From nobody@FreeBSD.org Mon Jan 25 10:38:16 2010 Return-Path: Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 769541065670 for ; Mon, 25 Jan 2010 10:38:16 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21]) by mx1.freebsd.org (Postfix) with ESMTP id 5A1828FC14 for ; Mon, 25 Jan 2010 10:38:16 +0000 (UTC) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.14.3/8.14.3) with ESMTP id o0PAcF5v077872 for ; Mon, 25 Jan 2010 10:38:15 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.14.3/8.14.3/Submit) id o0PAcFUm077853; Mon, 25 Jan 2010 10:38:15 GMT (envelope-from nobody) Message-Id: <201001251038.o0PAcFUm077853@www.freebsd.org> Date: Mon, 25 Jan 2010 10:38:15 GMT From: Alexey To: freebsd-gnats-submit@FreeBSD.org Subject: IPSec over gif interface X-Send-Pr-Version: www-3.1 X-GNATS-Notify: >Number: 143208 >Category: kern >Synopsis: [ipsec] [gif] IPSec over gif interface not working >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-net >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Mon Jan 25 10:40:06 UTC 2010 >Closed-Date: >Last-Modified: Tue Jan 26 05:10:51 UTC 2010 >Originator: Alexey >Release: 8.0 >Organization: home >Environment: FreeBSD freebsd01.internal.corp 8.0-RELEASE FreeBSD 8.0-RELEASE #4: Wed Jan 20 19:20:35 UTC 2010 root@freebsd01.internal.corp:/usr/obj/usr/src/sys/ROUTER i386 >Description: There is a simple network with two gateways, each gateway one interface connected to the Internet (em1 interfaces) to a local area network (em0 interfaces). FreeBSD01: Code: freebsd01# ifconfig em0: inet 192.168.192.151 netmask 0xffffff00 broadcast 192.168.192.255 em1: inet 10.0.0.1 netmask 0xff000000 broadcast 10.255.255.255 lo0: inet 127.0.0.1 netmask 0xff000000 gif0: tunnel inet 10.0.0.1 -> 10.10.10.1 inet 192.168.192.151 -> 192.168.194.1 netmask 0xffffffff Code: freebsd02# ifconfig em0: inet 192.168.194.1 netmask 0xffffff00 broadcast 192.168.194.255 em1: inet 10.10.10.1 netmask 0xff000000 broadcast 10.255.255.255 lo0: inet 127.0.0.1 netmask 0xff000000 gif0: tunnel inet 10.10.10.1 -> 10.0.0.1 inet 192.168.194.1 -> 192.168.192.151 netmask 0xffffffff Installed tunnel (gif0) between two external interfaces. Installed and configured racoon, properly configured IPSec. When I run on freebsd01 command: ping -S 192.168.192.151 192.168.194.1 in another terminal at Code: freebsd01 # tcpdump-pni gif0 IP192.168.192.151> 192.168.194.1: ICMP echo request, id 50693, seq 14, length 64 IP 10.10.10.1> 10.0.0.1: IP 192.168.194.1> 192.168.192.151: ICMP echo reply, id 50693, seq 14, length 64 (ipip-proto-4) At Code: freebsd02 # tcpdump-pni gif0 IP 10.0.0.1> 10.10.10.1: IP 192.168.192.151> 192.168.194.1: ICMP echo request, id 50693, seq 150, length 64 (ipip-proto-4) IP 192.168.194.1> 192.168.192.151: ICMP echo reply, id 50693, seq 150, length 64 Incoming packets are not encapsulated in strange ways. If disable IPSec example command setkey -PFall works well. If you disable IPSec for example the command setkey -PF all works well. That is not in freebsd 6, but it appeared to freebsd 7 and 8 versions. Perhaps there is a solution? RUSSIAN: Имеется две корпоративные сети (em0) связанные через интернет (em1) через два шлюза (freebsd01 и 02). Код: Выделить всё • Развернуть freebsd01# ifconfig em0: inet 192.168.192.151 netmask 0xffffff00 broadcast 192.168.192.255 em1: inet 10.0.0.1 netmask 0xff000000 broadcast 10.255.255.255 lo0: inet 127.0.0.1 netmask 0xff000000 gif0: tunnel inet 10.0.0.1 -> 10.10.10.1 inet 192.168.192.151 -> 192.168.194.1 netmask 0xffffffff Код: Выделить всё • Развернуть freebsd02# ifconfig em0: inet 192.168.194.1 netmask 0xffffff00 broadcast 192.168.194.255 em1: inet 10.10.10.1 netmask 0xff000000 broadcast 10.255.255.255 lo0: inet 127.0.0.1 netmask 0xff000000 gif0: tunnel inet 10.10.10.1 -> 10.0.0.1 inet 192.168.194.1 -> 192.168.192.151 netmask 