From owner-freebsd-current@freebsd.org  Fri Jul 24 12:11:13 2015
Return-Path: <owner-freebsd-current@freebsd.org>
Delivered-To: freebsd-current@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 03E2E9A8DB4
 for <freebsd-current@mailman.ysv.freebsd.org>;
 Fri, 24 Jul 2015 12:11:13 +0000 (UTC)
 (envelope-from shuriku@shurik.kiev.ua)
Received: from graal.it-profi.org.ua (graal.shurik.kiev.ua [193.239.74.7])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id B8092191D;
 Fri, 24 Jul 2015 12:11:11 +0000 (UTC)
 (envelope-from shuriku@shurik.kiev.ua)
Received: from [109.237.91.29] (helo=thinkpad.it-profi.org.ua)
 by graal.it-profi.org.ua with esmtpa (Exim 4.85 (FreeBSD))
 (envelope-from <shuriku@shurik.kiev.ua>)
 id 1ZIbod-000NZt-4E; Fri, 24 Jul 2015 15:11:03 +0300
Message-ID: <55B22B52.9030402@shurik.kiev.ua>
Date: Fri, 24 Jul 2015 15:10:58 +0300
From: Alexandr Krivulya <shuriku@shurik.kiev.ua>
User-Agent: Mozilla/5.0 (X11; FreeBSD amd64;
 rv:31.0) Gecko/20100101 Thunderbird/31.7.0
MIME-Version: 1.0
To: "Andrey V. Elsukov" <ae@FreeBSD.org>, 
 FreeBSD CURRENT <freebsd-current@freebsd.org>
Subject: Re: IPSEC stop works after r285336
References: <55B099F6.8000004@shurik.kiev.ua> <55B21124.9020802@FreeBSD.org>
In-Reply-To: <55B21124.9020802@FreeBSD.org>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-SA-Exim-Connect-IP: 109.237.91.29
X-SA-Exim-Mail-From: shuriku@shurik.kiev.ua
X-SA-Exim-Scanned: No (on graal.it-profi.org.ua);
 SAEximRunCond expanded to false
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.20
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
 <freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-current>, 
 <mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current/>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
 <mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 24 Jul 2015 12:11:13 -0000

24.07.2015 13:19, Andrey V. Elsukov пишет:
> On 23.07.2015 10:38, Alexandr Krivulya wrote:
>> I have IPSEC tunnel inside l2tp tunnel via mpd. After r285536 I see only
>> outgoing esp packets on ng interface:
> What FreeBSD version do you use?
> Please check https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=192774
> and your security policies configuration.
>

I think it is not my situation.
I'm using latest CURRENT r285833 with rules:

root@thinkpad:/usr/src # setkey -DP
0.0.0.0/0[any] 10.10.10.2[any] any
        in ipsec
        esp/tunnel/10.10.10.1-10.10.10.2/require
        spid=3 seq=1 pid=14609
        refcnt=1
10.10.10.2[any] 0.0.0.0/0[any] any
        out ipsec
        esp/tunnel/10.10.10.2-10.10.10.1/require
        spid=4 seq=0 pid=14609
        refcnt=1

In that bug L2TP use IPSEC in transport mode, but in my scenario IPSEC
in tunnel mode inside L2TP. And it works fine prior to r285536.