IPsec and EAGAIN

IPsec and EAGAIN

[James Ring]

Hi all,

I have recently run into the issue where connect() returns -EAGAIN
if the remote host is on the other end of an IPsec tunnel for which no
SAD exists yet.

I have read a few threads on the topic, and it seems that the idea is to
implement a scheme similar to ARP for queueing outgoing packets until the
SAD has been negotiated by the IKE process.

I have a couple of questions: are there any patches out which solve this
problem?

Also, what is the purpose of the code in the xfrm_lookup function
(in net/xfrm_policy.c) when `flags' is true? I have applied a patch
similar to

http://sourceforge.net/mailarchive/message.php?msg_id=8621194

which gives desirable behaviour (ie. telnet appears to pause while the
racoon negotiation is performed, after which it connects just fine, no
EAGAIN).

Please CC me to any responses, I am not subscribed to the list.

Thanks for your time,
James
-- 
James Ring

Re: IPsec and EAGAIN

[Herbert Xu]

James Ring <sjr@jdns.org> wrote:
> 
> I have a couple of questions: are there any patches out which solve this
> problem?

This is on our todo list but AFAIK there aren't patches for it yet.

> http://sourceforge.net/mailarchive/message.php?msg_id=8621194

This patch can lock up your machine when this function is entered in an
unsleepable context.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt