Date: Wed, 20 Nov 2002 13:58:36 +0100 From: Guido van Rooij <guido@gvr.org> To: Archie Cobbs <archie@dellroad.org> Cc: David Kelly <dkelly@HiWAAY.net>, Scott Ullrich <sullrich@CRE8.COM>, "'greg.panula@dolaninformation.com'" <greg.panula@dolaninformation.com>, FreeBSD-stable@FreeBSD.ORG Subject: Re: IPsec/gif VPN tunnel packets on wrong NIC in ipfw? SOLUTION AND QUESTIONS Message-ID: <20021120125836.GA50114@gvr.gvr.org> In-Reply-To: <20021120124332.GD47298@gvr.gvr.org> References: <20021119194150.GA43806@gvr.gvr.org> <200211200348.gAK3mhtT058983@arch20m.dellroad.org> <20021120124332.GD47298@gvr.gvr.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, Nov 20, 2002 at 01:43:33PM +0100, Guido van Rooij wrote: > > Right now, if you use IPSec transport mode in combination with a > gif device, the incoming packets will pass through ipfw twice: > first, as encrypted ESP packets and 'in via fxp0', and again, as > decrypted whatever packets and 'in via gif0' > > In IPSec tunnel mode, the incoming packets will pass through ipfw twice: > both 'in via fxp0'. Explanation: esp_input() has a switch for transport/tunnel mode packets. In transport it directly calls the subprotocol handler. In tunnel mode, it places the packet on ipintrq. So when a gif device is used with tunnel mode, first the packet is filtered in ip_input(). Then the packet goes to esp_input(), whihc decrypts it. Then it is placed on ipintrq without modifying the rcvif. Then ip_input() handles it again (also filtering!) and calls gif_input(), which decapsulates the packet and places it on ipintrq, but it sets rcvif to gif0. Then it is placed on ipintrq and handled (and filtered) again in ip_input(). In transport mode, the packet is fed and filtered in ip_input() which calls gif_input() that puts it on ipintrq (with rcvif set to gif0). Then it is handled and filtered again by ip_input(). -Guido To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20021120125836.GA50114>