On 21.10.2014 01:34, Matthew Grooms wrote:
>>>>> https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=110959
>>>>
>>>> Did you try the patch from last PR? It is small and should be
>>>> applicable
>>>> to stable/10.
>>>>
>>>
>>> As I mentioned, it's not clear to me if the patch was intended to fix
>>> the issue that I am describing. Is that the case? If so, I would be
>>> happy to apply it and report back. These are production firewalls, so
>>> I'd prefer to have some feedback before calculating that risk.
>>
>> This commit fixes similar problem with ipfw in 11.0-CURRENT. But I think
>> it won't help you with pf in 10. I guess r266800 is what you need.
>>
>
> From the commit message, it would appear that r266800 is intended to
> correct issues related to IPv4-in-IPv6 or IPv6-in-IPv4 configurations.
> I'm using the more traditional IPv4-in-IPv4 tunnel mode configuration.
It also changes places from where pfil consumers are called. You may use
dtrace script to see where is the problem. Try this:
> kldload dtraceall
> cat > ~/ipsec.d
#!/usr/sbin/dtrace -s
fbt::ipsec_filter:entry
{
m = *(struct mbuf **)arg0;
ip = (struct ip *)m->m_hdr.mh_data;
printf("%s: %s: %s->%s proto %d",
(arg1 & 1) ? "in": "out",
(arg2 & 1) ? "before": "after",
inet_ntoa(&ip->ip_src.s_addr),
inet_ntoa(&ip->ip_dst.s_addr),
ip->ip_p);
}
^D
> chmod +x ~/ipsec.d
> ~/ipsec.d
This script will print messages when ipsec_filter function will be
invoked. Can you show what it will print for your case?
> Would a change to if_enc.c only effect the operation of ipfw? Unless I'm
> misreading the man page, it only deals with traffic associated with the
> IPSec processing path. In theory, I don't see why it would have an
> effect on one pfil consumer and not the other.
pf and ipfw deal differently when they want to determine incoming interface.
> It looks like the last commit to 10.0-RELEASE is r255926, which is the
> last real code change ( r257176 is just a header file include ) before
> your commit of 272695 in CURRENT. So besides r272695, the driver in both
> 10.x and CURRENT are essentially the same, are they not?
No, they are not the same.
--
WBR, Andrey V. Elsukov
_______________________________________________
freebsd-net@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org"
