IJ27370: LOADING IPSEC AND IPFILTER CAN CRASH SYSTEM APPLIES TO AIX 7200-05

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• A system crash can occur when loading and unloading
  ipfilter and ipsec:
  1) /usr/lib/methods/cfg_ipf -l ## load ipfilter
  2) mkdev -l ipsec_v4 ## load ipsec
  3) rmdev -l ipsec_v4 ## unload ipsec ==> sets
  ip_fltr_in_hook  to NULL
  4) /usr/lib/methods/cfg_ipf -u ## unload ipfilter ==>
  crash
  
  Its also possible to get ipsec into a permanent EBUSY
  condition
  requiring reboot to clear using the following sequence:
  1) mkdev -l ipsec_v4 ## load ipsec
  2) /usr/lib/methods/cfg_ipf -l ## load ipfilter
  3) /usr/lib/methods/cfg_ipf -u ## unload ipfilter  sets
  ip_fltr_in_hook
  4) rmdev -l ipsec_v4 ## unload ipsec ==> fails EBUSY
  
  No warning is issued to prevent admin from combining
  incompatible
  filter extensions.
  

Local fix

• If the ipfilter (ipfl.rte) software is not used it can be
  removed to
  help prevent this issue.
  

Problem summary

• LOADING IPSEC AND IPFILTER CAN CRASH SYSTEM
  

Problem conclusion

• Modified ipsec code to avoid loading if some other filter
  already has the hooks
  

Temporary fix

Comments

• 7200-05 - use AIX APAR IJ27370
  

APAR Information

• APAR is sysrouted FROM one or more of the following:

  IJ26519

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  AIX V7.2

• Fixed component ID

  5765CD200

Applicable component levels

• R720 PSY U885585

     UP20/11/04 I 1000

PTF to Fileset Mapping

• U885585 bos.net.ipsec.rte 7.2.5.0