From owner-freebsd-stable  Tue Nov 19 11:16:18 2002
Delivered-To: freebsd-stable@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 628F737B401
	for <FreeBSD-stable@FreeBSD.ORG>; Tue, 19 Nov 2002 11:16:17 -0800 (PST)
Received: from InterJet.dellroad.org (adsl-63-194-81-26.dsl.snfc21.pacbell.net [63.194.81.26])
	by mx1.FreeBSD.org (Postfix) with ESMTP id A803A43E75
	for <FreeBSD-stable@FreeBSD.ORG>; Tue, 19 Nov 2002 11:16:16 -0800 (PST)
	(envelope-from archie@dellroad.org)
Received: from arch20m.dellroad.org (arch20m.dellroad.org [10.1.1.20])
	by InterJet.dellroad.org (8.9.1a/8.9.1) with ESMTP id KAA67073;
	Tue, 19 Nov 2002 10:56:25 -0800 (PST)
Received: from arch20m.dellroad.org (localhost [127.0.0.1])
	by arch20m.dellroad.org (8.12.6/8.12.6) with ESMTP id gAJIuQOS056700;
	Tue, 19 Nov 2002 10:56:26 -0800 (PST)
	(envelope-from archie@arch20m.dellroad.org)
Received: (from archie@localhost)
	by arch20m.dellroad.org (8.12.6/8.12.6/Submit) id gAJIuPf6056699;
	Tue, 19 Nov 2002 10:56:25 -0800 (PST)
From: Archie Cobbs <archie@dellroad.org>
Message-Id: <200211191856.gAJIuPf6056699@arch20m.dellroad.org>
Subject: Re: IPsec/gif VPN tunnel packets on wrong NIC in ipfw?
In-Reply-To: <20021119150826.GA42097@gvr.gvr.org>
To: Guido van Rooij <guido@gvr.org>
Date: Tue, 19 Nov 2002 10:56:25 -0800 (PST)
Cc: David Kelly <dkelly@HiWAAY.net>,
	Scott Ullrich <sullrich@CRE8.COM>,
	"'Archie Cobbs'" <archie@dellroad.org>,
	"'greg.panula@dolaninformation.com'" <greg.panula@dolaninformation.com>,
	FreeBSD-stable@FreeBSD.ORG
X-Mailer: ELM [version 2.4ME+ PL99b (25)]
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=US-ASCII
Sender: owner-freebsd-stable@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-stable.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-stable>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-stable>
X-Loop: FreeBSD.ORG

Guido van Rooij wrote:
> > The problem is that while ESP packets arrive to be processed by 
> > IPsec just fine thru my ipfw rules, when the packets are de-encrypted 
> > and re-inserted into the kernel they appear to ipfw to be coming from 
> > my external interface (the one they arrived on via ESP). tcpdump can't 
> > find them (decrypted) on the external interface.

I think the bug is that in esp4_input() the "detunneled" packet
is placed back onto the IP input queue 'ipintrq' without the
'm->m_pkthdr.rcvif' being updated to point to the gif interface.

-Archie

__________________________________________________________________________
Archie Cobbs     *     Packet Design     *     http://www.packetdesign.com

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-stable" in the body of the message