* Regression in 4.16-rc7 - ipsec vpn broken
@ 2018-03-28 22:26 Derek Robson
0 siblings, 0 replies; 3+ messages in thread
From: Derek Robson @ 2018-03-28 22:26 UTC (permalink / raw)
To: Herbert Xu, Steffen Klassert, ben; +Cc: linux-kernel
The ipsec VPN is broken in 4.16-rc7 and seems to have been broken in all of 4.15
connecting from an iphone seems to give a timeout.
A bisect brings me to this commit as the one that is the issue.
commit: acf568ee859f098279eadf551612f103afdacb4e (xfrm: Reinject
transport-mode packets through tasklet)
Reverting commit acf568ee859f098279eadf551612f103afdacb4e against
4.16-rc7 causes the VPN to function again.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Regression in 4.16-rc7 - ipsec vpn broken
2018-03-29 6:51 ` Steffen Klassert
@ 2018-03-30 0:22 ` Derek Robson
0 siblings, 0 replies; 3+ messages in thread
From: Derek Robson @ 2018-03-30 0:22 UTC (permalink / raw)
To: Steffen Klassert; +Cc: Herbert Xu, ben, linux-kernel, netdev
Thanks, that patch has solved issue.
On Thu, Mar 29, 2018 at 7:51 PM, Steffen Klassert
<steffen.klassert@secunet.com> wrote:
> Please always make sure to Cc netdev@vger.kernel.org
> on networking problems.
>
> On Wed, Mar 28, 2018 at 10:21:32PM +0000, Derek Robson wrote:
>> The ipsec VPN is broken in 4.16-rc7 and seem to have been broken in all of
>> 4.15
>>
>> connecting from an iphone seems to give a timeout.
>>
>>
>> A bisect brings me to this commit as the one that is the issue.
>>
>> commit: acf568ee859f098279eadf551612f103afdacb4e (xfrm: Reinject
>> transport-mode packets through tasklet)
>
> I have a fix queued for this commit in the ipsec tree.
>
> Can you please try if the patch below fixes your problems?
>
> Thanks!
>
> Subject: [PATCH] xfrm: Fix transport mode skb control buffer usage.
>
> A recent commit introduced a new struct xfrm_trans_cb
> that is used with the sk_buff control buffer. Unfortunately
> it placed the structure in front of the control buffer and
> overlooked that the IPv4/IPv6 control buffer is still needed
> for some layer 4 protocols. As a result the IPv4/IPv6 control
> buffer is overwritten with this structure. Fix this by setting
> a apropriate header in front of the structure.
>
> Fixes acf568ee859f ("xfrm: Reinject transport-mode packets ...")
> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
> ---
> net/xfrm/xfrm_input.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
> index 1472c0857975..81788105c164 100644
> --- a/net/xfrm/xfrm_input.c
> +++ b/net/xfrm/xfrm_input.c
> @@ -26,6 +26,12 @@ struct xfrm_trans_tasklet {
> };
>
> struct xfrm_trans_cb {
> + union {
> + struct inet_skb_parm h4;
> +#if IS_ENABLED(CONFIG_IPV6)
> + struct inet6_skb_parm h6;
> +#endif
> + } header;
> int (*finish)(struct net *net, struct sock *sk, struct sk_buff *skb);
> };
>
> --
> 2.14.1
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Regression in 4.16-rc7 - ipsec vpn broken
[not found] <CAMfSVWDZn28cYpseJCc=gO1uD1Cr_P5vKRW8FjaqczooyecHwg@mail.gmail.com>
@ 2018-03-29 6:51 ` Steffen Klassert
2018-03-30 0:22 ` Derek Robson
0 siblings, 1 reply; 3+ messages in thread
From: Steffen Klassert @ 2018-03-29 6:51 UTC (permalink / raw)
To: Derek Robson; +Cc: Herbert Xu, ben, linux-kernel, netdev
Please always make sure to Cc netdev@vger.kernel.org
on networking problems.
On Wed, Mar 28, 2018 at 10:21:32PM +0000, Derek Robson wrote:
> The ipsec VPN is broken in 4.16-rc7 and seem to have been broken in all of
> 4.15
>
> connecting from an iphone seems to give a timeout.
>
>
> A bisect brings me to this commit as the one that is the issue.
>
> commit: acf568ee859f098279eadf551612f103afdacb4e (xfrm: Reinject
> transport-mode packets through tasklet)
I have a fix queued for this commit in the ipsec tree.
Can you please try if the patch below fixes your problems?
Thanks!
Subject: [PATCH] xfrm: Fix transport mode skb control buffer usage.
A recent commit introduced a new struct xfrm_trans_cb
that is used with the sk_buff control buffer. Unfortunately
it placed the structure in front of the control buffer and
overlooked that the IPv4/IPv6 control buffer is still needed
for some layer 4 protocols. As a result the IPv4/IPv6 control
buffer is overwritten with this structure. Fix this by setting
a apropriate header in front of the structure.
Fixes acf568ee859f ("xfrm: Reinject transport-mode packets ...")
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
---
net/xfrm/xfrm_input.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index 1472c0857975..81788105c164 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -26,6 +26,12 @@ struct xfrm_trans_tasklet {
};
struct xfrm_trans_cb {
+ union {
+ struct inet_skb_parm h4;
+#if IS_ENABLED(CONFIG_IPV6)
+ struct inet6_skb_parm h6;
+#endif
+ } header;
int (*finish)(struct net *net, struct sock *sk, struct sk_buff *skb);
};
--
2.14.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2018-03-30 0:22 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-03-28 22:26 Regression in 4.16-rc7 - ipsec vpn broken Derek Robson
[not found] <CAMfSVWDZn28cYpseJCc=gO1uD1Cr_P5vKRW8FjaqczooyecHwg@mail.gmail.com>
2018-03-29 6:51 ` Steffen Klassert
2018-03-30 0:22 ` Derek Robson
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.