[Bug 211486] [panic] [IPSec] [IP6] Crash with IPv6 ESP usage

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=211486

--- Comment #3 from Harald Schmalzbauer <bugzilla.freebsd at omnilan.de> ---
(In reply to Andrey V. Elsukov from comment #2)

Thanks for your attention!

ipsec.conf of the affected machine:
############
# policies #
############
#----------------------------------------------------#
# Encrypt any IPv6 LDAP traffic to/from own networks #
#----------------------------------------------------#
# No local IP, -> site1
spdadd -6 ::/0 2001:db8:abcd::/48[389] any -P out ipsec esp/transport//require;
spdadd -6 2001:db8:abcd::/48[389] ::/0 any -P in ipsec esp/transport//require;
# No local IP, -> site2
spdadd -6 ::/0 2001:db8:ef00::/48[389] any -P out ipsec esp/transport//require;
spdadd -6 2001:db8:ef00::/48[389] ::/0 any -P in ipsec esp/transport//require;
#-----------------------------------------------#
#                    keys                       #
#-----------------------------------------------#
# key for host<->client
add -6 1stf.q.d.n 2ndf.q.d.n esp 54320 -E rijndael-cbc
0x00000000000000000000000000000000
add -6 2ndf.q.d.n 1st.f.q.d.n esp 54321 -E rijndael-cbc
0x000000000000000000000000000000000000

netstat -f inet6 -nr:

Destination                       Gateway                       Flags     Netif
Expire
::/96                             ::1                           UGRS        lo0
default                           2001:db8:abcd:2::1            UGS        
myif
::1                               link#2                        UH          lo0
::ffff:0.0.0.0/96                 ::1                           UGRS        lo0
2001:db8:abcd:2::/64              link#1                        U          
myif
2001:db8:abcd:2::3:1              link#1                        UHS         lo0
fe80::/10                         ::1                           UGRS        lo0
fe80::%myif/64                     link#1                        U          
myif
fe80::20c:29ff:feac:e09a%myif      link#1                        UHS        
lo0
fe80::%lo0/64                     link#2                        U           lo0
fe80::1%lo0                       link#2                        UHS         lo0
ff02::/16                         ::1                           UGRS        lo0

Additional notes:
1st.f.q.d.n has the AAAA record 2001:db8:abcd::efgh:10, so default gateway sits
on the trouted.
netif "myif" is renamed (and masked) em0|vmx0. With both interfaces it's the
same panic. Also mtu settings (which is 9000 on the interface and 1500 on the
default route normally) don't influence the panic.
No pf|ipfw involved.

As soon as I fire up 'ldapsearch', I get the result followed by an immediate
crash. Since I'd like to help testing that this will work in 11-RELEASE, I'll
keep 11 installed on this host, but it means a medium severe outage, since no
ldap users can login anymore. Hope the fix isn't too hard to find!

-Harry

-- 
You are receiving this mail because:
You are the assignee for the bug.