From owner-freebsd-net@FreeBSD.ORG Mon Oct 20 21:35:05 2014 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 75F08238 for ; Mon, 20 Oct 2014 21:35:05 +0000 (UTC) Received: from mx2.shrew.net (mx2.shrew.net [38.97.5.132]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 2CAB1DC9 for ; Mon, 20 Oct 2014 21:35:04 +0000 (UTC) Received: from mail.shrew.net (mail.shrew.prv [10.24.10.20]) by mx2.shrew.net (8.14.7/8.14.7) with ESMTP id s9KLY4WH068974; Mon, 20 Oct 2014 16:34:04 -0500 (CDT) (envelope-from mgrooms@shrew.net) Received: from [10.16.32.30] (rrcs-50-84-127-134.sw.biz.rr.com [50.84.127.134]) by mail.shrew.net (Postfix) with ESMTPSA id 0D98218B182; Mon, 20 Oct 2014 16:33:53 -0500 (CDT) Message-ID: <54458001.6000507@shrew.net> Date: Mon, 20 Oct 2014 16:34:57 -0500 From: Matthew Grooms User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.6.0 MIME-Version: 1.0 To: "Andrey V. Elsukov" , freebsd-net@freebsd.org Subject: Re: Broken IPsec + enc +pf/ipfw References: <544535C2.9020301@shrew.net> <544566D2.40303@FreeBSD.org> <544569CF.2060905@shrew.net> <54457599.4060102@yandex.ru> In-Reply-To: <54457599.4060102@yandex.ru> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.4.3 (mx2.shrew.net [10.24.10.11]); Mon, 20 Oct 2014 16:34:04 -0500 (CDT) X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Oct 2014 21:35:05 -0000 On 10/20/2014 3:50 PM, Andrey V. Elsukov wrote: > On 21.10.2014 00:00, Matthew Grooms wrote: >> On 10/20/2014 2:47 PM, Andrey V. Elsukov wrote: >>> On 20.10.2014 20:18, Matthew Grooms wrote: >>>> Lastly, I tried to locate a relevant PR but didn't find anything >>>> concrete. Is this related to the issue? And if so, can it be MFCd? >>>> >>>> https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=110959 >>> >>> Did you try the patch from last PR? It is small and should be applicable >>> to stable/10. >>> >> >> As I mentioned, it's not clear to me if the patch was intended to fix >> the issue that I am describing. Is that the case? If so, I would be >> happy to apply it and report back. These are production firewalls, so >> I'd prefer to have some feedback before calculating that risk. > > This commit fixes similar problem with ipfw in 11.0-CURRENT. But I think > it won't help you with pf in 10. I guess r266800 is what you need. > From the commit message, it would appear that r266800 is intended to correct issues related to IPv4-in-IPv6 or IPv6-in-IPv4 configurations. I'm using the more traditional IPv4-in-IPv4 tunnel mode configuration. Would a change to if_enc.c only effect the operation of ipfw? Unless I'm misreading the man page, it only deals with traffic associated with the IPSec processing path. In theory, I don't see why it would have an effect on one pfil consumer and not the other. It looks like the last commit to 10.0-RELEASE is r255926, which is the last real code change ( r257176 is just a header file include ) before your commit of 272695 in CURRENT. So besides r272695, the driver in both 10.x and CURRENT are essentially the same, are they not? Thanks, -Matthew