Synopsis: Shrewsoft vpn client 2.2.0 (linux) causes openbsd to kernel panic Category: isakmpd using basic psk Environment: System : OpenBSD 5.4 Details : OpenBSD 5.4-current (GENERIC) #63: Tue Oct 1 12:33:25 MDT 2013 dera...@i386.openbsd.org: /usr/src/sys/arch/i386/compile/GENERIC
Architecture: OpenBSD.i386 Machine : i386 Description: The Shrewsoft VPN client compiled version 2.2.0 for linux immediately causes the openbsd server to kernel panic when initiating a connection. Other vpn clients (strongswan, and NCP vpn for android ) do not crash the server. sample ipsec.conf #isakmpd -4dv && ipsecctl -F -f /etc/ipsec.conf dmz="172.18.1.0/24" lan="10.22.1.0/24" ike passive esp from any to {$dmz, $lan} \ main auth hmac-sha1 enc 3des \ quick auth hmac-sha1 enc 3des \ psk whatthehell shrewsoft client version (http://www.shrew.net) matt@linux-smuw:~> ikec -v ii : ## : VPN Connect, ver 2.2.0 ## : Copyright 2013 Shrew Soft Inc. linux-smuw:/home/matt # /usr/sbin/iked ii : created ike socket 0.0.0.0:500 ii : created natt socket 0.0.0.0:4500 ## : IKE Daemon, ver 2.2.0 ## : Copyright 2013 Shrew Soft Inc. ## : This product linked OpenSSL 1.0.1e 11 Feb 2013 How-To-Repeat: Initiate an ikev1 vpn connection to openbsd using the ipsec.conf file and shrewsoft vpn client versions included in this bug report. Fix: dmesg: OpenBSD 5.4-current (GENERIC) #63: Tue Oct 1 12:33:25 MDT 2013 dera...@i386.openbsd.org:/usr/src/sys/arch/i386/compile/GENERIC cpu0: Geode(TM) Integrated Processor by AMD PCS ("AuthenticAMD" 586-class) 500 MHz cpu0: FPU,DE,PSE,TSC,MSR,CX8,SEP,PGE,CMOV,CFLUSH,MMX,MMXX,3DNOW2,3DNOW real mem = 536408064 (511MB) avail mem = 515915776 (492MB) mainbus0 at root bios0 at mainbus0: AT/286+ BIOS, date 20/71/05, BIOS32 rev. 0 @ 0xfac40 pcibios0 at bios0: rev 2.0 @ 0xf0000/0x10000 pcibios0: pcibios_get_intr_routing - function not supported pcibios0: PCI IRQ Routing information unavailable. pcibios0: PCI bus #0 is the last bus bios0: ROM list: 0xc8000/0xa800 cpu0 at mainbus0: (uniprocessor) amdmsr0 at mainbus0 pci0 at mainbus0 bus 0: configuration mode 1 (bios) 0:20:0: io address conflict 0x6100/0x100 0:20:0: io address conflict 0x6200/0x200 pchb0 at pci0 dev 1 function 0 "AMD Geode LX" rev 0x31 glxsb0 at pci0 dev 1 function 2 "AMD Geode LX Crypto" rev 0x00: RNG AES vr0 at pci0 dev 6 function 0 "VIA VT6105M RhineIII" rev 0x96: irq 11, address 00:00:24:c9:58:d0 ukphy0 at vr0 phy 1: Generic IEEE 802.3u media interface, rev. 3: OUI 0x004063, model 0x0034 vr1 at pci0 dev 7 function 0 "VIA VT6105M RhineIII" rev 0x96: irq 5, address 00:00:24:c9:58:d1 ukphy1 at vr1 phy 1: Generic IEEE 802.3u media interface, rev. 3: OUI 0x004063, model 0x0034 vr2 at pci0 dev 8 function 0 "VIA VT6105M RhineIII" rev 0x96: irq 9, address 00:00:24:c9:58:d2 ukphy2 at vr2 phy 1: Generic IEEE 802.3u media interface, rev. 3: OUI 0x004063, model 0x0034 vr3 at pci0 dev 9 function 0 "VIA VT6105M RhineIII" rev 0x96: irq 12, address 00:00:24:c9:58:d3 ukphy3 at vr3 phy 1: Generic IEEE 802.3u media interface, rev. 3: OUI 0x004063, model 0x0034 glxpcib0 at pci0 dev 20 function 0 "AMD CS5536 ISA" rev 0x03: rev 3, 32-bit 3579545Hz timer, watchdog, gpio, i2c gpio0 at glxpcib0: 32 pins iic0 at glxpcib0 pciide0 at pci0 dev 20 function 2 "AMD CS5536 IDE" rev 0x01: DMA, channel 0 wired to compatibility, channel 1 wired to compatibility wd0 at pciide0 channel 0 drive 1: <LEXAR ATA FLASH CARD> wd0: 1-sector PIO, LBA, 7631MB, 15630048 sectors wd0(pciide0:0:1): using PIO mode 4, Ultra-DMA mode 2 pciide0: channel 1 ignored (disabled) ohci0 at pci0 dev 21 function 0 "AMD CS5536 USB" rev 0x02: irq 15, version 1.0, legacy support ehci0 at pci0 dev 21 function 1 "AMD CS5536 USB" rev 0x02: irq 15 usb0 at ehci0: USB revision 2.0 uhub0 at usb0 "AMD EHCI root hub" rev 2.00/1.00 addr 1 isa0 at glxpcib0 isadma0 at isa0 com0 at isa0 port 0x3f8/8 irq 4: ns16550a, 16 byte fifo com0: console com1 at isa0 port 0x2f8/8 irq 3: ns16550a, 16 byte fifo pckbc0 at isa0 port 0x60/5 pckbd0 at pckbc0 (kbd slot) pckbc0: using irq 1 for kbd slot wskbd0 at pckbd0: console keyboard pcppi0 at isa0 port 0x61 spkr0 at pcppi0 nsclpcsio0 at isa0 port 0x2e/2: NSC PC87366 rev 10: GPIO VLM TMS gpio1 at nsclpcsio0: 29 pins npx0 at isa0 port 0xf0/16: reported by CPUID; using exception 16 usb1 at ohci0: USB revision 1.0 uhub1 at usb1 "AMD OHCI root hub" rev 1.00/1.00 addr 1 mtrr: K6-family MTRR support (2 registers) vscsi0 at root scsibus0 at vscsi0: 256 targets softraid0 at root scsibus1 at softraid0: 256 targets root on wd0a swap on wd0b dump on wd0b WARNING: / was not properly unmounted usbdevs: Controller /dev/usb0: addr 1: high speed, self powered, config 1, EHCI root hub(0x0000), AMD(0x1022), rev 1.00 port 1 powered port 2 powered port 3 powered port 4 powered Controller /dev/usb1: addr 1: full speed, self powered, config 1, OHCI root hub(0x0000), AMD(0x1022), rev 1.00 port 1 powered port 2 powered port 3 powered port 4 powered pcidump: Domain /dev/pci0: 0:1:0: AMD Geode LX 0x0000: Vendor ID: 1022 Product ID: 2080 0x0004: Command: 0005 Status: 0220 0x0008: Class: 06 Subclass: 00 Interface: 00 Revision: 31 0x000c: BIST: 00 Header Type: 80 Latency Timer: f8 Cache Line Size: 08 0x0010: BAR empty (00000000) 0x0014: BAR empty (00000000) 0x0018: BAR empty (00000000) 0x001c: BAR empty (00000000) 0x0020: BAR empty (00000000) 0x0024: BAR empty (00000000) 0x0028: Cardbus CIS: 00000000 0x002c: Subsystem Vendor ID: 1022 Product ID: 2080 0x0030: Expansion ROM Base Address: 00000000 0x0038: 00000000 0x003c: Interrupt Pin: 00 Line: 00 Min Gnt: 00 Max Lat: 00 0x0000: 20801022 02200005 06000031 0080f808 0x0010: 00000000 00000000 00000000 00000000 0x0020: 00000000 00000000 00000000 20801022 0x0030: 00000000 00000000 00000000 00000000 0x0040: 00000000 00000000 00000000 00000000 0x0050: 00000000 00000000 00000000 00000000 0x0060: 00000000 00000000 00000000 00000000 0x0070: 00000000 00000000 00000000 00000000 0x0080: 00000000 00000000 00000000 00000000 0x0090: 00000000 00000000 00000000 00000000 0x00a0: 00000000 00000000 00000000 00000000 0x00b0: 00000000 00000000 00000000 00000000 0x00c0: 00000000 00000000 00000000 00000000 0x00d0: 00000000 00000000 00000000 00000000 0x00e0: 00000000 00000000 00000000 00000000 0x00f0: 00000000 00000000 00000000 00000000 0:1:2: AMD Geode LX Crypto 0x0000: Vendor ID: 1022 Product ID: 2082 0x0004: Command: 0006 Status: 0220 0x0008: Class: 10 Subclass: 10 Interface: 00 Revision: 00 0x000c: BIST: 00 Header Type: 00 Latency Timer: 00 Cache Line Size: 08 0x0010: BAR mem 32bit addr: 0xa0000000/0x00004000 0x0014: BAR empty (00000000) 0x0018: BAR empty (00000000) 0x001c: BAR empty (00000000) 0x0020: BAR empty (00000000) 0x0024: BAR empty (00000000) 0x0028: Cardbus CIS: 00000000 0x002c: Subsystem Vendor ID: 1022 Product ID: 2082 0x0030: Expansion ROM Base Address: 00000000 0x0038: 00000000 0x003c: Interrupt Pin: 01 Line: 0a Min Gnt: 00 Max Lat: 00 0x0000: 20821022 02200006 10100000 00000008 0x0010: a0000000 00000000 00000000 00000000 0x0020: 00000000 00000000 00000000 20821022 0x0030: 00000000 00000000 00000000 0000010a 0x0040: 00000000 00000000 00000000 00000000 0x0050: 00000000 00000000 00000000 00000000 0x0060: 00000000 00000000 00000000 00000000 0x0070: 00000000 00000000 00000000 00000000 0x0080: 00000000 00000000 00000000 00000000 0x0090: 00000000 00000000 00000000 00000000 0x00a0: 00000000 00000000 00000000 00000000 0x00b0: 00000000 00000000 00000000 00000000 0x00c0: 00000000 00000000 00000000 00000000 0x00d0: 00000000 00000000 00000000 00000000 0x00e0: 00000000 00000000 00000000 00000000 0x00f0: 00000000 00000000 00000000 00000000 0:6:0: VIA VT6105M RhineIII 0x0000: Vendor ID: 1106 Product ID: 3053 0x0004: Command: 0117 Status: 0210 0x0008: Class: 02 Subclass: 00 Interface: 00 Revision: 96 0x000c: BIST: 00 Header Type: 00 Latency Timer: 40 Cache Line Size: 08 0x0010: BAR io addr: 0x0000e100/0x0100 0x0014: BAR mem 32bit addr: 0xa0004000/0x00000100 0x0018: BAR empty (00000000) 0x001c: BAR empty (00000000) 0x0020: BAR empty (00000000) 0x0024: BAR empty (00000000) 0x0028: Cardbus CIS: 00000000 0x002c: Subsystem Vendor ID: 1106 Product ID: 0106 0x0030: Expansion ROM Base Address: 00000000 0x0038: 00000000 0x003c: Interrupt Pin: 01 Line: 0b Min Gnt: 03 Max Lat: 08 0x0040: Capability 0x01: Power Management 0x0000: 30531106 02100117 02000096 00004008 0x0010: 0000e101 a0004000 00000000 00000000 0x0020: 00000000 00000000 00000000 01061106 0x0030: 00000000 00000040 00000000 0803010b 0x0040: fe020001 00000000 00000000 00000000 0x0050: 04000000 00000000 00000000 00000000 0x0060: 00000000 00000000 00000000 00000000 0x0070: 00000000 00000000 00000000 00000000 0x0080: 00000000 00000000 00000000 00000000 0x0090: 00000000 00000000 00000000 00000000 0x00a0: 00000000 00000000 00000000 00000000 0x00b0: 00000000 00000000 00000000 00000000 0x00c0: 00000000 00000000 00000000 00000000 0x00d0: 00000000 00000000 00000000 00000000 0x00e0: 00000000 00000000 00000000 00000000 0x00f0: 00000000 00000000 00000000 00000000 0:7:0: VIA VT6105M RhineIII 0x0000: Vendor ID: 1106 Product ID: 3053 0x0004: Command: 0117 Status: 0210 0x0008: Class: 02 Subclass: 00 Interface: 00 Revision: 96 0x000c: BIST: 00 Header Type: 00 Latency Timer: 40 Cache Line Size: 08 0x0010: BAR io addr: 0x0000e200/0x0100 0x0014: BAR mem 32bit addr: 0xa0004100/0x00000100 0x0018: BAR empty (00000000) 0x001c: BAR empty (00000000) 0x0020: BAR empty (00000000) 0x0024: BAR empty (00000000) 0x0028: Cardbus CIS: 00000000 0x002c: Subsystem Vendor ID: 1106 Product ID: 0106 0x0030: Expansion ROM Base Address: 00000000 0x0038: 00000000 0x003c: Interrupt Pin: 01 Line: 05 Min Gnt: 03 Max Lat: 08 0x0040: Capability 0x01: Power Management 0x0000: 30531106 02100117 02000096 00004008 0x0010: 0000e201 a0004100 00000000 00000000 0x0020: 00000000 00000000 00000000 01061106 0x0030: 00000000 00000040 00000000 08030105 0x0040: fe020001 00000000 00000000 00000000 0x0050: 04000000 00000000 00000000 00000000 0x0060: 00000000 00000000 00000000 00000000 0x0070: 00000000 00000000 00000000 00000000 0x0080: 00000000 00000000 00000000 00000000 0x0090: 00000000 00000000 00000000 00000000 0x00a0: 00000000 00000000 00000000 00000000 0x00b0: 00000000 00000000 00000000 00000000 0x00c0: 00000000 00000000 00000000 00000000 0x00d0: 00000000 00000000 00000000 00000000 0x00e0: 00000000 00000000 00000000 00000000 0x00f0: 00000000 00000000 00000000 00000000 0:8:0: VIA VT6105M RhineIII 0x0000: Vendor ID: 1106 Product ID: 3053 0x0004: Command: 0117 Status: 0210 0x0008: Class: 02 Subclass: 00 Interface: 00 Revision: 96 0x000c: BIST: 00 Header Type: 00 Latency Timer: 40 Cache Line Size: 08 0x0010: BAR io addr: 0x0000e300/0x0100 0x0014: BAR mem 32bit addr: 0xa0004200/0x00000100 0x0018: BAR empty (00000000) 0x001c: BAR empty (00000000) 0x0020: BAR empty (00000000) 0x0024: BAR empty (00000000) 0x0028: Cardbus CIS: 00000000 0x002c: Subsystem Vendor ID: 1106 Product ID: 0106 0x0030: Expansion ROM Base Address: 00000000 0x0038: 00000000 0x003c: Interrupt Pin: 01 Line: 09 Min Gnt: 03 Max Lat: 08 0x0040: Capability 0x01: Power Management 0x0000: 30531106 02100117 02000096 00004008 0x0010: 0000e301 a0004200 00000000 00000000 0x0020: 00000000 00000000 00000000 01061106 0x0030: 00000000 00000040 00000000 08030109 0x0040: fe020001 00000000 00000000 00000000 0x0050: 04000000 00000000 00000000 00000000 0x0060: 00000000 00000000 00000000 00000000 0x0070: 00000000 00000000 00000000 00000000 0x0080: 00000000 00000000 00000000 00000000 0x0090: 00000000 00000000 00000000 00000000 0x00a0: 00000000 00000000 00000000 00000000 0x00b0: 00000000 00000000 00000000 00000000 0x00c0: 00000000 00000000 00000000 00000000 0x00d0: 00000000 00000000 00000000 00000000 0x00e0: 00000000 00000000 00000000 00000000 0x00f0: 00000000 00000000 00000000 00000000 0:9:0: VIA VT6105M RhineIII 0x0000: Vendor ID: 1106 Product ID: 3053 0x0004: Command: 0117 Status: 0210 0x0008: Class: 02 Subclass: 00 Interface: 00 Revision: 96 0x000c: BIST: 00 Header Type: 00 Latency Timer: 40 Cache Line Size: 08 0x0010: BAR io addr: 0x0000e400/0x0100 0x0014: BAR mem 32bit addr: 0xa0004300/0x00000100 0x0018: BAR empty (00000000) 0x001c: BAR empty (00000000) 0x0020: BAR empty (00000000) 0x0024: BAR empty (00000000) 0x0028: Cardbus CIS: 00000000 0x002c: Subsystem Vendor ID: 1106 Product ID: 0106 0x0030: Expansion ROM Base Address: 