bin/126468: some ipsec configurations make FreeBSD panic

[Eugene M. Zheganin]

>Number:         126468
>Category:       bin
>Synopsis:       some ipsec configurations make FreeBSD panic
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Aug 12 05:20:01 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator:     Eugene M. Zheganin
>Release:        7.0-RELEASE-p3
>Organization:
Norma JSC.
>Environment:
FreeBSD izh.norma.com. 7.0-RELEASE-p3 FreeBSD 7.0-RELEASE-p3 #5: Mon Aug 11 18:41:13 YEKST 2008     emz at ravenholm.hq.norma.perm.ru:/usr/obj/usr/src/sys/IZH  i386
>Description:
The ipsec.conf below makes FreeBSD panic immidiately after setkey -f ipsec.conf.
This ipsec.conf was reported to be working on 6.2-RELEASE and on all releases since 4.7-RELEASE. Problem appeared after an upgrade to 7.0-RELEASE.

The problem is repeatable on 2 FreeBSD machines, one of those machines is running a clean install of FreeBSD 7.0-RELEASE-p3.

The file is also available at http://zhegan.in/unix/ipsec.conf .

===Cut===
flush;
spdflush;

spdadd 212.33.248.82 212.33.248.81 ipencap -P out ipsec esp/tunnel/212.33.248.82-212.33.248.81/require ah/transport/212.33.248.82-212.33.248.81/require;
spdadd 212.33.248.81 212.33.248.82 ipencap -P in  ipsec esp/tunnel/212.33.248.81-212.33.248.82/require ah/transport/212.33.248.81-212.33.248.82/require;
spdadd 192.168.251.5 192.168.251.2 ipencap -P out ipsec esp/tunnel/192.168.251.5-192.168.251.2/require ah/transport/192.168.251.5-192.168.251.2/require;
spdadd 192.168.251.2 192.168.251.5 ipencap -P in  ipsec esp/tunnel/192.168.251.2-192.168.251.5/require ah/transport/192.168.251.2-192.168.251.5/require;

add 212.33.248.81 212.33.248.82 esp 0x10007 -m tunnel -E 3des-cbc "Somepeoplesaymylovecanno" -A hmac-md5 "Pleasebelievemem";
add 212.33.248.81 212.33.248.82 ah 0x10008 -m transport -A keyed-md5 "Yourloveformehas";

add 212.33.248.82 212.33.248.81 esp 0x10005 -m tunnel -E 3des-cbc "ButnowIvegottoknowyatell" -A hmac-md5 "TellmewhoamItobl";
add 212.33.248.82 212.33.248.81 ah 0x10006 -m transport -A keyed-md5 "Iwasbornwithouty";

add 192.168.251.5 192.168.251.2 esp 0x10052 -m tunnel -E 3des-cbc "DrutfomgooxkeabTevutOcks" -A hmac-md5 "onghojdiodhovtev";
add 192.168.251.5 192.168.251.2 ah 0x10053 -m transport -A keyed-md5 "saidIltUxOpZeeld";

add 192.168.251.2 192.168.251.5 esp 0x10054 -m tunnel -E 3des-cbc "DrutfomgooxkeabTevutOcks" -A hmac-md5 "MesbemusnEbMifAv";
add 192.168.251.2 192.168.251.5 ah 0x10055 -m transport -A keyed-md5 "toojijbishriRiwi";
===Cut===
>How-To-Repeat:
Get a FreeBSD, get an IPSEC-enabled kernel. Try to setkey -f <file> with a proposed configuration inside the <file>.
>Fix:


>Release-Note:
>Audit-Trail:
>Unformatted: