<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi Paul,<div class=""><br class=""></div><div class="">ikelifetime is 24h, I change salifetime to the same value. It doesn’t disconnect after an hour, but the issue is there.. </div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">As for the remote end it is libreswan 3.27, but this start to happen only after upgrading the server to libreswan 3.41.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">In the debug when establish for the first time there is the information about the missing certificate:</div><div class=""><br class=""></div><div class=""><div class="">Jan 25 12:03:56 sol pluto[19224]: | authentication succeeded</div><div class="">Jan 25 12:03:56 sol pluto[19224]: | thinking about whether to send my certificate:</div><div class="">Jan 25 12:03:56 sol pluto[19224]: | I have RSA key: OAKLEY_PRESHARED_KEY cert.type: 0??</div><div class="">Jan 25 12:03:56 sol pluto[19224]: | sendcert: CERT_ALWAYSSEND and I did not get a certificate request</div><div class="">Jan 25 12:03:56 sol pluto[19224]: | so do not send cert.</div><div class="">Jan 25 12:03:56 sol pluto[19224]: | I did not send a certificate because digital signatures are not being used. (PSK)</div><div class="">Jan 25 12:03:56 sol pluto[19224]: | opening output PBS reply packet</div><div class="">Jan 25 12:03:56 sol pluto[19224]: | **emit ISAKMP Message:</div><div class="">Jan 25 12:03:56 sol pluto[19224]: | initiator SPI: 27 e6 51 cd 5e 56 cb eb</div><div class="">Jan 25 12:03:56 sol pluto[19224]: | responder SPI: 5e 32 29 aa 54 2d 89 7e</div><div class="">Jan 25 12:03:56 sol pluto[19224]: | next payload type: ISAKMP_NEXT_NONE (0x0)</div><div class="">Jan 25 12:03:56 sol pluto[19224]: | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10)</div><div class="">Jan 25 12:03:56 sol pluto[19224]: | exchange type: ISAKMP_XCHG_IDPROT (0x2)</div><div class="">Jan 25 12:03:56 sol pluto[19224]: | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1)</div><div class="">Jan 25 12:03:56 sol pluto[19224]: | Message ID: 0 (00 00 00 00)</div><div class="">Jan 25 12:03:56 sol pluto[19224]: | next payload chain: saving message location 'ISAKMP Message'.'next payload type’</div></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">But it does establish the connection. </div><div class=""><br class=""></div><div class="">Then after 1h, the log after the authentication is successful and it fail on “CERTIFICATE_UNAVAILABLE”.</div><div class=""> </div><div class=""><br class=""></div><div class=""><div class="">n 25 12:59:26 sol pluto[19224]: "tunnel8"[6] 95.61.168.133 #24: XAUTH: User <a href="mailto:asilvapt@remote.local" class="">asilvapt@remote.local</a>: Authentication Successful</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | opening output PBS xauth_buf</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | **emit ISAKMP Message:</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | initiator SPI: 66 6a 3c 3e 85 e9 f9 6d</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | responder SPI: 7c 4c 08 f8 93 21 f7 2a</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | next payload type: ISAKMP_NEXT_NONE (0x0)</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10)</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | exchange type: ISAKMP_XCHG_MODE_CFG (0x6)</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1)</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | Message ID: 1337103569 (4f b2 94 d1)</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | next payload chain: saving message location 'ISAKMP Message'.'next payload type'</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | ***emit ISAKMP Hash Payload:</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | next payload type: ISAKMP_NEXT_NONE (0x0)</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Hash Payload (8:ISAKMP_NEXT_HASH)</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | next payload chain: saving location 'ISAKMP Hash Payload'.'next payload type' in 'xauth_buf'</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | emitting 32 zero bytes of HASH DATA into ISAKMP Hash Payload</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | emitting length of ISAKMP Hash Payload: 36</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | ***emit ISAKMP Mode Attribute:</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | next payload type: ISAKMP_NEXT_NONE (0x0)</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | Attr Msg Type: ISAKMP_CFG_SET (0x3)</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | Identifier: 0 (00 00)</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | next payload chain: setting previous 'ISAKMP Hash Payload'.'next payload type' to current ISAKMP Mode Attribute (14:ISAKMP_NEXT_MODECFG)</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | next payload chain: saving location 'ISAKMP Mode Attribute'.'next payload type' in 'xauth_buf'</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | ****emit ISAKMP ModeCfg attribute:</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | ModeCfg attr type: AF+XAUTH-STATUS (0xc08f)</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | length/value: 1 (00 01)</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | no IKEv1 message padding required</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | emitting length of ISAKMP Mode Attribute: 12</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | XAUTH: status HASH(1):</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | 3a 1b b0 42 f5 9e 74 ce ee 4d 35 ac 28 72 99 52</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | a0 e8 1d 79 87 eb e4 be 67 9f 2e f8 15 d6 be 9c</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | no IKEv1 message padding required</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | emitting length of ISAKMP Message: 76</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | no IKEv1 message padding required</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | emitting length of ISAKMP Message: 76</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | state #24 has no .st_event to delete</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | #24 STATE_XAUTH_R0: retransmits: cleared</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | event_schedule: newref EVENT_RETRANSMIT-pe@0x55a5339d7158</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | inserting