Re: Fw: [Bugme-new] [Bug 4138] New: ipsec with racoon in transport mode with esp and ah hangs (problem is in xfrm_state_add)

[Andreas Unterluggauer <au@unterluggauer.org>]

Hallo Herbert,

> On Mon, Jan 31, 2005 at 03:40:16PM +0000, Andreas Unterluggauer wrote:
> > 2005-01-31 16:29:58: DEBUG: ===
> > 2005-01-31 16:29:58: DEBUG: get pfkey ADD message
> > andi: libipsec/pfkey.c, pfkey_check: start (msg->sadb_msg_satype: 3)
> > 2005-01-31 16:29:58: DEBUG: andi: in pfkey.c, pk_recvadd:
> > msg->sadb_msg_seq 2, msg->sadb_msg_type: ADD 2005-01-31 16:29:58: INFO:
> > IPsec-SA established: ESP/Transport 192.168.2.5->192.168.2.3
> > spi=103868257(0x630e761) 2005-01-31 16:29:58: DEBUG: ===
>
> Does the machine hang at this point in time? If not, then this is
> simply a racoon bug.  Although the acquire message carries a policy
> with it, it's really only acquiring a single SA.  Therefore, only
> the SA being acquired should be added with that sequence number.
the machine (kernel) is not hanging!
only the programm (e.g. ping ) is hanging until it gets a timeout. the kernel 
is acquiring a SA and racoon answers, and the kernel is acquiring and racoon 
answers ... until the user-programm stops.

thanks for the information, that its a racoon (ipsec-tools) problem.  I will 
contact the ipsec-tools developers.

ciao
andi