misc/143208: IPSec over gif interface

Mon Jan 25 10:40:06 UTC 2010

>Number:         143208
>Category:       misc
>Synopsis:       IPSec over gif interface
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Jan 25 10:40:06 UTC 2010
>Closed-Date:
>Last-Modified:
>Originator:     Alexey
>Release:        8.0
>Organization:
home
>Environment:
FreeBSD freebsd01.internal.corp 8.0-RELEASE FreeBSD 8.0-RELEASE #4: Wed Jan 20 19:20:35 UTC 2010     root at freebsd01.internal.corp:/usr/obj/usr/src/sys/ROUTER  i386
>Description:
There is a simple network with two gateways, each gateway one interface connected to the Internet (em1 interfaces) to a local area network (em0 interfaces).

FreeBSD01:
Code:

freebsd01# ifconfig 
em0: inet 192.168.192.151 netmask 0xffffff00 broadcast 192.168.192.255
em1: inet 10.0.0.1 netmask 0xff000000 broadcast 10.255.255.255
lo0: inet 127.0.0.1 netmask 0xff000000
gif0: tunnel inet 10.0.0.1 -> 10.10.10.1
       inet 192.168.192.151 -> 192.168.194.1 netmask 0xffffffff

Code:

freebsd02# ifconfig
em0: inet 192.168.194.1 netmask 0xffffff00 broadcast 192.168.194.255
em1: inet 10.10.10.1 netmask 0xff000000 broadcast 10.255.255.255
lo0: inet 127.0.0.1 netmask 0xff000000
gif0: tunnel inet 10.10.10.1 -> 10.0.0.1
      inet 192.168.194.1 -> 192.168.192.151 netmask 0xffffffff

Installed tunnel (gif0) between two external interfaces.
Installed and configured racoon, properly configured IPSec.

When I run on freebsd01 command:
ping -S 192.168.192.151 192.168.194.1

in another terminal at
Code:

freebsd01 # tcpdump-pni gif0
IP192.168.192.151> 192.168.194.1: ICMP echo request, id 50693, seq 14, length 64
IP 10.10.10.1> 10.0.0.1: IP 192.168.194.1> 192.168.192.151: ICMP echo reply, id 50693, seq 14, length 64 (ipip-proto-4)

At
Code:

freebsd02 # tcpdump-pni gif0
IP 10.0.0.1> 10.10.10.1: IP 192.168.192.151> 192.168.194.1: ICMP echo request, id 50693, seq 150, length 64 (ipip-proto-4)
IP 192.168.194.1> 192.168.192.151: ICMP echo reply, id 50693, seq 150, length 64

Incoming packets are not encapsulated in strange ways.
If disable IPSec example command setkey -PFall works well.

If you disable IPSec for example the command setkey -PF all works well.

That is not in freebsd 6, but it appeared to freebsd 7 and 8 versions.
Perhaps there is a solution?

RUSSIAN:

éÍÅÅÔÓÑ Ä×Å ËÏÒÐÏÒÁÔÉ×ÎÙÅ ÓÅÔÉ (em0) Ó×ÑÚÁÎÎÙÅ ÞÅÒÅÚ ÉÎÔÅÒÎÅÔ (em1) ÞÅÒÅÚ Ä×Á ÛÌÀÚÁ (freebsd01 É 02).

ëÏÄ: ÷ÙÄÅÌÉÔØ ×Ó£ &#8226; òÁÚ×ÅÒÎÕÔØ

    freebsd01# ifconfig 
    em0: inet 192.168.192.151 netmask 0xffffff00 broadcast 192.168.192.255
    em1: inet 10.0.0.1 netmask 0xff000000 broadcast 10.255.255.255
    lo0: inet 127.0.0.1 netmask 0xff000000
    gif0: tunnel inet 10.0.0.1 -> 10.10.10.1
           inet 192.168.192.151 -> 192.168.194.1 netmask 0xffffffff

ëÏÄ: ÷ÙÄÅÌÉÔØ ×Ó£ &#8226; òÁÚ×ÅÒÎÕÔØ

    freebsd02# ifconfig
    em0: inet 192.168.194.1 netmask 0xffffff00 broadcast 192.168.194.255
    em1: inet 10.10.10.1 netmask 0xff000000 broadcast 10.255.255.255
    lo0: inet 127.0.0.1 netmask 0xff000000
    gif0: tunnel inet 10.10.10.1 -> 10.0.0.1
          inet 192.168.194.1 -> 192.168.192.151 netmask 0xffffffff

óÏÏÔ×ÅÔÓÔ×ÅÎÎÏ ÕÓÔÁÎÏ×ÌÅÎ gif ÔÕÎÎÅÌØ ×Ï ×ÎÕÔÒÅÎÎÉÅ ÓÅÔÉ ÞÅÒÅÚ ×ÎÅÛÎÉÅ, ÕÓÔÁÎÏ×ÌÅÎ É ÎÁÓÔÒÏÅÎ racoon, ÐÒÁ×ÉÌØÎÏ ÚÁÂÉÔÁ ÂÁÚÁ SPD, ×Ó£ ÒÁÂÏÔÁÅÔ.

