From owner-freebsd-bugs@FreeBSD.ORG Thu Nov 4 09:20:27 2004 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 0191616A4CE for ; Thu, 4 Nov 2004 09:20:27 +0000 (GMT) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id DC3E643D53 for ; Thu, 4 Nov 2004 09:20:26 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.12.11/8.12.11) with ESMTP id iA49KQmD072749 for ; Thu, 4 Nov 2004 09:20:26 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.12.11/8.12.11/Submit) id iA49KQc6072747; Thu, 4 Nov 2004 09:20:26 GMT (envelope-from gnats) Resent-Date: Thu, 4 Nov 2004 09:20:26 GMT Resent-Message-Id: <200411040920.iA49KQc6072747@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Ari Suutari Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 78FCD16A4CE for ; Thu, 4 Nov 2004 09:19:31 +0000 (GMT) Received: from fep19.inet.fi (fep19.inet.fi [194.251.242.244]) by mx1.FreeBSD.org (Postfix) with ESMTP id 29EFB43D31 for ; Thu, 4 Nov 2004 09:19:30 +0000 (GMT) (envelope-from ari@mato.dyndns.suutari.iki.fi) Received: from mato.dyndns.suutari.iki.fi ([80.222.160.96]) by fep19.inet.fi with ESMTP <20041104091928.IUCX5926.fep19.inet.fi@mato.dyndns.suutari.iki.fi> for ; Thu, 4 Nov 2004 11:19:28 +0200 Received: from mato.dyndns.suutari.iki.fi (localhost [127.0.0.1]) iA49JPJS001544 for ; Thu, 4 Nov 2004 11:19:28 +0200 (EET) (envelope-from ari@mato.dyndns.suutari.iki.fi) Received: (from ari@localhost)iA49JPh3001543; Thu, 4 Nov 2004 11:19:25 +0200 (EET) (envelope-from ari) Message-Id: <200411040919.iA49JPh3001543@mato.dyndns.suutari.iki.fi> Date: Thu, 4 Nov 2004 11:19:25 +0200 (EET) From: Ari Suutari To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Subject: kern/73517: pfil_hooks (ipfw,pf etc) and ipsec processing order for outgoing packets is wrong X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: Ari Suutari List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Nov 2004 09:20:27 -0000 >Number: 73517 >Category: kern >Synopsis: pfil_hooks (ipfw,pf etc) and ipsec processing order for outgoing packets is wrong >Confidential: no >Severity: non-critical >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Thu Nov 04 09:20:26 GMT 2004 >Closed-Date: >Last-Modified: >Originator: Ari Suutari >Release: FreeBSD 5.3-RC2 i386 >Organization: >Environment: System: FreeBSD mato.suutari.iki.fi 5.3-RC2 FreeBSD 5.3-RC2 #13: Wed Nov 3 17:47:15 EET 2004 ari@mato.suutari.iki.fi:/usr/obj/usr/src/sys/MATO i386 >Description: When using IPSEC_FILTERGIF kernel option, the processing order of ipsec and ipfw (pfil_hook) is not correct for outgoing packets. Currently, ipsec processing is done first regardsless of IPSEC_FILTERGIF, which makes packets to go through without firewall inspection. This might be a security problem for someone, but at least it breaks stateful rule handling. My test setup is (all freebsd 5.3-rc1 machines): freebsd laptop <-> ipsec tunnel <->freebsd server When server sends packet to laptop, it now goes like this: ip_output -> ipsec -> ipfw -> network It should go like this: ip_output -> ipfw -> ipsec -> ipfw -> network >How-To-Repeat: Compiler kernel with ipsec and IPSEC_FILTERGIF options. Create ipsec policy, which uses esp between two machines. Add firewall rules like ipfw add count esp from a to b ipfw add count esp from b to a ipfw add count icmp from a to b ipfw add count icmp from b to a Start pinging from a to b. You'll notice that only one of the icmp counters increases. >Fix: I think that this could be fixed by just moving/adding pfil_hook processing in ip_output before ipsec processing when IPSEC_FILTERGIF is enabled. I received example patch from Mr. Joost Bekkers (http://jodocus.org/ipsec-pfil.diff ), but it doesn't fully work for kame IPSEC (kame ipsec seems to require having pfil_hooks both before ipsec and after it, FAST_IPSEC queues the packet back to ip_output so it works correctly with proposed fix). >Release-Note: >Audit-Trail: >Unformatted: