On 10/16/19 5:57 AM, Bartschies, Thomas wrote:
> Hello,
>
> did another test. This time I've changed the order. First triggered the IPSec
> policy and then tried to ping in parallel with a big packet size.
> Could also reproduce the issue, but the trace was completely different. May
> be this time I've got the trace for the problematic connection?
>
This one was probably a false positive.
The other one, I finally understood what was going on.
You told us you removed netfilter, but it seems you still have the ip defrag
modules there.
(For a pure fowarding node, no reassembly-defrag should be needed)
When ip_forward() is used, it correctly clears skb->tstamp
But later, ip_do_fragment() might re-use the skbs found attached to the master
skb
and we do not init properly their skb->tstamp
The master skb->tstamp should be copied to the children.
I will send a patch asap.
Thanks.
