From owner-freebsd-bugs@FreeBSD.ORG Tue Mar 11 18:58:45 2014 Return-Path: Delivered-To: freebsd-bugs@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 3D8E2FCA; Tue, 11 Mar 2014 18:58:45 +0000 (UTC) Received: from dub0-omc2-s3.dub0.hotmail.com (dub0-omc2-s3.dub0.hotmail.com [157.55.1.142]) by mx1.freebsd.org (Postfix) with ESMTP id CCC0DFAD; Tue, 11 Mar 2014 18:58:44 +0000 (UTC) Received: from DUB114-W84 ([157.55.1.136]) by dub0-omc2-s3.dub0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675); Tue, 11 Mar 2014 11:57:36 -0700 X-TMN: [9E6/a5IlkGlycSJBpK2itUy/3hLGcT+d] X-Originating-Email: [robert.sevat@live.nl] Message-ID: From: Robert Sevat To: Nicolas DEFFAYET , Georgios Amanakis Subject: RE: kern/185876: ipfw not matching incoming packets decapsulating ipsec. example l2tp/ipsec Date: Tue, 11 Mar 2014 19:57:35 +0100 Importance: Normal In-Reply-To: <1393627004.8727.3.camel@fr-wks3.corp.novso.com> References: , , <1393369044.21345.1.camel@fr-wks3.corp.novso.com>, <1393627004.8727.3.camel@fr-wks3.corp.novso.com> MIME-Version: 1.0 X-OriginalArrivalTime: 11 Mar 2014 18:57:36.0131 (UTC) FILETIME=[C4468D30:01CF3D5B] Content-Type: text/plain; charset="koi8-r" Content-Transfer-Encoding: quoted-printable X-Content-Filtered-By: Mailman/MimeDel 2.1.17 Cc: "melifaro@freebsd.org" , "freebsd-bugs@freebsd.org" , "andre@freebsd.org" , "bug-followup@freebsd.org" , =?koi8-r?B?4czFy9PBzsTSIPfPzM/C1cXX?= X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Mar 2014 18:58:45 -0000 Hey=2C First off all=2C thanks for the patch=2C should we wait for FreeBSD 10.1=2C= use 10.0/stable or patch it our selves? Or is this going to be issued as Errata patch for FreeBSD 10.0-Release? (wh= ich I think it should be) Kind Regards=2C Robert Sevat > Subject: Re: kern/185876: ipfw not matching incoming packets decapsulatin= g ipsec. example l2tp/ipsec > From: nicolas@deffayet.com > To: gamanakis@gmail.com > Date: Fri=2C 28 Feb 2014 23:36:44 +0100 > CC: andre@freebsd.org=3B melifaro@freebsd.org=3B a.v.volobuev@gmail.com= =3B freebsd-bugs@freebsd.org=3B bug-followup@freebsd.org >=20 > The following patch seem to be the only working workaround for IPsec > transport mode and tunnel mode. Please note the use of M_PROTO7 instead > of M_PROTO5 as that is not used in netinet & netinet6. M_PROTO5 is used > for another purpose and so using it may create a conflict like M_PROTO3. >=20 > --- > Index: netinet/ip_var.h > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > --- netinet/ip_var.h (revision 262470) > +++ netinet/ip_var.h (working copy) > @@ -167=2C7 +167=2C7 @@ > */ > #define M_FASTFWD_OURS M_PROTO1 /* changed dst to > local */ > #define M_IP_NEXTHOP M_PROTO2 /* explicit ip > nexthop */ > -#define M_SKIP_FIREWALL M_PROTO3 /* skip firewall > processing=2C > +#define M_SKIP_FIREWALL M_PROTO7 /* skip firewall > processing=2C > keep in sync with IP6 > */ > #define M_IP_FRAG M_PROTO4 /* fragment > reassembly */ >=20 > Index: netinet6/ip6_var.h > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > --- netinet6/ip6_var.h (revision 262470) > +++ netinet6/ip6_var.h (working copy) > @@ -297=2C7 +297=2C7 @@ > * IPv6 protocol layer specific mbuf flags. > */ > #define M_IP6_NEXTHOP M_PROTO2 /* explicit ip > nexthop */ > -#define M_SKIP_FIREWALL M_PROTO3 /* skip firewall > processing=2C > +#define M_SKIP_FIREWALL M_PROTO7 /* skip firewall > processing=2C > keep in sync with > IPv4 */ >=20 > #ifdef __NO_STRICT_ALIGNMENT > --- >=20 >=20 > --=20 > Nicolas DEFFAYET >=20 > _______________________________________________ > freebsd-bugs@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-bugs > To unsubscribe=2C send any mail to "freebsd-bugs-unsubscribe@freebsd.org" =