samshotmar13l: pluto freeze

-----BEGIN PGP SIGNED MESSAGE-----



Our network setup could be roughly called "OE-gateway": we've got a network of
machines with TXT records all pointing at our FS gateway, which merrily does
OE for the lot.

FS gateway suddenly stopped passing packets to anywhere. I first suspected ISP 
foul play; but after a while, I attempted to restart IPsec, which simply hung 
with no response:

Mar 28 03:31:22 owl ipsec_setup: Stopping FreeS/WAN IPsec...

I tried again:

Mar 28 03:32:47 owl ipsec_setup: Stopping FreeS/WAN IPsec...

I ended up manually killing pluto via "pgrep pluto | xargs kill -9". Most, if
not all, of the pgrep arguments failed with "no such process", which I think 
resulted in these messages:

Mar 28 03:34:25 owl ipsec__plutorun: pluto died without exit status!?!
Mar 28 03:34:25 owl ipsec_setup: whack: read() failed (104 Connection reset by 
peer)

... I don't know if the following messages would have resulted in any case:

Mar 28 03:34:26 owl ipsec_setup: Attempt to shut Pluto down failed!  Trying 
kill:
Mar 28 03:34:26 owl ipsec_setup: /usr/local/lib/ipsec/_realsetup: line 1: 
kill: (9657) - No such process


About the only thing of note about events leading up to this incident are 
pluto's last messages in /var/log/secure before totally dying:

Mar 28 02:05:50 owl pluto[9657]: | asynch DNS answer 285 for TXT of 
72.183.11.66.in-addr.arpa.
Mar 28 02:05:50 owl pluto[9657]: | DNS query 292 for TXT for 
177.43.47.4.in-addr.arpa.
Mar 28 02:05:50 owl pluto[9657]: |  
Mar 28 02:05:50 owl pluto[9657]: | asynch DNS answer 286 no TXT record for 
177.43.47.4.in-addr.arpa.
Mar 28 02:05:50 owl pluto[9657]: | Can't Opportunistically initiate for 
66.11.183.67 to 4.47.43.177: target's TXT record: no TXT record for 
177.43.47.4.in-addr.arpa.
Mar 28 02:05:50 owl pluto[9657]: |  
Mar 28 02:05:50 owl pluto[9657]: | asynch DNS answer 287 no TXT record for 
177.43.47.4.in-addr.arpa.
Mar 28 02:05:50 owl pluto[9657]: | Can't Opportunistically initiate for 
66.11.183.68 to 4.47.43.177: target's TXT record: no TXT record for 
177.43.47.4.in-addr.arpa.
Mar 28 02:05:50 owl pluto[9657]: |  
Mar 28 02:05:50 owl pluto[9657]: | asynch DNS answer 288 no TXT record for 
177.43.47.4.in-addr.arpa.
Mar 28 02:05:50 owl pluto[9657]: | Can't Opportunistically initiate for 
66.11.183.69 to 4.47.43.177: target's TXT record: no TXT record for 
177.43.47.4.in-addr.arpa.
Mar 28 02:05:50 owl pluto[9657]: | DNS query 294 for 
TXT for 75.183.11.66.in-addr.arpa.
Mar 28 02:05:50 owl pluto[9657]: | DNS query 295 for TXT for 
76.183.11.66.in-addr.arpa.
Mar 28 02:05:50 owl pluto[9657]: | DNS query 296 for TXT for 
77.183.11.66.in-addr.arpa.
Mar 28 02:05:50 owl pluto[9657]: | DNS query 297 for TXT for 
78.183.11.66.in-addr.arpa.
Mar 28 02:05:50 owl pluto[9657]: | DNS query 298 for TXT for 
80.183.11.66.in-addr.arpa.
Mar 28 02:05:50 owl pluto[9657]: | DNS query 299 for TXT for 
81.183.11.66.in-addr.arpa.
Mar 28 02:05:50 owl pluto[9657]: | DNS query 300 for TXT for 
82.183.11.66.in-addr.arpa.
Mar 28 02:05:50 owl pluto[9657]: | DNS query 301 for TXT for 
83.183.11.66.in-addr.arpa.
Mar 28 02:05:50 owl pluto[9657]: | DNS query 302 for TXT for 
84.183.11.66.in-addr.arpa.
Mar 28 02:05:50 owl pluto[9657]: | DNS query 303 for TXT for 
85.183.11.66.in-addr.arpa.
Mar 28 02:05:50 owl pluto[9657]: | DNS query 304 for TXT for 
86.183.11.66.in-addr.arpa.
Mar 28 02:05:50 owl pluto[9657]: | DNS query 305 for TXT for 
87.183.11.66.in-addr.arpa.
Mar 28 02:05:50 owl pluto[9657]: | DNS query 306 for TXT for 
88.183.11.66.in-addr.arpa.
Mar 28 02:05:50 owl pluto[9657]: | DNS query 307 for TXT for 
89.183.11.66.in-addr.arpa.
Mar 28 02:05:50 owl pluto[9657]: | DNS query 308 for TXT for 
90.183.11.66.in-addr.arpa.
Mar 28 02:05:50 owl pluto[9657]: | DNS query 309 for TXT for 
91.183.11.66.in-addr.arpa.
Mar 28 03:04:46 owl sshd2[1996]: connection from "66.11.183.72"

66.11.183.91 is not the final IP address of my subnet. Could this have 
something to do with the "self-check for OE capability" code? 

- -- 
Sam Sgro
[email protected]

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: noconv
Comment: For the matching public key, finger the Reply-To: address.

iQCVAwUBPoPGQEOSC4btEQUtAQGqEAQAjAzeNC1LQoEQk0AJFGR54ymTfY783Z1p
QFB122SpunfiLoibF4KdaVi+fXHk03ZCdhOnQI1jr/JMn1RZ8ou7CWduuUrMteRq
ZFYazJLrcbK0k8IP892mjOA6a9vHN2yPxm5AncpTRLAtgV3sCOaOF2YHV3r2PvTV
UJFm+Z1iRYM=
=dbq5
-----END PGP SIGNATURE-----