# kern/101400: [ipsec] some packets do not pass through IPSEC tunnel

Sat Aug 19 12:40:19 UTC 2006

```The following reply was made to PR kern/101400; it has been noted by GNATS.

To: <bug-followup at FreeBSD.org>, <read at midland.com.ua>
Cc:
Subject: Re: kern/101400: [ipsec] some packets do not pass through IPSEC tunnel
Date: Sat, 19 Aug 2006 15:37:30 +0300

After additional testing it was found out, that packets (not only ESP) =
the certain size are lost all.
If it is ICMP(as example) packet from 1473 to 1479 bytes we have lost =
it.
Examle:

And I found that after 1480*x, where x=3D1,3,4,5,6... bytes we have the =
same problem
1480+1473=9A -=9A=9A 1480+1479=9A=9A=9A=9A=9A=9A=9A=9A=9A first range of =
1480*2+1473=9A - 1480*2+1479=9A=9A=9A=9A=9A second range of payload of =
ICMP packet
.........
And so on

If packets bigger or smaller=9A of that range - packets pass
When problem exists I have kernel:
diff -u ./GENERIC ./black
--- ./GENERIC=9A=9A Mon May=9A 1 03:15:12 2006
+++ ./black=9A=9A=9A=9A Sat Aug 19 10:51:09 2006
@@ -22,7 +22,7 @@
=9Acpu=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A I486_CPU
=9Acpu=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A I586_CPU
=9Acpu=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A I686_CPU
-ident=9A=9A=9A=9A=9A=9A=9A=9A=9A GENERIC
+ident=9A=9A=9A=9A=9A=9A=9A=9A=9A black

=9A# To statically compile in device wiring instead of =
/boot/device.hints
=9A#hints=9A=9A=9A=9A=9A=9A=9A=9A =
"GENERIC.hints"=9A=9A=9A=9A=9A=9A=9A=9A # Default places to look for =
devices.
@@ -33,7 +33,7 @@
=9Aoptions=9A=9A=9A=9A=9A=9A=9A =
SCHED_4BSD=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A # 4BSD scheduler
=9Aoptions=9A=9A=9A=9A=9A=9A=9A =
PREEMPTION=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A =9A# Enable kernel thread =
preemption
=9Aoptions=9A=9A=9A=9A=9A=9A=9A =
INET=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A # =
InterNETworking
-options=9A=9A=9A=9A=9A=9A=9A =
INET6=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A # IPv6 =
communications protocols
+#options=9A=9A=9A=9A=9A=9A =
INET6=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A # IPv6 =
communications protocols
=9Aoptions=9A=9A=9A=9A=9A=9A=9A =
FFS=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A # =
Berkeley Fast Filesystem
=9Aoptions=9A=9A=9A=9A=9A=9A=9A =
SOFTUPDATES=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A # Enable FFS soft =
=9Aoptions=9A=9A=9A=9A=9A=9A=9A =
UFS_ACL=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A # Support for =
access control lists
@@ -279,3 +279,41 @@
FireWire bus code
sbp=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A # SCSI over FireWire (Requires =
scbus and da)
fwe=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A # Ethernet over FireWire =
(non-standard!)
+
+#--------------------------------
+options=9A=9A=9A=9A=9A=9A=9A=9A =
SMP=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A =9A=9A=9A=9A=9A# =
Symmetric MultiProcessor Kernel
+options=9A=9A=9A=9A=9A=9A=9A=9A IPFIREWALL
+options=9A=9A=9A=9A=9A=9A=9A=9A IPFIREWALL_VERBOSE
+options=9A=9A=9A=9A=9A=9A=9A=9A IPFIREWALL_VERBOSE_LIMIT=3D100
+options=9A=9A=9A=9A=9A=9A=9A=9A IPFIREWALL_DEFAULT_TO_ACCEPT
+options=9A=9A=9A=9A=9A=9A=9A=9A IPDIVERT
+options=9A=9A=9A=9A=9A=9A=9A=9A TCP_DROP_SYNFIN
+options=9A=9A=9A=9A=9A=9A=9A=9A IPFILTER
+options=9A=9A=9A=9A=9A=9A=9A=9A IPFILTER_LOG
+options=9A=9A=9A=9A=9A=9A=9A=9A DUMMYNET
+options=9A=9A=9A=9A=9A=9A=9A=9A SC_HISTORY_SIZE=3D1000
+options=9A=9A=9A=9A=9A=9A=9A=9A PANIC_REBOOT_WAIT_TIME=3D120
+options=9A=9A=9A=9A=9A=9A=9A=9A SC_DISABLE_REBOOT
+options=9A=9A=9A=9A=9A=9A=9A=9A IPSEC
+options=9A=9A=9A=9A=9A=9A=9A=9A IPSEC_ESP
+options=9A=9A=9A=9A=9A=9A=9A=9A IPSEC_DEBUG
+options=9A=9A=9A=9A=9A=9A=9A=9A IPFIREWALL_FORWARD
+options=9A=9A=9A=9A=9A=9A=9A=9A IPFIREWALL_FORWARD_EXTENDED
+
+options=9A=9A=9A=9A=9A=9A=9A=9A HZ=3D1000
+
+# pf otions
+device pf
+device pflog
+device pfsync
+
+#ALTQ
+options=9A=9A=9A=9A=9A=9A=9A=9A ALTQ
+options=9A=9A=9A=9A=9A=9A=9A=9A ALTQ_CBQ=9A=9A=9A=9A=9A=9A=9A # Class =
Bases Queueing
+options=9A=9A=9A=9A=9A=9A=9A=9A ALTQ_RED=9A=9A=9A=9A=9A=9A=9A # Random =
Early Detection
+options=9A=9A=9A=9A=9A=9A=9A=9A ALTQ_RIO=9A=9A=9A=9A=9A=9A=9A # RED =
In/Out
+options=9A=9A=9A=9A=9A=9A=9A=9A ALTQ_HFSC=9A=9A=9A=9A=9A=9A # =
Hierarchical Packet Scheduler
+options=9A=9A=9A=9A=9A=9A=9A=9A ALTQ_CDNR=9A=9A=9A=9A =9A=9A# Traffic =
conditioner
+options=9A=9A=9A=9A=9A=9A=9A=9A ALTQ_PRIQ=9A=9A=9A=9A=9A=9A # Priority =
Queueing
+options=9A=9A=9A=9A=9A=9A=9A=9A ALTQ_NOPCC=9A=9A=9A=9A=9A # Required =
for SMP build
+

But when I comment some lines from config problem with packets =
disappear!
diff -u ./GENERIC ./black
--- ./GENERIC=9A=9A Mon May=9A 1 03:15:12 2006
+++ ./black=9A=9A=9A=9A Sat Aug 19 10:51:09 2006
@@ -22,7 +22,7 @@
=9Acpu=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A I486_CPU
=9Acpu=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A I586_CPU
=9Acpu=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A I686_CPU
-ident=9A=9A=9A=9A=9A=9A=9A=9A=9A GENERIC
+ident=9A=9A=9A=9A=9A=9A=9A=9A=9A black

=9A# To statically compile in device wiring instead of =
/boot/device.hints
=9A#hints=9A=9A=9A=9A=9A=9A=9A=9A =
"GENERIC.hints"=9A=9A=9A=9A=9A=9A=9A=9A # Default places to look for =
devices.