00000000 0x0038: 00000000 0x003c: Interrupt Pin: 01 Line: 0c Min Gnt: 03 Max Lat: 08 0x0040: Capability 0x01: Power Management 0x0000: 30531106 02100117 02000096 00004008 0x0010: 0000e401 a0004300 00000000 00000000 0x0020: 00000000 00000000 00000000 01061106 0x0030: 00000000 00000040 00000000 0803010c 0x0040: fe020001 00000000 00000000 00000000 0x0050: 04000000 00000000 00000000 00000000 0x0060: 00000000 00000000 00000000 00000000 0x0070: 00000000 00000000 00000000 00000000 0x0080: 00000000 00000000 00000000 00000000 0x0090: 00000000 00000000 00000000 00000000 0x00a0: 00000000 00000000 00000000 00000000 0x00b0: 00000000 00000000 00000000 00000000 0x00c0: 00000000 00000000 00000000 00000000 0x00d0: 00000000 00000000 00000000 00000000 0x00e0: 00000000 00000000 00000000 00000000 0x00f0: 00000000 00000000 00000000 00000000 0:20:0: AMD CS5536 ISA 0x0000: Vendor ID: 1022 Product ID: 2090 0x0004: Command: 0009 Status: 02a0 0x0008: Class: 06 Subclass: 01 Interface: 00 Revision: 03 0x000c: BIST: 00 Header Type: 80 Latency Timer: 40 Cache Line Size: 08 0x0010: BAR io addr: 0x00006000/0x2000 0x0014: BAR io addr: 0x00006100/0x0100 0x0018: BAR io addr: 0x00006200/0x0200 0x001c: BAR empty (00000000) 0x0020: BAR empty (00000000) 0x0024: BAR empty (00000000) 0x0028: Cardbus CIS: 00000000 0x002c: Subsystem Vendor ID: 1022 Product ID: 2090 0x0030: Expansion ROM Base Address: 00000000 0x0038: 00000000 0x003c: Interrupt Pin: 00 Line: 00 Min Gnt: 00 Max Lat: 00 0x0000: 20901022 02a00009 06010003 00804008 0x0010: 00006001 00006101 00006201 00000000 0x0020: 00000000 00000000 00000000 20901022 0x0030: 00000000 00000000 00000000 00000000 0x0040: 00000000 00000000 00000000 00000000 0x0050: 00000000 00000000 00000000 00000000 0x0060: 00000000 00000000 00000000 00000000 0x0070: 00000000 00000000 00000000 00000000 0x0080: 00000000 00000000 00000000 00000000 0x0090: 00000000 00000000 00000000 00000000 0x00a0: 00000000 00000000 00000000 00000000 0x00b0: 00000000 00000000 00000000 00000000 0x00c0: 00000000 00000000 00000000 00000000 0x00d0: 00000000 00000000 00000000 00000000 0x00e0: 00000000 00000000 00000000 00000000 0x00f0: 00000000 00000000 00000000 00000000 0:20:2: AMD CS5536 IDE 0x0000: Vendor ID: 1022 Product ID: 209a 0x0004: Command: 0005 Status: 02a0 0x0008: Class: 01 Subclass: 01 Interface: 80 Revision: 01 0x000c: BIST: 00 Header Type: 00 Latency Timer: 00 Cache Line Size: 08 0x0010: BAR empty (00000000) 0x0014: BAR empty (00000000) 0x0018: BAR empty (00000000) 0x001c: BAR empty (00000000) 0x0020: BAR io addr: 0x0000e000/0x0010 0x0024: BAR empty (00000000) 0x0028: Cardbus CIS: 00000000 0x002c: Subsystem Vendor ID: 1022 Product ID: 209a 0x0030: Expansion ROM Base Address: 00000000 0x0038: 00000000 0x003c: Interrupt Pin: 00 Line: 00 Min Gnt: 00 Max Lat: 00 0x0000: 209a1022 02a00005 01018001 00000008 0x0010: 00000000 00000000 00000000 00000000 0x0020: 0000e001 00000000 00000000 209a1022 0x0030: 00000000 00000000 00000000 00000000 0x0040: 00004002 00000000 0020a8a8 ffff00ff 0x0050: 00c00303 00000000 00000000 00000000 0x0060: 00000000 00000000 00000000 00000000 0x0070: 00000000 00000000 00000000 00000000 0x0080: 00000000 00000000 00000000 00000000 0x0090: 00000000 00000000 00000000 00000000 0x00a0: 00000000 00000000 00000000 00000000 0x00b0: 00000000 00000000 00000000 00000000 0x00c0: 00000000 00000000 00000000 00000000 0x00d0: 00000000 00000000 00000000 00000000 0x00e0: 00000000 00000000 00000000 00000000 0x00f0: 00000000 00000000 00000000 00000000 0:21:0: AMD CS5536 USB 0x0000: Vendor ID: 1022 Product ID: 2094 0x0004: Command: 0006 Status: 0230 0x0008: Class: 0c Subclass: 03 Interface: 10 Revision: 02 0x000c: BIST: 00 Header Type: 80 Latency Timer: 00 Cache Line Size: 08 0x0010: BAR mem 32bit addr: 0xa0005000/0x00001000 0x0014: BAR empty (00000000) 0x0018: BAR empty (00000000) 0x001c: BAR empty (00000000) 0x0020: BAR empty (00000000) 0x0024: BAR empty (00000000) 0x0028: Cardbus CIS: 00000000 0x002c: Subsystem Vendor ID: 1022 Product ID: 2094 0x0030: Expansion ROM Base Address: 00000000 0x0038: 00000000 0x003c: Interrupt Pin: 01 Line: 0f Min Gnt: 00 Max Lat: 00 0x0000: 20941022 02300006 0c031002 00800008 0x0010: a0005000 00000000 00000000 00000000 0x0020: 00000000 00000000 00000000 20941022 0x0030: 00000000 00000000 00000000 0000010f 0x0040: c8020001 00000000 00000000 00000000 0x0050: 00000000 00000000 00000000 00000000 0x0060: 00000000 00000000 00000000 00000000 0x0070: 00000000 00000000 00000000 00000000 0x0080: 00000000 00000000 00000000 00000000 0x0090: 00000000 00000000 00000000 00000000 0x00a0: 00000000 00000000 00000000 00000000 0x00b0: 00000000 00000000 00000000 00000000 0x00c0: 00000000 00000000 00000000 00000000 0x00d0: 00000000 00000000 00000000 00000000 0x00e0: 00000000 00000000 00000000 00000000 0x00f0: 00000000 00000000 00000000 00000000 0:21:1: AMD CS5536 USB 0x0000: Vendor ID: 1022 Product ID: 2095 0x0004: Command: 0006 Status: 0230 0x0008: Class: 0c Subclass: 03 Interface: 20 Revision: 02 0x000c: BIST: 00 Header Type: 00 Latency Timer: 00 Cache Line Size: 08 0x0010: BAR mem 32bit addr: 0xa0006000/0x00001000 0x0014: BAR empty (00000000) 0x0018: BAR empty (00000000) 0x001c: BAR empty (00000000) 0x0020: BAR empty (00000000) 0x0024: BAR empty (00000000) 0x0028: Cardbus CIS: 00000000 0x002c: Subsystem Vendor ID: 1022 Product ID: 2095 0x0030: Expansion ROM Base Address: 00000000 0x0038: 00000000 0x003c: Interrupt Pin: 01 Line: 0f Min Gnt: 00 Max Lat: 00 0x0000: 20951022 02300006 0c032002 00000008 0x0010: a0006000 00000000 00000000 00000000 0x0020: 00000000 00000000 00000000 20951022 0x0030: 00000000 00000000 00000000 0000010f 0x0040: c8020001 00000000 00000000 00000000 0x0050: 00000000 00000000 00000000 00000000 0x0060: 00002020 00000000 00000000 00000000 0x0070: 00000000 00000000 00000000 00000000 0x0080: 00000000 00000000 00000000 00000000 0x0090: 00000000 00000000 00000000 00000000 0x00a0: 00000000 00000000 00000000 00000000 0x00b0: 00000000 00000000 00000000 00000000 0x00c0: 00000000 00000000 00000000 00000000 0x00d0: 00000000 00000000 00000000 00000000 0x00e0: 00000000 00000000 00000000 00000000 0x00f0: 00000000 00000000 00000000 00000000 acpidump: