From a538dc4e862dc30a306d383342ec1c34f2dad33e Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Sat, 31 May 2008 00:54:50 +0000
Subject: [PATCH] Linux: IPSEC and xfrm_larval_drop

---
 FAQ.xml | 26 +++++++++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

diff --git a/FAQ.xml b/FAQ.xml
index 5594024a85..cf24dc8a10 100644
--- a/FAQ.xml
+++ b/FAQ.xml
@@ -17,7 +17,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: FAQ.xml,v 1.35 2008/02/25 01:28:02 marka Exp $ -->
+<!-- $Id: FAQ.xml,v 1.36 2008/05/31 00:54:50 marka Exp $ -->
 
 <article class="faq">
   <title>Frequently Asked Questions about BIND 9</title>
@@ -1015,6 +1015,30 @@ client: UDP client handler shutting down due to fatal receive error: unexpected
       </answer>
     </qandaentry>
 
+    <qandaentry>
+      <question>
+	<para>
+	  Why does named lock up when it attempts to connect over IPSEC tunnels?
+	</para>
+      </question>
+      <answer>
+	<para>
+	  This is due to a kernel bug where the fact the a socket is marked
+	  non-blocking is ignored.  It is reported that setting
+	  xfrm_larval_drop to 1 helps but this may have negative side effects.
+	  See:
+<ulink url="https://bugzilla.redhat.com/show_bug.cgi?id=427629">https://bugzilla.redhat.com/show_bug.cgi?id=427629</ulink>
+	  and
+<ulink url="http://lkml.org/lkml/2007/12/4/260">http://lkml.org/lkml/2007/12/4/260</ulink>
+	</para>
+	<para>
+	xfrm_larval_drop can be set to 1 by the following proceedure:
+<programlisting>
+echo "1" &gt; proc/sys/net/core/xfrm_larval_drop</programlisting>
+	</para>
+      </answer>
+    </qandaentry>
+
     <qandaentry>
       <question>
 	<para>