[Swan] STATE_QUICK_I1: retransmission and memory violation sig=11 in audit.log
Miroslav Betak
betak at orgatrade.sk
Wed Sep 4 17:51:25 EEST 2013
Hi
I tried to establish connection between Fedora linux with libreswan (as
roadwarrior ) and cisco router 1760.
root at Fedora18lxde ~]# ipsec whack --initiate --name router
002 "router" #1: initiating Aggressive Mode #1, connection "router"
112 "router" #1: STATE_AGGR_I1: initiate
003 "router" #1: received Vendor ID payload [Cisco-Unity]
003 "router" #1: received Vendor ID payload [Dead Peer Detection]
003 "router" #1: ignoring unknown Vendor ID payload
[46544a54512c8193f9a5248435e01f0d]
003 "router" #1: received Vendor ID payload [XAUTH]
002 "router" #1: Aggressive mode peer ID is ID_FQDN: '@router.domain.sk'
002 "router" #1: transition from state STATE_AGGR_I1 to state STATE_AGGR_I2
004 "router" #1: STATE_AGGR_I2: sent AI2, ISAKMP SA established
{auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_md5
group=modp1024}
002 "router" #1: XAUTH: Answering XAUTH challenge with user='my-name'
002 "router" #1: transition from state STATE_XAUTH_I0 to state
STATE_XAUTH_I1
004 "router" #1: STATE_XAUTH_I1: XAUTH client - awaiting CFG_set
002 "router" #1: XAUTH: Successfully Authenticated
002 "router" #1: transition from state STATE_XAUTH_I0 to state
STATE_XAUTH_I1
004 "router" #1: STATE_XAUTH_I1: XAUTH client - awaiting CFG_set
002 "router" #1: modecfg: Sending IP request (MODECFG_I1)
002 "router" #1: received mode cfg reply
002 "router" #1: setting client address to 192.168.200.12/32
002 "router" #1: setting ip source address to 192.168.200.12/32
002 "router" #1: Received DNS 192.168.2.2, len=15
002 "router" #1: transition from state STATE_MODE_CFG_I1 to state
STATE_MAIN_I4
004 "router" #1: STATE_MAIN_I4: ISAKMP SA established
002 "router" #2: initiating Quick Mode
PSK+ENCRYPT+TUNNEL+UP+XAUTH+AGGRESSIVE+IKEv2ALLOW+SAREFTRACK+IKE_FRAG
{using isakmp#1 msgid:7101b445 proposal=3DES(3)_192-SHA1(2)_160
pfsgroup=no-pfs}
117 "router" #2: STATE_QUICK_I1: initiate
010 "router" #2: STATE_QUICK_I1: retransmission; will wait 20s for response
003 "router" #2: ignoring informational payload
IPSEC_RESPONDER_LIFETIME, msgid=7101b445, length=40
After few unsuccessful attempts I observed this message in my audit.log:
"type=ANOM_ABEND msg=audit(1378285305.800:408): auid=4294967295 uid=0
gid=0 ses=4294967295 subj=system_u:system_r:ipsec_t:s0 pid=1587
comm="pluto" reason="memory violation" sig=11"
[root at Fedora18lxde ~]# cat /etc/issue
Fedora release 18 (Spherical Cow)
Kernel \r on an \m (\l)
root at Fedora18lxde ~]# uname -a
Linux Fedora18lxde 3.10.10-100.fc18.i686 #1 SMP Thu Aug 29 20:37:10 UTC
2013 i686 i686 i386 GNU/Linux
[root at Fedora18lxde ~]#
[root at Fedora18lxde ~]# rpm -qa | grep libreswan
libreswan-3.3-1.fc18.i686
[root at Fedora18lxde ipsec.d]# cat /etc/ipsec.conf | grep -v '#'
config setup
protostack=netkey
plutodebug="control parsing"
dumpdir=/var/run/pluto/
nat_traversal=yes
virtual_private=%v4:10.0.0.0/8,%v4:!192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10
include /etc/ipsec.d/*.conf
[root at Fedora18lxde ~]# cat /etc/ipsec.d/router.conf
conn router
aggrmode=yes
ike=3des-md5;modp1024
phase2alg=3des-sha1
