Re: Broken IPsec + enc +pf/ipfw

2014-10-23 Thread Matthew Grooms
On 10/23/2014 5:56 AM, Andrey V. Elsukov wrote: On 22.10.2014 23:28, Matthew Grooms wrote: On 10/21/2014 1:39 PM, Kyle Williams wrote: On Tue Oct 21 11:35:15 2014, Matthew Grooms wrote: Hey Kyle, Thanks for lending a hand. I tested a few myself last night but had no luck. This morning I recei

Re: Broken IPsec + enc +pf/ipfw

2014-10-23 Thread Andrey V. Elsukov
On 22.10.2014 23:28, Matthew Grooms wrote: > On 10/21/2014 1:39 PM, Kyle Williams wrote: >> On Tue Oct 21 11:35:15 2014, Matthew Grooms wrote: >>> Hey Kyle, >>> >>> Thanks for lending a hand. I tested a few myself last night but had no >>> luck. This morning I received an email off list that pointe

Re: Broken IPsec + enc +pf/ipfw

2014-10-22 Thread Ermal Luçi
On Wed, Oct 22, 2014 at 9:28 PM, Matthew Grooms wrote: > On 10/21/2014 1:39 PM, Kyle Williams wrote: > >> On Tue Oct 21 11:35:15 2014, Matthew Grooms wrote: >> >>> Hey Kyle, >>> >>> Thanks for lending a hand. I tested a few myself last night but had no >>> luck. This morning I received an email o

Re: Broken IPsec + enc +pf/ipfw

2014-10-22 Thread Matthew Grooms
On 10/21/2014 1:39 PM, Kyle Williams wrote: On Tue Oct 21 11:35:15 2014, Matthew Grooms wrote: Hey Kyle, Thanks for lending a hand. I tested a few myself last night but had no luck. This morning I received an email off list that pointed to a patch that was merged to 10 stable. It sounds promisi

Re: Broken IPsec + enc +pf/ipfw

2014-10-21 Thread Kyle Williams
On Tue Oct 21 11:35:15 2014, Matthew Grooms wrote: >Hey Kyle, > >Thanks for lending a hand. I tested a few myself last night but had no >luck. This morning I received an email off list that pointed to a patch >that was merged to 10 stable. It sounds promising ... > >Log: > Merge r263091: fix mb

Re: Broken IPsec + enc +pf/ipfw

2014-10-21 Thread Matthew Grooms
On 10/21/2014 11:06 AM, Kyle Williams wrote: Hello, I'm currently using 10.0, IPSEC, racoon, enc, and pf between two remote hosts without NATT. The gif tunnel is ipv4 only, host A is ipv4 only, host B is ipv4/ipv6. I use IPSEC to route traffic between jails on both hosts, with the jails using cl

Re: Broken IPsec + enc +pf/ipfw

2014-10-21 Thread Kyle Williams
Hello, I'm currently using 10.0, IPSEC, racoon, enc, and pf between two remote hosts without NATT. The gif tunnel is ipv4 only, host A is ipv4 only, host B is ipv4/ipv6. I use IPSEC to route traffic between jails on both hosts, with the jails using cloned lo1 and 10.0.0.0/8 addresses. I'm testing

Re: Broken IPsec + enc +pf/ipfw

2014-10-21 Thread Andrey V. Elsukov
On 21.10.2014 01:34, Matthew Grooms wrote: > https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=110959 Did you try the patch from last PR? It is small and should be applicable to stable/10. >>> >>> As I mentioned, it's not clear to me if the patch was intended to fix >>>

Re: Broken IPsec + enc +pf/ipfw

2014-10-20 Thread Matthew Grooms
On 10/20/2014 3:50 PM, Andrey V. Elsukov wrote: On 21.10.2014 00:00, Matthew Grooms wrote: On 10/20/2014 2:47 PM, Andrey V. Elsukov wrote: On 20.10.2014 20:18, Matthew Grooms wrote: Lastly, I tried to locate a relevant PR but didn't find anything concrete. Is this related to the issue? And if

Re: Broken IPsec + enc +pf/ipfw

2014-10-20 Thread Andrey V. Elsukov
On 21.10.2014 00:00, Matthew Grooms wrote: > On 10/20/2014 2:47 PM, Andrey V. Elsukov wrote: >> On 20.10.2014 20:18, Matthew Grooms wrote: >>> Lastly, I tried to locate a relevant PR but didn't find anything >>> concrete. Is this related to the issue? And if so, can it be MFCd? >>> >>> https://bugs

Re: Broken IPsec + enc +pf/ipfw

2014-10-20 Thread Matthew Grooms
On 10/20/2014 2:44 PM, Mark Felder wrote: On Mon, Oct 20, 2014, at 11:18, Matthew Grooms wrote: All, There appears to be an issue with FreeBSD 10.x when using enc device to filter inbound traffic on the receive path. After searching the mailing lists, I see two different people reporting the i

Re: Broken IPsec + enc +pf/ipfw

2014-10-20 Thread Matthew Grooms
On 10/20/2014 2:47 PM, Andrey V. Elsukov wrote: On 20.10.2014 20:18, Matthew Grooms wrote: Lastly, I tried to locate a relevant PR but didn't find anything concrete. Is this related to the issue? And if so, can it be MFCd? https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=110959 Did you try t

Re: Broken IPsec + enc +pf/ipfw

2014-10-20 Thread Andrey V. Elsukov
On 20.10.2014 20:18, Matthew Grooms wrote: > Lastly, I tried to locate a relevant PR but didn't find anything > concrete. Is this related to the issue? And if so, can it be MFCd? > > https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=110959 Did you try the patch from last PR? It is small and shoul

Re: Broken IPsec + enc +pf/ipfw

2014-10-20 Thread Mark Felder
On Mon, Oct 20, 2014, at 11:18, Matthew Grooms wrote: > All, > > There appears to be an issue with FreeBSD 10.x when using enc device to > filter inbound traffic on the receive path. After searching the mailing > lists, I see two different people reporting the issue ... > Your subject mentio

Broken IPsec + enc +pf/ipfw

2014-10-20 Thread Matthew Grooms
All, There appears to be an issue with FreeBSD 10.x when using enc device to filter inbound traffic on the receive path. After searching the mailing lists, I see two different people reporting the issue ... https://lists.freebsd.org/pipermail/freebsd-stable/2014-January/076900.html https://l