Broken IPsec + enc +pf/ipfw

[Ermal Luçi]

On Wed, Oct 22, 2014 at 9:28 PM, Matthew Grooms <mgrooms at shrew.net> wrote:

> On 10/21/2014 1:39 PM, Kyle Williams wrote:
>
>> On Tue Oct 21 11:35:15 2014, Matthew Grooms wrote:
>>
>>> Hey Kyle,
>>>
>>> Thanks for lending a hand. I tested a few myself last night but had no
>>> luck. This morning I received an email off list that pointed to a patch
>>> that was merged to 10 stable. It sounds promising ...
>>>
>>> Log:
>>>    Merge r263091: fix mbuf flags clash that lead to failure of operation
>>>    of IPSEC and packet filters.
>>>
>>> https://lists.freebsd.org/pipermail/svn-src-stable-10/
>>> 2014-March/001111.html
>>>
>>> I won't have a chance to try it until after business hours tonight, but
>>> will report back to the list with my results. Alternately, I assume you
>>> also could upgrade to 10.1-RC2 as the MFC for this patch happened back
>>> in March. I may go this route myself and then bump up to RELEASE in a
>>> few weeks when it happens.
>>>
>>
>> r263091, r266800, and r272695 together on 10.0-RELENG works for me.
>>
>> I didn't test r263091 by itself.
>>
>>
> I couldn't get a kernel to boot without crashing with the single patch,
> (r263091) applied. With all three patches, I can also confirm that the
> problem is resolved.
>
> And some additional info: I also experimented with using gif + IPsec
> transport mode instead of enc + IPsec tunnel mode. I was hoping that
> changing the configuration would work around the issue. Unfortunately, gif
> + IPsec transport mode was exhibiting the same type of problems that enc +
> IPsec tunnel mode was, even with a patched kernel ( pf doesn't see the
> traffic on the gif interface so return traffic gets blocked for lack of a
> state entry ).
>
>
The below patch should fix your issue.

diff --git a/sys/netipsec/ipsec_input.c b/sys/netipsec/ipsec_input.c
index 15d5bae..c31034a 100644
--- a/sys/netipsec/ipsec_input.c
+++ b/sys/netipsec/ipsec_input.c
@@ -472,11 +472,11 @@ ipsec4_common_input_cb(struct mbuf *m, struct
secasvar *sav,
 	 * Pass the mbuf to enc0 for bpf and pfil. We will filter the IPIP
 	 * packet later after it has been decapsulated.
 	 */
-	ipsec_bpf(m, sav, AF_INET, ENC_IN|ENC_BEFORE);
+	ipsec_bpf(m, sav, AF_INET, saidx->mode == IPSEC_MODE_TRANSPORT ?
ENC_IN|ENC_AFTER : ENC_IN|ENC_BEFORE);
  	if (prot != IPPROTO_IPIP)
 		if ((error = ipsec_filter(&m, &sav->sah->saidx, PFIL_IN,
-			ENC_IN|ENC_BEFORE)) != 0)
+			saidx->mode == IPSEC_MODE_TRANSPORT ? ENC_IN|ENC_AFTER :
ENC_IN|ENC_BEFORE)) != 0)
 			return (error);
 #endif
 @@ -727,12 +727,12 @@ ipsec6_common_input_cb(struct mbuf *m, struct
secasvar *sav, int skip, int proto
 	 * Pass the mbuf to enc0 for bpf and pfil. We will filter the IPIP
 	 * packet later after it has been decapsulated.
 	 */
-	ipsec_bpf(m, sav, AF_INET6, ENC_IN|ENC_BEFORE);
+	ipsec_bpf(m, sav, AF_INET6, saidx->mode == IPSEC_MODE_TRANSPORT ?
ENC_IN|ENC_AFTER : ENC_IN|ENC_BEFORE);
  	/* XXX-BZ does not make sense. */
 	if (prot != IPPROTO_IPIP)
 		if ((error = ipsec_filter(&m, &sav->sah->saidx, PFIL_IN,
-			ENC_IN|ENC_BEFORE)) != 0)
+			saidx->mode == IPSEC_MODE_TRANSPORT ? ENC_IN|ENC_AFTER :
ENC_IN|ENC_BEFORE)) != 0)
 			return (error);
 #endif



> Thanks,
>
> -Matthew
>
> _______________________________________________
> freebsd-net at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-net
> To unsubscribe, send any mail to "freebsd-net-unsubscribe at freebsd.org"
>



-- 
Ermal