From owner-freebsd-stable Thu Nov 21 1: 9:42 2002 Delivered-To: freebsd-stable@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 90AC837B401 for ; Thu, 21 Nov 2002 01:09:41 -0800 (PST) Received: from gvr.gvr.org (gvr.gvr.org [212.61.40.17]) by mx1.FreeBSD.org (Postfix) with ESMTP id B2D7243E8A for ; Thu, 21 Nov 2002 01:09:40 -0800 (PST) (envelope-from guido@gvr.org) Received: by gvr.gvr.org (Postfix, from userid 657) id 3B3152A3; Thu, 21 Nov 2002 10:09:38 +0100 (CET) Date: Thu, 21 Nov 2002 10:09:38 +0100 From: Guido van Rooij To: Helge Oldach Cc: archie@dellroad.org, dkelly@HiWAAY.net, sullrich@CRE8.COM, greg.panula@dolaninformation.com, FreeBSD-stable@FreeBSD.ORG Subject: Re: IPsec/gif VPN tunnel packets on wrong NIC in ipfw? SOLUTION AND QUESTIONS Message-ID: <20021121090938.GC96801@gvr.gvr.org> References: <20021120124332.GD47298@gvr.gvr.org> <200211210811.gAL8BALI080518@sep.oldach.net> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <200211210811.gAL8BALI080518@sep.oldach.net> Sender: owner-freebsd-stable@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG On Thu, Nov 21, 2002 at 09:11:10AM +0100, Helge Oldach wrote: > ACK. Note that this emulates behaviour of commercial IPSec > implementations. For example, on Cisco IOS boxes the input access list > (roughly a subset of ipfw) are checked twice - once for the original > packet and once for the de-capsulated packet. This holds for tunnel mode > as well as for transport mode. That seems a security hole to me. -Guido To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message