This list is intended for people who want to be involved with the development and design of OpenSWAN. ()

headers hiren joshi | 19 Aug 2008 11:41 · /ipsec/

_______________________________________________
Dev mailing list
Dev <at> openswan.org
http://lists.openswan.org/mailman/listinfo/dev

Sending kernel back-trace.

Thanks for your time.

Regards,
-hiren

----------------------------------------------------------------

root <at> manage /root]# Unable to handle kernel paging requiest at virtual
address bccd0858 printing eip:
*pde = 00000000
Oops : 0002 [#1]
Modules linked in: ppp_deflate zlib_deflate zlib_inflate bsd_comp
ip_nat_ftp ip_conntrack_ftp ip_conntrack_netlink ipsec sha512
ip_nat_h323 ip_conntrack_h323 ip_nat_irc ip_conntrack_irc ip_nat_pptp
ip_conntrack_pptp ip_nat_tftp ip_conntrack_tftp sch_htb md5 sha1
sha256 des blowfish cast5 serpent twofish aes pppoe pppox ppp_synctty
ppp_async crc_ccitt ppp_generic slhc ipt_MASQUERADE ipt_iprange
ipt_ULOG imq ipt_mport ipt_status xt_pkttype ipt_REDIRECT
arptable_filter arp_tables ipt_hashlimit xt_tcpudp ipt_unclean
ipt_recent ipt_NOTRACK ipt_IMQ ipt_CONNMARK xt_state iptable_raw
iptable_mangle ipt_ipp2p iptable_nat ip_nat ip_conntrack nfnetlink
iptable_filter ip_tables x_tables e100 8021q

CPU:    0
EIP:      0060:[<d0ae7004>]        Not tainted VLI
EFLAGS:          00010202          (2.6.13.13-1 #81)
EIP is at ipcomp_inflate_flush+0x74/0x170 [ipsec]
eax: c934a380 ebx: 000001d5 ecx: 00000075 edx:00000000
esi:  c85a8000 edi: bccd0858 ebp: c85a8000 esp: c03579ec
ds: 007b es: 007b ss: 0068
Process swapper (pid: 0, threadinfo=c0356000 task=c030c200)
Stack: <0>000000ff 00007e38 c85a81c8 bccd0585 00000008 00000006
c934a380 ced54560
    d0ae5a65 c934a380 c0357b44 00000000 c816c800 c934a380 c0357b44 00007e2b
    c85a81d5 00000000 cd32f980 00000000 00000000 c0357b44 00000000
000000f2 [<d0ae5a65>] ipcomp_inflate_codes+0x725/0x800 [ipsec]
[<d0ae4d93>] ipcomp_deflate_blocks+0x993/0xe30 [ipsec] [<c0252ae7>]
__alloc_skb+0x57/0x110 [<d0ae63ba>] ipcomp_inflate+0x27a/0x3e0 [ipsec]
[<d0ae1ff9>] skb_decompress+0x329/0x7a0 [ipsec] [<d0ae15d0>]
my_zcalloc+0x0/0x30 [ipsec] [<d0ae1600>] my_zfree+0x0/0x10 [ipsec]
[<d0add0e8>] ipsec_rcv_ipcomp_decomp+0x188/0x2a0 [ipsec] [<d0acd013>]
ipsec_rcv_decap_once+0x463/0xde0 [ipsec] [<d0acd9d7>]
ipsec_rcv_decap+0x74/0x9d0 [ipsec] [<c02161e1>]
ide_do_request+0x1b1/0x390 [<c01c7065>] vsnprintf+0x265/0x4e0
[<d0ace725>] ipsec_rcv+0x245/0x4a0 [ipsec] [<c0277096>]
ip_local_deliver+0x116/0x270 [<c0277770>]
ip_local_deliver_finish+0x0/0x1d0 [<c02774ac>] ip_rcv+0x2bc/0x580
[<c0277940>] ip_rcv_finish+0x0/0x2c0 [<d08c310e>]
pcnet32_interrupt+0x48e/0x500 [pcnet32] [<c0258e9c>]
netif_receive_skb+0x23c/0x2e0 [<c0258fb8>] process_backlog+0x78/0xf0
[<c02590bc>] net_rx_action+0x8c/0x140 [<c0119d9b>]
__do_softirq+0x7b/0x90 [<c0119dd6>] do_softirq+0x26/0x30 [<c0104a3e>]
do_IRQ+0x1e/0x30 [<c0102e16>] common_interrupt+0x1a/0x20 [<c0100cf1>]
default_idle+0x1a/0x20 [<c0100d90>] cpu_idle+0x50/0x60 [<c0358778>]
start_kernel+0x178/0x1c0 [<c03582d0>] unknown_bootoption+0x178/0x1c0
Code: 2c 89 44 24 2c 8b 4c 24 28 29 da 01 59 14 89 51 10 8b 44 24 24
8b 50 38 85 d2 0f 85 dc 00 00 00 89 d9 8b 7c 24 0c 89 ee c1 e9 02 <f3>
a5
89 d9 83 e1 03 74 02 f3 a4 01 5c 24 0c 01 dd 8b 54 24 24 <0>Kernel
panic - not syncing: Fatal exception in interrupt

Hello,

I get different md5sum of openswan binaries (pluto for example) after
compilation even without any modification to source.
Is there any timestamp or random number input to source that changes the md5sum?

I use md5sums to detect any change in source across builds.
Is there any way to get same md5sums for same source (or any other
method to detect the change in source)?

Thanks in advance.

-hiren

On Wed, 20 Aug 2008, hiren joshi wrote:

> I get different md5sum of openswan binaries (pluto for example) after
> compilation even without any modification to source.
> Is there any timestamp or random number input to source that changes the md5sum?
>
> I use md5sums to detect any change in source across builds.
> Is there any way to get same md5sums for same source (or any other
> method to detect the change in source)?

No. It does not happen for me:

make programs
cp OBJ.linux.x86_64/programs/pluto/pluto .
make clean
make programs
ls -l pluto OBJ.linux.x86_64/programs/pluto/pluto
-rwxrwxr-x 1 paul paul 2617570 2008-08-20 13:12 OBJ.linux.x86_64/programs/pluto/pluto
-rwxrwxr-x 1 paul paul 2617570 2008-08-20 13:11 pluto

Paul

_______________________________________________
Dev mailing list
Dev <at> openswan.org
http://lists.openswan.org/mailman/listinfo/dev

Hi all,

I'm trying to build a clustered ipsec gateway (to skip tunnel negotiation in 
case of cluster node failover) by replicating the Security Associations and 
Security Policies pluto established with its other tunnel endpoints. But for 
some reason pluto or ipsec ignores these replicated SADs and SPDs on the 
other clusternode when I start it there.

I prevent pluto flushing any SAD/SPD entries by a kill -KILL instead of
using the init script and when starting pluto by commenting out any flushes
in the scripts in /usr/lib/ipsec/ so pluto has the same SADs and SPDs in
the same order when starting on the other clusternode as he had on the
clusternode where he originally established the connections. I verify that
pluto listens on the service IP that is moved to the other clusternode with
ifconfig before pluto is started there.

It makes no difference whether I insert the data with setkey or directly
using the netlink PF_KEY interface.

Any hints/help appreciated.

Sorry for crossposting, not sure where my problem fits better.

Thanks a lot,
--

-- 
: Wieland Gmeiner                               Tel +43-1-8178292-57  :
: LINBIT Information Technologies GmbH          Fax +43-1-8178292-82  :
: Vivenotgasse 48, A-1120 Vienna/Europe         http://www.linbit.com :

_______________________________________________
Dev mailing list
Dev <at> openswan.org
http://lists.openswan.org/mailman/listinfo/dev

_______________________________________________
Dev mailing list
Dev <at> openswan.org
http://lists.openswan.org/mailman/listinfo/dev

Hi all,

I'm trying to build a clustered ipsec gateway by replicating the Security 
Associations and Security Policies pluto established with its other 
endpoints. But for some reason pluto ignores these replicated SADs and SPDs 
on the other clusternode when I start it there.

I prevent pluto flushing any SAD/SPD entries by a kill -KILL instead of using 
the init script and when starting pluto by commenting out any flushes in the 
scripts in /usr/lib/ipsec/ so pluto has the same SADs and SPDs in the same 
order when starting on the other clusternode as he had on the clusternode 
where he originally established the connections. I verify that pluto listens 
on the service IP that is moved to the other clusternode with ifconfig before 
pluto is started there.

It makes no difference whether I insert the data with setkey or directly using 
the netlink PF_KEY interface.

Any hints/help appreciated.

Sorry for crossposting, not sure where I fit better and please cc me in an 
answer.

Thanks a lot,
--

-- 
: Wieland Gmeiner                               Tel +43-1-8178292-57  :
: LINBIT Information Technologies GmbH          Fax +43-1-8178292-82  :
: Vivenotgasse 48, A-1120 Vienna/Europe         http://www.linbit.com :

_______________________________________________
Users <at> openswan.org
http://lists.openswan.org/mailman/listinfo/users
Building and Integrating Virtual Private Networks with Openswan: 
http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155

On Wed, 27 Aug 2008, hiren joshi wrote:

> While working on the issue I observe that: in programs/pluto/demux.c
> 'complete_state_transition' calls 'nat_traversal_change_port_lookup' only if the state
transition requested to
> send a reply packet.
> As in aggressive mode, there will be no reply packet in transition from STATE_AGGR_R1 to STATE_AGGR_R2, port
> floating will not happen for p1st (phase-1 SA).
> 
> The following patch calls 'nat_traversal_change_port_lookup' unconditional to sending reply packet.

Thanks. The patch has been applied and will be in openswan 2.6.18.

Paul

Hello,

I use openswan-2.4.8 (KLIPS).

I have two external interfaces.
Physical to ipsec interface bindings are: interfaces="ipsec0=eth1 ipsec1=eth2"

If I define a connection on the first interface (eth1), decrypted
packet appears on corresponding ipsec interface (ipsec0).

21:49:11.504898 eth1 < 172.16.1.1.4500 > 172.16.1.2.4500: udp 116 (DF)
(ttl 63, id 10582)
21:49:11.504898 if119 < 172.16.3.2 > 192.168.88.21: icmp: echo request
(DF) (ttl 64, id 0)
21:49:11.512770 eth0 > 172.16.3.2 > 192.168.88.21: icmp: echo request
(DF) (ttl 63, id 0)
21:49:11.512988 eth0 < 192.168.88.21 > 172.16.3.2: icmp: echo reply
(ttl 255, id 15887)
21:49:11.513280 if119 > 192.168.88.21 > 172.16.3.2: icmp: echo reply
(ttl 254, id 15887)
21:49:11.516443 eth1 > 172.16.1.2.4500 > 172.16.1.1.4500: udp 116 (ttl
64, id 50791)

However if I define the same connection on eth2, decrypted packet
still appears on ipsec0 instead of ipsec1.

21:51:44.300464 eth2 < 172.16.2.1.4500 > 172.16.2.2.4500: udp 116 (DF)
(ttl 63, id 10582)
21:51:44.300464 if119 < 172.16.3.2 > 192.168.88.21: icmp: echo request
(DF) (ttl 64, id 0)
21:51:44.300877 eth0 > 172.16.3.2 > 192.168.88.21: icmp: echo request
(DF) (ttl 63, id 0)
21:51:44.301378 eth0 < 192.168.88.21 > 172.16.3.2: icmp: echo reply
(ttl 255, id 15888)
21:51:44.301449 if120 > 192.168.88.21 > 172.16.3.2: icmp: echo reply
(ttl 254, id 15888)
21:51:44.301528 eth2 > 172.16.2.2.4500 > 172.16.2.1.4500: udp 116 (ttl
64, id 50792)

Is it normal?

Thank you.

Regards,
-hiren

------------------details (connection on eth1: behavior I do not
expect)-----------------

ip addr show
1: lo: <LOOPBACK,UP> mtu 1500 qdisc noqueue
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 brd 127.255.255.255 scope host lo
2: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:0c:29:11:5a:84 brd ff:ff:ff:ff:ff:ff
    inet 192.168.88.13/24 brd 192.168.88.255 scope global eth0
3: eth1: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:0c:29:11:5a:8e brd ff:ff:ff:ff:ff:ff
    inet 172.16.1.2/24 brd 172.16.1.255 scope global eth1
4: eth2: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:0c:29:11:5a:98 brd ff:ff:ff:ff:ff:ff
    inet 172.16.2.2/24 brd 172.16.2.255 scope global eth2
5: imq0: <NOARP,UP> mtu 1500 qdisc htb qlen 30
    link/void
6: imq1: <NOARP> mtu 1500 qdisc noop qlen 30
    link/void
119: ipsec0: <NOARP,UP> mtu 16260 qdisc pfifo_fast qlen 10
    link/ether 00:0c:29:11:5a:8e brd ff:ff:ff:ff:ff:ff
    inet 172.16.1.2/24 brd 172.16.1.255 scope global ipsec0
120: ipsec1: <NOARP,UP> mtu 16260 qdisc pfifo_fast qlen 10
    link/ether 00:0c:29:11:5a:98 brd ff:ff:ff:ff:ff:ff
    inet 172.16.2.2/24 brd 172.16.2.255 scope global ipsec1
121: ipsec2: <NOARP> mtu 0 qdisc noop qlen 10
    link/void
122: ipsec3: <NOARP> mtu 0 qdisc noop qlen 10
    link/void
----------------------
ip rule show
0:	from all lookup local
49:	from 192.168.88.0/24 to 172.16.3.2 lookup vpnroute
50:	from all lookup main
150:	from all fwmark        4 lookup gw4nof
150:	from all fwmark        5 lookup gw5nof
151:	from 172.16.2.0/24 lookup 151
152:	from 172.16.1.0/24 lookup 152
221:	from all lookup 221
32766:	from all lookup main
32767:	from all lookup 253
----------------------
ip route show
192.168.88.13 dev eth0  scope link
172.16.2.2 dev eth2  scope link
172.16.2.0/24 dev eth2  proto kernel  scope link  src 172.16.2.2
172.16.2.0/24 dev ipsec1  scope link  metric 1
172.16.1.0/24 dev eth1  proto kernel  scope link  src 172.16.1.2
172.16.1.0/24 dev ipsec0  scope link  metric 1
192.168.88.0/24 dev eth0  proto kernel  scope link  src 192.168.88.13
127.0.0.0/8 dev lo  scope link
----------------------
ip route show table vpnroute
172.16.3.2 dev ipsec1  scope link
----------------------
ip route show table local
broadcast 127.255.255.255 dev lo  proto kernel  scope link  src 127.0.0.1
local 192.168.88.13 dev eth0  proto kernel  scope host  src 192.168.88.13
broadcast 172.16.2.0 dev eth2  proto kernel  scope link  src 172.16.2.2
broadcast 172.16.2.0 dev ipsec1  proto kernel  scope link  src 172.16.2.2
broadcast 172.16.1.255 dev eth1  proto kernel  scope link  src 172.16.1.2
broadcast 172.16.1.255 dev ipsec0  proto kernel  scope link  src 172.16.1.2
broadcast 192.168.88.255 dev eth0  proto kernel  scope link  src 192.168.88.13
local 172.16.2.2 dev eth2  proto kernel  scope host  src 172.16.2.2
local 172.16.2.2 dev ipsec1  proto kernel  scope host  src 172.16.2.2
broadcast 172.16.2.255 dev eth2  proto kernel  scope link  src 172.16.2.2
broadcast 172.16.2.255 dev ipsec1  proto kernel  scope link  src 172.16.2.2
broadcast 172.16.1.0 dev eth1  proto kernel  scope link  src 172.16.1.2
broadcast 172.16.1.0 dev ipsec0  proto kernel  scope link  src 172.16.1.2
broadcast 127.0.0.0 dev lo  proto kernel  scope link  src 127.0.0.1
broadcast 192.168.88.0 dev eth0  proto kernel  scope link  src 192.168.88.13
local 172.16.1.2 dev eth1  proto kernel  scope host  src 172.16.1.2
local 172.16.1.2 dev ipsec0  proto kernel  scope host  src 172.16.1.2
local 127.0.0.1 dev lo  proto kernel  scope host  src 127.0.0.1
local 127.0.0.0/8 dev lo  proto kernel  scope host  src 127.0.0.1
----------------------
ipsec auto --status
000 interface ipsec0/eth1 172.16.1.2
000 interface ipsec0/eth1 172.16.1.2
000 interface ipsec1/eth2 172.16.2.2
000 interface ipsec1/eth2 172.16.2.2
000 %myid = (none)
000 debug none
000
000 algorithm ESP encrypt: id=2, name=ESP_DES, ivlen=64,
keysizemin=64, keysizemax=64
000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=64,
keysizemin=192, keysizemax=192
000 algorithm ESP encrypt: id=6, name=ESP_CAST, ivlen=64,
keysizemin=128, keysizemax=128
000 algorithm ESP encrypt: id=7, name=ESP_BLOWFISH, ivlen=64,
keysizemin=96, keysizemax=448
000 algorithm ESP encrypt: id=11, name=ESP_NULL, ivlen=0,
keysizemin=0, keysizemax=0
000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=128,
keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=252, name=ESP_SERPENT, ivlen=128,
keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=253, name=ESP_TWOFISH, ivlen=128,
keysizemin=128, keysizemax=256
000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5,
keysizemin=128, keysizemax=128
000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1,
keysizemin=160, keysizemax=160
000
000 algorithm IKE encrypt: id=1, name=OAKLEY_DES_CBC, blocksize=8, keydeflen=64
000 algorithm IKE encrypt: id=3, name=OAKLEY_BLOWFISH_CBC,
blocksize=8, keydeflen=128
000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8,
keydeflen=192
000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16,
keydeflen=128
000 algorithm IKE encrypt: id=65004, name=OAKLEY_SERPENT_CBC,
blocksize=16, keydeflen=128
000 algorithm IKE encrypt: id=65005, name=OAKLEY_TWOFISH_CBC,
blocksize=16, keydeflen=128
000 algorithm IKE encrypt: id=65289, name=OAKLEY_TWOFISH_CBC_SSH,
blocksize=16, keydeflen=128
000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16
000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20
000 algorithm IKE hash: id=4, name=OAKLEY_SHA2_256, hashsize=32
000 algorithm IKE hash: id=6, name=OAKLEY_SHA2_512, hashsize=64
000 algorithm IKE dh group: id=1, name=OAKLEY_GROUP_MODP768, bits=768
000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024
000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536
000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048
000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072
000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096
000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144
000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192
000
000 stats db_ops.c: {curr_cnt, total_cnt, maxsz} :context={0,0,0}
trans={0,0,0} attrs={0,0,0}
000
000 "rw_2-1": 192.168.88.0/24===172.16.2.2---172.16.2.1...%virtual===?;
unrouted; eroute owner: #0
000 "rw_2-1":     srcip=unset; dstip=unset;
srcup=/usr/lib/ipsec/_updown; dstup=/usr/lib/ipsec/_updown;
000 "rw_2-1":   ike_life: 3600s; ipsec_life: 3600s; rekey_margin:
120s; rekey_fuzz: 0%; keyingtries: 3
000 "rw_2-1":   policy:
PSK+ENCRYPT+COMPRESS+TUNNEL+PFS+DONTREKEY+failureDROP; prio: 24,32;
interface: eth2; encap: esp;
000 "rw_2-1":   dpd: action:clear; delay:30; timeout:120;
000 "rw_2-1":   newest ISAKMP SA: #0; newest IPsec SA: #0;
000 "rw_2-1":   IKE algorithms wanted:
3DES_CBC(5)_000-MD5(1)-MODP1024(2); flags=strict
000 "rw_2-1":   IKE algorithms found: 3DES_CBC(5)_192-MD5(1)_128-MODP1024(2)
000 "rw_2-1":   ESP algorithms wanted: 3DES(3)_000-MD5(1); flags=strict
000 "rw_2-1":   ESP algorithms loaded: 3DES(3)_000-MD5(1); flags=strict
000 "rw_2-1"[2]:
192.168.88.0/24===172.16.2.2...172.16.2.1[172.16.3.2]===172.16.3.2/32;
erouted; eroute owner: #8
000 "rw_2-1"[2]:     srcip=unset; dstip=unset;
srcup=/usr/lib/ipsec/_updown; dstup=/usr/lib/ipsec/_updown;
000 "rw_2-1"[2]:   ike_life: 3600s; ipsec_life: 3600s; rekey_margin:
120s; rekey_fuzz: 0%; keyingtries: 3
000 "rw_2-1"[2]:   policy:
PSK+ENCRYPT+COMPRESS+TUNNEL+PFS+DONTREKEY+failureDROP; prio: 24,32;
interface: eth2; encap: esp;
000 "rw_2-1"[2]:   dpd: action:clear; delay:30; timeout:120;
000 "rw_2-1"[2]:   newest ISAKMP SA: #7; newest IPsec SA: #8;
000 "rw_2-1"[2]:   IKE algorithms wanted:
3DES_CBC(5)_000-MD5(1)-MODP1024(2); flags=strict
000 "rw_2-1"[2]:   IKE algorithms found: 3DES_CBC(5)_192-MD5(1)_128-MODP1024(2)
000 "rw_2-1"[2]:   IKE algorithm newest: 3DES_CBC_192-MD5-MODP1024
000 "rw_2-1"[2]:   ESP algorithms wanted: 3DES(3)_000-MD5(1); flags=strict
000 "rw_2-1"[2]:   ESP algorithms loaded: 3DES(3)_000-MD5(1); flags=strict
000 "rw_2-1"[2]:   ESP algorithm newest: 3DES_0-HMAC_MD5; pfsgroup=<Phase1>
000
000 #8: "rw_2-1"[2] 172.16.2.1:4500 STATE_QUICK_R2 (IPsec SA
established); EVENT_SA_REPLACE in 3509s; newest IPSEC; eroute owner
000 #8: "rw_2-1"[2] 172.16.2.1 esp.1387c495 <at> 172.16.2.1
esp.9b60af09 <at> 172.16.2.2 tun.1006 <at> 172.16.2.1 tun.1005 <at> 172.16.2.2
000 #7: "rw_2-1"[2] 172.16.2.1:4500 STATE_MAIN_R3 (sent MR3, ISAKMP SA
established); EVENT_SA_EXPIRE in 3568s; newest ISAKMP; lastdpd=1s(seq
in:5966 out:0)
000
----------------------
ipsec.conf
version 2
config setup
	interfaces="ipsec0=eth1 ipsec1=eth2 "
	klipsdebug=none
	plutodebug="none"
	uniqueids=no
	nat_traversal=yes
	crlcheckinterval=3600
	nhelpers=0

conn %default
	leftupdown=/usr/lib/ipsec/_updown
	rightupdown=/usr/lib/ipsec/_updown

conn rw_2-1
	leftsubnet=192.168.88.0/24
	auto=add
	also=rw_2

conn rw_2
	type=tunnel
	left=172.16.2.2
	leftnexthop=172.16.2.1
	right=%any
	x_rightdynamic=yes
	authby=secret
	rightsubnet="vhost:%v4:0.0.0.0/0"
	keylife=3600
	rekey=no
	rekeymargin=120
	rekeyfuzz=0%
	keyingtries=3
	compress=yes
	failureshunt=drop
	dpddelay=30
	dpdtimeout=120
	dpdaction=clear
	ikelifetime=3600
	pfs=yes
	ike="3des-md5-modp1024"
	esp="3des-md5"

------------------details (connection on eth1: normal behavior)-----------------
ip addr show
1: lo: <LOOPBACK,UP> mtu 1500 qdisc noqueue
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 brd 127.255.255.255 scope host lo
2: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:0c:29:11:5a:84 brd ff:ff:ff:ff:ff:ff
    inet 192.168.88.13/24 brd 192.168.88.255 scope global eth0
3: eth1: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:0c:29:11:5a:8e brd ff:ff:ff:ff:ff:ff
    inet 172.16.1.2/24 brd 172.16.1.255 scope global eth1
4: eth2: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:0c:29:11:5a:98 brd ff:ff:ff:ff:ff:ff
    inet 172.16.2.2/24 brd 172.16.2.255 scope global eth2
5: imq0: <NOARP,UP> mtu 1500 qdisc htb qlen 30
    link/void
6: imq1: <NOARP> mtu 1500 qdisc noop qlen 30
    link/void
119: ipsec0: <NOARP,UP> mtu 16260 qdisc pfifo_fast qlen 10
    link/ether 00:0c:29:11:5a:8e brd ff:ff:ff:ff:ff:ff
    inet 172.16.1.2/24 brd 172.16.1.255 scope global ipsec0
120: ipsec1: <NOARP,UP> mtu 16260 qdisc pfifo_fast qlen 10
    link/ether 00:0c:29:11:5a:98 brd ff:ff:ff:ff:ff:ff
    inet 172.16.2.2/24 brd 172.16.2.255 scope global ipsec1
121: ipsec2: <NOARP> mtu 0 qdisc noop qlen 10
    link/void
122: ipsec3: <NOARP> mtu 0 qdisc noop qlen 10
    link/void
----------------------
ip rule show
0:	from all lookup local
49:	from 192.168.88.0/24 to 172.16.3.2 lookup vpnroute
50:	from all lookup main
150:	from all fwmark        4 lookup gw4nof
150:	from all fwmark        5 lookup gw5nof
151:	from 172.16.2.0/24 lookup 151
152:	from 172.16.1.0/24 lookup 152
221:	from all lookup 221
32766:	from all lookup main
32767:	from all lookup 253
----------------------
ip route show
192.168.88.13 dev eth0  scope link
172.16.2.2 dev eth2  scope link
172.16.2.0/24 dev eth2  proto kernel  scope link  src 172.16.2.2
172.16.2.0/24 dev ipsec1  scope link  metric 1
172.16.1.0/24 dev eth1  proto kernel  scope link  src 172.16.1.2
172.16.1.0/24 dev ipsec0  scope link  metric 1
192.168.88.0/24 dev eth0  proto kernel  scope link  src 192.168.88.13
127.0.0.0/8 dev lo  scope link
----------------------
ip route show table vpnroute
172.16.3.2 dev ipsec0  scope link
----------------------
ip route show table local
broadcast 127.255.255.255 dev lo  proto kernel  scope link  src 127.0.0.1
local 192.168.88.13 dev eth0  proto kernel  scope host  src 192.168.88.13
broadcast 172.16.2.0 dev eth2  proto kernel  scope link  src 172.16.2.2
broadcast 172.16.2.0 dev ipsec1  proto kernel  scope link  src 172.16.2.2
broadcast 172.16.1.255 dev eth1  proto kernel  scope link  src 172.16.1.2
broadcast 172.16.1.255 dev ipsec0  proto kernel  scope link  src 172.16.1.2
broadcast 192.168.88.255 dev eth0  proto kernel  scope link  src 192.168.88.13
local 172.16.2.2 dev eth2  proto kernel  scope host  src 172.16.2.2
local 172.16.2.2 dev ipsec1  proto kernel  scope host  src 172.16.2.2
broadcast 172.16.2.255 dev eth2  proto kernel  scope link  src 172.16.2.2
broadcast 172.16.2.255 dev ipsec1  proto kernel  scope link  src 172.16.2.2
broadcast 172.16.1.0 dev eth1  proto kernel  scope link  src 172.16.1.2
broadcast 172.16.1.0 dev ipsec0  proto kernel  scope link  src 172.16.1.2
broadcast 127.0.0.0 dev lo  proto kernel  scope link  src 127.0.0.1
broadcast 192.168.88.0 dev eth0  proto kernel  scope link  src 192.168.88.13
local 172.16.1.2 dev eth1  proto kernel  scope host  src 172.16.1.2
local 172.16.1.2 dev ipsec0  proto kernel  scope host  src 172.16.1.2
local 127.0.0.1 dev lo  proto kernel  scope host  src 127.0.0.1
local 127.0.0.0/8 dev lo  proto kernel  scope host  src 127.0.0.1
----------------------
ipsec.conf
version 2
config setup
	interfaces="ipsec0=eth1 ipsec1=eth2 "
	klipsdebug=none
	plutodebug="none"
	uniqueids=no
	nat_traversal=yes
	crlcheckinterval=3600
	nhelpers=0

conn %default
	leftupdown=/usr/lib/ipsec/_updown
	rightupdown=/usr/lib/ipsec/_updown

conn rw_2-1
	leftsubnet=192.168.88.0/24
	auto=add
	also=rw_2

conn rw_2
	type=tunnel
	left=172.16.1.2
	leftnexthop=172.16.1.1
	right=%any
	x_rightdynamic=yes
	authby=secret
	rightsubnet="vhost:%v4:0.0.0.0/0"
	keylife=3600
	rekey=no
	rekeymargin=120
	rekeyfuzz=0%
	keyingtries=3
	compress=yes
	failureshunt=drop
	dpddelay=30
	dpdtimeout=120
	dpdaction=clear
	ikelifetime=3600
	pfs=yes
	ike="3des-md5-modp1024"
	esp="3des-md5"
----------------------
ipsec auto --status
000 interface ipsec0/eth1 172.16.1.2
000 interface ipsec0/eth1 172.16.1.2
000 interface ipsec1/eth2 172.16.2.2
000 interface ipsec1/eth2 172.16.2.2
000 %myid = (none)
000 debug none
000
000 algorithm ESP encrypt: id=2, name=ESP_DES, ivlen=64,
keysizemin=64, keysizemax=64
000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=64,
keysizemin=192, keysizemax=192
000 algorithm ESP encrypt: id=6, name=ESP_CAST, ivlen=64,
keysizemin=128, keysizemax=128
000 algorithm ESP encrypt: id=7, name=ESP_BLOWFISH, ivlen=64,
keysizemin=96, keysizemax=448
000 algorithm ESP encrypt: id=11, name=ESP_NULL, ivlen=0,
keysizemin=0, keysizemax=0
000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=128,
keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=252, name=ESP_SERPENT, ivlen=128,
keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=253, name=ESP_TWOFISH, ivlen=128,
keysizemin=128, keysizemax=256
000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5,
keysizemin=128, keysizemax=128
000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1,
keysizemin=160, keysizemax=160
000
000 algorithm IKE encrypt: id=1, name=OAKLEY_DES_CBC, blocksize=8, keydeflen=64
000 algorithm IKE encrypt: id=3, name=OAKLEY_BLOWFISH_CBC,
blocksize=8, keydeflen=128
000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8,
keydeflen=192
000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16,
keydeflen=128
000 algorithm IKE encrypt: id=65004, name=OAKLEY_SERPENT_CBC,
blocksize=16, keydeflen=128
000 algorithm IKE encrypt: id=65005, name=OAKLEY_TWOFISH_CBC,
blocksize=16, keydeflen=128
000 algorithm IKE encrypt: id=65289, name=OAKLEY_TWOFISH_CBC_SSH,
blocksize=16, keydeflen=128
000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16
000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20
000 algorithm IKE hash: id=4, name=OAKLEY_SHA2_256, hashsize=32
000 algorithm IKE hash: id=6, name=OAKLEY_SHA2_512, hashsize=64
000 algorithm IKE dh group: id=1, name=OAKLEY_GROUP_MODP768, bits=768
000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024
000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536
000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048
000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072
000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096
000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144
000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192
000
000 stats db_ops.c: {curr_cnt, total_cnt, maxsz} :context={0,0,0}
trans={0,0,0} attrs={0,0,0}
000
000 "rw_2-1": 192.168.88.0/24===172.16.1.2---172.16.1.1...%virtual===?;
unrouted; eroute owner: #0
000 "rw_2-1":     srcip=unset; dstip=unset;
srcup=/usr/lib/ipsec/_updown; dstup=/usr/lib/ipsec/_updown;
000 "rw_2-1":   ike_life: 3600s; ipsec_life: 3600s; rekey_margin:
120s; rekey_fuzz: 0%; keyingtries: 3
000 "rw_2-1":   policy:
PSK+ENCRYPT+COMPRESS+TUNNEL+PFS+DONTREKEY+failureDROP; prio: 24,32;
interface: eth1; encap: esp;
000 "rw_2-1":   dpd: action:clear; delay:30; timeout:120;
000 "rw_2-1":   newest ISAKMP SA: #0; newest IPsec SA: #0;
000 "rw_2-1":   IKE algorithms wanted:
3DES_CBC(5)_000-MD5(1)-MODP1024(2); flags=strict
000 "rw_2-1":   IKE algorithms found: 3DES_CBC(5)_192-MD5(1)_128-MODP1024(2)
000 "rw_2-1":   ESP algorithms wanted: 3DES(3)_000-MD5(1); flags=strict
000 "rw_2-1":   ESP algorithms loaded: 3DES(3)_000-MD5(1); flags=strict
000 "rw_2-1"[2]:
192.168.88.0/24===172.16.1.2...172.16.1.1[172.16.3.2]===172.16.3.2/32;
erouted; eroute owner: #6
000 "rw_2-1"[2]:     srcip=unset; dstip=unset;
srcup=/usr/lib/ipsec/_updown; dstup=/usr/lib/ipsec/_updown;
000 "rw_2-1"[2]:   ike_life: 3600s; ipsec_life: 3600s; rekey_margin:
120s; rekey_fuzz: 0%; keyingtries: 3
000 "rw_2-1"[2]:   policy:
PSK+ENCRYPT+COMPRESS+TUNNEL+PFS+DONTREKEY+failureDROP; prio: 24,32;
interface: eth1; encap: esp;
000 "rw_2-1"[2]:   dpd: action:clear; delay:30; timeout:120;
000 "rw_2-1"[2]:   newest ISAKMP SA: #5; newest IPsec SA: #6;
000 "rw_2-1"[2]:   IKE algorithms wanted:
3DES_CBC(5)_000-MD5(1)-MODP1024(2); flags=strict
000 "rw_2-1"[2]:   IKE algorithms found: 3DES_CBC(5)_192-MD5(1)_128-MODP1024(2)
000 "rw_2-1"[2]:   IKE algorithm newest: 3DES_CBC_192-MD5-MODP1024
000 "rw_2-1"[2]:   ESP algorithms wanted: 3DES(3)_000-MD5(1); flags=strict
000 "rw_2-1"[2]:   ESP algorithms loaded: 3DES(3)_000-MD5(1); flags=strict
000 "rw_2-1"[2]:   ESP algorithm newest: 3DES_0-HMAC_MD5; pfsgroup=<Phase1>
000
000 #6: "rw_2-1"[2] 172.16.1.1:4500 STATE_QUICK_R2 (IPsec SA
established); EVENT_SA_REPLACE in 3492s; newest IPSEC; eroute owner
000 #6: "rw_2-1"[2] 172.16.1.1 esp.885e979 <at> 172.16.1.1
esp.9b60af08 <at> 172.16.1.2 tun.1004 <at> 172.16.1.1 tun.1003 <at> 172.16.1.2
000 #5: "rw_2-1"[2] 172.16.1.1:4500 STATE_MAIN_R3 (sent MR3, ISAKMP SA
established); EVENT_SA_EXPIRE in 3552s; newest ISAKMP; lastdpd=18s(seq
in:22203 out:0)
000

2	May 2013
3	January 2013
4	December 2012
8	October 2012
3	September 2012
4	August 2012
3	June 2012
6	May 2012
8	April 2012
9	March 2012
22	February 2012
12	January 2012
9	December 2011
7	November 2011
10	October 2011
9	September 2011
8	August 2011
29	July 2011
19	June 2011
30	May 2011
11	April 2011
2	March 2011
36	February 2011
15	January 2011
81	December 2010
35	November 2010
198	October 2010
10	September 2010
32	August 2010
20	July 2010
14	June 2010
32	May 2010
39	April 2010
99	March 2010
40	February 2010
45	January 2010
13	December 2009
5	November 2009
18	October 2009
4	September 2009
17	August 2009
15	July 2009
21	June 2009
13	May 2009
10	April 2009
16	March 2009
28	February 2009
12	January 2009
24	December 2008
29	November 2008
17	October 2008
16	September 2008
11	August 2008
19	July 2008
42	June 2008
14	May 2008
5	April 2008
20	March 2008
8	February 2008
19	January 2008
60	December 2007
24	November 2007
32	October 2007
4	September 2007
8	August 2007
45	July 2007
34	June 2007
24	May 2007
17	April 2007
23	March 2007
6	February 2007
9	January 2007
20	December 2006
37	November 2006
9	October 2006
9	September 2006
18	August 2006
16	July 2006
24	June 2006
13	May 2006
34	April 2006
21	March 2006
44	February 2006
47	January 2006
38	December 2005
58	November 2005
34	October 2005
50	September 2005
70	August 2005
37	July 2005
18	June 2005
19	May 2005
65	April 2005
37	March 2005
24	February 2005
21	January 2005
45	December 2004
40	November 2004
33	October 2004
53	September 2004
65	August 2004
69	July 2004
95	June 2004
89	May 2004
57	April 2004

[Openswan dev] openswan-2.4.12 Compression: kernel panic

Re: [Openswan dev] openswan-2.4.12 Compression: kernel panic

[Openswan dev] md5sum of binaries are different across compilation

Re: [Openswan dev] md5sum of binaries are different across compilation

Re: [Openswan dev] md5sum of binaries are different across compilation

[Openswan dev] Pluto and replication of SADs and SPDs

Re: [Openswan dev] [Openswan Users] Road Warrior behind NAT - Aggressive Mode: wrong NAT-T decision

[Openswan Users] Pluto and replication of SADs and SPDs

Re: [Openswan dev] [Openswan Users] Road Warrior behind NAT - Aggressive Mode: wrong NAT-T decision

[Openswan dev] decrypted packet appears at wrong ipsec interface

Mon	Tue	Wed	Thu	Fri	Sat	Sun

				1	2	3
4	5	6	7	8	9	10
11	12	13	14	15	16	17
18	19	20	21	22	23	24
25	26	27	28	29	30	31