From owner-freebsd-hackers@FreeBSD.ORG Sun Apr 20 16:27:48 2003 Return-Path: Delivered-To: freebsd-hackers@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 053DA37B401 for ; Sun, 20 Apr 2003 16:27:48 -0700 (PDT) Received: from gw.nectar.cc (gw.nectar.cc [208.42.49.153]) by mx1.FreeBSD.org (Postfix) with ESMTP id 3BD9A43FBD for ; Sun, 20 Apr 2003 16:27:45 -0700 (PDT) (envelope-from nectar@celabo.org) Received: from madman.celabo.org (madman.celabo.org [10.0.1.111]) (using TLSv1 with cipher EDH-RSA-DES-CBC3-SHA (168/168 bits)) (Client CN "madman.celabo.org", Issuer "celabo.org CA" (verified OK)) by gw.nectar.cc (Postfix) with ESMTP id B71CA53; Sun, 20 Apr 2003 18:27:44 -0500 (CDT) Received: by madman.celabo.org (Postfix, from userid 1001) id 46F8078C66; Sun, 20 Apr 2003 18:27:44 -0500 (CDT) Date: Sun, 20 Apr 2003 18:27:44 -0500 From: "Jacques A. Vidrine" To: cjclark@alum.mit.edu Message-ID: <20030420232744.GB41554@madman.celabo.org> Mail-Followup-To: "Jacques A. Vidrine" , cjclark@alum.mit.edu, freebsd-hackers@FreeBSD.org References: <20030410161511.GA25681@madman.celabo.org> <20030416052335.GA2519@blossom.cjclark.org> <20030416123621.GC72501@madman.celabo.org> <20030420165538.GA31101@madman.celabo.org> <20030420205901.GA99917@blossom.cjclark.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20030420205901.GA99917@blossom.cjclark.org> X-Url: http://www.celabo.org/ User-Agent: Mutt/1.5.3i-ja.1 cc: freebsd-hackers@FreeBSD.org Subject: Re: Single IP host and IPsec tunnel mode experience X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 20 Apr 2003 23:27:48 -0000 On Sun, Apr 20, 2003 at 01:59:01PM -0700, Crist J. Clark wrote: > Yep, I can reproduce that. This setup, [...] > Works great with the apropriate swapping in the SPD on the other end > of the tunnel. However, do the following to both, > > bubbles# ed bubbles.spd > g/esp/s/esp/ah/ > g/-E/s/^/#/ > wq > bubbles# setkey -F; setkey -FP; setkey -f bubbles.spd > > And things do not work. The sender seems to work fine, but the > receiver increments the, > > "inbound packets violated process security policy" > > Counter. But the really puzzling part is that it increments the, > > "inbound packets processed successfully" (which I think I understand) > "inbound packets considered authentic" (which I do not) > > Counters too. > > Your conjecture that it may be somehow processing inbound packets > twice may be on the right track. Thanks for double-checking, Crist. Unfortunately I don't have the cycles right now to track it down. I hope anyone who encounters the same issue will come across this thread in the archives. Cheers, -- Jacques A. Vidrine http://www.celabo.org/ NTT/Verio SME . FreeBSD UNIX . Heimdal Kerberos jvidrine@verio.net . nectar@FreeBSD.org . nectar@kth.se