<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p>Hi Paul:</p>
<div style="color: rgb(0, 0, 0);">
<div dir="ltr">
<div id="x_divtagdefaultwrapper" style="font-size:12pt; color:#000000; font-family:Calibri,Helvetica,sans-serif" dir="ltr">
<div style="color:rgb(0,0,0)">
<div dir="ltr">
<div id="x_x_divtagdefaultwrapper" style="font-size:12pt; color:#000000; font-family:Calibri,Helvetica,sans-serif" dir="ltr">
<p><br>
</p>
<p>Thanks for your help in advance. Sorry for late response. (looks like libreswan email server does NOT like attachments.)</p>
<p><br>
</p>
<p>After I applied the "source code change" which in you give me in <a class="OWAAutoLink" id="LPlnk446855" href="https://lists.libreswan.org/pipermail/swan/2017/002368.html" previewremoved="true">
https://lists.libreswan.org/pipermail/swan/2017/002368.html</a>, and re-compile + re-install, still no luck. Same result as before.</p>
<p>By the way, I did sanity test by setting up "IPv4 transport mode" with another machine. It works. </p>
<p><br>
</p>
<p>Can you please double check again? </p>
<p><br>
</p>
<p><br>
</p>
<p>Thanks and regards</p>
<p><br>
</p>
<p>Hao Chen</p>
<p><br>
</p>
<p><br>
</p>
<p>I compared the cksum of "compiled pluto" and "running pluto". they are identical</p>
<p>============================</p>
<p></p>
<div>
<div>[root@xcvms196 libreswan-3.22]# ps -ef | grep pluto<br>
root 14926 1 0 16:21 ? 00:00:00 /usr/local/libexec/ipsec/pluto --leak-detective --config /etc/ipsec.conf --nofork<br>
root 15133 12522 0 16:33 pts/2 00:00:00 grep --color=auto pluto<br>
</div>
</div>
<div>[root@xcvms196 libreswan-3.22]# cksum /usr/local/libexec/ipsec/pluto<br>
3392178695 5987616 /usr/local/libexec/ipsec/pluto<br>
[root@xcvms196 libreswan-3.22]# cksum ./OBJ.linux.x86_64/programs/pluto/pluto<br>
3392178695 5987616 ./OBJ.linux.x86_64/programs/pluto/pluto<br>
</div>
<p></p>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
<p>My compiled libreswan configuration:</p>
<p><span>============================</span></p>
<p>[root@xcvms196 pluto]# /usr/local/libexec/ipsec/pluto --version<br>
</p>
<p></p>
<div>Libreswan 3.22 XFRM(netkey) KLIPS FORK PTHREAD_SETSCHEDPRIO NSS DNSSEC SYSTEMD_WATCHDOG LABELED_IPSEC LIBCAP_NG XAUTH_PAM NETWORKMANAGER CURL(non-NSS)<br>
</div>
<p></p>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
<p>"ip xfrm state" shows:</p>
<p>============================</p>
<p></p>
<div>[root@xcvms196 configs]# ip x s<br>
src 10.0.161.34 dst 10.0.146.196<br>
proto esp spi 0xf6ccf8cc reqid 16393 mode transport<br>
replay-window 32 <br>
auth-trunc hmac(sha1) 0xb0e0f9ca309657046061dcd8d92d54b912972669 96<br>
enc cbc(des3_ede) 0x42292459ae57b3ce22f34b45dd79eeaea83e504b5b1d96d2<br>
encap type espinudp sport 40733 dport 4500 addr 0.0.0.0<br>
anti-replay context: seq 0x4, oseq 0x0, bitmap 0x0000000f<br>
sel src 10.0.161.34/32 dst 10.0.146.196/32 <br>
src 10.0.146.196 dst 10.0.161.34<br>
proto esp spi 0x8655ecb3 reqid 16393 mode transport<br>
replay-window 32 <br>
auth-trunc hmac(sha1) 0x3cfc640908c17ba55bdbd569103ba80bec80fc9c 96<br>
enc cbc(des3_ede) 0x9d4db591e647969c424645ce0ed8c6457508067bb5289506<br>
encap type espinudp sport 4500 dport 40733 addr 0.0.0.0<br>
anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000<br>
sel src 10.0.146.196/32 dst 10.0.161.34/32 <br>
src 10.0.161.34 dst 10.0.146.196<br>
proto esp spi 0xf38542b7 reqid 16389 mode transport<br>
replay-window 32 <br>
auth-trunc hmac(sha1) 0x7a56dd1293ca9f18b5b70fd2e777b4914cf8a38b 96<br>
enc cbc(des3_ede) 0xaa5ac7da2b3cabdc592adf8addeac95ebc6fad6d31c2afb6<br>
encap type espinudp sport 40731 dport 4500 addr 0.0.0.0<br>
anti-replay context: seq 0x8, oseq 0x0, bitmap 0x000000ff<br>
sel src 10.0.161.34/32 dst 10.0.146.196/32 <br>
src 10.0.146.196 dst 10.0.161.34<br>
proto esp spi 0xf830edac reqid 16389 mode transport<br>
replay-window 32 <br>
auth-trunc hmac(sha1) 0x4d13eae0a52db253003992577a33a700b8b69ad9 96<br>
enc cbc(des3_ede) 0x3c8f413929b9a33a0e466c4c6bbf3db499327f62cf29dc85<br>
encap type espinudp sport 4500 dport 40731 addr 0.0.0.0<br>
anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000<br>
sel src 10.0.146.196/32 dst 10.0.161.34/32 <br>
[root@xcvms196 configs]# <br>
</div>
<p></p>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
<p>"ip xfrm pol" shows:</p>
<p>==========================</p>
<p></p>
<div>[root@xcvms196 configs]# ip x p<br>
src 10.0.146.196/32 dst 10.0.161.34/32 <br>
dir out priority 2080 ptype main <br>
<span style="color:rgb(255,0,0); background-color:rgb(255,255,0)">mark -1/0xffffffff</span><br>
tmpl src 0.0.0.0 dst 0.0.0.0<br>
proto esp reqid 16393 mode transport<br>
src 10.0.161.34/32 dst 10.0.146.196/32 <br>
dir in priority 2080 ptype main <br>
<span style="background-color:rgb(255,255,0)"> mark -1/0xffffffff</span><br>
tmpl src 0.0.0.0 dst 0.0.0.0<br>
proto esp reqid 16393 mode transport<br>
src 10.0.146.196/32 dst 192.168.161.0/24 <br>
dir out priority 2088 ptype main <br>
<span style="background-color:rgb(255,255,0)">mark -1/0xffffffff</span><br>
tmpl src 0.0.0.0 dst 0.0.0.0<br>
proto esp reqid 0 mode transport<br>
src ::/0 dst ::/0 <br>
socket out priority 0 ptype main <br>
src ::/0 dst ::/0 <br>
socket in priority 0 ptype main <br>
src 0.0.0.0/0 dst 0.0.0.0/0 <br>
socket out priority 0 ptype main <br>
src 0.0.0.0/0 dst 0.0.0.0/0 <br>
</div>
<p></p>
<p><br>
</p>
<p><br>
</p>
<p>I also attached modified connections.c/h for your cross-check. </p>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
<br>
<br>
<div style="color:rgb(0,0,0)">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_x_divRplyFwdMsg" dir="ltr"><font color="#000000" face="Calibri, sans-serif" style="font-size:11pt"><b>From:</b> Paul Wouters <paul@nohats.ca><br>
<b>Sent:</b> Tuesday, October 31, 2017 14:48<br>
<b>To:</b> Hao Chen<br>
<b>Cc:</b> swan@lists.libreswan.org<br>
<b>Subject:</b> PATCH, was Re: [Swan] Does libreswan v3.20 support multiple clients behind NAT to communicate with public server simultaneously?</font>
<div> </div>
</div>
<div class="x_x_BodyFragment"><font size="2"><span style="font-size:10pt">
<div class="x_x_PlainText">On Tue, 31 Oct 2017, Hao Chen wrote:<br>
<br>
> [root@xcvms196 configs]# ip x p<br>
> src 10.0.146.196/32 dst 10.0.161.34/32<br>
> dir out priority 2080 ptype main<br>
> mark -1/0xffffffff<br>
<br>
Oops, it should never have -1 there. turned out we couldn't really<br>
test for -1 because it is an unsigned int.<br>
<br>
Please try the attached patch. It works for me on 3.22, but I think<br>
it should work fine on 3.20 as well.<br>
<br>
Paul</div>
</span></font></div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>