[Openswan Users] klips_error:ipsec_xmit_encap_once: tried to skb_put 20, 16 available. This should never happen, please report.

[Paul Wouters]

On Fri, 29 Jul 2011, Danilo Godec wrote:

> Doing some more testing on this with OpenSwan 2.6.35. Looks like
> OpenSwan now shows a bit more details, so I'm re-posting.
>
> This is what I see in 'dmesg' while it's still working:
>
>> [1545317.522767] klips_debug:ipsec_mast_start_xmit: skb=ffff8800e72e4180
>> [1545317.522769] klips_debug:ipsec_mast_start_xmit: getting SAref=1
>> from nfmark
>> [1545317.523244] klips_debug:ipsec_mast_start_xmit: skb=ffff8800e72e4080
>> [1545317.523246] klips_debug:ipsec_mast_start_xmit: getting SAref=1
>> from nfmark
>> [1545318.611932] klips_debug:ipsec_mast_start_xmit: skb=ffff8800e72e4580
>> [1545318.694863] klips_debug:ipsec_mast_start_xmit: getting SAref=1
>> from nfmark
>> [1545318.761593] klips_debug:ipsec_mast_start_xmit: skb=ffff8800e72e4480
>> [1545318.844617] klips_debug:ipsec_mast_start_xmit: getting SAref=1
>> from nfmark
>> [1545318.844702] klips_debug:ipsec_mast_start_xmit: skb=ffff8800e1bbcbc0
>> [1545318.844704] klips_debug:ipsec_mast_start_xmit: getting SAref=1
>> from nfmark
>
> I guess 'klips_debug' is enabled by default and I don't have
> klips_debug="none" in my config.

It's a bug we introduced. I noticed it too and it should not be shown without
debug. It will be fixed in 2.6.36.

> To refresh - this is OpenSwan running in Xen Dom0. I then have one or
> more DomU's that connect through IPSEC to a cfengine server.
>
> So when I run 'cfagent' on a DomU, it I starts off fine, but after a
> while, it stops and at that moment I get these:
>
>> [1545318.844707] klips_error:ipsec_xmit_encap_init: tried to skb_put
>> 20, 16 available. Retuning IPSEC_XMIT_ESP_PUSHPULLERR  This should
>> never happen, please report.

Interesting. We tried to reproduce this error in the past and failed. Is your
xen perhaps running out of memory because it allocated all of it to guests?

Does it recover from this? Does it only happen occasionally?

Does lowering the mtu have any effect?

Paul