NetBSD Problem Report #27084
Received: (qmail 18545 invoked by uid 605); 30 Sep 2004 00:45:32 -0000
Message-Id: <20040930004524.4815.qmail@g.primenet.com.au>
Date: 30 Sep 2004 10:45:24 +1000
From: gcw@primenet.com.au
Sender: gnats-bugs-owner@NetBSD.org
Reply-To: gcw@primenet.com.au
To: gnats-bugs@gnats.NetBSD.org
Subject: ipsec_proxy broken again - indirectly by other IP changes
X-Send-Pr-Version: 3.95
>Number: 27084
>Category: kern
>Synopsis: IPF: ipsec_proxy functionality was broken by other IP changes
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: ipf-bug-people
>State: open
>Class: sw-bug
>Submitter-Id: net
>Arrival-Date: Thu Sep 30 00:46:01 +0000 2004
>Closed-Date:
>Last-Modified: Sun Feb 25 17:56:07 +0000 2018
>Originator: Geoff C. Wing
>Release: NetBSD 2.0H
>Organization:
>Environment:
System: NetBSD g.primenet.com.au 2.0H NetBSD 2.0H (G) #0: Tue Sep 28 17:40:08 EST 2004 gcw@g.primenet.com.au:/usr/netbsd/src/sys/arch/i386/compile/G i386
Architecture: i386
Machine: i386
>Description:
Sometime late August or early September, changes to IP or UDP code
broke the IPSEC proxy. ipnat lists:
MAP 192.168.1.5 500 <- -> 203.51.166.96 500 [203.43.15.55 500]
proxy ipsec/17 use 1 flags 0
proto 17 flags 0 bytes 1044 pkts 4 data YES size 328
IPSec Proxy:
ICookie 335d631f180abf04 RCookie 0000000000000000 (Not set)
>How-To-Repeat:
e.g. set up an IPNAT rule(1) on a gateway machine and try to set up
an MSWin L2TP connection over it.
(1) map pppoe0 192.168.1.0/24 -> 0/32 proxy port isakmp ipsec/udp
>Fix:
?
>Release-Note:
>Audit-Trail:
From: Geoff Wing <gcw@pobox.com>
To: NetBSD GNATS <gnats-bugs@netbsd.org>
Cc:
Subject: Re: kern/27084: ipsec_proxy broken again - indirectly by other IP changes
Date: Sat, 12 Feb 2005 16:40:57 +1100
Bug may be closed.
Now working with IPF 4.1.5
From: Geoff Wing <gcw@pobox.com>
To: NetBSD GNATS <gnats-bugs@netbsd.org>
Cc:
Subject: Re: kern/27084: ipsec_proxy broken again - indirectly by other IP changes
Date: Wed, 13 Apr 2005 09:13:58 +1000
As of early April 2005:
I was wrong about this bug being gone. It disappeared when ip_fil_netbsd.c
in src/sys/dist/ipf/netinet was being miscompiled due to typos in define names
but reappeared when being properly compiled.
If the m_makewritable() section in fr_check_wrapper() is #if 0'd out then
it works. My scan of m_makewritable() didn't see any problems. Maybe there's
an interaction problem that's obvious to someone else.
Regards,
Geoff
State-Changed-From-To: open->feedback
State-Changed-By: dholland@NetBSD.org
State-Changed-When: Sat, 25 Jul 2009 06:22:58 +0000
State-Changed-Why:
Is this still a problem in recent releases?
From: Geoff Wing <gcw@pobox.com>
To: gnats-bugs@NetBSD.org
Cc:
Subject: Re: kern/27084 (ipsec_proxy functionality was broken by other IP
changes)
Date: Wed, 5 Aug 2009 15:37:39 +1000
It may take me a couple of weeks or more to set up a machine to test this.
It wouldn't have been a complicated setup. I believe the old situation I
had been using off and on was:
Win2K Client -> NetBSD -> ... internet ... -> Win2K Server
private IP -> NAT -> -> public IP
Responsible-Changed-From-To: kern-bug-people->ipf-bug-people
Responsible-Changed-By: dholland@NetBSD.org
Responsible-Changed-When: Mon, 23 Dec 2013 22:53:45 +0000
Responsible-Changed-Why:
ipf-related problem
State-Changed-From-To: feedback->open
State-Changed-By: dholland@NetBSD.org
State-Changed-When: Mon, 23 Dec 2013 22:53:45 +0000
State-Changed-Why:
feedback timeout (>4 years)
>Unformatted:
(Contact us)
$NetBSD: query-full-pr,v 1.43 2018/01/16 07:36:43 maya Exp $
$NetBSD: gnats_config.sh,v 1.9 2014/08/02 14:16:04 spz Exp $
Copyright © 1994-2017
The NetBSD Foundation, Inc. ALL RIGHTS RESERVED.