From owner-freebsd-net@FreeBSD.ORG  Tue Feb  3 09:19:14 2004
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id D098416A4CE
	for <freebsd-net@freebsd.org>; Tue,  3 Feb 2004 09:19:14 -0800 (PST)
Received: from hotmail.com (sea2-dav70.sea2.hotmail.com [207.68.164.205])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 175C243D6D
	for <freebsd-net@freebsd.org>; Tue,  3 Feb 2004 09:19:12 -0800 (PST)
	(envelope-from pupilla@hotmail.com)
Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC;
	 Tue, 3 Feb 2004 09:19:11 -0800
Received: from 80.204.235.254 by sea2-dav70.sea2.hotmail.com with DAV;
	Tue, 03 Feb 2004 17:19:11 +0000
X-Originating-IP: [80.204.235.254]
X-Originating-Email: [pupilla@hotmail.com]
X-Sender: pupilla@hotmail.com
From: "Marco Berizzi" <pupilla@hotmail.com>
To: <freebsd-net@freebsd.org>
Date: Tue, 3 Feb 2004 18:19:17 +0100
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1123
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1123
Message-ID: <Sea2-DAV70BAZg1jlMo00012e8e@hotmail.com>
X-OriginalArrivalTime: 03 Feb 2004 17:19:11.0885 (UTC)
	FILETIME=[D7325BD0:01C3EA79]
Subject: ipsec ipcomp between FreeS/WAN 2.04 and FreeBSD 5.2
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 03 Feb 2004 17:19:14 -0000

Hello everybody.

I'm running an interop issue with IPSec tunnels
between FreeS/WAN and FreeBSD 5.2
Without IPComp tunnel are successfully established.
With IPComp enabled tunnel are again successfully
established but there is no traffic flow.

This is my setkey init (FreeBSD box side):

/usr/local/sbin/setkey -c <<EOF
flush;
spdflush;
spdadd 10.1.2.0/24 10.1.1.0/24 any -P in ipsec
    ipcomp/tunnel/172.16.1.247-172.16.1.226/use
    esp/tunnel/172.16.1.247-172.16.1.226/require;=20

spdadd 10.1.1.0/24 10.1.2.0/24 any -P out ipsec
    ipcomp/tunnel/172.16.1.226-172.16.1.247/use
    esp/tunnel/172.16.1.226-172.16.1.247/require;
EOF

However with this kind of init file FreeS/WAN is dropping packet coming =
from the FreeBSD box.=20
Michael Richardson (fsw mantainer) reply me telling:

"... The packets that racoon is telling the system to build
would appear to have been constructed like:

orig     IPsrc =3D 10.1.1.1,IPdst =3D 10.1.2.1
           IPcomp
*         IPsrc =3D 172.16.1.247,IPdst=3D172.16.1.226
           ESP
outer   IPsrc =3D 172.16.1.247,IPdst=3D172.16.1.226

[...]   This packet format is in error. It defeats most of the point of =
using
IPcomp, which is to compress the inner-IP header out. It appears that a =
new
IP header has been added.
If the 2.6.0 kernel accepts this, then I wonder what other things it
might accept!   The IPIP header marked "*" is completely superfluous and
a waste of 20 bytes. ..."

The full thread available at =
https://lists.freeswan.org/archives/design/2003-December/msg00032.html

The thread is about FreeS/WAN and kernel 2.6 (2.6 IPSec stack is a KAME =
based). However Linux 2.6 and FreeBSD have the same behaviour.

Comments?

TIA

PS: Please CC me. I'm not subscribed to the list.