From nobody@FreeBSD.org  Mon Jan 25 10:38:16 2010
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 769541065670
	for <freebsd-gnats-submit@FreeBSD.org>; Mon, 25 Jan 2010 10:38:16 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21])
	by mx1.freebsd.org (Postfix) with ESMTP id 5A1828FC14
	for <freebsd-gnats-submit@FreeBSD.org>; Mon, 25 Jan 2010 10:38:16 +0000 (UTC)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.14.3/8.14.3) with ESMTP id o0PAcF5v077872
	for <freebsd-gnats-submit@FreeBSD.org>; Mon, 25 Jan 2010 10:38:15 GMT
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.14.3/8.14.3/Submit) id o0PAcFUm077853;
	Mon, 25 Jan 2010 10:38:15 GMT
	(envelope-from nobody)
Message-Id: <201001251038.o0PAcFUm077853@www.freebsd.org>
Date: Mon, 25 Jan 2010 10:38:15 GMT
From: Alexey <vodvorezlaya@i.ua>
To: freebsd-gnats-submit@FreeBSD.org
Subject: IPSec over gif interface
X-Send-Pr-Version: www-3.1
X-GNATS-Notify:

>Number:         143208
>Category:       kern
>Synopsis:       [ipsec] [gif] IPSec over gif interface not working
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    ae
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Jan 25 10:40:06 UTC 2010
>Closed-Date:    
>Last-Modified:  Fri Apr 04 09:45:48 UTC 2014
>Originator:     Alexey
>Release:        8.0
>Organization:
home
>Environment:
FreeBSD freebsd01.internal.corp 8.0-RELEASE FreeBSD 8.0-RELEASE #4: Wed Jan 20 19:20:35 UTC 2010     root@freebsd01.internal.corp:/usr/obj/usr/src/sys/ROUTER  i386
>Description:
There is a simple network with two gateways, each gateway one interface
connected to the Internet (em1 interfaces) to a local area network (em0
interfaces).

FreeBSD01:
Code:

freebsd01# ifconfig 
em0: inet 192.168.192.151 netmask 0xffffff00 broadcast 192.168.192.255
em1: inet 10.0.0.1 netmask 0xff000000 broadcast 10.255.255.255
lo0: inet 127.0.0.1 netmask 0xff000000
gif0: tunnel inet 10.0.0.1 -> 10.10.10.1
       inet 192.168.192.151 -> 192.168.194.1 netmask 0xffffffff

Code:

freebsd02# ifconfig
em0: inet 192.168.194.1 netmask 0xffffff00 broadcast 192.168.194.255
em1: inet 10.10.10.1 netmask 0xff000000 broadcast 10.255.255.255
lo0: inet 127.0.0.1 netmask 0xff000000
gif0: tunnel inet 10.10.10.1 -> 10.0.0.1
      inet 192.168.194.1 -> 192.168.192.151 netmask 0xffffffff

Installed tunnel (gif0) between two external interfaces.
Installed and configured racoon, properly configured IPSec.

When I run on freebsd01 command:
ping -S 192.168.192.151 192.168.194.1

in another terminal at
Code:

freebsd01 # tcpdump-pni gif0
IP192.168.192.151> 192.168.194.1: ICMP echo request, id 50693, seq 14, length 64
IP 10.10.10.1> 10.0.0.1: IP 192.168.194.1> 192.168.192.151: ICMP echo reply, id 50693, seq 14, length 64 (ipip-proto-4)

At
Code:

freebsd02 # tcpdump-pni gif0
IP 10.0.0.1> 10.10.10.1: IP 192.168.192.151> 192.168.194.1: ICMP echo request, id 50693, seq 150, length 64 (ipip-proto-4)
IP 192.168.194.1> 192.168.192.151: ICMP echo reply, id 50693, seq 150, length 64

Incoming packets are not encapsulated in strange ways.
If disable IPSec example command setkey -PFall works well.

If you disable IPSec for example the command setkey -PF all works well.

That is not in freebsd 6, but it appeared to freebsd 7 and 8 versions.
Perhaps there is a solution?



RUSSIAN:

    (em0)    (em1)    (freebsd01  02).

:  ӣ &#8226; 

    freebsd01# ifconfig 
    em0: inet 192.168.192.151 netmask 0xffffff00 broadcast 192.168.192.255
    em1: inet 10.0.0.1 netmask 0xff000000 broadcast 10.255.255.255
    lo0: inet 127.0.0.1 netmask 0xff000000
    gif0: tunnel inet 10.0.0.1 -> 10.10.10.1
           inet 192.168.192.151 -> 192.168.194.1 netmask 0xffffffff



:  ӣ &#8226; 

    freebsd02# ifconfig
    em0: inet 192.168.194.1 netmask 0xffffff00 broadcast 192.168.194.255
    em1: inet 10.10.10.1 netmask 0xff000000 broadcast 10.255.255.255
    lo0: inet 127.0.0.1 netmask 0xff000000
    gif0: tunnel inet 10.10.10.1 -> 10.0.0.1
          inet 192.168.194.1 -> 192.168.192.151 netmask 0xffffffff



  gif      ,    racoon,    SPD, ӣ .

