Bug 36122

Summary:	New cache learned PMTU information in inetpeer causes ssh to fail when tunneled via an IPSEC VPN
Product:	Networking	Reporter:	Anthony Basile (blueness)
Component:	IPV4	Assignee:	Stephen Hemminger (stephen)
Status:	RESOLVED CODE_FIX
Severity:	normal	CC:	alan, dan, kenyon, kernel
Priority:	P1
Hardware:	All
OS:	Linux
URL:	http://bugs.gentoo.org/show_bug.cgi?id=369025
Kernel Version:	2.6.39	Subsystem:
Regression:	Yes	Bisected commit-id:

Description Anthony Basile 2011-05-28 21:50:21 UTC

When trying to ssh from a box running 2.6.39 on one private subnet to another box on another private subnet via an IPSEC vpn, ssh freezes and times out at:

   debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP

This was traced down to commit 2c8cec5c10bced2408082a6656170e74ac17231c.

This type of error is known to occur when there is fragmentation due to mismatched mtu's which the commit addresses.

Notice the problem does not occur when ssh-ing directly, ie not via an IPSEC tunnel.  I have not tested if other tunnels are affected.

Please see the downstream bug for more details.

Comment 1 Andrew Morton 2011-06-06 20:49:40 UTC

(switched to email.  Please respond via emailed reply-to-all, not via the
bugzilla web interface).

On Sat, 28 May 2011 21:50:32 GMT
bugzilla-daemon@bugzilla.kernel.org wrote:

> https://bugzilla.kernel.org/show_bug.cgi?id=36122
> 
>                URL: http://bugs.gentoo.org/show_bug.cgi?id=369025
>            Summary: New cache learned PMTU information in inetpeer causes
>                     ssh to fail when tunneled via an IPSEC VPN
>            Product: Networking
>            Version: 2.5
>     Kernel Version: 2.6.39
>           Platform: All
>         OS/Version: Linux
>               Tree: Mainline
>             Status: NEW
>           Severity: normal
>           Priority: P1
>          Component: IPV4
>         AssignedTo: shemminger@linux-foundation.org
>         ReportedBy: blueness@gentoo.org
>                 CC: kernel@gentoo.org
>         Regression: No
> 
> 
> When trying to ssh from a box running 2.6.39 on one private subnet to another
> box on another private subnet via an IPSEC vpn, ssh freezes and times out at:
> 
>    debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
> 
> This was traced down to commit 2c8cec5c10bced2408082a6656170e74ac17231c.
> 
> This type of error is known to occur when there is fragmentation due to
> mismatched mtu's which the commit addresses.
> 
> Notice the problem does not occur when ssh-ing directly, ie not via an IPSEC
> tunnel.  I have not tested if other tunnels are affected.
> 
> Please see the downstream bug for more details.
>

Comment 2 Dan Siemon 2011-06-10 02:50:19 UTC

I've been having PMTU problems with 2.6.39 and IPIP tunnels which might be related to this. The symptom is that the MTU values in the route cache decrease in odd increments until nothing works. I can collect specific details if needed.