|Subject:||More IPSEC trouble|
|From:||Steve Hill <steve@xxxxxxxxxxxxxxxxxxx>|
|Date:||Thu, 10 Mar 2005 12:45:29 +0000 (GMT)|
Running IPSEC in IPv4 tunnel mode - obviously the packets grow in size when encrypted and when I send a packet that grows to > MTU size when encrypted the machine locks up solid (the packet is generated by a different machine that is routing it via the Linux IPSEC router whcih is having problems). When it locks up I get no errors from the kernel - it just freezes up solid.
All interfaces have an MTU of 1500 bytes. The IP address of the machine generating the packet is 10.101.0.42 and the public address of it's ipsec gateway (which is the one locking up) is "a.b.c.d" in the below logging. The VPN server at the other end, also running the 2.6.10 kernel, is w.x.y.z. The below logging shows a large ICMP packet that produces an MTU-sized encrypted packet and works ok:
$ ping -n 10.254.3.19 -c 1 -s 1372 PING 10.254.3.19 (10.254.3.19) 1372(1400) bytes of data. 1380 bytes from 10.254.3.19: icmp_seq=0 ttl=62 time=94.8 ms
# tcpdump -n -i eth0 proto ICMP -v
12:35:50.064417 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto 1, length: 1400) 10.101.0.42 > 10.254.3.19: icmp 1380: echo request seq 0
# tcpdump -n -i eth1 proto 50 or proto 51 or proto ICMP -v
12:28:53.427655 IP (tos 0x0, ttl 64, id 8224, offset 0, flags [DF], proto 51, length: 1500) a.b.c.d > w.x.y.z: AH(spi=0x07260bb2,sumlen=16,seq=0x2d): IP (tos 0x0, ttl 64, id 55247, offset 0, flags [DF], proto 50, length: 1456) a.b.c.d > w.x.y.z: ESP(spi=0x041b1078,seq=0x2d)
Increasing the packet size by 1 byte would obviously require fragmentation of the encrypted packet and causes the machine to lock up.
I will continue to do some debugging but any insight would be appreciated. Thanks.
- Steve Hill (BSc) Senior Software Developer Email: steve@xxxxxxxxxxxx Navaho Technologies Ltd. Tel: +44-870-7034015
|<Prev in Thread]||Current Thread||[Next in Thread>|
|Previous by Date:||Re: [Patch] sctp: add receive buffer accounting to sctp (fwd), nhorman|
|Next by Date:||RE: [Bugme-new] [Bug 4310] New: ppc 8260 fcc ethernet driver cann ot read LXT971 PHY id, Balasaygun, Oray (Oray)|
|Previous by Thread:||Re: pppoe and receive checksum offload, David S. Miller|
|Next by Thread:||Re: More IPSEC trouble, Nicolas DICHTEL|
|Indexes:||[Date] [Thread] [Top] [All Lists]|