left=%defaultroute
leftid=@[ROUTER-GROUP]
leftxauthclient=yes
leftxauthusername=my-name
leftmodecfgclient=yes
right=Y.Y.Y.Y
rightid=@router.domain.sk
rightxauthserver=yes
remote_peer_type=cisco
pfs=no
authby=secret
auto=add
[root at Fedora18lxde ~]# cat /etc/ipsec.secrets
include /etc/ipsec.d/*.secrets
: PSK "real-key"
@my-name : XAUTH "real-password"
[root at Fedora18lxde ~]# service ipsec start
Redirecting to /bin/systemctl start ipsec.service
root at Fedora18lxde ~]# ps auxww | grep pluto
root 1584 0.0 0.0 5356 1052 ? Ss 10:57 0:00 /bin/sh
-c eval `/usr/libexec/ipsec/pluto --config /etc/ipsec.conf --nofork
$PLUTO_OPTIONS`
root 1586 0.0 0.0 5356 552 ? S 10:57 0:00 /bin/sh
-c eval `/usr/libexec/ipsec/pluto --config /etc/ipsec.conf --nofork
$PLUTO_OPTIONS`
root 1587 0.0 0.1 17468 5248 ? S 10:57 0:00
/usr/libexec/ipsec/pluto --config /etc/ipsec.conf --nofork
root 1728 0.0 0.0 4556 640 ? S 10:57 0:00 _pluto_adns
root 1733 0.0 0.0 4788 800 pts/0 S+ 10:58 0:00 grep
--color=auto pluto
[root at Fedora18lxde ~]#
[root at Fedora18lxde ~]# tail /var/log/messages
Sep 4 10:57:47 Fedora18lxde systemd[1]: Starting Internet Key Exchange
(IKE) Protocol Daemon for IPsec...
Sep 4 10:57:48 Fedora18lxde kernel: [ 287.189527] NET: Registered
protocol family 15
Sep 4 10:57:48 Fedora18lxde systemd[1]: Started Internet Key Exchange
(IKE) Protocol Daemon for IPsec.
Sep 4 10:57:48 Fedora18lxde sh[1584]: pluto: chdir() do dumpdir failed
(2: No such file or directory)
Sep 4 10:57:48 Fedora18lxde pluto: pluto: chdir() do dumpdir failed (2:
No such file or directory)
[root at Fedora18lxde ~]# netstat -ulpn | grep pluto
udp 0 0 127.0.0.1:4500
0.0.0.0:* 1587/pluto
udp 0 0 192.168.240.11:4500
0.0.0.0:* 1587/pluto
udp 0 0 127.0.0.1:500
0.0.0.0:* 1587/pluto
udp 0 0 192.168.240.11:500
0.0.0.0:* 1587/pluto
udp6 0 0 ::1:500
:::* 1587/pluto
root at Fedora18lxde ~]# ipsec whack --initiate --name router
002 "router" #1: initiating Aggressive Mode #1, connection "router"
112 "router" #1: STATE_AGGR_I1: initiate
003 "router" #1: received Vendor ID payload [Cisco-Unity]
003 "router" #1: received Vendor ID payload [Dead Peer Detection]
003 "router" #1: ignoring unknown Vendor ID payload
[46544a54512c8193f9a5248435e01f0d]
003 "router" #1: received Vendor ID payload [XAUTH]
002 "router" #1: Aggressive mode peer ID is ID_FQDN: '@Orouter.domain.sk'
002 "router" #1: transition from state STATE_AGGR_I1 to state STATE_AGGR_I2
004 "router" #1: STATE_AGGR_I2: sent AI2, ISAKMP SA established
{auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_md5
group=modp1024}
002 "router" #1: XAUTH: Answering XAUTH challenge with user='my-name'
002 "router" #1: transition from state STATE_XAUTH_I0 to state
STATE_XAUTH_I1
004 "router" #1: STATE_XAUTH_I1: XAUTH client - awaiting CFG_set
002 "router" #1: XAUTH: Successfully Authenticated
002 "router" #1: transition from state STATE_XAUTH_I0 to state
STATE_XAUTH_I1
004 "router" #1: STATE_XAUTH_I1: XAUTH client - awaiting CFG_set
002 "router" #1: modecfg: Sending IP request (MODECFG_I1)
002 "router" #1: received mode cfg reply
002 "router" #1: setting client address to 192.168.200.12/32
002 "router" #1: setting ip source address to 192.168.200.12/32
002 "router" #1: Received DNS 192.168.2.2, len=15
002 "router" #1: transition from state STATE_MODE_CFG_I1 to state
STATE_MAIN_I4
004 "router" #1: STATE_MAIN_I4: ISAKMP SA established
002 "router" #2: initiating Quick Mode
PSK+ENCRYPT+TUNNEL+UP+XAUTH+AGGRESSIVE+IKEv2ALLOW+SAREFTRACK+IKE_FRAG
{using isakmp#1 msgid:7101b445 proposal=3DES(3)_192-SHA1(2)_160
pfsgroup=no-pfs}
117 "router" #2: STATE_QUICK_I1: initiate
010 "router" #2: STATE_QUICK_I1: retransmission; will wait 20s for response
003 "router" #2: ignoring informational payload
IPSEC_RESPONDER_LIFETIME, msgid=7101b445, length=40
[root at Fedora18lxde ~]# ipsec status
000 using kernel interface: netkey
000 interface lo/lo ::1
000 interface lo/lo 127.0.0.1
000 interface lo/lo 127.0.0.1
000 interface eth0/eth0 192.168.240.11
000 interface eth0/eth0 192.168.240.11
000 %myid = (none)
000 debug none
000
000 virtual_private (%priv):
000 - allowed 5 subnets: 10.0.0.0/8, 172.16.0.0/12, 25.0.0.0/8,
fd00::/8, fe80::/10
000 - disallowed 1 subnet: 192.168.0.0/16
000
000 algorithm ESP encrypt: id=2, name=ESP_DES, ivlen=8, keysizemin=64,
keysizemax=64
000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=8, keysizemin=192,
keysizemax=192
000 algorithm ESP encrypt: id=6, name=ESP_CAST, ivlen=8, keysizemin=40,
keysizemax=128
000 algorithm ESP encrypt: id=7, name=ESP_BLOWFISH, ivlen=8,
keysizemin=40, keysizemax=448
000 algorithm ESP encrypt: id=11, name=ESP_NULL, ivlen=0, keysizemin=0,
keysizemax=0
000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=8, keysizemin=128,
keysizemax=256
000 algorithm ESP encrypt: id=13, name=ESP_AES_CTR, ivlen=8,
keysizemin=160, keysizemax=288
000 algorithm ESP encrypt: id=14, name=ESP_AES_CCM_A, ivlen=8,
keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=15, name=ESP_AES_CCM_B, ivlen=8,
keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=16, name=ESP_AES_CCM_C, ivlen=8,
keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=18, name=ESP_AES_GCM_A, ivlen=8,
keysizemin=160, keysizemax=288
000 algorithm ESP encrypt: id=19, name=ESP_AES_GCM_B, ivlen=12,
keysizemin=160, keysizemax=288
000 algorithm ESP encrypt: id=20, name=ESP_AES_GCM_C, ivlen=16,
keysizemin=160, keysizemax=288
000 algorithm ESP encrypt: id=22, name=ESP_CAMELLIA, ivlen=8,
keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=252, name=ESP_SERPENT, ivlen=8,
keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=253, name=ESP_TWOFISH, ivlen=8,
keysizemin=128, keysizemax=256
000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5,
keysizemin=128, keysizemax=128
000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1,
keysizemin=160, keysizemax=160
000 algorithm ESP auth attr: id=5, name=AUTH_ALGORITHM_HMAC_SHA2_256,
keysizemin=256, keysizemax=256
000 algorithm ESP auth attr: id=6, name=AUTH_ALGORITHM_HMAC_SHA2_384,
keysizemin=384, keysizemax=384
000 algorithm ESP auth attr: id=7, name=AUTH_ALGORITHM_HMAC_SHA2_512,
keysizemin=512, keysizemax=512
000 algorithm ESP auth attr: id=8, name=AUTH_ALGORITHM_HMAC_RIPEMD,
keysizemin=160, keysizemax=160
000 algorithm ESP auth attr: id=9, name=AUTH_ALGORITHM_AES_CBC,
keysizemin=128, keysizemax=128
000 algorithm ESP auth attr: id=251, name=AUTH_ALGORITHM_NULL_KAME,
keysizemin=0, keysizemax=0
000
000 algorithm IKE encrypt: id=0, name=(null), blocksize=16, keydeflen=131
000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8,
keydeflen=192
000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16,
keydeflen=128
000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16
000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20
000 algorithm IKE hash: id=4, name=OAKLEY_SHA2_256, hashsize=32
000 algorithm IKE hash: id=5, name=OAKLEY_SHA2_384, hashsize=48
000 algorithm IKE hash: id=6, name=OAKLEY_SHA2_512, hashsize=64
000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024
000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536
000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048
000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072
000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096
000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144
000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192
000 algorithm IKE dh group: id=22, name=OAKLEY_GROUP_DH22, bits=1024
000 algorithm IKE dh group: id=23, name=OAKLEY_GROUP_DH23, bits=2048
000 algorithm IKE dh group: id=24, name=OAKLEY_GROUP_DH24, bits=2048
000
000 stats db_ops: {curr_cnt, total_cnt, maxsz} :context={0,0,0}
trans={0,0,0} attrs={0,0,0}
000
000 "router":
192.168.240.11[@#0x4f52474154524144452d47524f5550,+MC+XC+S=C]...Y.Y.Y.Y<Y.Y.Y.Y>[@router.domain.sk,+XS+S=C];
unrouted; eroute owner: #0
000 "router": oriented; my_ip=unset; their_ip=unset;
000 "router": xauth info: us:client, them:server,
my_xauthuser=my-name; their_xauthuser=[any]; ;
000 "router": modecfg info: us:client, them:none, modecfg policy:push,
dns1:unset, dns2:unset;
000 "router": labeled_ipsec:no, loopback:no;
000 "router": policy_label:unset;
000 "router": ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s;
rekey_fuzz: 100%; keyingtries: 0; sha2_truncbug:no; initial_contact:no;
000 "router": policy:
PSK+ENCRYPT+TUNNEL+XAUTH+AGGRESSIVE+IKEv2ALLOW+SAREFTRACK+IKE_FRAG;
000 "router": prio: 32,32; interface: eth0; metric: 0, mtu: unset;
000 "router": newest ISAKMP SA: #0; newest IPsec SA: #0;
000 "router": IKE algorithms wanted:
3DES_CBC(5)_000-MD5(1)_000-MODP1024(2)
000 "router": IKE algorithms found:
3DES_CBC(5)_192-MD5(1)_128-MODP1024(2)
000 "router": ESP algorithms wanted: 3DES(3)_000-SHA1(2)_000
000 "router": ESP algorithms loaded: 3DES(3)_192-SHA1(2)_160
000
000 Total IPsec connections: loaded 1, active 0
000
000
[root at Fedora18lxde ~]# ps auxww | grep pluto
root 1854 0.0 0.0 5356 1056 ? Ss 11:01 0:00 /bin/sh
-c eval `/usr/libexec/ipsec/pluto --config /etc/ipsec.conf --nofork
$PLUTO_OPTIONS`
root 1856 0.0 0.0 5356 556 ? S 11:01 0:00 /bin/sh
-c eval `/usr/libexec/ipsec/pluto --config /etc/ipsec.conf --nofork
$PLUTO_OPTIONS`
root 1857 0.0 0.1 17468 5252 ? S 11:01 0:00
/usr/libexec/ipsec/pluto --config /etc/ipsec.conf --nofork
root 1887 0.0 0.0 4556 640 ? S 11:01 0:00 _pluto_adns
root 1934 0.0 0.0 4788 800 pts/0 S+ 11:02 0:00 grep
--color=auto pluto
[root at Fedora18lxde ~]#
[root at Fedora18lxde ~]#
[root at Fedora18lxde ~]#
[root at Fedora18lxde ~]# netstat -ulpn | grep pluto
udp 0 0 127.0.0.1:4500
0.0.0.0:* 1857/pluto
udp 0 0 192.168.240.11:4500
0.0.0.0:* 1857/pluto
udp 0 0 127.0.0.1:500
0.0.0.0:* 1857/pluto
udp 0 0 192.168.240.11:500
0.0.0.0:* 1857/pluto
udp6 0 0 ::1:500
:::* 1857/pluto
[root at Fedora18lxde ~]#
Sep 4 10:57:49 Fedora18lxde pluto[1587]: added connection description
"router"
Sep 4 11:01:34 Fedora18lxde pluto[1587]: "router" #1: initiating
Aggressive Mode #1, connection "router"
Sep 4 11:01:35 Fedora18lxde pluto[1587]: "router" #1: received Vendor
ID payload [Cisco-Unity]
Sep 4 11:01:35 Fedora18lxde pluto[1587]: "router" #1: received Vendor
ID payload [Dead Peer Detection]
Sep 4 11:01:35 Fedora18lxde pluto[1587]: "router" #1: ignoring unknown
Vendor ID payload [46544a54512c8193f9a5248435e01f0d]
Sep 4 11:01:35 Fedora18lxde pluto[1587]: "router" #1: received Vendor
ID payload [XAUTH]
Sep 4 11:01:35 Fedora18lxde pluto[1587]: "router" #1: Aggressive mode
peer ID is ID_FQDN: '@router.domain.sk'
Sep 4 11:01:35 Fedora18lxde pluto[1587]: "router" #1: transition from
state STATE_AGGR_I1 to state STATE_AGGR_I2
Sep 4 11:01:35 Fedora18lxde pluto[1587]: "router" #1: STATE_AGGR_I2:
sent AI2, ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY
cipher=oakley_3des_cbc_192 prf=oakley_md5 group=modp1024}
Sep 4 11:01:35 Fedora18lxde pluto[1587]: "router" #1: XAUTH: Answering
XAUTH challenge with user='my-name'
Sep 4 11:01:35 Fedora18lxde pluto[1587]: "router" #1: transition from
state STATE_XAUTH_I0 to state STATE_XAUTH_I1
Sep 4 11:01:35 Fedora18lxde pluto[1587]: "router" #1: STATE_XAUTH_I1:
XAUTH client - awaiting CFG_set
Sep 4 11:01:35 Fedora18lxde pluto[1587]: "router" #1: XAUTH:
Successfully Authenticated
Sep 4 11:01:35 Fedora18lxde pluto[1587]: "router" #1: transition from
state STATE_XAUTH_I0 to state STATE_XAUTH_I1
Sep 4 11:01:35 Fedora18lxde pluto[1587]: "router" #1: STATE_XAUTH_I1:
XAUTH client - awaiting CFG_set
Sep 4 11:01:35 Fedora18lxde pluto[1587]: "router" #1: modecfg: Sending
IP request (MODECFG_I1)
Sep 4 11:01:35 Fedora18lxde pluto[1587]: "router" #1: received mode cfg
reply
Sep 4 11:01:35 Fedora18lxde pluto[1587]: "router" #1: setting client
address to 192.168.200.12/32
Sep 4 11:01:35 Fedora18lxde pluto[1587]: "router" #1: setting ip source
address to 192.168.200.12/32
Sep 4 11:01:35 Fedora18lxde pluto[1587]: "router" #1: Received DNS
192.168.2.2, len=15
Sep 4 11:01:35 Fedora18lxde pluto[1587]: | Cisco DNS info: 192.168.2.2,
len=15
Sep 4 11:01:35 Fedora18lxde pluto[1587]: "router" #1: transition from
state STATE_MODE_CFG_I1 to state STATE_MAIN_I4
Sep 4 11:01:35 Fedora18lxde pluto[1587]: "router" #1: STATE_MAIN_I4:
ISAKMP SA established
Sep 4 11:01:35 Fedora18lxde pluto[1587]: "router" #2: initiating Quick
Mode
PSK+ENCRYPT+TUNNEL+UP+XAUTH+AGGRESSIVE+IKEv2ALLOW+SAREFTRACK+IKE_FRAG
{using isakmp#1 msgid:7101b445 proposal=3DES(3)_192-SHA1(2)_160
pfsgroup=no-pfs}
Sep 4 11:01:45 Fedora18lxde pluto[1587]: "router" #2: ignoring
informational payload IPSEC_RESPONDER_LIFETIME, msgid=7101b445, length=40
Sep 4 11:01:46 Fedora18lxde pluto[1857]: nss directory plutomain:
/etc/ipsec.d
Sep 4 11:01:46 Fedora18lxde pluto[1857]: NSS Initialized
Sep 4 11:01:46 Fedora18lxde pluto[1857]: Non-fips mode set in
/proc/sys/crypto/fips_enabled
Sep 4 11:01:46 Fedora18lxde pluto[1857]: libcap-ng support [enabled]
Sep 4 11:01:46 Fedora18lxde pluto[1857]: Linux audit support [disabled]
