Subject: kern/35333: IPv6+IPsec broken (KAME tree is working fine, so it has to be problem during/after merge)
To: None <kern-bug-people@netbsd.org, gnats-admin@netbsd.org,>
From: None <itojun@itojun.org>
List: netbsd-bugs
Date: 12/28/2006 06:35:00 
>Number:         35333
>Category:       kern
>Synopsis:       IPv6+IPsec broken (KAME tree is working fine, so it has to be problem during/after merge)
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Dec 28 06:35:00 +0000 2006
>Originator:     Jun-ichiro itojun Hagino
>Release:        NetBSD 4.99.5
>Organization:
	itojun.org
>Environment:
System: NetBSD coconut.itojun.org 4.99.5 NetBSD 4.99.5 (COCONUT) #1: Thu Dec 14 15:18:17 JST 2006 itojun@coconut.itojun.org:/home/itojun/NetBSD/src/sys/arch/i386/compile/COCONUT i386
Architecture: i386
Machine: i386
>Description:

	if you have the following IPsec SAD/SPD entries, "ping6 ::1" will choke
	kernel (no kernel panic, but cpu loops in kernel and other processes
	will stop working, the only way to escape is to reset the machine).

# setkey -c <<EOF
add ::1 ::1 ah 0x1000 -A hmac-sha1 "hogehogehogehogehoge";
spdadd ::1 ::1 any -P out ipsec ah/transport//use;
EOF

	note that this works fine with version in KAME repository.  something
	broke during KAME -> NetBSD merge.

>How-To-Repeat:
>Fix: