>Number: 188018
>Category: misc
>Synopsis: Running pfctl -sr -v in Jail with VIMAGE crashes host
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Thu Mar 27 15:20:00 UTC 2014
>Closed-Date:
>Last-Modified:
>Originator: Philipp Schmid
>Release: 10.0
>Organization:
OpenResearch Software Development OG
>Environment:
FreeBSD rna 10.0-RELEASE FreeBSD 10.0-RELEASE #4: Sat Mar 8 04:54:46 CET 2014 root@rna:/usr/obj/usr/src/sys/RNA amd64
>Description:
I have a jail running with VIMAGE enabled.
The host is using PF for packet filtering.
The script:
/etc/periodic/security/520.pfdenied
gets run daily at 4:00 am CET every day per default.
520.pfdenied runs the command:
pfctl -sr -v
If pfctl -sr -v is executed in the jail by the script or by hand, the host reboots/crashes immediately.
>How-To-Repeat:
Setup FreeBSD 10.
Compile a kernel with the following config:
root@host:~ # diff kernels/RNA /usr/src/sys/amd64/conf/GENERIC
22c22
< ident RNA
---
> ident GENERIC
345,356d344
<
< # IPSec
< options IPSEC #IP security
< device crypto
< options IPSEC_FILTERTUNNEL
< device enc
<
< # Virtual networking for jail
< options VIMAGE
< device epair
< device if_bridge
Enable PF on the host.
Create a Jail.
Run: pfctl -sr -v
Crash
>Fix:
>Release-Note:
>Audit-Trail:
>Unformatted:
_______________________________________________
freebsd-bugs@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-bugs
To unsubscribe, send any mail to "freebsd-bugs-unsubscribe@freebsd.org"