4 messages, 3 authors, 2007-09-04 · open the first message on its own page
From: David Miller <davem@davemloft.net>
Date: 2007-08-31 05:39:11
Every so often some piece of userland dies, and often it's bad enough that my desktop session logs out. I've been trying to find some clues and it seems to happen about as often as openswan rekeys my VPN, so one suspect area is the netlink cleanups to xfrm_user. I plan to do some auditing of those changes looking for errors, but if someone can beat me to it... :-)
From: Thomas Graf <tgraf@suug.ch>
Date: 2007-09-03 09:56:58
* David Miller [off-list ref] 2007-08-30 22:39
Every so often some piece of userland dies, and often it's bad enough that my desktop session logs out. I've been trying to find some clues and it seems to happen about as often as openswan rekeys my VPN, so one suspect area is the netlink cleanups to xfrm_user. I plan to do some auditing of those changes looking for errors, but if someone can beat me to it... :-)
I've been trying to reproduce this, what happens on my system is that when the ISAKMP SA lifetime is exceeded the rekeying fails and my connection dies. I can reproduce this back to 2.6.22 and it doesn't seem related to my recent xfrm_user work. It looks like this behaviour is hiding the bug you are seeing.
From: Herbert Xu <herbert@gondor.apana.org.au>
Date: 2007-09-03 23:06:00
Thomas Graf [off-list ref] wrote:
I've been trying to reproduce this, what happens on my system is that when the ISAKMP SA lifetime is exceeded the rekeying fails and my connection dies. I can reproduce this back to 2.6.22 and it doesn't seem related to my recent xfrm_user work. It looks like this behaviour is hiding the bug you are seeing.
Could you try extending the ISAKMP SA life time so that it is
longer than the IPSec SA life time?
Cheers,
--
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} [off-list ref]
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
From: Thomas Graf <tgraf@suug.ch>
Date: 2007-09-04 11:24:30
* Herbert Xu [off-list ref] 2007-09-04 07:05
Thomas Graf [off-list ref] wrote:quoted
I've been trying to reproduce this, what happens on my system is that when the ISAKMP SA lifetime is exceeded the rekeying fails and my connection dies. I can reproduce this back to 2.6.22 and it doesn't seem related to my recent xfrm_user work. It looks like this behaviour is hiding the bug you are seeing.Could you try extending the ISAKMP SA life time so that it is longer than the IPSec SA life time?
Yes, in this case the IPSec SA rekeying works just fine. I can't spot any signs of corruptions or alike.