0xffffffff Соответственно установлен gif туннель во внутренние сети через внешние, установлен и настроен racoon, правильно забита база SPD, всё работает. Но вот когда на одном шлюзов пингуешь внутреннюю сеть другого шлюза: freebsd01: Код: Выделить всё • Развернуть ping -S 192.168.192.151 192.168.194.1 И делаем tcpdump -pni gif0, то получаем следующее: Код: Выделить всё • Развернуть freebsd01 # tcpdump-pni gif0 IP192.168.192.151> 192.168.194.1: ICMP echo request, id 50693, seq 14, length 64 IP 10.10.10.1> 10.0.0.1: IP 192.168.194.1> 192.168.192.151: ICMP echo reply, id 50693, seq 14, length 64 (ipip-proto-4) Код: Выделить всё • Развернуть freebsd02 # tcpdump-pni gif0 IP 10.0.0.1> 10.10.10.1: IP 192.168.192.151> 192.168.194.1: ICMP echo request, id 50693, seq 150, length 64 (ipip-proto-4) IP 192.168.194.1> 192.168.192.151: ICMP echo reply, id 50693, seq 150, length 64 Оказывается всегда входящие пакеты появляются инкапсулированными, на обоих шлюзах симметрично. Если отключить IPSec командой setkey -PF на обоих шлюзах - то всё ходит красиво. Этот бок проявляется в FreeBSD начиная с 7-й версии. В 6-й всё работает отлично, но это не позволяет связать 6-ю и 7-ю версии(ping идёт а больше ничего не работает). Возможно кто либо сталкивался с подобной ситуацией? Есть ли решение? Спасибо. P.S. На всякий случай приведу таблици маршрутизации: Код: Выделить всё • Развернуть freebsd01# netstat -rn Routing tables Internet: Destination Gateway Flags Refs Use Netif Expire default 192.168.192.1 UGS 0 0 em0 10.0.0.0/8 link#2 U 1 91 em1 10.0.0.1 link#2 UHS 0 0 lo0 127.0.0.1 link#3 UH 0 26 lo0 192.168.192.0/24 link#1 U 2 245 em0 192.168.192.151 link#1 UHS 0 0 lo0 192.168.194.0/24 192.168.194.1 UGS 0 0 gif0 192.168.194.1 link#4 UH 0 27 gif0 Код: Выделить всё • Развернуть freebsd02# netstat -rn Routing tables Internet: Destination Gateway Flags Refs Use Netif Expire 10.0.0.0/8 link#2 U 1 690 em1 10.10.10.1 link#2 UHS 0 0 lo0 127.0.0.1 link#3 UH 0 0 lo0 192.168.192.0/24 192.168.192.151 UGS 0 225 gif0 192.168.192.151 link#4 UH 0 12 gif0 192.168.194.0/24 link#1 U 0 0 em0 192.168.194.1 link#1 UHS 0 0 lo0 >How-To-Repeat: Create gif interface, configure IPSec. Run tcpdump -pni gif0 on both gateways. Run ping. >Fix: >Release-Note: >Audit-Trail: From: "Bjoern A. Zeeb" To: Alexey Cc: bug-followup@FreeBSD.org Subject: Re: misc/143208: IPSec over gif interface Date: Mon, 25 Jan 2010 10:55:09 +0000 (UTC) On Mon, 25 Jan 2010, Alexey wrote: Is this a potential duplicate of kern/122065 and kern/121642, ..? -- Bjoern A. Zeeb It will not break if you know what you are doing. Responsible-Changed-From-To: freebsd-bugs->freebsd-net Responsible-Changed-By: linimon Responsible-Changed-When: Mon Jan 25 16:36:05 UTC 2010 Responsible-Changed-Why: Over to maintainer(s). Note: potential duplicate of kern/122065 and kern/121642. http://www.freebsd.org/cgi/query-pr.cgi?pr=143208 Date: Mon, 25 Jan 2010 19:56:19 +0200 From: =?utf-8?B?0JDQu9C10LrRgdC10Lkg0K7RgNGM0LXQstC40Yc=?= To: "Bjoern A. Zeeb" Subject: =?utf-8?B?UmVbMl06IG1pc2MvMTQzMjA4OiBJUFNlYyBvdmVyIGdpZiBpbnRlcmZhY2U=?= > On Mon, 25 Jan 2010, Alexey wrote: > Is this a potential duplicate of kern/122065 and kern/121642, ..? Yes, seems at kern/121642, on FreeBSD 8.0 is still present . I use a gif interface for dynamic routing. I understood correctly, the problem appears only in tunnel mode, and no sol= utions? -- =D1=80=D0=B5=D0=BA=D0=BB=D0=B0=D0=BC=D0=B0 -----------------------------= ------------------------------ =D0=93=D0=BB=D1=83=D0=B7=D0=B1=D0=B5=D0=B7=D0=B4=D0=B8=D0=B9...=D1=82=D0=BE= =D0=B1=D1=82=D0=BE =D0=B1=D0=B5=D0=B7=D0=B3=D0=BB=D1=83=D0=B7=D0=B4=D0=B8= =D0=B9 =D1=80=D0=BE=D0=B7=D0=BF=D1=80=D0=BE=D0=B4=D0=B0=D0=B6 =D0=B2 Comfy = =D0=B4=D0=BE 31/01 =D0=B7=D0=BD=D0=B8=D0=B6=D0=BA=D0=B8 =D0=B4=D0=BE 30% http://comfy.com.ua/?/actions/15 >Unformatted: