kern/101400: [ipsec] some packets do not pass through IPSEC tunnel

Шкурко Александр read at midland.com.ua
Sat Aug 19 12:40:19 UTC 2006


The following reply was made to PR kern/101400; it has been noted by GNATS.

From: =?koi8-r?B?+8vV0svPIOHMxcvTwc7E0g==?= <read at midland.com.ua>
To: <bug-followup at FreeBSD.org>, <read at midland.com.ua>
Cc:  
Subject: Re: kern/101400: [ipsec] some packets do not pass through IPSEC tunnel
Date: Sat, 19 Aug 2006 15:37:30 +0300

 After additional testing it was found out, that packets (not only ESP) =
 the certain size are lost all.
 If it is ICMP(as example) packet from 1473 to 1479 bytes we have lost =
 it.
 Examle:
 ping -s 1473 any_ip_address
 
 And I found that after 1480*x, where x=3D1,3,4,5,6... bytes we have the =
 same problem
 1480+1473=9A -=9A=9A 1480+1479=9A=9A=9A=9A=9A=9A=9A=9A=9A first range of =
 payload of ICMP packet
 1480*2+1473=9A - 1480*2+1479=9A=9A=9A=9A=9A second range of payload of =
 ICMP packet
 .........
 And so on
 
 If packets bigger or smaller=9A of that range - packets pass
 When problem exists I have kernel:
 diff -u ./GENERIC ./black
 --- ./GENERIC=9A=9A Mon May=9A 1 03:15:12 2006
 +++ ./black=9A=9A=9A=9A Sat Aug 19 10:51:09 2006
 @@ -22,7 +22,7 @@
 =9Acpu=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A I486_CPU
 =9Acpu=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A I586_CPU
 =9Acpu=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A I686_CPU
 -ident=9A=9A=9A=9A=9A=9A=9A=9A=9A GENERIC
 +ident=9A=9A=9A=9A=9A=9A=9A=9A=9A black
 
 =9A# To statically compile in device wiring instead of =
 /boot/device.hints
 =9A#hints=9A=9A=9A=9A=9A=9A=9A=9A =
 "GENERIC.hints"=9A=9A=9A=9A=9A=9A=9A=9A # Default places to look for =
 devices.
 @@ -33,7 +33,7 @@
 =9Aoptions=9A=9A=9A=9A=9A=9A=9A =
 SCHED_4BSD=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A # 4BSD scheduler
 =9Aoptions=9A=9A=9A=9A=9A=9A=9A =
 PREEMPTION=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A =9A# Enable kernel thread =
 preemption
 =9Aoptions=9A=9A=9A=9A=9A=9A=9A =
 INET=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A # =
 InterNETworking
 -options=9A=9A=9A=9A=9A=9A=9A =
 INET6=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A # IPv6 =
 communications protocols
 +#options=9A=9A=9A=9A=9A=9A =
 INET6=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A # IPv6 =
 communications protocols
 =9Aoptions=9A=9A=9A=9A=9A=9A=9A =
 FFS=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A # =
 Berkeley Fast Filesystem
 =9Aoptions=9A=9A=9A=9A=9A=9A=9A =
 SOFTUPDATES=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A # Enable FFS soft =
 updates support
 =9Aoptions=9A=9A=9A=9A=9A=9A=9A =
 UFS_ACL=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A # Support for =
 access control lists
 @@ -279,3 +279,41 @@
 =9Adevice=9A=9A=9A=9A=9A=9A=9A=9A firewire=9A=9A=9A=9A=9A=9A=9A # =
 FireWire bus code
 =9Adevice=9A=9A=9A=9A=9A=9A=9A=9A =
 sbp=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A # SCSI over FireWire (Requires =
 scbus and da)
 =9Adevice=9A=9A=9A=9A=9A=9A=9A=9A =
 fwe=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A # Ethernet over FireWire =
 (non-standard!)
 +
 +#--------------------------------
 +options=9A=9A=9A=9A=9A=9A=9A=9A =
 SMP=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A =9A=9A=9A=9A=9A# =
 Symmetric MultiProcessor Kernel
 +options=9A=9A=9A=9A=9A=9A=9A=9A IPFIREWALL
 +options=9A=9A=9A=9A=9A=9A=9A=9A IPFIREWALL_VERBOSE
 +options=9A=9A=9A=9A=9A=9A=9A=9A IPFIREWALL_VERBOSE_LIMIT=3D100
 +options=9A=9A=9A=9A=9A=9A=9A=9A IPFIREWALL_DEFAULT_TO_ACCEPT
 +options=9A=9A=9A=9A=9A=9A=9A=9A IPDIVERT
 +options=9A=9A=9A=9A=9A=9A=9A=9A TCP_DROP_SYNFIN
 +options=9A=9A=9A=9A=9A=9A=9A=9A IPFILTER
 +options=9A=9A=9A=9A=9A=9A=9A=9A IPFILTER_LOG
 +options=9A=9A=9A=9A=9A=9A=9A=9A DUMMYNET
 +options=9A=9A=9A=9A=9A=9A=9A=9A SC_HISTORY_SIZE=3D1000
 +options=9A=9A=9A=9A=9A=9A=9A=9A PANIC_REBOOT_WAIT_TIME=3D120
 +options=9A=9A=9A=9A=9A=9A=9A=9A SC_DISABLE_REBOOT
 +options=9A=9A=9A=9A=9A=9A=9A=9A IPSEC
 +options=9A=9A=9A=9A=9A=9A=9A=9A IPSEC_ESP
 +options=9A=9A=9A=9A=9A=9A=9A=9A IPSEC_DEBUG
 +options=9A=9A=9A=9A=9A=9A=9A=9A IPFIREWALL_FORWARD
 +options=9A=9A=9A=9A=9A=9A=9A=9A IPFIREWALL_FORWARD_EXTENDED
 +
 +options=9A=9A=9A=9A=9A=9A=9A=9A HZ=3D1000
 +
 +# pf otions
 +device pf
 +device pflog
 +device pfsync
 +
 +#ALTQ
 +options=9A=9A=9A=9A=9A=9A=9A=9A ALTQ
 +options=9A=9A=9A=9A=9A=9A=9A=9A ALTQ_CBQ=9A=9A=9A=9A=9A=9A=9A # Class =
 Bases Queueing
 +options=9A=9A=9A=9A=9A=9A=9A=9A ALTQ_RED=9A=9A=9A=9A=9A=9A=9A # Random =
 Early Detection
 +options=9A=9A=9A=9A=9A=9A=9A=9A ALTQ_RIO=9A=9A=9A=9A=9A=9A=9A # RED =
 In/Out
 +options=9A=9A=9A=9A=9A=9A=9A=9A ALTQ_HFSC=9A=9A=9A=9A=9A=9A # =
 Hierarchical Packet Scheduler
 +options=9A=9A=9A=9A=9A=9A=9A=9A ALTQ_CDNR=9A=9A=9A=9A =9A=9A# Traffic =
 conditioner
 +options=9A=9A=9A=9A=9A=9A=9A=9A ALTQ_PRIQ=9A=9A=9A=9A=9A=9A # Priority =
 Queueing
 +options=9A=9A=9A=9A=9A=9A=9A=9A ALTQ_NOPCC=9A=9A=9A=9A=9A # Required =
 for SMP build
 +
 
 But when I comment some lines from config problem with packets =
 disappear!
 diff -u ./GENERIC ./black
 --- ./GENERIC=9A=9A Mon May=9A 1 03:15:12 2006
 +++ ./black=9A=9A=9A=9A Sat Aug 19 10:51:09 2006
 @@ -22,7 +22,7 @@
 =9Acpu=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A I486_CPU
 =9Acpu=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A I586_CPU
 =9Acpu=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A I686_CPU
 -ident=9A=9A=9A=9A=9A=9A=9A=9A=9A GENERIC
 +ident=9A=9A=9A=9A=9A=9A=9A=9A=9A black
 
