Regression #11435: IPsec status incorrect for entries using expanded IKE connection numbers - pfSense - pfSense bugtracker

Custom queries

2.4.5-p1 - Resolved/Closed
2.5.0 - Resolved/Closed
2.5.1 - Resolved/Closed
2.5.2 - Resolved/Closed
2.6.0 - Resolved/Closed
2.7.0 - Resolved/Closed
2.7.1 - All Open Issues
2.7.1 - Resolved/Closed
2.7.2 - Resolved/Closed
2.8.0 - All Open Bugs
2.8.0 - All Open Features
2.8.0 - All Open Issues
2.8.0 - All Open Regressions
2.8.0 - Feedback
2.8.0 - Needs Attention
2.8.0 - New/Confirmed
2.8.0 - Pull Requests
2.8.0 - Regressions affecting 2.7.0
2.8.0 - Resolved/Closed
21.02.2/2.5.1 - Resolved/Closed
21.05 Plus - All Closed Issues
21.05.1 Plus Target - All Closed Issues
21.05.1 Target - All Closed Issues
22.01 Plus - All Closed Issues
22.01 Target - All Closed Issues
22.05 Plus - All Closed Issues
22.05 Target - All Closed Issues
23.01 Plus - All Closed Issues
23.01 Target - All Closed Issues
23.05 Plus - All Closed Issues
23.05 Target - All Closed Issues
23.05.1 Plus - All Closed Issues
23.05.1 Target - All Closed Issues
23.09 Plus - All Closed Issues
23.09 Target - All Closed Issues
23.09.1 Plus - All Closed Issues
23.09.1 Plus - All Open Issues
23.09.1 Target - All Closed Issues
23.09.1 Target - All Open Issues
24.03 Plus - All Closed Issues
24.03 Plus - All Open Issues
24.03 Plus - Feedback Issues
24.03 Plus - Needs Attention/Work
24.03 Plus - New/Confirmed/In Progress Issues
24.03 Plus - Pull Request Review
24.03 Plus - Waiting on Merge
24.03 Target - All Closed Issues
24.03 Target - All Open Issues
All Open Issues assigned to Me
All Open Pull Requests
Any Target - All Open Regressions
Any Target - Feedback Issues
CE-Next - All Closed Issues (Move to specific target)
CE-Next - All Open Issues
CE-Next - Feedback (Likely needs target changed)
New Issues by Category - Future Target
New Issues by Category - No Target
New Issues by Category - No Target+Future
No Target - All Open Issues (Base Only)
No Target - New Issues (Base Only)
No Target - New Issues (Base and Packages)
Release Notes - Plus Target Version (DO NOT EDIT)
Release Notes - Target Version (DO NOT EDIT)

Actions

Copy link

Regression #11435

closed

IPsec status incorrect for entries using expanded IKE connection numbers

Added by Jim Pingle about 3 years ago. Updated about 3 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Jim Pingle

Category:

IPsec

Target version:

2.5.1

Start date:

02/17/2021

Due date:

% Done:

100%

Estimated time:

Plus Target Version:

Release Notes:

Default

Affected Version:

2.5.0

Affected Architecture:

Description

IPsec status is not correctly matching some tunnels. #9592 introduced a mechanism to accommodate large numbers of VTI interfaces, and entries which use the new larger connection numbers are not being matched properly. Entries using the older format are OK.

For example, a tunnel mode entry with an IKE ID of 1 is now using a con name of "con100000" when previously it was "con1000" the additional zeroes are throwing off the matching logic in status_ipsec.php and presumably also the widget.

History
Notes
Property changes
Associated revisions

Actions

Copy link

Updated by Jim Pingle about 3 years ago

% Done changed from 0 to 40

I pushed a fix for the status page, widget works much differently so it needs handled another way.

Actions

Copy link

Updated by Jim Pingle about 3 years ago

Status changed from New to Feedback

I checked in a fix for the widget now as well. Worked on two systems here (one which worked before, another which did not) and accurately reflected the tunnel status on both in the widget and on the status page.

Actions

Copy link

Updated by Jim Pingle about 3 years ago

% Done changed from 40 to 100

Actions

Copy link

Updated by Renato Botelho about 3 years ago

Target version changed from CE-Next to 2.5.1

Actions

Copy link

Updated by Jim Pingle about 3 years ago

To reproduce the problem, restore the IPsec config section from issue #11487 to a system without IPsec. Edit/save/apply on the IPsec tunnel. Restore it to a second one, and adjust them so they complement each other (e.g. fix remote addresses, change P2 subnets to match the LANs, etc).

From there, try to bring up the tunnel with traffic and check the status with swanctl --list-sas from the CLI. Confirm the tunnel is up there, and check the GUI status and dashboard widget status.

On a system without the fix, the IPsec status page will show the tunnel as up but also show an additional entry which makes it appear to be disconnected. The dashboard widget will not show any active tunnels.

On a system with the fix, the status is correct in both places.

Now create a new IPsec tunnel mode instance manually and repeat the test. Then create a new VTI tunnel instance and repeat the test as well. If all three (Restored section, fresh tunnel, fresh VTI) show the expected status in each place, then we can consider it resolved.

Actions

Copy link

Updated by Viktor Gurov about 3 years ago

Jim Pingle wrote:

I checked in a fix for the widget now as well. Worked on two systems here (one which worked before, another which did not) and accurately reflected the tunnel status on both in the widget and on the status page.

In case of IKEv1 (IKEv2 is OK), the IPsec widget always shows the tunnel status as inactive

fix:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/202

Actions

Copy link