Solaris 10 x86 Panic using IPSEC with IP Filter 4.1.5

IP in IP tunnels protected by transport mode IPSEC work using
Solaris 9 and IP Filter 4.1.3 (plus various patches which have
since been folded into 4.1.5).

Under Solaris 10 with IP Filter 4.1.5 (we removed SUNWipfu and
SUNWipfr since they're too old to support our application) the
system panics when traffic transverses the tunnel.

The panic only seems to occur when IPSEC is enabled and the
system goes to send a packet out the tunnel ... it does not
occur when traffic transverses the tunnel if IPSEC is disabled.

It's as if the IPSEC code is expecting to be handed message
blocks in a certain fashion which pfil isn't respecting (i.e.
extra space in the data block for IPSEC to use without having
to reallocate things).

ifconfig e1000g0 modlist ifconfig ip.tun0 modlist

0 arp 0 ip
1 ip 1 pfil
2 pfil 2 tun
3 e1000g 3 ip

Running snoop on the machine results in complaints about:

bad packet header in buffer off 188 length = 0

and

RUNT (short packet - 2 bytes)

prior to each crash.

The stack from one crash is:

... possibly more lines which scrolled off the screen ...
ip:ipsec_out_process+322
ip:ip_wput_ire+18d0
ip:ip_output+70a
ip:ip_wput+14
unix:putnext+1b7
tun:tun_wputnext_v4+1f8
tun:tun_wproc_mdata+71
tun:tun_wproc+df
tun:tun_ppa_list+25231e7c
unix:putnext+1b7
pfil:pfilmodwput+1df
unix:putnext+1b7
ip:ip_wput_ire+17d1
ip:ip_output+70a
ip:tcp_send_data+5f9
ip:tcp_ack_timer+b0
ip:tcp_timer_handler+1d
ip:squeue_drain+bb
ip:squeue_worker+eb

other crashes look like:

freemsg+0x69
e1000g_start+0x362
e1000gwsrv+0x59
runservice+0x2a
queue_service+0x30
stream_service+0x69
taskq_d_thread+0x8a

Any suggestions on what to do next?

-- John
-------------------------------------------------------------------------
| Feith Systems | Voice: 1-215-646-8000 | Email: john@feith.com |
| John Wehle | Fax: 1-215-540-5495 | |
-------------------------------------------------------------------------