kern/137036: fastforwarding breaks ipsec

[Ingo Flaschberger]

>Number:         137036
>Category:       kern
>Synopsis:       fastforwarding breaks ipsec
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Jul 23 17:00:04 UTC 2009
>Closed-Date:
>Last-Modified:
>Originator:     Ingo Flaschberger
>Release:        7.2-STABLE
>Organization:
>Environment:
FreeBSD  7.2-STABLE FreeBSD 7.2-STABLE #13: Thu Jul 23 13:40:58 UTC 2009     root at xxxxx:/usr/obj/usr/src/sys/ROUTER  i386
>Description:
When fastforwarding is enabled, packets directed to a ipsec-link are not passed to ipsec but routed (not encrypted) via the suitable route.
setkey - sa's are ignored

>How-To-Repeat:
sysctl -w net.inet.ip.fastforwarding=1

>Fix:
sysctl -w net.inet.ip.fastforwarding=0

>Release-Note:
>Audit-Trail:
>Unformatted: