ipsec.conf Syntax error

[Dr-D]

I've been running ipsec on my OpenBSD 5.3 router without issue since 5.3 became available. I've finally just gotten around to upgrading to version 6.4 today and my ipsec.conf file which works perfectly fine in 5.3 is giving me a syntax error in 6.4 and for the life of me I can't figure it out. I tried stripping the comments out and reducing it down to just one VPN connection but I'm still getting a syntax error when booting up. I've attached a pic of the boot screen as well as my ipsec.conf file. Any help would be greatly appreciated.

Thanks.

ipsec.conf is below.

# VPN to Company A RV042
ike dynamic esp from 10.10.10.0/24 to 192.168.11.0/24 peer 96.30.1.11 main auth hmac-sha1 enc aes-256 group modp1536 quick auth hmac-sha1 enc aes-256 srcid 96.69.72.49 psk "pa$$word"
# VPN to Company B RV042
ike dynamic esp from 10.10.10.0/24 to 192.168.12.0/24 peer 96.30.1.12 main auth hmac-sha1 enc aes-256 group modp1536 quick auth hmac-sha1 enc aes-256 srcid 96.69.72.49 psk "pa$$word"
# VPN to Company C RV340
ike dynamic esp from 10.10.10.0/24 to 192.168.13.0/24 peer 96.30.1.13 main auth hmac-sha1 enc aes-256 group modp1536 quick auth hmac-sha1 enc aes-256 srcid 96.69.72.49 psk "pa$$word"
# VPN to Company D RV042G
ike dynamic esp from 10.10.10.0/24 to 192.168.14.0/24 peer 96.30.1.14 main auth hmac-sha1 enc aes-256 group modp1536 quick auth hmac-sha1 enc aes-256 srcid 96.69.72.49 psk "pa$$word"
# VPN to Company E RV042G
ike dynamic esp from 10.10.10.0/24 to 192.168.15.0/24 peer 96.30.1.15 main auth hmac-sha1 enc aes-256 group modp1536 quick auth hmac-sha1 enc aes-256 srcid 96.69.72.49 psk "pa$$word"
# VPN to Company F RV320
ike dynamic esp from 10.10.10.0/24 to 192.168.16.0/24 peer 96.30.1.16 main auth hmac-sha1 enc aes-256 group modp1536 quick auth hmac-sha1 enc aes-256 srcid 96.69.72.49 psk "pa$$word"
# VPN to Company G RV340
ike dynamic esp from 10.10.10.0/24 to 192.168.17.0/24 peer 96.30.1.17 main auth hmac-sha1 enc aes-256 group modp1536 quick auth hmac-sha1 enc aes-256 srcid 96.69.72.49 psk "pa$$word"
# VPN to Company H RV130
ike dynamic esp from 10.10.10.0/24 to 192.168.18.0/24 peer 96.30.1.18 main auth hmac-sha1 enc aes-256 group modp1536 quick auth hmac-sha1 enc aes-256 srcid 96.69.72.49 psk "pa$$word"
# VPN to Company I RV130W
ike dynamic esp from 10.10.10.0/24 to 192.168.19.0/24 peer 96.30.1.19 main auth hmac-sha1 enc aes-256 group modp1536 quick auth hmac-sha1 enc aes-256 srcid 96.69.72.49 psk "pa$$word"
# VPN to Company J RV345
ike dynamic esp from 10.10.10.0/24 to 192.168.20.0/24 peer 96.30.1.20 main auth hmac-sha1 enc aes-256 group modp1536 quick auth hmac-sha1 enc aes-256 srcid 96.69.72.49 psk "pa$$word"
# VPN to Company K RV345P
ike dynamic esp from 10.10.10.0/24 to 192.168.21.0/24 peer 96.30.1.21 main auth hmac-sha1 enc aes-256 group modp1536 quick auth hmac-sha1 enc aes-256 srcid 96.69.72.49 psk "pa$$word"

[jggimi]

I am unable to reproduce the problem when I copied and pasted your configuration file locally:

$ ipsecctl -nf your.ipsec.conf.file
$

What happens when you test the file this way?

[Dr-D]

Originally Posted by jggimi

I am unable to reproduce the problem when I copied and pasted your configuration file locally:

$ ipsecctl -nf your.ipsec.conf.file
$

What happens when you test the file this way?

The same thing happens.

[jggimi]

No, that is not exactly the same thing. You show two errors. The first, a permission problem. The second, a syntax error without a line number defined. When I intentionally create a syntax error, I get a mesage that tells me which line number has the error.

Due to this difference in behavior, try correcting the permission problem. The file should be owned by root:wheel and have a 600 file mode (-rw-------).

[Dr-D]

Changing the file permission fixed it. I learned something new today. You are a god!

Thank you.

[jggimi]

Sweet! Now, if you want to, you can report this bug to the Project. If you're feeling really energetic, you can debug ipsecctl and post a proposed fix. (I would, but I'm at $DAYJOB and don't have ready access to my test systems.)

[Dr-D]

I don't think the problem is a bug. The problem was likely due to copying the ipsec.conf file from the old BSD router to a Windows machine via WinSCP then onto a USB flash drive then finally onto the new BSD router. Wouldn't that play havoc with file permissions?

[jggimi]

From here, it looks like the permissions error is produced correctly, but the syntax error is both extraneous and misleading.

[Dr-D]

I don't work in UNIX/Linux world enough to get it truly burned into my brain like I'd like to. That syntax error message was driving me absolutely insane because I knew there wasn't a syntax error. Had I been able to understand the message immediately before the syntax error line (group writable or world read/writable) then I would have known how to fix the problem as you did. Should it occur again the future now I'll know what to do. It's always good to learn something new everyday.