From owner-freebsd-current@freebsd.org Mon Jul 27 10:29:23 2015 Return-Path: Delivered-To: freebsd-current@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 9D0EB9AC9E7 for ; Mon, 27 Jul 2015 10:29:23 +0000 (UTC) (envelope-from shuriku@shurik.kiev.ua) Received: from graal.it-profi.org.ua (graal.shurik.kiev.ua [193.239.74.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 58F28A49 for ; Mon, 27 Jul 2015 10:29:22 +0000 (UTC) (envelope-from shuriku@shurik.kiev.ua) Received: from [109.237.91.29] (helo=thinkpad.it-profi.org.ua) by graal.it-profi.org.ua with esmtpa (Exim 4.85 (FreeBSD)) (envelope-from ) id 1ZJfeo-000G1y-MN for freebsd-current@freebsd.org; Mon, 27 Jul 2015 13:29:18 +0300 Subject: Re: IPSEC stop works after r285336 To: freebsd-current@freebsd.org References: <55B099F6.8000004@shurik.kiev.ua> <20150724213839.GP78154@funkthat.com> <55B323F5.3030200@shurik.kiev.ua> <16ADAE9E-1CE1-4E52-8C68-BBE8CCB6B164@neville-neil.com> <55B5DC67.8060706@shurik.kiev.ua> From: Alexandr Krivulya Message-ID: <55B607F9.7050605@shurik.kiev.ua> Date: Mon, 27 Jul 2015 13:29:13 +0300 User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:38.0) Gecko/20100101 Thunderbird/38.1.0 MIME-Version: 1.0 In-Reply-To: <55B5DC67.8060706@shurik.kiev.ua> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-SA-Exim-Connect-IP: 109.237.91.29 X-SA-Exim-Mail-From: shuriku@shurik.kiev.ua X-SA-Exim-Scanned: No (on graal.it-profi.org.ua); SAEximRunCond expanded to false X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2015 10:29:23 -0000 27.07.2015 10:23, Alexandr Krivulya пишет: > 26.07.2015 21:39, George Neville-Neil пишет: >> >> On 25 Jul 2015, at 1:51, Alexandr Krivulya wrote: >> >>> 25.07.2015 00:38, John-Mark Gurney пишет: >>>> Alexandr Krivulya wrote this message on Thu, Jul 23, 2015 at 10:38 >>>> +0300: >>>>> I have IPSEC tunnel inside l2tp tunnel via mpd. After r285536 I see >>>>> only >>>>> outgoing esp packets on ng interface: >>>> This change is -stable, not -current, but the change referenced below >>>> is -current... Which one are you running? >>>> >>>> Also, the only ipsec related change after r285535 is r285770, though >>>> that probably won't effect it... Could you possibly narrow the change >>>> that broke things? >>>> >>>>> root@thinkpad:/usr/src # tcpdump -i ng0 >>>>> tcpdump: verbose output suppressed, use -v or -vv for full protocol >>>>> decode >>>>> listening on ng0, link-type NULL (BSD loopback), capture size >>>>> 262144 bytes >>>>> 10:35:27.331886 IP 10.10.10.2 > 10.10.10.1: >>>>> ESP(spi=0x03081e58,seq=0x9a5), length 140 >>>>> 10:35:28.371707 IP 10.10.10.2 > 10.10.10.1: >>>>> ESP(spi=0x03081e58,seq=0x9a6), length 140 >>>>> 10:35:29.443536 IP 10.10.10.2 > 10.10.10.1: >>>>> ESP(spi=0x03081e58,seq=0x9a7), length 140 >>>>> 10:35:30.457370 IP 10.10.10.2 > 10.10.10.1: >>>>> ESP(spi=0x03081e58,seq=0x9a8), length 140 >>>>> 10:35:31.475606 IP 10.10.10.2 > 10.10.10.1: >>>>> ESP(spi=0x03081e58,seq=0x9a9), length 140 >>>>> 10:35:31.622315 IP 10.10.10.1.isakmp > 10.10.10.2.isakmp: isakmp: >>>>> phase >>>>> 2/others ? inf[E] >>>>> 10:35:31.622544 IP 10.10.10.2.isakmp > 10.10.10.1.isakmp: isakmp: >>>>> phase >>>>> 2/others ? inf[E] >>>>> 10:35:31.622658 IP 10.10.10.2.isakmp > 10.10.10.1.isakmp: isakmp: >>>>> phase >>>>> 2/others ? inf[E] >>>>> 10:35:31.623933 IP 10.10.10.1.isakmp > 10.10.10.2.isakmp: isakmp: >>>>> phase >>>>> 2/others ? inf[E] >>>>> 10:35:32.492349 IP 10.10.10.2 > 10.10.10.1: >>>>> ESP(spi=0x03081e58,seq=0x9aa), length 140 >>>>> 10:35:33.509346 IP 10.10.10.2 > 10.10.10.1: >>>>> ESP(spi=0x03081e58,seq=0x9ab), length 140 >>>>> 10:35:34.527187 IP 10.10.10.2 > 10.10.10.1: >>>>> ESP(spi=0x03081e58,seq=0x9ac), length 140 >>>>> 10:35:35.539600 IP 10.10.10.2 > 10.10.10.1: >>>>> ESP(spi=0x03081e58,seq=0x9ad), length 140 >>>>> >>>>> With r285535 all works fine. >>> >>> Right commit is in subject - r285336. >> There were two IPsec related commits after 285336. >> >> Either 285347 or 285526 could be the fix. If you're OK after those >> two commits then the system is in correct working order. > I have 285833 on my laptop now (world+kernel full rebuild), but problem > still exists. With IPSEC_DEBUG enabled I have a lot of messages: kernel: esp_output: skip 20 hlen 24 rlen 76 padding 4 alen 20 blksd 16 kernel: esp_output: skip 20 hlen 24 rlen 160 padding 16 alen 20 blksd 16 kernel: esp_output: skip 20 hlen 24 rlen 30 padding 2 alen 20 blksd 16 kernel: esp_output: skip 20 hlen 24 rlen 161 padding 15 alen 20 blksd 16