From owner-freebsd-net@FreeBSD.ORG  Tue Mar  4 15:16:27 2008
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 224F61065674
	for <freebsd-net@freebsd.org>; Tue,  4 Mar 2008 15:16:27 +0000 (UTC)
	(envelope-from crahman@gmail.com)
Received: from wa-out-1112.google.com (wa-out-1112.google.com [209.85.146.178])
	by mx1.freebsd.org (Postfix) with ESMTP id E9A8D8FC18
	for <freebsd-net@freebsd.org>; Tue,  4 Mar 2008 15:16:26 +0000 (UTC)
	(envelope-from crahman@gmail.com)
Received: by wa-out-1112.google.com with SMTP id k17so895081waf.3
	for <freebsd-net@freebsd.org>; Tue, 04 Mar 2008 07:16:26 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma;
	h=domainkey-signature:received:received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition;
	bh=MPWWZY7aBBQz3GyhsqE8y3G4grePB0u1oOPnLQV83rk=;
	b=E3SUYOBgf8UxuCxaL9dbwPVdmh8XfxES6v82Cpvif3iByFlwypAadgyuMINONNIIy+9Vv6VXjF5ns6mfJvPmY/k5sW6oZNicgZFrFnLdDjr4Im1slsDjjRckqWm0DVFjDFqfCOuv09KC9/qy04sIlKZHJ1+Zn+hTwuP65t8fU+M=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma;
	h=message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition;
	b=lq4T1KuaNXtrakipfyJz9apPz+Jw6jaFJKztLbkmGzCySXBD7OTdHgFfUORaJ+UQVu8s/GN279WbclR+9TLGtOjS4bTr2MC/h9V/MTzGYzOSFZu7dcEtUWmjzKhbugGgvquHc7gCaZ0erdsb3UqRF6LPUpm7bDDnWWw+pYQTz9A=
Received: by 10.114.146.1 with SMTP id t1mr2241596wad.20.1204642142969;
	Tue, 04 Mar 2008 06:49:02 -0800 (PST)
Received: by 10.115.14.11 with HTTP; Tue, 4 Mar 2008 06:49:02 -0800 (PST)
Message-ID: <9e77bdb50803040649u1876d8d4l9f2b7a4cef5c4b5@mail.gmail.com>
Date: Tue, 4 Mar 2008 07:49:02 -0700
From: "Cyrus Rahman" <crahman@gmail.com>
To: freebsd-net@freebsd.org
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Subject: ipv6 + ah + esp
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 04 Mar 2008 15:16:27 -0000

Is there a known problem running ah+esp on ip6?  I can set up an
association and run ah+esp just fine on ip4,
and ah or esp work well by themselves in ip6, but I've had no luck
with combining them on ip6.

I know that ipcomp is documented to be broken but I haven't seen
anything about this problem.  This is on 7.0-RELEASE.

For example this:

    spdadd hostA hostB any -P out ipsec
        esp/transport//require ah/transport//require;
    spdadd hostB hostA any -P in ipsec
        esp/transport//require ah/transport//require;

results in no exchange but the following messages in syslog:

    snowfall kernel: ip6_output (ipsec): error code 22

Taking either ah or esp out of the policy works just fine.