[prev in list] [next in list] [prev in thread] [next in thread] 

List:       ipfilter
Subject:    Solaris 10 x86 Panic using IPSEC with IP Filter 4.1.5
From:       John Wehle <john () feith ! com>
Date:       2005-02-18 3:21:57
Message-ID: 200502180321.j1I3LvEU028885 () jwlab ! FEITH ! COM
[Download RAW message or body]

IP in IP tunnels protected by transport mode IPSEC work using
Solaris 9 and IP Filter 4.1.3 (plus various patches which have
since been folded into 4.1.5).

Under Solaris 10 with IP Filter 4.1.5 (we removed SUNWipfu and
SUNWipfr since they're too old to support our application) the
system panics when traffic transverses the tunnel.

The panic only seems to occur when IPSEC is enabled and the
system goes to send a packet out the tunnel ... it does not
occur when traffic transverses the tunnel if IPSEC is disabled.

It's as if the IPSEC code is expecting to be handed message
blocks in a certain fashion which pfil isn't respecting (i.e.
extra space in the data block for IPSEC to use without having
to reallocate things).

ifconfig e1000g0 modlist                ifconfig ip.tun0 modlist

       0 arp                                 0 ip
       1 ip                                  1 pfil
       2 pfil                                2 tun
       3 e1000g                              3 ip

Running snoop on the machine results in complaints about:

  bad packet header in buffer off 188 length = 0

and

  RUNT (short packet - 2 bytes)

prior to each crash.

The stack from one crash is:

  ... possibly more lines which scrolled off the screen ...
  ip:ipsec_out_process+322
  ip:ip_wput_ire+18d0
  ip:ip_output+70a
  ip:ip_wput+14
  unix:putnext+1b7
  tun:tun_wputnext_v4+1f8
  tun:tun_wproc_mdata+71
  tun:tun_wproc+df
  tun:tun_ppa_list+25231e7c
  unix:putnext+1b7
  pfil:pfilmodwput+1df
  unix:putnext+1b7
  ip:ip_wput_ire+17d1
  ip:ip_output+70a
  ip:tcp_send_data+5f9
  ip:tcp_ack_timer+b0
  ip:tcp_timer_handler+1d
  ip:squeue_drain+bb
  ip:squeue_worker+eb

other crashes look like:

  freemsg+0x69
  e1000g_start+0x362
  e1000gwsrv+0x59
  runservice+0x2a
  queue_service+0x30
  stream_service+0x69
  taskq_d_thread+0x8a

Any suggestions on what to do next?

-- John
-------------------------------------------------------------------------
|   Feith Systems  |   Voice: 1-215-646-8000  |  Email: john@feith.com  |
|    John Wehle    |     Fax: 1-215-540-5495  |                         |
-------------------------------------------------------------------------

[prev in list] [next in list] [prev in thread] [next in thread]