[Swan] mis-matched phase 2 settings cause infinite rekeys, high load, and broad failure across unrelated tunnels

2018-10-19 Thread Dharma Indurthy
Hey, folks. My colleague Terell described this issue about a month ago. For background, we have libreswan server running that supports ~150 connections. We proceeded with a libreswan upgrade to 3.25. ipsec verify: Verifying installed system and configuration files Version check and ipsec

Re: [Swan] Valid packets dropping in the kernel

2018-11-06 Thread Dharma Indurthy
Hey, Paul. I appreciate your response. Do not use leftsourceip= if you specify more then one leftsubnet. Also, > leftsourceip= must be an IP address within the (single) leftsubnet= > > right=12.131.93.13 > > rightsubnets=" 10.50.32.166/32 10.50.32.239/32 10.50.36.4/32 " > >

Re: [Swan] Valid packets dropping in the kernel

2018-11-07 Thread Dharma Indurthy
priority 1040351 tmpl src 172.20.109.76 dst 12.131.93.13 proto esp reqid 20137 mode tunnel But not the others. On Tue, Nov 6, 2018 at 10:59 AM Dharma Indurthy wrote: > Hey, Paul. I appreciate your response. > > Do not use leftsourceip= if you specify more then one leftsubnet. Also, >>

[Swan] One more hi-rekey cycling issue

2018-11-06 Thread Dharma Indurthy
Previously, we mentioned this issue: https://lists.libreswan.org/pipermail/swan/2018/002759.html which more-or-less appears to be working as designed, although I have not seen the specific pattern since our 3.25 upgrade. However, we have a new infinitely loop that appears to occur completely on

[Swan] Valid packets dropping in the kernel

2018-11-02 Thread Dharma Indurthy
Hey, folks. I have a conundrum. It looks very similar to https://lists.libreswan.org/pipermail/swan/2018/002834.html, which doesn't have an outcome yet, I don't think. We have the following connection, one of a couple hundred -- the rest of which seem to work fine as far as we can tell. I