 =9A# To statically compile in device wiring instead of =
 /boot/device.hints
 =9A#hints=9A=9A=9A=9A=9A=9A=9A=9A =
 "GENERIC.hints"=9A=9A=9A=9A=9A=9A=9A=9A # Default places to look for =
 devices.
 @@ -33,7 +33,7 @@
 =9Aoptions=9A=9A=9A=9A=9A=9A=9A =
 SCHED_4BSD=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A # 4BSD scheduler
 =9Aoptions=9A=9A=9A=9A=9A=9A=9A =
 PREEMPTION=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A # Enable kernel thread =
 preemption
 =9Aoptions=9A=9A=9A=9A=9A=9A=9A =
 INET=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A # =
 InterNETworking
 -options=9A=9A=9A=9A=9A=9A=9A =
 INET6=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A # IPv6 =
 communications protocols
 +#options=9A=9A=9A=9A=9A=9A =
 INET6=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A =9A=9A=9A=9A# IPv6 =
 communications protocols
 =9Aoptions=9A=9A=9A=9A=9A=9A=9A =
 FFS=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A # =
 Berkeley Fast Filesystem
 =9Aoptions=9A=9A=9A=9A=9A=9A=9A =
 SOFTUPDATES=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A # Enable FFS soft =
 updates support
 =9Aoptions=9A=9A=9A=9A=9A=9A=9A =
 UFS_ACL=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A # Support for =
 access control lists
 @@ -279,3 +279,41 @@
 =9Adevice=9A=9A=9A=9A=9A=9A=9A=9A firewire=9A=9A=9A=9A=9A=9A=9A # =
 FireWire bus code
 =9Adevice=9A=9A=9A=9A=9A=9A=9A=9A =
 sbp=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A # SCSI over FireWire (Requires =
 scbus and da)
 =9Adevice=9A=9A=9A=9A=9A=9A=9A=9A =
 fwe=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A # Ethernet over FireWire =
 (non-standard!)
 +
 +#--------------------------------
 +options=9A=9A=9A=9A=9A=9A=9A=9A =
 SMP=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A # =
 Symmetric MultiProcessor Kernel
 +#options=9A=9A=9A=9A=9A=9A=9A=9A IPFIREWALL
 +#options=9A=9A=9A=9A=9A=9A=9A=9A IPFIREWALL_VERBOSE
 +#options=9A=9A=9A=9A=9A=9A=9A=9A IPFIREWALL_VERBOSE_LIMIT=3D100
 +#options=9A=9A=9A=9A=9A=9A=9A=9A IPFIREWALL_DEFAULT_TO_ACCEPT
 +#options=9A=9A=9A=9A=9A=9A=9A=9A IPDIVERT
 +#options=9A=9A=9A=9A=9A=9A=9A=9A TCP_DROP_SYNFIN
 +#options=9A=9A=9A=9A=9A=9A=9A=9A IPFILTER
 +#options=9A=9A=9A=9A=9A=9A=9A=9A IPFILTER_LOG
 +#options=9A=9A=9A=9A=9A=9A=9A=9A DUMMYNET
 +options=9A=9A=9A=9A=9A=9A=9A=9A SC_HISTORY_SIZE=3D1000
 +options=9A=9A=9A=9A=9A=9A=9A=9A PANIC_REBOOT_WAIT_TIME=3D120
 +options=9A=9A=9A=9A=9A=9A=9A=9A SC_DISABLE_REBOOT
 +options=9A=9A=9A=9A=9A=9A=9A=9A IPSEC
 +options=9A=9A=9A=9A=9A=9A=9A=9A IPSEC_ESP
 +options=9A=9A=9A=9A=9A=9A=9A=9A IPSEC_DEBUG
 +options=9A=9A=9A=9A=9A=9A=9A=9A IPFIREWALL_FORWARD
 +options=9A=9A=9A=9A=9A=9A=9A=9A IPFIREWALL_FORWARD_EXTENDED
 +
 +options=9A=9A=9A=9A=9A=9A=9A=9A HZ=3D1000
 +
 +# pf otions
 +device pf
 +device pflog
 +device pfsync
 +
 +#ALTQ
 +options=9A=9A=9A=9A=9A=9A=9A=9A ALTQ
 +options=9A=9A=9A=9A=9A=9A=9A=9A ALTQ_CBQ=9A=9A=9A=9A=9A=9A=9A # Class =
 Bases Queueing
 +options=9A=9A=9A=9A=9A=9A=9A=9A ALTQ_RED=9A=9A=9A=9A=9A=9A=9A # Random =
 Early Detection
 +options=9A=9A=9A=9A=9A=9A=9A=9A ALTQ_RIO=9A=9A=9A=9A=9A=9A=9A # RED =
 In/Out
 +options=9A=9A=9A=9A=9A=9A=9A=9A ALTQ_HFSC=9A=9A=9A=9A=9A=9A # =
 Hierarchical Packet Scheduler
 +options=9A=9A=9A=9A=9A=9A=9A=9A ALTQ_CDNR=9A=9A=9A=9A=9A=9A # Traffic =
 conditioner
 +options=9A=9A=9A=9A=9A=9A=9A=9A ALTQ_PRIQ=9A=9A=9A=9A=9A=9A # Priority =
 Queueing
 +options=9A=9A=9A=9A=9A=9A=9A=9A ALTQ_NOPCC=9A=9A=9A=9A=9A # Required =
 for SMP build
 +
 
 


More information about the freebsd-bugs mailing list