ipsec blocking issue in 2.6.25 (and earlier)

ipsec blocking issue in 2.6.25 (and earlier)

[Matt LaPlante]

I'd like to call attention to an apparent bug that has been causing me some significant trouble lately.  In brief, transmission of data over IPSEC (apparently the sendmsg call in particular) is blocking when the IPSEC connection becomes unavailable.  This is causing various daemons such as named and squid to behave rather badly... in the case of named, it binds (no pun intended) up the entire daemon and it starts refusing queries from all interfaces.

I first noticed this somewhat earlier on in the 2.6.2x series, but only recently did I find a fairly comprehensive bug report with Redhat that confirmed the issue.  Please see the full report here:
https://bugzilla.redhat.com/show_bug.cgi?id=427629

Please also note that I'm actually experiencing this under Ubuntu, and am using a custom built (fairly minimal; unpatched) kernel.  This apparently confirms that it is not a distro-specific issue, and is most likely a fairly purvasive kernel bug.

As I can still replicate this fairly readily, I'd be glad to assist in further troubleshooting, but I'm about at the end of my range when it comes to diagnosing the issue myself.

Thanks,
Matt LaPlante

Re: ipsec blocking issue in 2.6.25 (and earlier)

[David Miller]

echo "1" >/proc/sys/net/core/xfrm_larval_drop