Sep 4 11:01:46 Fedora18lxde pluto[1857]: Starting Pluto (Libreswan
Version 3.3 LDAP_V3; Vendor ID OENWEGDKhehJ) pid:1857
Sep 4 11:01:46 Fedora18lxde pluto[1857]: Non-fips mode set in
/proc/sys/crypto/fips_enabled
Sep 4 11:01:46 Fedora18lxde pluto[1857]: Pluto is NOT running in FIPS mode
Sep 4 11:01:46 Fedora18lxde pluto[1857]: core dump dir: /var/run/pluto/
Sep 4 11:01:46 Fedora18lxde pluto[1857]: secrets file: /etc/ipsec.secrets
Sep 4 11:01:46 Fedora18lxde pluto[1857]: LEAK_DETECTIVE support [disabled]
Sep 4 11:01:46 Fedora18lxde pluto[1857]: OCF support for IKE [disabled]
Sep 4 11:01:46 Fedora18lxde pluto[1857]: SAref support [disabled]:
Protocol not available
Sep 4 11:01:46 Fedora18lxde pluto[1857]: SAbind support [disabled]:
Protocol not available
Sep 4 11:01:46 Fedora18lxde pluto[1857]: NSS crypto [enabled]
Sep 4 11:01:46 Fedora18lxde pluto[1857]: XAUTH PAM support [enabled]
Sep 4 11:01:46 Fedora18lxde pluto[1857]: HAVE_STATSD notification
support [disabled]
Sep 4 11:01:46 Fedora18lxde pluto[1857]: Setting NAT-Traversal
port-4500 floating to on
Sep 4 11:01:46 Fedora18lxde pluto[1857]: port floating activation
criteria nat_t=1/port_float=1
Sep 4 11:01:46 Fedora18lxde pluto[1857]: NAT-Traversal support
[enabled]
Sep 4 11:01:46 Fedora18lxde pluto[1857]: ike_alg_register_enc():
Activating OAKLEY_AES_CBC: Ok (ret=0)
Sep 4 11:01:46 Fedora18lxde pluto[1857]: ike_alg_register_hash():
Activating OAKLEY_SHA2_512: Ok (ret=0)
Sep 4 11:01:46 Fedora18lxde pluto[1857]: ike_alg_register_hash():
Activating OAKLEY_SHA2_384: Ok (ret=0)
Sep 4 11:01:46 Fedora18lxde pluto[1857]: ike_alg_register_hash():
Activating OAKLEY_SHA2_256: Ok (ret=0)
Sep 4 11:01:46 Fedora18lxde pluto[1857]: no helpers will be started,
all cryptographic operations will be done inline
Sep 4 11:01:46 Fedora18lxde pluto[1857]: Using Linux XFRM/NETKEY IPsec
interface code on 3.10.10-100.fc18.i686
Sep 4 11:01:46 Fedora18lxde pluto[1857]: ike_alg_register_enc():
Activating aes_ccm_8: Ok (ret=0)
Sep 4 11:01:46 Fedora18lxde pluto[1857]: ike_alg_add(): ERROR:
algo_type '0', algo_id '0', Algorithm type already exists
Sep 4 11:01:46 Fedora18lxde pluto[1857]: ike_alg_register_enc():
Activating aes_ccm_12: FAILED (ret=-17)
Sep 4 11:01:46 Fedora18lxde pluto[1857]: ike_alg_add(): ERROR:
algo_type '0', algo_id '0', Algorithm type already exists
Sep 4 11:01:46 Fedora18lxde pluto[1857]: ike_alg_register_enc():
Activating aes_ccm_16: FAILED (ret=-17)
Sep 4 11:01:46 Fedora18lxde pluto[1857]: ike_alg_add(): ERROR:
algo_type '0', algo_id '0', Algorithm type already exists
Sep 4 11:01:46 Fedora18lxde pluto[1857]: ike_alg_register_enc():
Activating aes_gcm_8: FAILED (ret=-17)
Sep 4 11:01:46 Fedora18lxde pluto[1857]: ike_alg_add(): ERROR:
algo_type '0', algo_id '0', Algorithm type already exists
Sep 4 11:01:46 Fedora18lxde pluto[1857]: ike_alg_register_enc():
Activating aes_gcm_12: FAILED (ret=-17)
Sep 4 11:01:46 Fedora18lxde pluto[1857]: ike_alg_add(): ERROR:
algo_type '0', algo_id '0', Algorithm type already exists
Sep 4 11:01:46 Fedora18lxde pluto[1857]: ike_alg_register_enc():
Activating aes_gcm_16: FAILED (ret=-17)
Sep 4 11:01:46 Fedora18lxde pluto[1857]: | selinux support is enabled.
Sep 4 11:01:46 Fedora18lxde pluto[1857]: listening for IKE messages
Sep 4 11:01:46 Fedora18lxde pluto[1857]: adding interface eth0/eth0
192.168.240.11:500
Sep 4 11:01:46 Fedora18lxde pluto[1857]: adding interface eth0/eth0
192.168.240.11:4500
Sep 4 11:01:46 Fedora18lxde pluto[1857]: adding interface lo/lo
127.0.0.1:500
Sep 4 11:01:46 Fedora18lxde pluto[1857]: adding interface lo/lo
127.0.0.1:4500
Sep 4 11:01:46 Fedora18lxde pluto[1857]: adding interface lo/lo ::1:500
Sep 4 11:01:46 Fedora18lxde pluto[1857]: loading secrets from
"/etc/ipsec.secrets"
Sep 4 11:01:46 Fedora18lxde pluto[1857]: no secrets filename matched
"/etc/ipsec.d/*.secrets"
Sep 4 11:01:47 Fedora18lxde pluto[1857]: added connection description
"router"
Sep 4 11:02:15 Fedora18lxde pluto[1857]: packet from Y.Y.Y.Y:500: Quick
Mode message is for a non-existent (expired?) ISAKMP SA
Sep 4 11:02:25 Fedora18lxde pluto[1857]: packet from Y.Y.Y.Y:500: Quick
Mode message is for a non-existent (expired?) ISAKMP SA
Sep 4 11:02:35 Fedora18lxde pluto[1857]: packet from Y.Y.Y.Y:500: Quick
Mode message is for a non-existent (expired?) ISAKMP SA
cat audit.log
type=USER_END msg=audit(1378285261.633:403): pid=1744 uid=0 auid=0
ses=3 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='
op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=?
terminal=cron res=success'
type=MAC_IPSEC_EVENT msg=audit(1378285305.777:404): op=SAD-add
auid=4294967295 ses=4294967295 subj=system_u:system_r:ipsec_t:
s0 src=192.168.240.11 dst=Y.Y.Y.Y spi=3958996377(0xebf97d99) res=1
type=SYSCALL msg=audit(1378285305.777:404): arch=40000003 syscall=4
success=yes exit=424 a0=6 a1=bff4adb0 a2=1a8 a3=b95eb0d8
items=0 ppid=1586 pid=1587 auid=4294967295 uid=0 gid=0 euid=0 suid=0
fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none)
comm="pluto" exe="/usr/libexec/ipsec/pluto"
subj=system_u:system_r:ipsec_t:s0 key=(null)
type=MAC_IPSEC_EVENT msg=audit(1378285305.800:405): op=SAD-add
auid=4294967295 ses=4294967295 subj=system_u:system_r:ipsec_t:s0
src=Y.Y.Y.Y dst=192.168.240.11 spi=1877915368(0x6feeb6e8) res=1
type=SYSCALL msg=audit(1378285305.800:405): arch=40000003 syscall=4
success=yes exit=424 a0=6 a1=bff4adb0 a2=1a8 a3=b95eb0a0 items=0
ppid=1586 pid=1587 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="pluto"
exe="/usr/libexec/ipsec/pluto" subj=system_u:system_r:ipsec_t:s0 key=(null)
type=MAC_IPSEC_EVENT msg=audit(1378285305.800:406): op=SPD-add
auid=4294967295 ses=4294967295 subj=system_u:system_r:ipsec_t:s0 res=1
src=Y.Y.Y.Y dst=192.168.200.12
type=SYSCALL msg=audit(1378285305.800:406): arch=40000003 syscall=4
success=yes exit=248 a0=6 a1=bff4ac58 a2=f8 a3=bff4b238 items=0
ppid=1586 pid=1587 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="pluto"
exe="/usr/libexec/ipsec/pluto" subj=system_u:system_r:ipsec_t:s0 key=(null)
type=MAC_IPSEC_EVENT msg=audit(1378285305.800:407): op=SPD-add
auid=4294967295 ses=4294967295 subj=system_u:system_r:ipsec_t:s0 res=1
src=Y.Y.Y.Y dst=192.168.200.12
type=SYSCALL msg=audit(1378285305.800:407): arch=40000003 syscall=4
success=yes exit=248 a0=6 a1=bff4ac58 a2=f8 a3=bff4b238 items=0
