2.6.2 issues (IPSec+NAT, RFC2684 bridge)

2.6.2 issues (IPSec+NAT, RFC2684 bridge)

[Samofatov, Nickolay]

Hi!

Here is a list of minor issues I encountered when migrated my AMD64
machine to 2.6.2 kernel (64-bit).

1) Attempts to combine IPSec and NAT result in various kinds of
failures. The easiest to reproduce is reliable hard system lock-up when
IKE session needs to be initiated because of request from masqueraded
machine.
(workaround is to run cron job keeping IPSec connection active)

2) I had to add following line to my routing rules to get IPSec working
locally:
--
route add -m 172.20.0.0 netmask 255.255.0.0 gw 172.21.113.1
--
172.20.0.0 here is VPN subnet I'm interested in. 172.21.113.1 is the
address assigned to eth0 interface which is also IP address of this
machine in VPN.
Before I added this rule TCP connections from localhost failed with no
route to host. The result works for most applications, but not all. For
example, SSH fails.
(my workaround is to use SOCKS5 proxy running locally for local SSH
connections over IPSec tunnels)

3) RFC2684 bridge oopses when I try to run it with my ATM device
(SpeedTouch USB) not plugged.
(workaround is to check if device is really plugged and initialized in
usbfs before attempting to start bridge)
BTW, if you build SpeedTouch driver as module and build ATM bridge into
kernel you get oopses during bridge initialization.
(AFAIU, they work fine only if both built into kernel)

4) My attempts to use preemptable kernel failed miserably. Kernel
produces lots of warnings during boot and usually oopses before system
init finishes. If I disable RFC2684 bridge it successfully boots more
often, but attempts to do any big work, for example to start X fail in
any case.
(workaround is to build non-preeptable kernel, bad for multimedia
applications, but tolerable)

If there is interest, I may provide as much information as required to
resolve the problems.

But in general, 2.6.2 kernel works great. When I find a way to work
around hard system lockups when NPTL is used in combination with NVIDIA
XFree drivers I'll be totally happy.


Nickolay Samofatov

Re: 2.6.2 issues (IPSec+NAT, RFC2684 bridge)

[Michal Ludvig]

Samofatov, Nickolay told me that:
> Here is a list of minor issues I encountered when migrated my AMD64
> machine to 2.6.2 kernel (64-bit).
> 
> 1) Attempts to combine IPSec and NAT result in various kinds of
> failures. The easiest to reproduce is reliable hard system lock-up when
> IKE session needs to be initiated because of request from masqueraded
> machine.
> (workaround is to run cron job keeping IPSec connection active)

You probably hit the same bug as I did. When a SPD policy expires the 
notification to userspace fails. Please try the patch from here and let 
me know if it helps:
http://marc.theaimsgroup.com/?l=linux-netdev&m=107761652405761&w=2

> 2) I had to add following line to my routing rules to get IPSec working
> locally:
> --
> route add -m 172.20.0.0 netmask 255.255.0.0 gw 172.21.113.1
> --
> 172.20.0.0 here is VPN subnet I'm interested in. 172.21.113.1 is the
> address assigned to eth0 interface which is also IP address of this
> machine in VPN.
> Before I added this rule TCP connections from localhost failed with no
> route to host. The result works for most applications, but not all. For
> example, SSH fails.
> (my workaround is to use SOCKS5 proxy running locally for local SSH
> connections over IPSec tunnels)

Try to specify source address as well:
ip route add 172.20.0.0/16 via 172.21.113.1 src 172.21.x.x

> If there is interest, I may provide as much information as required to
> resolve the problems.

If the IPsec issues still remain, send me more information so that I 
could reproduce it here.

Michal Ludvig
-- 
SUSE Labs                    mludvig@suse.cz | Cray is the only computer
(+420) 296.545.373        http://www.suse.cz | that runs an endless loop
Personal homepage http://www.logix.cz/michal | in just four hours.