135-207-30-103.research.att.com [135.207.30.103])
	by hub.freebsd.org (Postfix) with ESMTP id AED0537B403
	for <freebsd-net@freebsd.org>; Fri,  3 Aug 2001 10:53:30 -0700 (PDT)
	(envelope-from fenner@research.att.com)
Received: from alliance.research.att.com (alliance.research.att.com [135.207.26.26])
	by mail-green.research.att.com (Postfix) with ESMTP
	id 8F9881E0A8; Fri,  3 Aug 2001 13:53:14 -0400 (EDT)
Received: from windsor.research.att.com (windsor.research.att.com [135.207.26.46])
	by alliance.research.att.com (8.8.7/8.8.7) with ESMTP id NAA16039;
	Fri, 3 Aug 2001 13:53:13 -0400 (EDT)
From: Bill Fenner <fenner@research.att.com>
Received: (from fenner@localhost)
	by windsor.research.att.com (8.8.8+Sun/8.8.5) id KAA19454;
	Fri, 3 Aug 2001 10:53:13 -0700 (PDT)
Message-Id: <200108031753.KAA19454@windsor.research.att.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
To: itojun@iijlab.net
Subject: Re: kernel upgrade causes truncated IPSEC packets
Cc: mlnn4@oaks.com.au, freebsd-net@freebsd.org
Date: Fri, 3 Aug 2001 10:53:13 -0700
Versions: dmail (solaris) 2.2j/makemail 2.9b
Sender: owner-freebsd-net@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-net.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-net>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-net>
X-Loop: FreeBSD.org


>	was the fix committed to sys/net/if_tun.c?  i guess other *BSDs have
>	the same issue.

I just committed it.

If anyone is interested in tracking down the problem in the IPSEC stack,
the problem only seems to occur when the data is in a cluster mbuf
(thus Chris's observation that small packets get through).  My observation
was:
mbuf 1: IP header
mbuf 2: AH header
mbuf 3: ESP header
mbuf 4: 0 length
mbuf 5: cluster mbuf containing data

When the data mbuf is a small mbuf, mbuf 4 is not inserted.

I will spend a little more time on this in the next couple of weeks but
it might be better if someone more familiar with the IPSEC code could
look at it.  Itojun, if you'll be at the IETF perhaps we can get together
and look at it there?

  Bill

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-net" in the body of the message