Broken IPsec + enc +pf/ipfw

[Andrey V. Elsukov]

On 21.10.2014 01:34, Matthew Grooms wrote:
>>>>> https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=110959
>>>>
>>>> Did you try the patch from last PR? It is small and should be
>>>> applicable
>>>> to stable/10.
>>>>
>>>
>>> As I mentioned, it's not clear to me if the patch was intended to fix
>>> the issue that I am describing. Is that the case? If so, I would be
>>> happy to apply it and report back. These are production firewalls, so
>>> I'd prefer to have some feedback before calculating that risk.
>>
>> This commit fixes similar problem with ipfw in 11.0-CURRENT. But I think
>> it won't help you with pf in 10. I guess r266800 is what you need.
>>
> 
> From the commit message, it would appear that r266800 is intended to
> correct issues related to IPv4-in-IPv6 or IPv6-in-IPv4 configurations.
> I'm using the more traditional IPv4-in-IPv4 tunnel mode configuration.

It also changes places from where pfil consumers are called. You may use
dtrace script to see where is the problem. Try this:

> kldload dtraceall
> cat > ~/ipsec.d
#!/usr/sbin/dtrace -s

fbt::ipsec_filter:entry
{
        m = *(struct mbuf **)arg0;
        ip = (struct ip *)m->m_hdr.mh_data;
        printf("%s: %s: %s->%s proto %d",
            (arg1 & 1) ? "in": "out",
            (arg2 & 1) ? "before": "after",
            inet_ntoa(&ip->ip_src.s_addr),
            inet_ntoa(&ip->ip_dst.s_addr),
            ip->ip_p);
}
^D
> chmod +x ~/ipsec.d
> ~/ipsec.d

This script will print messages when ipsec_filter function will be
invoked. Can you show what it will print for your case?

> Would a change to if_enc.c only effect the operation of ipfw? Unless I'm
> misreading the man page, it only deals with traffic associated with the
> IPSec processing path. In theory, I don't see why it would have an
> effect on one pfil consumer and not the other.

pf and ipfw deal differently when they want to determine incoming interface.

> It looks like the last commit to 10.0-RELEASE is r255926, which is the
> last real code change ( r257176 is just a header file include ) before
> your commit of 272695 in CURRENT. So besides r272695, the driver in both
> 10.x and CURRENT are essentially the same, are they not?

No, they are not the same.

-- 
WBR, Andrey V. Elsukov