[Swan] large number of events being logged

Andrew Cagney andrew.cagney at gmail.com
Wed May 24 02:30:12 EEST 2023


Are connections from that address expected?

It looks like this read:
  uint8_t bigbuffer[MAX_INPUT_UDP_SIZE]; /* ??? this buffer seems
*way* too big */
  ssize_t packet_len = read((*ifp)->fd, bigbuffer, sizeof(bigbuffer));
in read_espintcp_packet() returned zero bytes triggering:
  if (packet_len == 0) {
    /* interpret this as EOF */
    llog_iketcp(RC_LOG, logger, *ifp, /*no-error*/0,
    "%zd byte %s indicates EOF",
    packet_len, what);
normally a 0 byte read from a socket indicates EOF (but these are a
little strange).  You could check the other end to see if there's a
reason why the socket closed.

ref: https://testing.libreswan.org/v4.9-1688-g8bfefe7284-main/ikev2-tcp-01-eof/OUTPUT/east.console.txt


More information about the Swan mailing list