Re: IPSEC stop works after r285336

27.07.2015 10:23, Alexandr Krivulya пишет:
> 26.07.2015 21:39, George Neville-Neil пишет:
>>
>> On 25 Jul 2015, at 1:51, Alexandr Krivulya wrote:
>>
>>> 25.07.2015 00:38, John-Mark Gurney пишет:
>>>> Alexandr Krivulya wrote this message on Thu, Jul 23, 2015 at 10:38
>>>> +0300:
>>>>> I have IPSEC tunnel inside l2tp tunnel via mpd. After r285536 I see
>>>>> only
>>>>> outgoing esp packets on ng interface:
>>>> This change is -stable, not -current, but the change referenced below
>>>> is -current... Which one are you running?
>>>>
>>>> Also, the only ipsec related change after r285535 is r285770, though
>>>> that probably won't effect it...  Could you possibly narrow the change
>>>> that broke things?
>>>>
>>>>> root_at_thinkpad:/usr/src # tcpdump -i ng0
>>>>> tcpdump: verbose output suppressed, use -v or -vv for full protocol
>>>>> decode
>>>>> listening on ng0, link-type NULL (BSD loopback), capture size
>>>>> 262144 bytes
>>>>> 10:35:27.331886 IP 10.10.10.2 > 10.10.10.1:
>>>>> ESP(spi=0x03081e58,seq=0x9a5), length 140
>>>>> 10:35:28.371707 IP 10.10.10.2 > 10.10.10.1:
>>>>> ESP(spi=0x03081e58,seq=0x9a6), length 140
>>>>> 10:35:29.443536 IP 10.10.10.2 > 10.10.10.1:
>>>>> ESP(spi=0x03081e58,seq=0x9a7), length 140
>>>>> 10:35:30.457370 IP 10.10.10.2 > 10.10.10.1:
>>>>> ESP(spi=0x03081e58,seq=0x9a8), length 140
>>>>> 10:35:31.475606 IP 10.10.10.2 > 10.10.10.1:
>>>>> ESP(spi=0x03081e58,seq=0x9a9), length 140
>>>>> 10:35:31.622315 IP 10.10.10.1.isakmp > 10.10.10.2.isakmp: isakmp:
>>>>> phase
>>>>> 2/others ? inf[E]
>>>>> 10:35:31.622544 IP 10.10.10.2.isakmp > 10.10.10.1.isakmp: isakmp:
>>>>> phase
>>>>> 2/others ? inf[E]
>>>>> 10:35:31.622658 IP 10.10.10.2.isakmp > 10.10.10.1.isakmp: isakmp:
>>>>> phase
>>>>> 2/others ? inf[E]
>>>>> 10:35:31.623933 IP 10.10.10.1.isakmp > 10.10.10.2.isakmp: isakmp:
>>>>> phase
>>>>> 2/others ? inf[E]
>>>>> 10:35:32.492349 IP 10.10.10.2 > 10.10.10.1:
>>>>> ESP(spi=0x03081e58,seq=0x9aa), length 140
>>>>> 10:35:33.509346 IP 10.10.10.2 > 10.10.10.1:
>>>>> ESP(spi=0x03081e58,seq=0x9ab), length 140
>>>>> 10:35:34.527187 IP 10.10.10.2 > 10.10.10.1:
>>>>> ESP(spi=0x03081e58,seq=0x9ac), length 140
>>>>> 10:35:35.539600 IP 10.10.10.2 > 10.10.10.1:
>>>>> ESP(spi=0x03081e58,seq=0x9ad), length 140
>>>>>
>>>>> With r285535 all works fine.
>>>
>>> Right commit is in subject - r285336.
>> There were two IPsec related commits after 285336.
>>
>> Either 285347 or 285526 could be the fix.  If you're OK after those
>> two commits then the system is in correct working order.
> I have 285833 on my laptop now (world+kernel full rebuild), but problem
> still exists.

With IPSEC_DEBUG enabled I have a lot of messages:

kernel: esp_output: skip 20 hlen 24 rlen 76 padding 4 alen 20 blksd 16
kernel: esp_output: skip 20 hlen 24 rlen 160 padding 16 alen 20 blksd 16
kernel: esp_output: skip 20 hlen 24 rlen 30 padding 2 alen 20 blksd 16
kernel: esp_output: skip 20 hlen 24 rlen 161 padding 15 alen 20 blksd 16