IPsec mobile client problems: no virtual IP found for %any …
-
Its easy setkey -PD setkey -D
and ipsec logs.
-
This may well be a configuration error on my part, but still, it was working earlier. I don't see any errors on either the client or pfSense side, just no traffic. This capture is with pfSense "Built On: Thu Sep 11 09:25:40 CDT 2014"
Here
xx.yy.zz.132 is the WAN connection on the pfSense box,
aaa.bbb.ccc.137 is the WAN connection of the client,
192.168.2.0/24 is the LAN behind pfSense,
192.168.3.1 is the virtual IP assigned to the client. Client is on a NAT'd LAN network 10.5.60.0/24setkey -D and setkey -PD output (note that 'lastused' time never changes from creation time):
xx.yy.zz.132 aaa.bbb.ccc.137 esp mode=tunnel spi=1572953404(0x5dc15d3c) reqid=1(0x00000001) E: rijndael-cbc 50725a75 f02eb788 f888fb98 da4872b6 c16c47c5 8f87ae3b 4b184b01 cd6c1c99 A: hmac-sha1 c9cc9950 a4d5c037 825fe8ef 4927e83e bb8390c2 seq=0x00000000 replay=32 flags=0x00000000 state=mature created: Sep 11 12:02:46 2014 current: Sep 11 12:03:49 2014 diff: 63(s) hard: 3600(s) soft: 2674(s) last: hard: 0(s) soft: 0(s) current: 0(bytes) hard: 0(bytes) soft: 0(bytes) allocated: 0 hard: 0 soft: 0 sadb_seq=1 pid=8606 refcnt=1 aaa.bbb.ccc.137 xx.yy.zz.132 esp mode=any spi=3482626703(0xcf94aa8f) reqid=1(0x00000001) E: rijndael-cbc dd784cd1 86593380 9fddc58a 5d4179b5 0080d03d 43a46c1d b8879113 110cf70e A: hmac-sha1 519fb0a9 f4bcac6f 8318e207 072fe9cc 845d4620 seq=0x00000000 replay=32 flags=0x00000000 state=mature created: Sep 11 12:02:46 2014 current: Sep 11 12:03:49 2014 diff: 63(s) hard: 3600(s) soft: 2546(s) last: hard: 0(s) soft: 0(s) current: 0(bytes) hard: 0(bytes) soft: 0(bytes) allocated: 0 hard: 0 soft: 0 sadb_seq=0 pid=8606 refcnt=1 192.168.3.1[any] 192.168.2.0/24[any] any in ipsec esp/tunnel/aaa.bbb.ccc.137-xx.yy.zz.132/unique:1 created: Sep 11 12:02:46 2014 lastused: Sep 11 12:02:46 2014 lifetime: 9223372036854775807(s) validtime: 0(s) spid=4 seq=1 pid=32577 refcnt=1 192.168.2.0/24[any] 192.168.3.1[any] any out ipsec esp/tunnel/xx.yy.zz.132-aaa.bbb.ccc.137/unique:1 created: Sep 11 12:02:46 2014 lastused: Sep 11 12:02:46 2014 lifetime: 9223372036854775807(s) validtime: 0(s) spid=3 seq=0 pid=32577 refcnt=1
And the condensed ipsec.log. This log is from boot, set up shrewsoft link, 5 failed pings from the client, and tear down of the connection. I have the corresponding logs on the client side as well.
Sep 11 12:02:46 pfsense charon: 12[NET] received packet: from aaa.bbb.ccc.137[500] to xx.yy.zz.132[500] (484 bytes) Sep 11 12:02:46 pfsense charon: 12[ENC] parsed AGGRESSIVE request 0 [ SA KE No ID V V V V V V V V V V ] Sep 11 12:02:46 pfsense charon: 12[IKE] <1> received draft-ietf-ipsec-nat-t-ike-00 vendor ID Sep 11 12:02:46 pfsense charon: 12[IKE] received draft-ietf-ipsec-nat-t-ike-00 vendor ID Sep 11 12:02:46 pfsense charon: 12[ENC] received unknown vendor ID: 16:f6:ca:16:e4:a4:06:6d:83:82:1a:0f:0a:ea:a8:62 Sep 11 12:02:46 pfsense charon: 12[IKE] <1> received draft-ietf-ipsec-nat-t-ike-02\n vendor ID Sep 11 12:02:46 pfsense charon: 12[IKE] received draft-ietf-ipsec-nat-t-ike-02\n vendor ID Sep 11 12:02:46 pfsense charon: 12[IKE] <1> received draft-ietf-ipsec-nat-t-ike-03 vendor ID Sep 11 12:02:46 pfsense charon: 12[IKE] received draft-ietf-ipsec-nat-t-ike-03 vendor ID Sep 11 12:02:46 pfsense charon: 12[IKE] <1> received NAT-T (RFC 3947) vendor ID Sep 11 12:02:46 pfsense charon: 12[IKE] received NAT-T (RFC 3947) vendor ID Sep 11 12:02:46 pfsense charon: 12[IKE] <1> received FRAGMENTATION vendor ID Sep 11 12:02:46 pfsense charon: 12[IKE] received FRAGMENTATION vendor ID Sep 11 12:02:46 pfsense charon: 12[ENC] received unknown vendor ID: f1:4b:94:b7:bf:f1:fe:f0:27:73:b8:c4:9f:ed:ed:26 Sep 11 12:02:46 pfsense charon: 12[ENC] received unknown vendor ID: 16:6f:93:2d:55:eb:64:d8:e4:df:4f:d3:7e:23:13:f0:d0:fd:84:51 Sep 11 12:02:46 pfsense charon: 12[ENC] received unknown vendor ID: 84:04:ad:f9:cd:a0:57:60:b2:ca:29:2e:4b:ff:53:7b Sep 11 12:02:46 pfsense charon: 12[IKE] <1> received Cisco Unity vendor ID Sep 11 12:02:46 pfsense charon: 12[IKE] received Cisco Unity vendor ID Sep 11 12:02:46 pfsense charon: 12[IKE] <1> aaa.bbb.ccc.137 is initiating a Aggressive Mode IKE_SA Sep 11 12:02:46 pfsense charon: 12[IKE] aaa.bbb.ccc.137 is initiating a Aggressive Mode IKE_SA Sep 11 12:02:46 pfsense charon: 12[CFG] looking for pre-shared key peer configs matching xx.yy.zz.132...aaa.bbb.ccc.137[vpnusers@home.com] Sep 11 12:02:46 pfsense charon: 12[CFG] selected peer config "con1" Sep 11 12:02:46 pfsense charon: 12[ENC] generating AGGRESSIVE response 0 [ SA KE No ID NAT-D NAT-D HASH V V V V V ] Sep 11 12:02:46 pfsense charon: 12[NET] sending packet: from xx.yy.zz.132[500] to aaa.bbb.ccc.137[500] (492 bytes) Sep 11 12:02:46 pfsense charon: 12[NET] received packet: from aaa.bbb.ccc.137[4500] to xx.yy.zz.132[4500] (140 bytes) Sep 11 12:02:46 pfsense charon: 12[ENC] parsed AGGRESSIVE request 0 [ HASH NAT-D NAT-D ] Sep 11 12:02:46 pfsense charon: 12[IKE] <con1|1>IKE_SA con1[1] established between xx.yy.zz.132[vpnusers@home.com]...aaa.bbb.ccc.137[vpnusers@home.com] Sep 11 12:02:46 pfsense charon: 12[IKE] IKE_SA con1[1] established between xx.yy.zz.132[vpnusers@home.com]...aaa.bbb.ccc.137[vpnusers@home.com] Sep 11 12:02:46 pfsense charon: 12[IKE] <con1|1>scheduling reauthentication in 85824s Sep 11 12:02:46 pfsense charon: 12[IKE] scheduling reauthentication in 85824s Sep 11 12:02:46 pfsense charon: 12[IKE] <con1|1>maximum IKE_SA lifetime 86364s Sep 11 12:02:46 pfsense charon: 12[IKE] maximum IKE_SA lifetime 86364s Sep 11 12:02:46 pfsense charon: 12[IKE] <con1|1>local host is behind NAT, sending keep alives Sep 11 12:02:46 pfsense charon: 12[IKE] local host is behind NAT, sending keep alives Sep 11 12:02:46 pfsense charon: 12[IKE] <con1|1>remote host is behind NAT Sep 11 12:02:46 pfsense charon: 12[IKE] remote host is behind NAT Sep 11 12:02:46 pfsense charon: 14[NET] received packet: from aaa.bbb.ccc.137[4500] to xx.yy.zz.132[4500] (92 bytes) Sep 11 12:02:46 pfsense charon: 14[ENC] parsed INFORMATIONAL_V1 request 588915076 [ HASH N(INITIAL_CONTACT) ] Sep 11 12:02:46 pfsense charon: 14[NET] received packet: from aaa.bbb.ccc.137[4500] to xx.yy.zz.132[4500] (156 bytes) Sep 11 12:02:46 pfsense charon: 14[ENC] parsed TRANSACTION request 3720127689 [ HASH CPRQ(ADDR EXP MASK U_BANNER U_NATTPORT VER U_FWTYPE) ] Sep 11 12:02:46 pfsense charon: 14[IKE] <con1|1>peer requested virtual IP %any Sep 11 12:02:46 pfsense charon: 14[IKE] peer requested virtual IP %any Sep 11 12:02:46 pfsense charon: 14[CFG] assigning new lease to 'vpnusers@home.com' Sep 11 12:02:46 pfsense charon: 14[IKE] <con1|1>assigning virtual IP 192.168.3.1 to peer 'vpnusers@home.com' Sep 11 12:02:46 pfsense charon: 14[IKE] assigning virtual IP 192.168.3.1 to peer 'vpnusers@home.com' Sep 11 12:02:46 pfsense charon: 14[ENC] generating TRANSACTION response 3720127689 [ HASH CPRP(ADDR SUBNET DNS U_SPLITINC U_BANNER) ] Sep 11 12:02:46 pfsense charon: 14[NET] sending packet: from xx.yy.zz.132[4500] to aaa.bbb.ccc.137[4500] (156 bytes) Sep 11 12:02:46 pfsense charon: 14[NET] received packet: from aaa.bbb.ccc.137[4500] to xx.yy.zz.132[4500] (172 bytes) Sep 11 12:02:46 pfsense charon: 14[ENC] parsed QUICK_MODE request 3113463846 [ HASH SA No ID ID ] Sep 11 12:02:46 pfsense charon: 14[IKE] <con1|1>received 28800s lifetime, configured 3600s Sep 11 12:02:46 pfsense charon: 14[IKE] received 28800s lifetime, configured 3600s Sep 11 12:02:46 pfsense charon: 14[ENC] generating QUICK_MODE response 3113463846 [ HASH SA No ID ID ] Sep 11 12:02:46 pfsense charon: 14[NET] sending packet: from xx.yy.zz.132[4500] to aaa.bbb.ccc.137[4500] (188 bytes) Sep 11 12:02:46 pfsense charon: 14[NET] received packet: from aaa.bbb.ccc.137[4500] to xx.yy.zz.132[4500] (76 bytes) Sep 11 12:02:46 pfsense charon: 14[ENC] parsed QUICK_MODE request 3113463846 [ HASH ] Sep 11 12:02:46 pfsense charon: 14[IKE] <con1|1>CHILD_SA con1{1} established with SPIs cf94aa8f_i 5dc15d3c_o and TS 192.168.2.0/24|/0 === 192.168.3.1/32|/0 Sep 11 12:02:46 pfsense charon: 14[IKE] CHILD_SA con1{1} established with SPIs cf94aa8f_i 5dc15d3c_o and TS 192.168.2.0/24|/0 === 192.168.3.1/32|/0 Sep 11 12:03:10 pfsense charon: 14[IKE] <con1|1>sending keep alive to aaa.bbb.ccc.137[4500] Sep 11 12:03:10 pfsense charon: 14[IKE] sending keep alive to aaa.bbb.ccc.137[4500] Sep 11 12:03:30 pfsense charon: 14[IKE] <con1|1>sending keep alive to aaa.bbb.ccc.137[4500] Sep 11 12:03:30 pfsense charon: 14[IKE] sending keep alive to aaa.bbb.ccc.137[4500] Sep 11 12:03:50 pfsense charon: 14[IKE] <con1|1>sending keep alive to aaa.bbb.ccc.137[4500] Sep 11 12:07:10 pfsense charon: 14[IKE] sending keep alive to aaa.bbb.ccc.137[4500] Sep 11 12:07:30 pfsense charon: 14[IKE] <con1|1>sending keep alive to aaa.bbb.ccc.137[4500] Sep 11 12:07:30 pfsense charon: 14[IKE] sending keep alive to aaa.bbb.ccc.137[4500] Sep 11 12:07:50 pfsense charon: 14[IKE] <con1|1>sending keep alive to aaa.bbb.ccc.137[4500] Sep 11 12:07:50 pfsense charon: 14[IKE] sending keep alive to aaa.bbb.ccc.137[4500] Sep 11 12:07:50 pfsense charon: 14[NET] received packet: from aaa.bbb.ccc.137[4500] to xx.yy.zz.132[4500] (92 bytes) Sep 11 12:07:50 pfsense charon: 14[ENC] parsed INFORMATIONAL_V1 request 4150358938 [ HASH D ] Sep 11 12:07:50 pfsense charon: 14[IKE] <con1|1>received DELETE for ESP CHILD_SA with SPI 5dc15d3c Sep 11 12:07:50 pfsense charon: 14[IKE] received DELETE for ESP CHILD_SA with SPI 5dc15d3c Sep 11 12:07:50 pfsense charon: 14[IKE] <con1|1>closing CHILD_SA con1{1} with SPIs cf94aa8f_i (0 bytes) 5dc15d3c_o (0 bytes) and TS 192.168.2.0/24|/0 === 192.168.3.1/32|/0 Sep 11 12:07:50 pfsense charon: 14[IKE] closing CHILD_SA con1{1} with SPIs cf94aa8f_i (0 bytes) 5dc15d3c_o (0 bytes) and TS 192.168.2.0/24|/0 === 192.168.3.1/32|/0 Sep 11 12:07:50 pfsense charon: 08[NET] received packet: from aaa.bbb.ccc.137[4500] to xx.yy.zz.132[4500] (92 bytes) Sep 11 12:07:50 pfsense charon: 08[ENC] parsed INFORMATIONAL_V1 request 2594436540 [ HASH D ] Sep 11 12:07:50 pfsense charon: 08[IKE] <con1|1>received DELETE for IKE_SA con1[1] Sep 11 12:07:50 pfsense charon: 08[IKE] received DELETE for IKE_SA con1[1] Sep 11 12:07:50 pfsense charon: 08[IKE] <con1|1>deleting IKE_SA con1[1] between xx.yy.zz.132[vpnusers@home.com]...aaa.bbb.ccc.137[vpnusers@home.com] Sep 11 12:07:50 pfsense charon: 08[IKE] deleting IKE_SA con1[1] between xx.yy.zz.132[vpnusers@home.com]...aaa.bbb.ccc.137[vpnusers@home.com] Sep 11 12:07:50 pfsense charon: 08[CFG] lease 192.168.3.1 by 'vpnusers@home.com' went offline</con1|1></con1|1></con1|1></con1|1></con1|1></con1|1></con1|1></con1|1></con1|1></con1|1></con1|1></con1|1></con1|1></con1|1></con1|1></con1|1></con1|1></con1|1>
-
I have tested this all day today and it works correctly.
Are you sourcing your ping correctly?
-
@ermal:
Are you sourcing your ping correctly?
I believe so; the routing table on the client is correct. It's failed with two different client machines on two different external networks.
Hmm, unrelated, but I just tried to refresh diap_ipsec.php after bringing up the tunnel, and noticed it hanging. php-fpm is cpu-bound at 100%, and I see this in the logs:
Sep 11 17:31:54 pfsense charon: 02[IKE] assigning virtual IP 192.168.3.1 to peer 'vpnusers@home.com' Sep 11 17:31:54 pfsense charon: 02[ENC] generating TRANSACTION response 1975182865 [ HASH CPRP(ADDR SUBNET DNS U_SPLITINC U_BANNER) ] Sep 11 17:31:54 pfsense charon: 02[NET] sending packet: from xx.yy.zz.132[4500] to aaa.bbb.ccc.137[4500] (156 bytes) Sep 11 17:32:00 pfsense charon: 02[DMN] thread 2 received 10 Sep 11 17:32:00 pfsense charon: 02[LIB] dumping 2 stack frame addresses: Sep 11 17:32:00 pfsense charon: 02[LIB] /lib/libthr.so.3 @ 0x801340000 (_swapcontext+0x15b) [0x80134e4ab] Sep 11 17:32:00 pfsense charon: 02[LIB] -> Sep 11 17:32:00 pfsense charon: 02[LIB] /lib/libthr.so.3 @ 0x801340000 (sigaction+0x343) [0x80134e093] Sep 11 17:32:00 pfsense charon: 02[LIB] -> Sep 11 17:32:00 pfsense charon: 02[DMN] killing ourself, received critical signal Sep 11 17:32:07 pfsense charon: 00[DMN] Starting IKE charon daemon (strongSwan 5.2.0, FreeBSD 10.1-PRERELEASE, amd64)
This hasn't happened before.
-
Which snapshot are you on?
Please update to the latest one.
That was due to makeing the status page include necessary information. -
This was "Built On: Thu Sep 11 09:25:40 CDT 2014"
I will wait for the next snapshot with your latest changes to appear, and re-test, thanks.
-
On version "built on Thu Sep 11 19:41:05 CDT 2014"
Good news is I can't reproduce the hang in php-fpm.
Bad news is now no SAD or SPD entries are created, but a lease does show up in the pool. Still no traffic though.
Further bad news is that setting any loglevels to '-1' is not possible any more. This triggers corresponding entries in syslog:
Sep 12 07:59:35 pfsense php-fpm[27936]: /vpn_ipsec_settings.php: The command '/usr/local/sbin/ipsec stroke loglevel tls -1' returned exit code '255', the output was 'stroke: invalid option -- 1 stroke [OPTIONS] command [ARGUMENTS] Options: -h, --help print this information. -d, --daemon=NAME name of the daemon. Commands: Add a connection: stroke add NAME MY_ID OTHER_ID MY_ADDR OTHER_ADDR\ MY_NET OTHER_NET where: ID is any IKEv2 ID ADDR is a IPv4 address NET is a IPv4 subnet in CIDR notation Delete a connection: stroke delete NAME where: NAME is a connection name added with "stroke add" Initiate a connection: stroke up NAME where: NAME is a connection name added with "stroke add" Initiate a connection without blocking: stroke up-nb NAME where: NAME is a connection name added with "stroke add" Terminate a connection: stroke down NAME where: NAME is a connection name added with "stroke add" Terminate a connecti
And it fails interactively as well. Note the usage text still shows it as a valid command:
[2.2-ALPHA][root@pfsense.localdomain]/var/log(17): /usr/local/sbin/ipsec stroke loglevel imc -1 stroke: invalid option -- 1 < lots of usage info deleted here > Error: invalid option [2.2-ALPHA][root@pfsense.localdomain]/var/log(18):
-
Can you share your configs?
I will check the loglevel thing.
Though it will have been there even before but it was not noticed! -
@ermal:
Can you share your configs?
Sure, thanks for looking! First ipsec.conf, then strongswan.conf and last ipsec listall output (with tunnel up, client appears OK and gets the login banner).
[2.2-ALPHA][root@pfsense.localdomain]/var/etc/ipsec(37): cat ipsec.conf # This file is automatically generated. Do not edit config setup uniqueids = yes charondebug="dmn = 1,mgr = 0,ike = 0,chd = 0,job = 0,cfg = 0,knl = 0,net = 1,enc = 0,app = 0,esp = 1,lib = 1" conn con1 aggressive = yes fragmentation = yes keyexchange = ikev1 reauth = yes rekey = yes reqid = 1 installpolicy = yes type = tunnel dpdaction = none auto = add left = xx.yy.zz.132 right = %any leftid = vpnusers@home.com ikelifetime = 86400s lifetime = 3600s rightsourceip = 192.168.3.0/24 rightsubnet = 192.168.3.0/24 leftsubnet = 192.168.2.0/24 ike = aes256-sha256-modp1024! esp = aes256-md5,aes256-sha1,aes256-sha256,blowfish256-md5,blowfish256-sha1,blowfish256-sha256,blowfish192-md5,blowfish192-sha1,blowfish192-sha256,blowfish128-md5,blowfish128-sha1,blowfish128-sha256,3des-md5,3des-sha1,3des-sha256! leftauth = psk rightauth = psk
[2.2-ALPHA][root@pfsense.localdomain]/var/etc/ipsec(38): cat strongswan.conf #Automatically generated please do not modify starter { load_warning = no } charon { # number of worker threads in charon threads = 16 ikesa_table_size = 32 ikesa_table_segments = 4 init_limit_half_open = 1000; # XXX: There is not much choice here really users win their security! i_dont_care_about_security_and_use_aggressive_mode_psk=yes # And two loggers using syslog. The subsections define the facility to log # to, currently one of: daemon, auth. syslog { identifier = charon # default level to the LOG_DAEMON facility daemon { } # very minimalistic IKE auditing logs to LOG_AUTHPRIV auth { default = -1 ike = 1 ike_name = yes } } cisco_unity = yes plugins { attr { subnet = 192.168.3.0/24 dns = 8.8.8.8 split-include = 192.168.2.0/24 28672 = Welcome to Test .. Authorized use only! } xauth-generic { script = /etc/inc/ipsec.auth-user.php authcfg = Local Database } } }
[2.2-ALPHA][root@pfsense.localdomain]/var/etc/ipsec(41): ipsec statusall Status of IKE charon daemon (weakSwan 5.2.0, FreeBSD 10.1-PRERELEASE, amd64): uptime: 11 hours, since Sep 11 22:56:08 2014 worker threads: 10 of 16 idle, 6/0/0/0 working, job queue: 0/0/0/0, scheduled: 11 loaded plugins: charon curl unbound aes des blowfish rc2 sha1 sha2 md4 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey ipseckey pem openssl fips-prf gmp xcbc cmac hmac attr kernel-pfkey kernel-pfroute resolve socket-default stroke smp updown eap-identity eap-sim eap-aka eap-aka-3gpp2 eap-md5 eap-mschapv2 eap-dynamic eap-tls eap-ttls eap-peap xauth-generic xauth-eap whitelist addrblock Virtual IP pools (size/online/offline): 192.168.3.0/24: 254/1/0 Listening IP addresses: 192.168.2.128 xx.yy.zz.132 192.168.100.5 Connections: con1: xx.yy.zz.132...%any IKEv1 Aggressive con1: local: [vpnusers@home.com] uses pre-shared key authentication con1: remote: uses pre-shared key authentication con1: child: 192.168.2.0/24|/0 === 192.168.3.0/24|/0 TUNNEL Security Associations (1 up, 0 connecting): con1[5]: ESTABLISHED 24 seconds ago, xx.yy.zz.132[vpnusers@home.com]...aaa.bbb.ccc.137[vpnusers@home.com] con1[5]: IKEv1 SPIs: 0076e8adb5b55a1e_i 4fe2ea1d13eec388_r*, pre-shared key reauthentication in 23 hours con1[5]: IKE proposal: AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024 [2.2-ALPHA][root@pfsense.localdomain]/var/etc/ipsec(42): setkey -D No SAD entries. [2.2-ALPHA][root@pfsense.localdomain]/var/etc/ipsec(43): setkey -PD No SPD entries.
-
You should have some warnings on your ipsec log.
Why the policies have not been created! -
No obvious errors in the log that I can see, they look just like what I posted yesterday.
-
Well try using a different subnet for the rightsourceip rather than peer ip address.
-
@ermal:
Well try using a different subnet for the rightsourceip rather than peer ip address.
SAD and SPD entries can be created if I comment out 'rightsubnet=192.168.3.0/24' from ipsec.conf (not sure that's possible with the current webgui code). But I still cannot pass any traffic through the tunnel.
I will start from scratch and take a close look over the weekend, thanks.
-
This strongswan bug https://wiki.strongswan.org/issues/586 was properly rejected because it was not a strongswan issue, but rather a FreeBSD 10.0 issue.
Symptoms seem to match what I'm seeing … Was or is this a valid bug? I can't immediately find a similar patchset in FreeBSD sources, but I can't believe a bug like this would still be around.
-
FYI:
i have the same issue.
https://forum.pfsense.org/index.php?topic=81657.msg446613#msg446613 -
This strongswan bug https://wiki.strongswan.org/issues/586 was properly rejected because it was not a strongswan issue, but rather a FreeBSD 10.0 issue.
Symptoms seem to match what I'm seeing … Was or is this a valid bug? I can't immediately find a similar patchset in FreeBSD sources, but I can't believe a bug like this would still be around.
The fix is already present in FreeBSD 10 afaik.
So that patch is already merged!