From: Joy Latten <latten@austin.ibm.com>
To: netdev@vger.kernel.org
Cc: paul.moore@hp.com, vyekkirala@TrustedCS.com, jmorris@namei.org,
herbert@gondor.apana.org.au, davem@davemloft.net
Subject: when having to acquire an SA, ipsec drops the packet
Date: Thu, 01 Feb 2007 16:51:21 -0600 [thread overview]
Message-ID: <1170370281.2603.359.camel@faith.austin.ibm.com> (raw)
IPsec returns EAGAIN when it needs to acquire an SA.
There have been a thread or two about this...
Has there been any info or progress in how best to fix this?
James Morris presented some work/ideas,
http://vger.kernel.org/jmorris_ipsec_sa_resolution_netconf2006.pdf
When using labeled xfrms (xfrms that contain a security context), there
is potential for a greater amount of SAs to be created than when using
regular xfrms. An SA may be created every time a different security
context is encountered in a particular traffic stream. This could be
many if each networking app has its own security context, making current
behavior problematic.
Bugreport 225328 has been opened in the Redhat Bugzilla to address
when having to acquire an SA, ipsec drops the packet.
Regards,
Joy
next reply other threads:[~2007-02-01 23:06 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-02-01 22:51 Joy Latten [this message]
2007-02-01 23:44 ` when having to acquire an SA, ipsec drops the packet James Morris
2007-02-02 15:30 ` Paul Moore
2007-02-05 4:53 ` David Miller
2007-02-05 16:33 ` James Morris
2007-02-05 20:34 ` James Morris
2007-02-05 21:07 ` David Miller
2007-02-05 20:49 ` Venkat Yekkirala
2007-02-05 21:11 ` David Miller
2007-02-05 20:53 ` Joy Latten
2007-02-05 21:13 ` David Miller
2007-02-05 20:52 ` Joy Latten
-- strict thread matches above, loose matches on Subject: below --
2007-02-07 16:33 Joy Latten
2007-03-06 1:47 Joy Latten
2007-03-06 3:21 ` James Morris
2007-03-06 17:14 ` Joy Latten
2007-03-06 19:40 ` James Morris
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1170370281.2603.359.camel@faith.austin.ibm.com \
--to=latten@austin.ibm.com \
--cc=davem@davemloft.net \
--cc=herbert@gondor.apana.org.au \
--cc=jmorris@namei.org \
--cc=netdev@vger.kernel.org \
--cc=paul.moore@hp.com \
--cc=vyekkirala@TrustedCS.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).