          :
freebsd01:

:  ӣ &#8226; 

    ping -S 192.168.192.151 192.168.194.1



  tcpdump -pni gif0,   :

:  ӣ &#8226; 

    freebsd01 # tcpdump-pni gif0
    IP192.168.192.151> 192.168.194.1: ICMP echo request, id 50693, seq 14, length 64
    IP 10.10.10.1> 10.0.0.1: IP 192.168.194.1> 192.168.192.151: ICMP echo reply, id 50693, seq 14, length 64 (ipip-proto-4)



:  ӣ &#8226; 

    freebsd02 # tcpdump-pni gif0
    IP 10.0.0.1> 10.10.10.1: IP 192.168.192.151> 192.168.194.1: ICMP echo request, id 50693, seq 150, length 64 (ipip-proto-4)
    IP 192.168.194.1> 192.168.192.151: ICMP echo reply, id 50693, seq 150, length 64



     ,    .

  IPSec  setkey -PF    -  ӣ  .

    FreeBSD   7- .
 6- ӣ  ,      6-  7- (ping ģ     ).

      ?
  ?

.

P.S.      :

:  ӣ &#8226; 

    freebsd01# netstat -rn
    Routing tables

    Internet:
    Destination        Gateway            Flags    Refs      Use  Netif Expire
    default            192.168.192.1      UGS         0        0    em0
    10.0.0.0/8         link#2             U           1       91    em1
    10.0.0.1           link#2             UHS         0        0    lo0
    127.0.0.1          link#3             UH          0       26    lo0
    192.168.192.0/24   link#1             U           2      245    em0
    192.168.192.151    link#1             UHS         0        0    lo0
    192.168.194.0/24   192.168.194.1      UGS         0        0   gif0
    192.168.194.1      link#4             UH          0       27   gif0



:  ӣ &#8226; 

    freebsd02# netstat -rn
    Routing tables

    Internet:
    Destination        Gateway            Flags    Refs      Use  Netif Expire
    10.0.0.0/8         link#2             U           1      690    em1
    10.10.10.1         link#2             UHS         0        0    lo0
    127.0.0.1          link#3             UH          0        0    lo0
    192.168.192.0/24   192.168.192.151    UGS         0      225   gif0
    192.168.192.151    link#4             UH          0       12   gif0
    192.168.194.0/24   link#1             U           0        0    em0
    192.168.194.1      link#1             UHS         0        0    lo0



>How-To-Repeat:
Create gif interface, configure IPSec. 
Run tcpdump -pni gif0 on both gateways.
Run ping.
>Fix:


>Release-Note:
>Audit-Trail:

From: "Bjoern A. Zeeb" <bz@FreeBSD.org>
To: Alexey <vodvorezlaya@i.ua>
Cc: bug-followup@FreeBSD.org
Subject: Re: misc/143208: IPSec over gif interface
Date: Mon, 25 Jan 2010 10:55:09 +0000 (UTC)

 On Mon, 25 Jan 2010, Alexey wrote:
 
 Is this a potential duplicate of kern/122065 and kern/121642, ..?
 
 
 -- 
 Bjoern A. Zeeb         It will not break if you know what you are doing.
Responsible-Changed-From-To: freebsd-bugs->freebsd-net 
Responsible-Changed-By: linimon 
Responsible-Changed-When: Mon Jan 25 16:36:05 UTC 2010 
Responsible-Changed-Why:  
Over to maintainer(s). 

Note: potential duplicate of kern/122065 and kern/121642. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=143208 

Date: Mon, 25 Jan 2010 19:56:19 +0200
From: =?utf-8?B?0JDQu9C10LrRgdC10Lkg0K7RgNGM0LXQstC40Yc=?= <vodvorezlaya@i.ua>
To: "Bjoern A. Zeeb" <bz@FreeBSD.org>
Subject: =?utf-8?B?UmVbMl06IG1pc2MvMTQzMjA4OiBJUFNlYyBvdmVyIGdpZiBpbnRlcmZhY2U=?=

 > On Mon, 25 Jan 2010, Alexey wrote:
 > Is this a potential duplicate of kern/122065 and kern/121642, ..?
 
 Yes, seems at  kern/121642,  on FreeBSD 8.0 is still present .
 I use a gif interface for dynamic routing.
 I understood correctly, the problem appears only in tunnel mode, and no sol=
 utions?
 
 -- =D1=80=D0=B5=D0=BA=D0=BB=D0=B0=D0=BC=D0=B0 -----------------------------=
 ------------------------------
 =D0=93=D0=BB=D1=83=D0=B7=D0=B1=D0=B5=D0=B7=D0=B4=D0=B8=D0=B9...=D1=82=D0=BE=
 =D0=B1=D1=82=D0=BE =D0=B1=D0=B5=D0=B7=D0=B3=D0=BB=D1=83=D0=B7=D0=B4=D0=B8=
 =D0=B9 =D1=80=D0=BE=D0=B7=D0=BF=D1=80=D0=BE=D0=B4=D0=B0=D0=B6 =D0=B2 Comfy =
 =D0=B4=D0=BE 31/01 =D0=B7=D0=BD=D0=B8=D0=B6=D0=BA=D0=B8 =D0=B4=D0=BE 30%
 http://comfy.com.ua/?/actions/15
Responsible-Changed-From-To: freebsd-net->ae 
Responsible-Changed-By: ae 
Responsible-Changed-When: Fri Apr 4 09:45:33 UTC 2014 
Responsible-Changed-Why:  
Take it. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=143208 
>Unformatted:
