My system FreeBSD 10.1-PRERELEASE (system1).
I have tunnel to FreeBSD 9.3-STABLE r270954 (gif1) (system2)
and to Gentoo Linux, Kernel 3.16 and 3.17, ipsec-tools 0.8.2 (gif2) (system3).
Both encrypted by IPSEC.
I check worked revision r273453 and check broken revision r273960.
Tunnel (gif1) to FreeBSD 9.3-STABLE work with r273453 and r273960.
Tunnel (gif2) to Gentoo Linux, Kernel 3.16 and 3.17 work with r273453 and broken with r273960.
Not work connection to gateway services and ping from FreeBSD (system1) to Linux (system3). Connection and ping from FreeBSD (sytem1) LAN work fine.
Ping from Linux (system3) to FreeBSD (system1) work.
A commit references this bug:
Date: Wed Nov 5 09:23:31 UTC 2014
New revision: 274132
MFC r266800 by vanhu:
IPv4-in-IPv6 and IPv6-in-IPv4 IPsec tunnels.
For IPv6-in-IPv4, you may need to do the following command
on the tunnel interface if it is configured as IPv4 only:
ifconfig <interface> inet6 -ifdisabled
Code logic inspired from NetBSD.
MC r266822 by bz:
Use IPv4 statistics in ipsec4_process_packet() rather than the IPv6
version. This also unbreaks the NOINET6 builds after r266800.
MFC r268083 by zec:
The assumption in ipsec4_process_packet() that the payload may be
only IPv4 is wrong, so check the IP version before mangling the
Do not strip outer header when operating in transport mode.
Instead requeue mbuf back to IPv4 protocol handler. If there is one extra IP-IP
encapsulation, it will be handled with tunneling interface. And thus proper
interface will be exposed into mbuf's rcvif. Also, tcpdump that listens on tunneling
interface will see packets in both directions.