[Bug 296598] inbound ipsec packets get tracked via outer ip header when the tunnel runs over if_wg

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296598

--- Comment #5 from Lars Krämer <lkr@wizard.de> ---
As far as I understand it, the issue seems to be that the responses (inbound on
enc0) are missing the state which the outbound connection created. I would
assume a floating state would be more likely to hit here than an if-bound one.
Or can the packet match a single state only once?
Either way, the dtrace output would lead me to believe that the kernel is
trying to look up the outer (IP-IP encapsulated) packet on enc0 for state
matching, and not the inner packet which pf misses entirely on enc0.
To be clear, "enc0 IN proto=4  <wg peer IP> <-> <local wg IP>  ports=0,0  HIT"
is the _only_ line that program prints, apart from an initial "MISS", which
creates this state in pfctl -vvss :
all ipencap <local wg IP> <- <wg peer IP>       NO_TRAFFIC:SINGLE
   age 00:00:03, expires in 00:00:27, 59:0 pkts, 4268:0 bytes, rule 67
   id: cd2d4e6a00000000 creatorid: 6ec3bd86 gateway: 0.0.0.0
   origif: enc0

-- 
You are receiving this mail because:
You are the assignee for the bug.