Bug: empty IPsec status overview

[8191]

I'm afraid that's a bug in vici and not in OPNsense itself:

The IPsec: Status Overview is empty, even there are several tunnels established (ipsec status shows several SAs). The error can be traced down to /usr/local/opnsense/scripts/ipsec/list_status.py not executing successfully:

# /usr/local/opnsense/scripts/ipsec/list_status.py
Traceback (most recent call last):
  File "/usr/local/opnsense/scripts/ipsec/list_status.py", line 73, in <module>
    for sas in s.list_sas():
  File "/usr/local/opnsense/scripts/ipsec/vici/session.py", line 334, in streamed_request
    self._register_unregister(event_stream_type, False);
  File "/usr/local/opnsense/scripts/ipsec/vici/session.py", line 250, in _register_unregister
    confirm=Packet.EVENT_CONFIRM,
vici.exception.SessionException: Unexpected response type 53, expected '5' (EVENT_CONFIRM)

The response type is different after each execution. Even a very simplified vici call leads to the same exception, why I assume the bug lies somewhere in vici (or even strongSwan?):

>>> import vici
>>> s = vici.Session()
>>> sas = s.list_sas()
>>> sas.next()
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "vici/session.py", line 334, in streamed_request
    self._register_unregister(event_stream_type, False);
  File "vici/session.py", line 250, in _register_unregister
    confirm=Packet.EVENT_CONFIRM,
vici.exception.SessionException: Unexpected response type 46, expected '5' (EVENT_CONFIRM)

[fichtner]

Probably this? That wasn't pushed to FreeBSD ports... pfsense/FreeBSD-ports@a7cec01

[8191]

Cannot really confirm nor reject this... The strongSwan issue does not really reveal much how the deadlock exposes to the user. Any indication why you assume the deadlock might be related to that problem?

Without looking too deep into the strongSwan code, wouldn't the error also show up when using ipsec status, if the referred deadlock was the issue?

[fichtner]

Similarities between *sense, timing and vici scope match and complexity not unlike your test setup: "I’m able to induce a deadlock condition in the charon daemon’s vici implementation with good repeatability using an eight-host full mesh test" vs. several tunnels.

[fichtner]

The deadlock may yield an error or timeout resulting in no data to be gathered. Check your system log for configd errors or timeouts?

[8191]

Just found these errors in my ipsec logs while error was present; might be related?

Jan 13 13:50:59 charon: 10[CFG] vici connection 6 unknown
Jan 13 13:50:59 charon: 10[CFG] vici connection 6 unknown
Jan 13 13:50:59 charon: 07[CFG] vici write error: Broken pipe
Jan 13 13:50:59 charon: 10[KNL] unable to query SAD entry with SPI c74cb422: No such file or directory (2)
Jan 13 13:50:59 charon: 10[KNL] unable to query SAD entry with SPI c7104cdf: No such file or directory (2)
Jan 13 13:50:59 charon: 10[KNL] unable to query SAD entry with SPI c9874632: No such file or directory (2)
Jan 13 13:50:59 charon: 10[KNL] unable to query SAD entry with SPI ce4aff68: No such file or directory (2)
Jan 13 13:50:59 charon: 10[KNL] unable to query SAD entry with SPI cd6da6a8: No such file or directory (2)
Jan 13 13:50:59 charon: 10[KNL] unable to query SAD entry with SPI ccb4ab5d: No such file or directory (2)
Jan 13 13:50:59 charon: 10[KNL] unable to query SAD entry with SPI c3324b8c: No such file or directory (2)
Jan 13 13:50:59 charon: 10[KNL] unable to query SAD entry with SPI c9199e22: No such file or directory (2)
Jan 13 13:50:59 charon: 10[KNL] unable to query SAD entry with SPI c6fcbc3b: No such file or directory (2)

[fichtner]

There is a new patch available on a branch in the upstream repo... https://git.strongswan.org/?p=strongswan.git;a=shortlog;h=refs/heads/1185-vici-action-unlock

[andreasvel]

Its still there...
I got it in
OPNsense 16.1.4-amd64
FreeBSD 10.2-RELEASE-p12
OpenSSL 1.0.2f 28 Jan 2016

nothing special in my IPSEC log.

[fichtner]

Yes, there has been no strongswan release yet.

[jschellevis]

It seems the patch mentioned by Franco was just merged, so next release of Strongswan should fix it.

[fichtner]

16.1.9 will ship the new StrongSwan 5.4.0 with said patches... ports commit here: opnsense/ports@63de190