Date: Thu, 27 Mar 2014 15:19:56 GMT From: Philipp Schmid <philipp.schmid@openresearch.com> To: freebsd-gnats-submit@FreeBSD.org Subject: misc/188018: Running pfctl -sr -v in Jail with VIMAGE crashes host Message-ID: <201403271519.s2RFJuCf026926@cgiserv.freebsd.org> Resent-Message-ID: <201403271520.s2RFK0fY021644@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 188018
>Category: misc
>Synopsis: Running pfctl -sr -v in Jail with VIMAGE crashes host
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Thu Mar 27 15:20:00 UTC 2014
>Closed-Date:
>Last-Modified:
>Originator: Philipp Schmid
>Release: 10.0
>Organization:
OpenResearch Software Development OG
>Environment:
FreeBSD rna 10.0-RELEASE FreeBSD 10.0-RELEASE #4: Sat Mar 8 04:54:46 CET 2014 root@rna:/usr/obj/usr/src/sys/RNA amd64
>Description:
I have a jail running with VIMAGE enabled.
The host is using PF for packet filtering.
The script:
/etc/periodic/security/520.pfdenied
gets run daily at 4:00 am CET every day per default.
520.pfdenied runs the command:
pfctl -sr -v
If pfctl -sr -v is executed in the jail by the script or by hand, the host reboots/crashes immediately.
>How-To-Repeat:
Setup FreeBSD 10.
Compile a kernel with the following config:
root@host:~ # diff kernels/RNA /usr/src/sys/amd64/conf/GENERIC
22c22
< ident RNA
---
> ident GENERIC
345,356d344
<
< # IPSec
< options IPSEC #IP security
< device crypto
< options IPSEC_FILTERTUNNEL
< device enc
<
< # Virtual networking for jail
< options VIMAGE
< device epair
< device if_bridge
Enable PF on the host.
Create a Jail.
Run: pfctl -sr -v
Crash
>Fix:
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201403271519.s2RFJuCf026926>