Subject: IPsec packets tagged for life?
To: None <email@example.com>
From: Quentin Garnier <firstname.lastname@example.org>
Date: 12/12/2005 17:34:19
Content-Type: text/plain; charset=us-ascii
I've just switched an IPsec tunnel setup to an IPsec-protected gif
tunnel, and I was surprised that I still could not filter decapsulated
packets. I was expecting to be able to use IPF for the decapsulated
gif packets, but apparently this is not possible (ipfstat shows that no
packets match the 'in' rules for the gif interface).
AFAICT, the ESP tag is not cleared when the packet is passed to the gif
layer, therefore it is still there when it is decapsulated, and the
pfil_hook in ip_input doesn't happen.
Should this be considered a bug? While I'm using netbsd-2-0, I don't
think it was changed/fixed meanwhile.
In any case, considering outbound packets go through IPF twice (before
they are encapsulated by gif, and after they are encapsulated by IPsec)
there is a dyssymetry that should be fixed one way or another.
Quentin Garnier - email@example.com - cube@NetBSD.org
"When I find the controls, I'll go where I like, I'll know where I want
to be, but maybe for now I'll stay right here on a silent sea."
KT Tunstall, Silent Sea, Eye to the Telescope, 2004.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (NetBSD)
-----END PGP SIGNATURE-----