Re: Broken IPsec + enc +pf/ipfw

2014-10-23 Thread Andrey V. Elsukov
On 22.10.2014 23:28, Matthew Grooms wrote: On 10/21/2014 1:39 PM, Kyle Williams wrote: On Tue Oct 21 11:35:15 2014, Matthew Grooms wrote: Hey Kyle, Thanks for lending a hand. I tested a few myself last night but had no luck. This morning I received an email off list that pointed to a patch

Re: Broken IPsec + enc +pf/ipfw

2014-10-23 Thread Matthew Grooms
On 10/23/2014 5:56 AM, Andrey V. Elsukov wrote: On 22.10.2014 23:28, Matthew Grooms wrote: On 10/21/2014 1:39 PM, Kyle Williams wrote: On Tue Oct 21 11:35:15 2014, Matthew Grooms wrote: Hey Kyle, Thanks for lending a hand. I tested a few myself last night but had no luck. This morning I

Re: Broken IPsec + enc +pf/ipfw

2014-10-22 Thread Matthew Grooms
On 10/21/2014 1:39 PM, Kyle Williams wrote: On Tue Oct 21 11:35:15 2014, Matthew Grooms wrote: Hey Kyle, Thanks for lending a hand. I tested a few myself last night but had no luck. This morning I received an email off list that pointed to a patch that was merged to 10 stable. It sounds

Re: Broken IPsec + enc +pf/ipfw

2014-10-22 Thread Ermal Luçi
On Wed, Oct 22, 2014 at 9:28 PM, Matthew Grooms mgro...@shrew.net wrote: On 10/21/2014 1:39 PM, Kyle Williams wrote: On Tue Oct 21 11:35:15 2014, Matthew Grooms wrote: Hey Kyle, Thanks for lending a hand. I tested a few myself last night but had no luck. This morning I received an email

Re: Broken IPsec + enc +pf/ipfw

2014-10-21 Thread Matthew Grooms
On 10/21/2014 11:06 AM, Kyle Williams wrote: Hello, I'm currently using 10.0, IPSEC, racoon, enc, and pf between two remote hosts without NATT. The gif tunnel is ipv4 only, host A is ipv4 only, host B is ipv4/ipv6. I use IPSEC to route traffic between jails on both hosts, with the jails using

Re: Broken IPsec + enc +pf/ipfw

2014-10-21 Thread Kyle Williams
On Tue Oct 21 11:35:15 2014, Matthew Grooms wrote: Hey Kyle, Thanks for lending a hand. I tested a few myself last night but had no luck. This morning I received an email off list that pointed to a patch that was merged to 10 stable. It sounds promising ... Log: Merge r263091: fix mbuf

Broken IPsec + enc +pf/ipfw

2014-10-20 Thread Matthew Grooms
All, There appears to be an issue with FreeBSD 10.x when using enc device to filter inbound traffic on the receive path. After searching the mailing lists, I see two different people reporting the issue ... https://lists.freebsd.org/pipermail/freebsd-stable/2014-January/076900.html

Re: Broken IPsec + enc +pf/ipfw

2014-10-20 Thread Mark Felder
On Mon, Oct 20, 2014, at 11:18, Matthew Grooms wrote: All, There appears to be an issue with FreeBSD 10.x when using enc device to filter inbound traffic on the receive path. After searching the mailing lists, I see two different people reporting the issue ... Your subject mentions

Re: Broken IPsec + enc +pf/ipfw

2014-10-20 Thread Andrey V. Elsukov
On 20.10.2014 20:18, Matthew Grooms wrote: Lastly, I tried to locate a relevant PR but didn't find anything concrete. Is this related to the issue? And if so, can it be MFCd? https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=110959 Did you try the patch from last PR? It is small and should

Re: Broken IPsec + enc +pf/ipfw

2014-10-20 Thread Matthew Grooms
On 10/20/2014 2:47 PM, Andrey V. Elsukov wrote: On 20.10.2014 20:18, Matthew Grooms wrote: Lastly, I tried to locate a relevant PR but didn't find anything concrete. Is this related to the issue? And if so, can it be MFCd? https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=110959 Did you try

Re: Broken IPsec + enc +pf/ipfw

2014-10-20 Thread Matthew Grooms
On 10/20/2014 2:44 PM, Mark Felder wrote: On Mon, Oct 20, 2014, at 11:18, Matthew Grooms wrote: All, There appears to be an issue with FreeBSD 10.x when using enc device to filter inbound traffic on the receive path. After searching the mailing lists, I see two different people reporting the

Re: Broken IPsec + enc +pf/ipfw

2014-10-20 Thread Andrey V. Elsukov
On 21.10.2014 00:00, Matthew Grooms wrote: On 10/20/2014 2:47 PM, Andrey V. Elsukov wrote: On 20.10.2014 20:18, Matthew Grooms wrote: Lastly, I tried to locate a relevant PR but didn't find anything concrete. Is this related to the issue? And if so, can it be MFCd?

Re: Broken IPsec + enc +pf/ipfw

2014-10-20 Thread Matthew Grooms
On 10/20/2014 3:50 PM, Andrey V. Elsukov wrote: On 21.10.2014 00:00, Matthew Grooms wrote: On 10/20/2014 2:47 PM, Andrey V. Elsukov wrote: On 20.10.2014 20:18, Matthew Grooms wrote: Lastly, I tried to locate a relevant PR but didn't find anything concrete. Is this related to the issue? And if