bin/183303: Add a fastforwarding check to the ipsec rc script

Olivier Cochard-Labbe olivier at
Fri Oct 25 16:10:03 UTC 2013

>Number:         183303
>Category:       bin
>Synopsis:       Add a fastforwarding check to the ipsec rc script
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Oct 25 16:10:01 UTC 2013
>Originator:     Olivier Cochard-Labbe
>Release:        9.2
BSD Router Project
FreeBSD R2 9.2-RELEASE FreeBSD 9.2-RELEASE #6 r255918M: Fri Oct 25 10:00:55 CEST 2013     root at  amd64

as noticed in inet(4): fastforwarding is not compatible with ipsec, but there is no error message from the kernel regarding this incompatibility when used together.
Here is a simple chock added on the rc.d/ipsec script regarding this incompatibility

Apply this patch

Patch attached with submission follows:

Index: etc/rc.d/ipsec
--- etc/rc.d/ipsec	(revision 255918)
+++ etc/rc.d/ipsec	(working copy)
@@ -23,6 +23,11 @@
+	if [ `sysctl -n net.inet.ip.fastforwarding` = 1 ]; then
+		warn "ipsec is not compatible with fastforwarding"
+		stop_boot
+		return 1
+	fi
 	if [ ! -f "$ipsec_file" ]; then
 		warn "$ipsec_file not readable; ipsec start aborted."


More information about the freebsd-bugs mailing list