kern/143593: When using IPSec, tcpdump doesn't show outgoing packets on gif interface

[Vadim Fedorenko]

>Number:         143593
>Category:       kern
>Synopsis:       When using IPSec, tcpdump doesn't show outgoing packets on gif interface
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sat Feb 06 00:30:06 UTC 2010
>Closed-Date:
>Last-Modified:
>Originator:     Vadim Fedorenko
>Release:        7.2-STABLE
>Organization:
>Environment:
FreeBSD hostname 7.2-STABLE FreeBSD 7.2-STABLE #1: Sat Jan 16 14:11:41 MSK 2010     junk at hostname:/usr/obj/usr/src/sys/PFKERNEL  i386
>Description:
I'm using ipsec tunnels between 2 hosts. 
The first one (Host1) is running 7.2-STABLE and the second one (Host2) 6.2-RELEASE.
The network topology:
Host1: public A.A.A.A private 192.168.1.114 net 192.168.1.0/24
Host2: public B.B.B.B private 192.168.4.254 net 192.168.4.0/24

The tunnel configuration for Host1:
gif0 tunnel A.A.A.A B.B.B.B 
     inet 192.168.1.114 192.168.4.254 netmask 255.255.255.255
ipsec.conf:
spdadd 192.168.1.0/24 192.168.4.0/24 any -P out ipsec esp/tunnel/A.A.A.A-B.B.B.B/require;
spdadd 192.168.4.0/24 192.168.1.0/24 any -P in ipsec esp/tunnel/B.B.B.B-A.A.A.A/require;

The tunnel configuration for Host2:
gif0 tunnel B.B.B.B A.A.A.A
     inet 192.168.4.254 192.168.1.114 netmask 255.255.255.255
ipsec.conf:
spdadd 192.168.4.0/24 192.168.1.0/24 any -P out ipsec esp/tunnel/B.B.B.B-A.A.A.A/require;
spdadd 192.168.1.0/24 192.168.4.0/24 any -P in ipsec esp/tunnel/A.A.A.A-B.B.B.B/require;

Pinging 192.168.1.114 from 192.168.4.254 successful:
[root at Host2 /etc]# ping 192.168.1.114
PING 192.168.1.114 (192.168.1.114): 56 data bytes
64 bytes from 192.168.1.114: icmp_seq=0 ttl=64 time=19.257 ms
64 bytes from 192.168.1.114: icmp_seq=1 ttl=64 time=19.443 ms
64 bytes from 192.168.1.114: icmp_seq=2 ttl=64 time=19.709 ms

but tcpdump on host1 doesn't show outgoing packets on gif0:
[root at Host1 /etc]#  tcpdump -ni gif0
                                                                           tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on gif0, link-type NULL (BSD loopback), capture size 96 bytes
03:16:49.915662 IP 192.168.4.254 > 192.168.1.114: ICMP echo request, id 61598, seq 0, length 64
03:16:50.916994 IP 192.168.4.254 > 192.168.1.114: ICMP echo request, id 61598, seq 1, length 64
03:16:51.918189 IP 192.168.4.254 > 192.168.1.114: ICMP echo request, id 61598, seq 2, length 64


03:16:52.922871 IP 192.168.4.254 > 192.168.1.114: ICMP echo request, id 61598, seq 3, length 64


>How-To-Repeat:
See above
>Fix:


>Release-Note:
>Audit-Trail:
>Unformatted: