On 23.7.2021. 16:20, Vitaliy Makkoveev wrote:
> On Thu, Jul 22, 2021 at 11:30:02PM +0200, Hrvoje Popovski wrote:
>> On 22.7.2021. 22:52, Vitaliy Makkoveev wrote:
>>> On Thu, Jul 22, 2021 at 08:38:04PM +0200, Hrvoje Popovski wrote:
>>>> On 22.7.2021. 12:21, Hrvoje Popovski wrote:
>>>>> Thank you for explanation..
>>>>>
>>>>> after hitting box all night, box panic and i was able to reproduce it
>>>>> this morning ... I'm not sure but box panic after hour or more of
>>>>> sending traffic through iked tunnel ..
>>>>> I will try to reproduce it through ipsec tunnel ..
>>>>
>>>> with isakmpd i've got panic after 5 or more hours
>>>>
>>>> r620-1# uvm_fault(0xffffffff822b2158, 0x137, 0, 2) -> e
>>>> kernel: page fault trap, code=0
>>>> Stopped at tdb_free+0x9c: movq %rsi,0(%rdi)
>>>> TID PID UID PRFLAGS PFLAGS CPU COMMAND
>>>> 469292 75215 68 0x10 0 2 isakmpd
>>>> *142487 42745 0 0x14000 0x40000200 0K softclock
>>>> tdb_free(ffff80000118f6e0) at tdb_free+0x9c
>>>> tdb_timeout(ffff80000118f6e0) at tdb_timeout+0x77
>>>> softclock_thread(ffff8000ffffefc0) at softclock_thread+0x16e
>>>> end trace frame: 0x0, count: 12
>>>> https://www.openbsd.org/ddb.html describes the minimum info required in
>>>> bug reports. Insufficient info makes it difficult to find and fix bugs.
>>>>
>>> There is the bluhm@'s diff with serialized `ipsec_in_use' access. Can
>>> you try it?
>>
>> Hi,
>>
>> I'm running this diff with "ipsec crypto no queue" and i'm seeing
>> traffic drops. This is little strange because "ipsec crypto no queue"
>> diff take care of those drops...
>>
>
> Thanks!
>
> Did you caught panics?
> Could you share "netstat -s -p ipsec" output?
>
Hi,
box didn't panic, just stopped forwarding traffic through tunnel.
ipsec:
0 input IPsec packets
3299331 output IPsec packets
0 input bytes
1781638740 output bytes
0 input bytes, decompressed
2235858152 output bytes, uncompressed
0 packets dropped on input
1030761 packets dropped on output
0 packets that failed crypto processing
0 packets for which no XFORM was set in TDB received
447309 packets for which no TDB was found
it still little strange to me that with "ipsec crypto no queue"
diff i see traffic drops ... so i will do all over again just to be sure
that i'm not doing something wrong ..
