misc/177785: ipsec-tools 0.8.0 racoon tends to segfault when multiple Phase1's aren't establishing

[Todd Blum]

>Number:         177785
>Category:       misc
>Synopsis:       ipsec-tools 0.8.0 racoon tends to segfault when multiple Phase1's aren't establishing
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Apr 11 19:20:00 UTC 2013
>Closed-Date:
>Last-Modified:
>Originator:     Todd Blum
>Release:        8.1
>Organization:
>Environment:
FreeBSD mbsnet-pf1.mbspchost.com 8.1-RELEASE-p13 FreeBSD 8.1-RELEASE-p13 #1: Fri Dec  7 16:55:26 EST 2012     root at snapshots-8_1-i386.builders.pfsense.org:/usr/obj./usr/pfSensesrc/src/sys/pfSense_SMP.8  i386

>Description:
I had two Phase1's that were not coming up, and it seemed like racoon was segfaulting once every 4 days or so.  Then when I had three Phase1's down, it seems like racoon started to segfault once every few days.

I've been noticing this behavior for several months.

I've opened this ticket at ipsec-tools with more detailed information:

https://sourceforge.net/tracker/?func=detail&aid=3603844&group_id=74601&atid=541482

>How-To-Repeat:
Try configuring 3 or more Ipsec tunnels that will not come up, then wait 7 days.
>Fix:
My current workaround is to reboot if racoon crashes (falling back on CARP slave while rebooting):

#!/bin/sh
#
# Find the pid of the process (PPID will be the shell that started it)
#  remember no spaces allowed between varnames, just equals sign, and the value
# Script name cannot contain the word racoon in order to to avoid self-triggering

sleep 30

FIND_PROC=`pgrep racoon`
# if FIND_PROC is empty, the process has died; restart it

if [ -z "${FIND_PROC}" ]; then
      echo racoon failed at `date`
       nohup  shutdown -r now &
fi

exit

With cron entry:

*     *     *     *     *     root     /root/ipsec-watchdog.sh >> /root/ipsec-watchdog.log

>Release-Note:
>Audit-Trail:
>Unformatted: