[Bug 226411] PF does not properly keep state with GRE in IPSec

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=226411

            Bug ID: 226411
           Summary: PF does not properly keep state with GRE in IPSec
           Product: Base System
           Version: CURRENT
          Hardware: amd64
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: kern
          Assignee: freebsd-bugs at FreeBSD.org
          Reporter: eric at edombroski.com

It appears pf keeps incorrect state for packets routed via a GRE tunnel secured
via IPSec.  GRE tunnel works correctly without IPSec, but with IPSec (transport
mode) enabled between the hosts and pf enabled, traffic does not flow as
expected.  Traffic between hosts (not going over GRE tunnel) with IPSec appears
to work as expected.

ICMP echo requests / replies and TCP SYN packets make it through, even if 
rules are put in place to prevent the traffic.  TCP replies are NOT let
through, even if rules are put in place to allow the traffic.  

When showing states with pfctl, it seems that the states are both in one
direction when using IPSec, as opposed to in opposite directions without IPSec.



CORRECT (GRE tunnel w/o IPSEC):
> pfctl -ss | grep 10.6.0.10 | grep 10.1.0.1
gre0 icmp 10.6.0.10:63271 <- 10.1.0.1:63271       0:0
vmx1 icmp 10.1.0.1:63271 -> 10.6.0.10:63271       0:0


BAD (GRE tunnel w/ IPSEC):
> pfctl -ss | grep 10.6.0.10 | grep 10.1.0.1
vmx1 icmp 10.1.0.1:588 -> 10.6.0.10:588       0:0
gre0 icmp 10.6.0.10:588 -> 10.1.0.1:588       0:0


Config:

host1 10.10.10.1 external interface, 10.6.0.1 internal interface
host2 10.10.10.2

host1 (freebsd router)
ifconfig gre0
        tunnel: inet 10.10.10.1 -> 10.10.10.2
        inet 10.1.0.1 --> 10.1.0.2 netmask 0xfffffffc

host2 (freebsd client)
ifconfig gre0
        tunnel: inet 10.10.10.2 -> 10.10.10.1
        inet 10.1.0.2 --> 10.1.0.1 netmask 0xfffffffc

host2:  route add -net 10.6.0.0/23 10.1.0.1

Originally came across this in downstream pfSense based on 11.1-RELEASE-p6, but
I've reproduced this 12-CURRENT snapshot r330034.

-- 
You are receiving this mail because:
You are the assignee for the bug.