XFRM_MSG_NEWAE

XFRM_MSG_NEWAE

[David Miller]

I seem to get two of these for every key I type over an SSH session
that goes over IPSEC.

root@sunset:~/src/GIT/iproute2/ip# ./ip xfrm mon
Unknown message: 00000096 0x0000001e 0x00000000
Unknown message: 00000096 0x0000001e 0x00000000
Unknown message: 00000096 0x0000001e 0x00000000
...

Are these being emitted for every replay window update during packet
send and receive?

I think we need a way to tone this down, so that if there are no truly
interested parties we don't do the km->notify work at all.

Also it would be nice to add xfrm mon support to print out these
messages properly if you haven't coded that up already :-)

Re: XFRM_MSG_NEWAE

[Herbert Xu]

David Miller <davem@davemloft.net> wrote:
> 
> I think we need a way to tone this down, so that if there are no truly
> interested parties we don't do the km->notify work at all.

Actually, we do turn it off if nobody is listening, through
xfrm_aevent_is_on().

> Also it would be nice to add xfrm mon support to print out these
> messages properly if you haven't coded that up already :-)

Yes that would be good :)

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: XFRM_MSG_NEWAE

[David Miller]

From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Tue, 15 Aug 2006 18:07:31 +1000

> David Miller <davem@davemloft.net> wrote:
> > 
> > I think we need a way to tone this down, so that if there are no truly
> > interested parties we don't do the km->notify work at all.
> 
> Actually, we do turn it off if nobody is listening, through
> xfrm_aevent_is_on().

Thanks for pointing that out.

Re: XFRM_MSG_NEWAE

[jamal]

On Tue, 2006-15-08 at 18:07 +1000, Herbert Xu wrote:
> David Miller <davem@davemloft.net> wrote:
> > 
> > I think we need a way to tone this down, so that if there are no truly
> > interested parties we don't do the km->notify work at all.
> 
> Actually, we do turn it off if nobody is listening, through
> xfrm_aevent_is_on().
> 

You can also adjust the default timers/packet counts (according to
Documentation/networking/xfrm_sync.txt):

a) /proc/sys/net/core/sysctl_xfrm_aevent_etime
used to provide default values for the XFRMA_ETIMER_THRESH in
incremental units of time of 100ms. The default is 10 (1 second)

b) /proc/sys/net/core/sysctl_xfrm_aevent_rseqth
used to provide default values for XFRMA_REPLAY_THRESH parameter
in incremental packet count. The default is two packets.

If you set either to 0 before starting ipsec, you should not see those
events being generated. You can also override the default values on a
per SA basis when adding/updating.

> > Also it would be nice to add xfrm mon support to print out these
> > messages properly if you haven't coded that up already :-)
> 
> Yes that would be good :)

I do have a few patches lined up. I was waiting for a sync with Stephen
with the current patchset i sent before submitting them (actually i will
wait until after him making a new release because there were just too
many patches i sent in the current update).

cheers,
jamal