ppid=1586 pid=1587 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="pluto"
exe="/usr/libexec/ipsec/pluto" subj=system_u:system_r:ipsec_t:s0 key=(null)
type=ANOM_ABEND msg=audit(1378285305.800:408): auid=4294967295 uid=0
gid=0 ses=4294967295 subj=system_u:system_r:ipsec_t:s0 pid=1587
comm="pluto" reason="memory violation" sig=11
type=MAC_IPSEC_EVENT msg=audit(1378285305.866:409): op=SPD-delete
auid=4294967295 ses=4294967295 subj=system_u:system_r:ifconfig_t:s0
res=1 src=Y.Y.Y.Y dst=192.168.200.12
type=MAC_IPSEC_EVENT msg=audit(1378285305.866:409): op=SPD-delete
auid=4294967295 ses=4294967295 subj=system_u:system_r:ifconfig_t:s0
res=1 src=Y.Y.Y.Y dst=192.168.200.12
type=SYSCALL msg=audit(1378285305.866:409): arch=40000003 syscall=102
success=yes exit=16 a0=10 a1=bfc25260 a2=8089000 a3=bfc2935c items=0
ppid=1 pid=1786 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="ip" exe="/usr/sbin/ip"
subj=system_u:system_r:ifconfig_t:s0 key=(null)
type=MAC_IPSEC_EVENT msg=audit(1378285305.869:410): op=SAD-delete
auid=4294967295 ses=4294967295 subj=system_u:system_r:ifconfig_t:s0
src=Y.Y.Y.Y dst=192.168.240.11 spi=1877915368(0x6feeb6e8) res=1
type=MAC_IPSEC_EVENT msg=audit(1378285305.869:410): op=SAD-delete
auid=4294967295 ses=4294967295 subj=system_u:system_r:ifconfig_t:s0
src=192.168.240.11 dst=Y.Y.Y.Y spi=3958996377(0xebf97d99) res=1
type=SYSCALL msg=audit(1378285305.869:410): arch=40000003 syscall=102
success=yes exit=17 a0=10 a1=bfd67ce0 a2=8089000 a3=bfd6bdbc items=0
ppid=1 pid=1788 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="ip" exe="/usr/sbin/ip"
subj=system_u:system_r:ifconfig_t:s0 key=(null)
type=SERVICE_STOP msg=audit(1378285305.870:411): pid=1 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='
comm="ipsec" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=?
res=failed'
type=SERVICE_START msg=audit(1378285305.971:412): pid=1 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='
comm="ipsec" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=?
res=success'
type=SERVICE_STOP msg=audit(1378285305.971:413): pid=1 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='
comm="ipsec" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=?
res=success'
type=SERVICE_START msg=audit(1378285306.101:414): pid=1 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='
comm="ipsec" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=?
res=success'
type=SERVICE_START msg=audit(1378285680.620:415): pid=1 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='
comm="systemd-tmpfiles-clean" exe="/usr/lib/systemd/systemd" hostname=?
addr=? terminal=? res=success'
type=SERVICE_STOP msg=audit(1378285680.621:416): pid=1 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='
comm="systemd-tmpfiles-clean" exe="/usr/lib/systemd/systemd" hostname=?
addr=? terminal=? res=success'
[root at Fedora18lxde ipsec.d]# sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: targeted
Current mode: permissive
Mode from config file: permissive
Policy MLS status: enabled
Policy deny_unknown status: allowed
Max kernel policy version: 28
Could you help me to explain this ?
Miro
More information about the Swan
mailing list