[Bug 262718] [patch] ipsec.conf failing at boot time

From: <bugzilla-noreply_at_freebsd.org>
Date: Tue, 22 Mar 2022 14:37:00 UTC

            Bug ID: 262718
           Summary: [patch] ipsec.conf failing at boot time
           Product: Base System
           Version: 13.1-RELEASE
          Hardware: amd64
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: misc
          Assignee: bugs@FreeBSD.org
          Reporter: dinoex@FreeBSD.org

Created attachment 232630
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=232630&action=edit
Suggested patch

I run BGP with md5 passwords, using setkey and ipsec.conf.
With FreeBSD-13 this configuration fail to work.

from logfile:
kernel: Feeding entropy: .
kernel: Installing ipsec manual keys/policies.
kernel: The result of line 1: Invalid argument.
kernel: The result of line 2: Invalid argument.
kernel: The result of line 3: Invalid argument.
kernel: The result of line 4: Invalid argument.
kernel: Loading kernel modules:

add 185.XXX.XXX.15 185.XXX.XXX.130 tcp 0x1000 -A tcp-md5 "password";
add 185.XXX.XXX.130 185.XXX.XXX.15 tcp 0x1000 -A tcp-md5 "password";
add 185.XXX.XXX.15 185.XXX.XXX.129 tcp 0x1000 -A tcp-md5 "password";
add 185.XXX.XXX.129 185.XXX.XXX.15 tcp 0x1000 -A tcp-md5 "password";

kld_list="netgraph tcpmd5 ng_ether ng_pppoe ng_socket ng_mppc ng_ppp ng_tee

# service -l | egrep 'ipsec|kld'

Workaround after reboot I run:
# /etc/rc.d/ipsec start

Suggested fix:
Change the Starting order.

Patching /etc/rc.d/ipsec solves the problem:

# rcorder /etc/rc.d/* /usr/local/etc/rc.d/* | egrep 'ipsec|kld'

start ipsec after

You are receiving this mail because:
You are the assignee for the bug.