kern/121642: When using IPSec, tcpdump shows non-decapsulated packets on gif interface

[Alexander Zagrebin]

>Number:         121642
>Category:       kern
>Synopsis:       When using IPSec, tcpdump shows non-decapsulated packets on gif interface
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Mar 12 11:50:00 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator:     Alexander Zagrebin
>Release:        7.0-RELEASE
>Organization:
>Environment:
FreeBSD hostname 7.0-RELEASE FreeBSD 7.0-RELEASE #0: Thu Mar  6 14:32:06 MSK 2008     alex at hostname:/usr/src/sys/i386/compile/KERNEL  i386
>Description:
I'm using ipsec-protected tunnel between 2 hosts.
The first one (HostA) is running 6.3-RELEASE and second one (HostB) - 7.0-RELEASE.
The network topology:

     ------- public network ------- 
        |                      |
        |                      |
     A.A.A.A                B.B.B.B
      Host A                 Host B
   6.3-RELEASE            7.0-RELEASE
   192.168.0.2            192.168.1.1
        |                      |
        |                      |
     private                private
net 192.168.0.0/24    net 192.168.1.0/24

After creating the tunnel using gif interfaces without IPSec, I can successfully
ping host 192.168.0.10 from 192.168.1.2.
tcpdump on gif interfaces shows:

HostA# tcpdump -ni gif0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on gif0, link-type NULL (BSD loopback), capture size 96 bytes
21:21:20.861465 IP 192.168.1.2 > 192.168.0.10: ICMP echo request, id 512, seq 49921, length 40
21:21:20.862060 IP 192.168.0.10 > 192.168.1.2: ICMP echo reply, id 512, seq 49921, length 40

HostB# tcpdump -ni gif0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on gif0, link-type NULL (BSD loopback), capture size 96 bytes
21:21:25.012390 IP 192.168.1.2 > 192.168.0.10: ICMP echo request, id 512, seq 49921, length 40
21:21:25.014457 IP 192.168.0.10 > 192.168.1.2: ICMP echo reply, id 512, seq 49921, length 40

All right.

Now I'm starting IPSec.

ipsec.conf on HostA:
spdadd B.B.B.B/32 A.A.A.A/32 ipencap
    -P in ipsec esp/tunnel/B.B.B.B-A.A.A.A/require;
spdadd A.A.A.A/32 B.B.B.B/32 ipencap
    -P out ipsec esp/tunnel/A.A.A.A-B.B.B.B/require;

ipsec.conf on HostB:
spdadd A.A.A.A/32 B.B.B.B/32 ipencap
    -P in ipsec esp/tunnel/A.A.A.A-B.B.B.B/require;
spdadd B.B.B.B/32 A.A.A.A/32 ipencap
    -P out ipsec esp/tunnel/B.B.B.B-A.A.A.A/require;

Pinging 192.168.0.10 from 192.168.1.2 is successful again, but
tcpdump shows:

HostA# tcpdump -ni gif0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on gif0, link-type NULL (BSD loopback), capture size 96 bytes
21:24:12.429778 IP 192.168.1.2 > 192.168.0.10: ICMP echo request, id 512, seq 51969, length 40
21:24:12.430246 IP 192.168.0.10 > 192.168.1.2: ICMP echo reply, id 512, seq 51969, length 40

HostB# tcpdump -ni gif0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on gif0, link-type NULL (BSD loopback), capture size 96 bytes
21:24:16.577374 IP 192.168.1.2 > 192.168.0.10: ICMP echo request, id 512, seq 51969, length 40
21:24:16.580876 IP 10.2.222.2 > 10.255.255.2: IP 192.168.0.10 > 192.168.1.2: 
                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
ICMP echo reply, id 512, seq 51969, length 40 (ipip-proto-4)

Oops!
tcpdump shows non-decapsulated packets, but tunnel works fine.
>How-To-Repeat:
See above
>Fix:


>Release-Note:
>Audit-Trail:
>Unformatted: