bin/126468: some ipsec configurations make FreeBSD panic
Eugene M. Zheganin
emz at norma.perm.ru
Tue Aug 12 05:20:01 UTC 2008
>Number: 126468
>Category: bin
>Synopsis: some ipsec configurations make FreeBSD panic
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Tue Aug 12 05:20:01 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator: Eugene M. Zheganin
>Release: 7.0-RELEASE-p3
>Organization:
Norma JSC.
>Environment:
FreeBSD izh.norma.com. 7.0-RELEASE-p3 FreeBSD 7.0-RELEASE-p3 #5: Mon Aug 11 18:41:13 YEKST 2008 emz at ravenholm.hq.norma.perm.ru:/usr/obj/usr/src/sys/IZH i386
>Description:
The ipsec.conf below makes FreeBSD panic immidiately after setkey -f ipsec.conf.
This ipsec.conf was reported to be working on 6.2-RELEASE and on all releases since 4.7-RELEASE. Problem appeared after an upgrade to 7.0-RELEASE.
The problem is repeatable on 2 FreeBSD machines, one of those machines is running a clean install of FreeBSD 7.0-RELEASE-p3.
The file is also available at http://zhegan.in/unix/ipsec.conf .
===Cut===
flush;
spdflush;
spdadd 212.33.248.82 212.33.248.81 ipencap -P out ipsec esp/tunnel/212.33.248.82-212.33.248.81/require ah/transport/212.33.248.82-212.33.248.81/require;
spdadd 212.33.248.81 212.33.248.82 ipencap -P in ipsec esp/tunnel/212.33.248.81-212.33.248.82/require ah/transport/212.33.248.81-212.33.248.82/require;
spdadd 192.168.251.5 192.168.251.2 ipencap -P out ipsec esp/tunnel/192.168.251.5-192.168.251.2/require ah/transport/192.168.251.5-192.168.251.2/require;
spdadd 192.168.251.2 192.168.251.5 ipencap -P in ipsec esp/tunnel/192.168.251.2-192.168.251.5/require ah/transport/192.168.251.2-192.168.251.5/require;
add 212.33.248.81 212.33.248.82 esp 0x10007 -m tunnel -E 3des-cbc "Somepeoplesaymylovecanno" -A hmac-md5 "Pleasebelievemem";
add 212.33.248.81 212.33.248.82 ah 0x10008 -m transport -A keyed-md5 "Yourloveformehas";
add 212.33.248.82 212.33.248.81 esp 0x10005 -m tunnel -E 3des-cbc "ButnowIvegottoknowyatell" -A hmac-md5 "TellmewhoamItobl";
add 212.33.248.82 212.33.248.81 ah 0x10006 -m transport -A keyed-md5 "Iwasbornwithouty";
add 192.168.251.5 192.168.251.2 esp 0x10052 -m tunnel -E 3des-cbc "DrutfomgooxkeabTevutOcks" -A hmac-md5 "onghojdiodhovtev";
add 192.168.251.5 192.168.251.2 ah 0x10053 -m transport -A keyed-md5 "saidIltUxOpZeeld";
add 192.168.251.2 192.168.251.5 esp 0x10054 -m tunnel -E 3des-cbc "DrutfomgooxkeabTevutOcks" -A hmac-md5 "MesbemusnEbMifAv";
add 192.168.251.2 192.168.251.5 ah 0x10055 -m transport -A keyed-md5 "toojijbishriRiwi";
===Cut===
>How-To-Repeat:
Get a FreeBSD, get an IPSEC-enabled kernel. Try to setkey -f <file> with a proposed configuration inside the <file>.
>Fix:
>Release-Note:
>Audit-Trail:
>Unformatted:
More information about the freebsd-bugs
mailing list