From owner-freebsd-bugs@freebsd.org Tue Aug 2 08:33:57 2016 Return-Path: Delivered-To: freebsd-bugs@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id AD20FBAC608 for ; Tue, 2 Aug 2016 08:33:57 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2001:1900:2254:206a::16:76]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 9C75E1F48 for ; Tue, 2 Aug 2016 08:33:57 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from bugs.freebsd.org ([127.0.1.118]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id u728Xvb8089963 for ; Tue, 2 Aug 2016 08:33:57 GMT (envelope-from bugzilla-noreply@freebsd.org) From: bugzilla-noreply@freebsd.org To: freebsd-bugs@FreeBSD.org Subject: [Bug 211486] [panic] [IPSec] [IP6] Crash with IPv6 ESP usage Date: Tue, 02 Aug 2016 08:33:57 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: kern X-Bugzilla-Version: 11.0-STABLE X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Many People X-Bugzilla-Who: bugzilla.freebsd@omnilan.de X-Bugzilla-Status: New X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: freebsd-bugs@FreeBSD.org X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Aug 2016 08:33:57 -0000 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D211486 --- Comment #3 from Harald Schmalzbauer --- (In reply to Andrey V. Elsukov from comment #2) Thanks for your attention! ipsec.conf of the affected machine: ############ # policies # ############ #----------------------------------------------------# # Encrypt any IPv6 LDAP traffic to/from own networks # #----------------------------------------------------# # No local IP, -> site1 spdadd -6 ::/0 2001:db8:abcd::/48[389] any -P out ipsec esp/transport//requ= ire; spdadd -6 2001:db8:abcd::/48[389] ::/0 any -P in ipsec esp/transport//requi= re; # No local IP, -> site2 spdadd -6 ::/0 2001:db8:ef00::/48[389] any -P out ipsec esp/transport//requ= ire; spdadd -6 2001:db8:ef00::/48[389] ::/0 any -P in ipsec esp/transport//requi= re; #-----------------------------------------------# # keys # #-----------------------------------------------# # key for host<->client add -6 1stf.q.d.n 2ndf.q.d.n esp 54320 -E rijndael-cbc 0x00000000000000000000000000000000 add -6 2ndf.q.d.n 1st.f.q.d.n esp 54321 -E rijndael-cbc 0x000000000000000000000000000000000000 netstat -f inet6 -nr: Destination Gateway Flags N= etif Expire ::/96 ::1 UGRS = lo0 default 2001:db8:abcd:2::1 UGS=20=20= =20=20=20=20=20=20 myif ::1 link#2 UH = lo0 ::ffff:0.0.0.0/96 ::1 UGRS = lo0 2001:db8:abcd:2::/64 link#1 U=20=20=20= =20=20=20=20=20=20=20 myif 2001:db8:abcd:2::3:1 link#1 UHS = lo0 fe80::/10 ::1 UGRS = lo0 fe80::%myif/64 link#1 U=20=20=20= =20=20=20=20=20=20=20 myif fe80::20c:29ff:feac:e09a%myif link#1 UHS=20=20= =20=20=20=20=20=20 lo0 fe80::%lo0/64 link#2 U = lo0 fe80::1%lo0 link#2 UHS = lo0 ff02::/16 ::1 UGRS = lo0 Additional notes: 1st.f.q.d.n has the AAAA record 2001:db8:abcd::efgh:10, so default gateway = sits on the trouted. netif "myif" is renamed (and masked) em0|vmx0. With both interfaces it's the same panic. Also mtu settings (which is 9000 on the interface and 1500 on t= he default route normally) don't influence the panic. No pf|ipfw involved. As soon as I fire up 'ldapsearch', I get the result followed by an immediate crash. Since I'd like to help testing that this will work in 11-RELEASE, I'= ll keep 11 installed on this host, but it means a medium severe outage, since = no ldap users can login anymore. Hope the fix isn't too hard to find! -Harry --=20 You are receiving this mail because: You are the assignee for the bug.=