@@ -33,7 +33,7 @@
=9Aoptions=9A=9A=9A=9A=9A=9A=9A =
SCHED_4BSD=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A # 4BSD scheduler
=9Aoptions=9A=9A=9A=9A=9A=9A=9A =
PREEMPTION=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A # Enable kernel thread =
preemption
=9Aoptions=9A=9A=9A=9A=9A=9A=9A =
INET=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A # =
InterNETworking
-options=9A=9A=9A=9A=9A=9A=9A =
INET6=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A # IPv6 =
communications protocols
+#options=9A=9A=9A=9A=9A=9A =
INET6=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A =9A=9A=9A=9A# IPv6 =
communications protocols
=9Aoptions=9A=9A=9A=9A=9A=9A=9A =
FFS=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A # =
Berkeley Fast Filesystem
=9Aoptions=9A=9A=9A=9A=9A=9A=9A =
SOFTUPDATES=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A # Enable FFS soft =
=9Aoptions=9A=9A=9A=9A=9A=9A=9A =
UFS_ACL=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A # Support for =
access control lists
@@ -279,3 +279,41 @@
FireWire bus code
sbp=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A # SCSI over FireWire (Requires =
scbus and da)
fwe=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A # Ethernet over FireWire =
(non-standard!)
+
+#--------------------------------
+options=9A=9A=9A=9A=9A=9A=9A=9A =
SMP=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A # =
Symmetric MultiProcessor Kernel
+#options=9A=9A=9A=9A=9A=9A=9A=9A IPFIREWALL
+#options=9A=9A=9A=9A=9A=9A=9A=9A IPFIREWALL_VERBOSE
+#options=9A=9A=9A=9A=9A=9A=9A=9A IPFIREWALL_VERBOSE_LIMIT=3D100
+#options=9A=9A=9A=9A=9A=9A=9A=9A IPFIREWALL_DEFAULT_TO_ACCEPT
+#options=9A=9A=9A=9A=9A=9A=9A=9A IPDIVERT
+#options=9A=9A=9A=9A=9A=9A=9A=9A TCP_DROP_SYNFIN
+#options=9A=9A=9A=9A=9A=9A=9A=9A IPFILTER
+#options=9A=9A=9A=9A=9A=9A=9A=9A IPFILTER_LOG
+#options=9A=9A=9A=9A=9A=9A=9A=9A DUMMYNET
+options=9A=9A=9A=9A=9A=9A=9A=9A SC_HISTORY_SIZE=3D1000
+options=9A=9A=9A=9A=9A=9A=9A=9A PANIC_REBOOT_WAIT_TIME=3D120
+options=9A=9A=9A=9A=9A=9A=9A=9A SC_DISABLE_REBOOT
+options=9A=9A=9A=9A=9A=9A=9A=9A IPSEC
+options=9A=9A=9A=9A=9A=9A=9A=9A IPSEC_ESP
+options=9A=9A=9A=9A=9A=9A=9A=9A IPSEC_DEBUG
+options=9A=9A=9A=9A=9A=9A=9A=9A IPFIREWALL_FORWARD
+options=9A=9A=9A=9A=9A=9A=9A=9A IPFIREWALL_FORWARD_EXTENDED
+
+options=9A=9A=9A=9A=9A=9A=9A=9A HZ=3D1000
+
+# pf otions
+device pf
+device pflog
+device pfsync
+
+#ALTQ
+options=9A=9A=9A=9A=9A=9A=9A=9A ALTQ
+options=9A=9A=9A=9A=9A=9A=9A=9A ALTQ_CBQ=9A=9A=9A=9A=9A=9A=9A # Class =
Bases Queueing
+options=9A=9A=9A=9A=9A=9A=9A=9A ALTQ_RED=9A=9A=9A=9A=9A=9A=9A # Random =
Early Detection
+options=9A=9A=9A=9A=9A=9A=9A=9A ALTQ_RIO=9A=9A=9A=9A=9A=9A=9A # RED =
In/Out
+options=9A=9A=9A=9A=9A=9A=9A=9A ALTQ_HFSC=9A=9A=9A=9A=9A=9A # =
Hierarchical Packet Scheduler
+options=9A=9A=9A=9A=9A=9A=9A=9A ALTQ_CDNR=9A=9A=9A=9A=9A=9A # Traffic =
conditioner
+options=9A=9A=9A=9A=9A=9A=9A=9A ALTQ_PRIQ=9A=9A=9A=9A=9A=9A # Priority =
Queueing
+options=9A=9A=9A=9A=9A=9A=9A=9A ALTQ_NOPCC=9A=9A=9A=9A=9A # Required =
for SMP build
+

```