From owner-freebsd-bugs@FreeBSD.ORG Tue Mar 11 21:14:34 2014 Return-Path: Delivered-To: freebsd-bugs@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id D1730153; Tue, 11 Mar 2014 21:14:34 +0000 (UTC) Received: from mail-pb0-x22c.google.com (mail-pb0-x22c.google.com [IPv6:2607:f8b0:400e:c01::22c]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 91DF42AB; Tue, 11 Mar 2014 21:14:34 +0000 (UTC) Received: by mail-pb0-f44.google.com with SMTP id rp16so102203pbb.17 for ; Tue, 11 Mar 2014 14:14:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=vB9mMm7JmgrOGNv4ajgfWZJwHPIGCNJA7ZRTmfhdPAE=; b=cOKJg9dhjK+4mESbudjRkdaeR7GlKEOk8OZAgxitzynUxFpjNhIUq5MyqHQgepRaxP ug7hOFZO75psIIH/I6NjIwLx3RBWrR6sdaBJOzRmPt+xQfTlSZTJ0bEdwBQA9dkq1xzQ 1I+eAyMnvSiDbKoVr/rdymk8K3vn/WnmxGqjVJNu3lyJLAC4FMHEmRd44XG1OCSpS+km FaTZdqhGKjlJL0fv1vUMGI4Yt71q3hM5znfka7Gr1rm6wuqPj+0+1dfYyEANN97ouxvu jBTfLefyBnFZ15QY4xqO5OnENVUfs8ATzH0MC6kdjBWl+3vCmdChWXB40QcnYrA0oTMY FYyQ== MIME-Version: 1.0 X-Received: by 10.68.162.1 with SMTP id xw1mr376656pbb.128.1394572474225; Tue, 11 Mar 2014 14:14:34 -0700 (PDT) Received: by 10.68.29.41 with HTTP; Tue, 11 Mar 2014 14:14:34 -0700 (PDT) In-Reply-To: References: <1393369044.21345.1.camel@fr-wks3.corp.novso.com> <1393627004.8727.3.camel@fr-wks3.corp.novso.com> Date: Tue, 11 Mar 2014 22:14:34 +0100 Message-ID: Subject: Re: kern/185876: ipfw not matching incoming packets decapsulating ipsec. example l2tp/ipsec From: Georgios Amanakis To: Robert Sevat Content-Type: text/plain; charset=ISO-8859-1 X-Content-Filtered-By: Mailman/MimeDel 2.1.17 Cc: "freebsd-bugs@freebsd.org" , "andre@freebsd.org" , "bug-followup@freebsd.org" , =?KOI8-U?B?4czFy9PBzsTSIPfPzM/C1cXX?= , Nicolas DEFFAYET , "melifaro@freebsd.org" X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Mar 2014 21:14:34 -0000 Glebius is working on a patch. I hope it will be commited soon to stable. On Tue, Mar 11, 2014 at 7:57 PM, Robert Sevat wrote: > Hey, > > First off all, thanks for the patch, should we wait for FreeBSD 10.1, use > 10.0/stable or patch it our selves? > > Or is this going to be issued as Errata patch for FreeBSD 10.0-Release? > (which I think it should be) > > Kind Regards, > Robert Sevat > > > > Subject: Re: kern/185876: ipfw not matching incoming packets > decapsulating ipsec. example l2tp/ipsec > > From: nicolas@deffayet.com > > To: gamanakis@gmail.com > > Date: Fri, 28 Feb 2014 23:36:44 +0100 > > CC: andre@freebsd.org; melifaro@freebsd.org; a.v.volobuev@gmail.com; > freebsd-bugs@freebsd.org; bug-followup@freebsd.org > > > > > The following patch seem to be the only working workaround for IPsec > > transport mode and tunnel mode. Please note the use of M_PROTO7 instead > > of M_PROTO5 as that is not used in netinet & netinet6. M_PROTO5 is used > > for another purpose and so using it may create a conflict like M_PROTO3. > > > > --- > > Index: netinet/ip_var.h > > =================================================================== > > --- netinet/ip_var.h (revision 262470) > > +++ netinet/ip_var.h (working copy) > > @@ -167,7 +167,7 @@ > > */ > > #define M_FASTFWD_OURS M_PROTO1 /* changed dst to > > local */ > > #define M_IP_NEXTHOP M_PROTO2 /* explicit ip > > nexthop */ > > -#define M_SKIP_FIREWALL M_PROTO3 /* skip firewall > > processing, > > +#define M_SKIP_FIREWALL M_PROTO7 /* skip firewall > > processing, > > keep in sync with IP6 > > */ > > #define M_IP_FRAG M_PROTO4 /* fragment > > reassembly */ > > > > Index: netinet6/ip6_var.h > > =================================================================== > > --- netinet6/ip6_var.h (revision 262470) > > +++ netinet6/ip6_var.h (working copy) > > @@ -297,7 +297,7 @@ > > * IPv6 protocol layer specific mbuf flags. > > */ > > #define M_IP6_NEXTHOP M_PROTO2 /* explicit ip > > nexthop */ > > -#define M_SKIP_FIREWALL M_PROTO3 /* skip firewall > > processing, > > +#define M_SKIP_FIREWALL M_PROTO7 /* skip firewall > > processing, > > keep in sync with > > IPv4 */ > > > > #ifdef __NO_STRICT_ALIGNMENT > > --- > > > > > > -- > > Nicolas DEFFAYET > > > > _______________________________________________ > > freebsd-bugs@freebsd.org mailing list > > http://lists.freebsd.org/mailman/listinfo/freebsd-bugs > > To unsubscribe, send any mail to "freebsd-bugs-unsubscribe@freebsd.org" >