îÏ ×ÏÔ ËÏÇÄÁ ÎÁ ÏÄÎÏÍ ÛÌÀÚÏ× ÐÉÎÇÕÅÛØ ×ÎÕÔÒÅÎÎÀÀ ÓÅÔØ ÄÒÕÇÏÇÏ ÛÌÀÚÁ:
freebsd01:

ëÏÄ: ÷ÙÄÅÌÉÔØ ×Ó£ &#8226; òÁÚ×ÅÒÎÕÔØ

    ping -S 192.168.192.151 192.168.194.1

é ÄÅÌÁÅÍ tcpdump -pni gif0, ÔÏ ÐÏÌÕÞÁÅÍ ÓÌÅÄÕÀÝÅÅ:

ëÏÄ: ÷ÙÄÅÌÉÔØ ×Ó£ &#8226; òÁÚ×ÅÒÎÕÔØ

    freebsd01 # tcpdump-pni gif0
    IP192.168.192.151> 192.168.194.1: ICMP echo request, id 50693, seq 14, length 64
    IP 10.10.10.1> 10.0.0.1: IP 192.168.194.1> 192.168.192.151: ICMP echo reply, id 50693, seq 14, length 64 (ipip-proto-4)

ëÏÄ: ÷ÙÄÅÌÉÔØ ×Ó£ &#8226; òÁÚ×ÅÒÎÕÔØ

    freebsd02 # tcpdump-pni gif0
    IP 10.0.0.1> 10.10.10.1: IP 192.168.192.151> 192.168.194.1: ICMP echo request, id 50693, seq 150, length 64 (ipip-proto-4)
    IP 192.168.194.1> 192.168.192.151: ICMP echo reply, id 50693, seq 150, length 64

ïËÁÚÙ×ÁÅÔÓÑ ×ÓÅÇÄÁ ×ÈÏÄÑÝÉÅ ÐÁËÅÔÙ ÐÏÑ×ÌÑÀÔÓÑ ÉÎËÁÐÓÕÌÉÒÏ×ÁÎÎÙÍÉ, ÎÁ ÏÂÏÉÈ ÛÌÀÚÁÈ ÓÉÍÍÅÔÒÉÞÎÏ.

åÓÌÉ ÏÔËÌÀÞÉÔØ IPSec ËÏÍÁÎÄÏÊ setkey -PF ÎÁ ÏÂÏÉÈ ÛÌÀÚÁÈ - ÔÏ ×Ó£ ÈÏÄÉÔ ËÒÁÓÉ×Ï.

üÔÏÔ ÂÏË ÐÒÏÑ×ÌÑÅÔÓÑ × FreeBSD ÎÁÞÉÎÁÑ Ó 7-Ê ×ÅÒÓÉÉ.
÷ 6-Ê ×Ó£ ÒÁÂÏÔÁÅÔ ÏÔÌÉÞÎÏ, ÎÏ ÜÔÏ ÎÅ ÐÏÚ×ÏÌÑÅÔ Ó×ÑÚÁÔØ 6-À É 7-À ×ÅÒÓÉÉ(ping ÉÄ£Ô Á ÂÏÌØÛÅ ÎÉÞÅÇÏ ÎÅ ÒÁÂÏÔÁÅÔ).

÷ÏÚÍÏÖÎÏ ËÔÏ ÌÉÂÏ ÓÔÁÌËÉ×ÁÌÓÑ Ó ÐÏÄÏÂÎÏÊ ÓÉÔÕÁÃÉÅÊ?
åÓÔØ ÌÉ ÒÅÛÅÎÉÅ?

óÐÁÓÉÂÏ.

P.S. îÁ ×ÓÑËÉÊ ÓÌÕÞÁÊ ÐÒÉ×ÅÄÕ ÔÁÂÌÉÃÉ ÍÁÒÛÒÕÔÉÚÁÃÉÉ:

ëÏÄ: ÷ÙÄÅÌÉÔØ ×Ó£ &#8226; òÁÚ×ÅÒÎÕÔØ

    freebsd01# netstat -rn
    Routing tables

    Internet:
    Destination        Gateway            Flags    Refs      Use  Netif Expire
    default            192.168.192.1      UGS         0        0    em0
    10.0.0.0/8         link#2             U           1       91    em1
    10.0.0.1           link#2             UHS         0        0    lo0
    127.0.0.1          link#3             UH          0       26    lo0
    192.168.192.0/24   link#1             U           2      245    em0
    192.168.192.151    link#1             UHS         0        0    lo0
    192.168.194.0/24   192.168.194.1      UGS         0        0   gif0
    192.168.194.1      link#4             UH          0       27   gif0

ëÏÄ: ÷ÙÄÅÌÉÔØ ×Ó£ &#8226; òÁÚ×ÅÒÎÕÔØ

    freebsd02# netstat -rn
    Routing tables

    Internet:
    Destination        Gateway            Flags    Refs      Use  Netif Expire
    10.0.0.0/8         link#2             U           1      690    em1
    10.10.10.1         link#2             UHS         0        0    lo0
    127.0.0.1          link#3             UH          0        0    lo0
    192.168.192.0/24   192.168.192.151    UGS         0      225   gif0
    192.168.192.151    link#4             UH          0       12   gif0
    192.168.194.0/24   link#1             U           0        0    em0
    192.168.194.1      link#1             UHS         0        0    lo0

>How-To-Repeat:
Create gif interface, configure IPSec. 
Run tcpdump -pni gif0 on both gateways.
Run ping.
>Fix:

>Release-Note:
>Audit-Trail:
>Unformatted: