[Bug 211486] [panic] [IPSec] [IP6] Crash with IPv6 ESP usage
bugzilla-noreply at freebsd.org
bugzilla-noreply at freebsd.org
Tue Aug 2 08:33:57 UTC 2016
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=211486
--- Comment #3 from Harald Schmalzbauer <bugzilla.freebsd at omnilan.de> ---
(In reply to Andrey V. Elsukov from comment #2)
Thanks for your attention!
ipsec.conf of the affected machine:
############
# policies #
############
#----------------------------------------------------#
# Encrypt any IPv6 LDAP traffic to/from own networks #
#----------------------------------------------------#
# No local IP, -> site1
spdadd -6 ::/0 2001:db8:abcd::/48[389] any -P out ipsec esp/transport//require;
spdadd -6 2001:db8:abcd::/48[389] ::/0 any -P in ipsec esp/transport//require;
# No local IP, -> site2
spdadd -6 ::/0 2001:db8:ef00::/48[389] any -P out ipsec esp/transport//require;
spdadd -6 2001:db8:ef00::/48[389] ::/0 any -P in ipsec esp/transport//require;
#-----------------------------------------------#
# keys #
#-----------------------------------------------#
# key for host<->client
add -6 1stf.q.d.n 2ndf.q.d.n esp 54320 -E rijndael-cbc
0x00000000000000000000000000000000
add -6 2ndf.q.d.n 1st.f.q.d.n esp 54321 -E rijndael-cbc
0x000000000000000000000000000000000000
netstat -f inet6 -nr:
Destination Gateway Flags Netif
Expire
::/96 ::1 UGRS lo0
default 2001:db8:abcd:2::1 UGS
myif
::1 link#2 UH lo0
::ffff:0.0.0.0/96 ::1 UGRS lo0
2001:db8:abcd:2::/64 link#1 U
myif
2001:db8:abcd:2::3:1 link#1 UHS lo0
fe80::/10 ::1 UGRS lo0
fe80::%myif/64 link#1 U
myif
fe80::20c:29ff:feac:e09a%myif link#1 UHS
lo0
fe80::%lo0/64 link#2 U lo0
fe80::1%lo0 link#2 UHS lo0
ff02::/16 ::1 UGRS lo0
Additional notes:
1st.f.q.d.n has the AAAA record 2001:db8:abcd::efgh:10, so default gateway sits
on the trouted.
netif "myif" is renamed (and masked) em0|vmx0. With both interfaces it's the
same panic. Also mtu settings (which is 9000 on the interface and 1500 on the
default route normally) don't influence the panic.
No pf|ipfw involved.
As soon as I fire up 'ldapsearch', I get the result followed by an immediate
crash. Since I'd like to help testing that this will work in 11-RELEASE, I'll
keep 11 installed on this host, but it means a medium severe outage, since no
ldap users can login anymore. Hope the fix isn't too hard to find!
-Harry
--
You are receiving this mail because:
You are the assignee for the bug.
More information about the freebsd-bugs
mailing list