From owner-freebsd-stable Wed Nov 20 4:58:43 2002 Delivered-To: freebsd-stable@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 1B25037B401 for ; Wed, 20 Nov 2002 04:58:42 -0800 (PST) Received: from gvr.gvr.org (gvr.gvr.org [212.61.40.17]) by mx1.FreeBSD.org (Postfix) with ESMTP id 5B42B43E3B for ; Wed, 20 Nov 2002 04:58:40 -0800 (PST) (envelope-from guido@gvr.org) Received: by gvr.gvr.org (Postfix, from userid 657) id 956452A4; Wed, 20 Nov 2002 13:58:36 +0100 (CET) Date: Wed, 20 Nov 2002 13:58:36 +0100 From: Guido van Rooij To: Archie Cobbs Cc: David Kelly , Scott Ullrich , "'greg.panula@dolaninformation.com'" , FreeBSD-stable@FreeBSD.ORG Subject: Re: IPsec/gif VPN tunnel packets on wrong NIC in ipfw? SOLUTION AND QUESTIONS Message-ID: <20021120125836.GA50114@gvr.gvr.org> References: <20021119194150.GA43806@gvr.gvr.org> <200211200348.gAK3mhtT058983@arch20m.dellroad.org> <20021120124332.GD47298@gvr.gvr.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20021120124332.GD47298@gvr.gvr.org> Sender: owner-freebsd-stable@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG On Wed, Nov 20, 2002 at 01:43:33PM +0100, Guido van Rooij wrote: > > Right now, if you use IPSec transport mode in combination with a > gif device, the incoming packets will pass through ipfw twice: > first, as encrypted ESP packets and 'in via fxp0', and again, as > decrypted whatever packets and 'in via gif0' > > In IPSec tunnel mode, the incoming packets will pass through ipfw twice: > both 'in via fxp0'. Explanation: esp_input() has a switch for transport/tunnel mode packets. In transport it directly calls the subprotocol handler. In tunnel mode, it places the packet on ipintrq. So when a gif device is used with tunnel mode, first the packet is filtered in ip_input(). Then the packet goes to esp_input(), whihc decrypts it. Then it is placed on ipintrq without modifying the rcvif. Then ip_input() handles it again (also filtering!) and calls gif_input(), which decapsulates the packet and places it on ipintrq, but it sets rcvif to gif0. Then it is placed on ipintrq and handled (and filtered) again in ip_input(). In transport mode, the packet is fed and filtered in ip_input() which calls gif_input() that puts it on ipintrq (with rcvif set to gif0). Then it is handled and filtered again by ip_input(). -Guido To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message