From owner-freebsd-net@FreeBSD.ORG  Tue Apr  1 11:03:40 2003
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 7714037B401
	for <freebsd-net@freebsd.org>; Tue,  1 Apr 2003 11:03:40 -0800 (PST)
Received: from ebb.errno.com (ebb.errno.com [66.127.85.87])
	by mx1.FreeBSD.org (Postfix) with ESMTP id E349443FCB
	for <freebsd-net@freebsd.org>; Tue,  1 Apr 2003 11:03:39 -0800 (PST)
	(envelope-from sam@errno.com)
Received: from melange (melange.errno.com [66.127.85.82])
	(authenticated bits=0)
	by ebb.errno.com (8.12.9/8.12.9) with ESMTP id h31J3cWJ049008
	(version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=NO);
	Tue, 1 Apr 2003 11:03:39 -0800 (PST)
	(envelope-from sam@errno.com)
Message-ID: <05b901c2f881$67e907f0$52557f42@errno.com>
From: "Sam Leffler" <sam@errno.com>
To: "Mailing List FreeBSD Network" <freebsd-net@freebsd.org>,
	"Eric Masson" <e-masson@kisoft-services.com>
References: <86pto6mbxj.fsf@notbsdems.interne.kisoft-services.com>
Date: Tue, 1 Apr 2003 11:03:05 -0800
Organization: Errno Consulting
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.50.4920.2300
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4920.2300
Subject: Re: options FAST_IPSEC & tunnels
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Apr 2003 19:03:40 -0000

> I'm using IPSEC tunnels to join different gateways over the Internet.
>
> I've made some trials with FAST_IPSEC today (I've received a Soekris
> VPN1201) and i'm facing a problem with incoming packets.
>
> The following code snippet from /sys/netinet/ip_input.c permits
> detunneled packets to flow without being filtered by ipf/ipfw :
>
> #if defined(IPSEC) && !defined(IPSEC_FILTERGIF)
> /*
> * Bypass packet filtering for packets from a tunnel (gif).
> */
> if (ipsec_gethist(m, NULL))
> goto pass;
> #endif
>
> Is there any counterpart for FAST_IPSEC (I've dug thru the code, but no
> luck atm) ?

Wow, someone besides me actually using fast ipsec! :)

Packets are tagged once they've been processed on input.  I think you can do
a similar check with something like:

if (m_tag_find(PACKET_TAG_IPSEC_IN_DONE) != NULL)
    goto pass;

Long term, I intend is to associate packets with an enc device so there's a
way to identify these packets when writing firewall rules.

    Sam