event EVENT_RETRANSMIT, timeout in 0.5 seconds for #24</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | libevent_malloc: newref ptr-libevent@0x55a5339c0148 size 128</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | #24 STATE_XAUTH_R0: retransmits: first event in 0.5 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 333161.099021</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | sending 80 bytes for XAUTH: status through pppeth2.24 from 92.211.123.17:4500 to 95.61.168.133:4500 using UDP (for #24)</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | 00 00 00 00 66 6a 3c 3e 85 e9 f9 6d 7c 4c 08 f8</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | 93 21 f7 2a 08 10 06 01 4f b2 94 d1 00 00 00 4c</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | e2 5d 4b 96 00 3d 44 96 0a 70 03 93 20 3b 31 93</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | 91 15 5e 42 d7 2d 36 9f b9 d2 ed ed b1 74 97 d4</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | 87 91 46 64 43 9b 76 c6 f4 9c 9d ca 62 1a e7 70</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | parent state #24: XAUTH_R0(established IKE SA) => XAUTH_R1(established IKE SA)</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | resume xauth immediate for #24 suppresed complete_v1_state_transition()</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | delref mdp@0x55a5339c0448(1->0) (in resume_handler() at server.c:731)</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | delref fd@NULL (in free_logger() at log.c:845)</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | delref fd@NULL (in free_logger() at log.c:846)</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | #24 spent 0.261 (0.261) milliseconds in resume xauth immediate</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | stop processing: state #24 connection "tunnel8"[6] 95.61.168.133 from 95.61.168.133:4500 (in resume_handler() at server.c:733)</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | libevent_free: delref ptr-libevent@0x55a5339f5538</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | spent 0.00237 (0.00237) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue()</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | newref md@0x55a5339c0448(0->1) (in read_message() at demux.c:103)</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | *received 76 bytes from 95.61.168.133:4500 on pppeth2.24 92.211.123.17:4500 using UDP</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | 43 9f 57 5d 9d 4e b0 ae b2 23 af 61 43 7d 07 5d</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | 08 10 05 01 19 09 57 d3 00 00 00 4c 44 ce 04 7d</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | 2a 61 eb df 62 1f 8c 41 5a d3 1e 58 d6 6a e3 fa</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | f1 7e 8b 9d ae ac b7 69 d4 cb 98 a7 bb 71 ed 4d</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | ee 58 47 54 c8 45 42 0f 4e 09 16 c3</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | **parse ISAKMP Message:</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | initiator SPI: 43 9f 57 5d 9d 4e b0 ae</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | responder SPI: b2 23 af 61 43 7d 07 5d</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | next payload type: ISAKMP_NEXT_HASH (0x8)</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10)</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | exchange type: ISAKMP_XCHG_INFO (0x5)</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1)</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | Message ID: 420042707 (19 09 57 d3)</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | length: 76 (00 00 00 4c)</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | processing version=1.0 packet with exchange type=ISAKMP_XCHG_INFO (5)</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | peer and cookies match on #23; msgid=00000000 st_msgid=00000000 st_v1_msgid.phase15=b9ea6076</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | p15 state object #23 found, in STATE_XAUTH_R0</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | State DB: found IKEv1 state #23 in XAUTH_R0 (find_v1_info_state)</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | start processing: state #23 connection "tunnel8"[6] 95.61.168.133 from 95.61.168.133:4500 (in process_v1_packet() at ikev1.c:1378)</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | #23 is idle</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | #23 idle</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | received encrypted packet from 95.61.168.133:4500</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x100 opt: 0x0</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | ***parse ISAKMP Hash Payload:</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | next payload type: ISAKMP_NEXT_N (0xb)</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | length: 36 (00 24)</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | got payload 0x800 (ISAKMP_NEXT_N) needed: 0x0 opt: 0x0</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | ***parse ISAKMP Notification Payload:</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | next payload type: ISAKMP_NEXT_NONE (0x0)</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | length: 12 (00 0c)</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | DOI: ISAKMP_DOI_IPSEC (0x1)</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | protocol ID: 1 (01)</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | SPI size: 0 (00)</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | Notify Message Type: CERTIFICATE_UNAVAILABLE (0x1c)</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | informational HASH(1):</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | 25 d1 55 70 1c c9 ce 35 cd 7f 09 23 8e 45 4b c4</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | ed 88 2e 3f ee bd 06 1c b0 c0 f0 14 43 41 f8 eb</div><div class="">Jan 25 12:59:26 sol pluto[19224]: | received 'informational' message HASH(1) data ok</div><div class="">Jan 25 12:59:26 sol pluto[19224]: "tunnel8"[6] 95.61.168.133 #23: ignoring informational payload CERTIFICATE_UNAVAILABLE, msgid=00000000, length=12</div></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">I’ve the full log if you need more info. </div><div class=""><br class=""></div><div class="">Thanks.</div><div class=""><br class=""></div><div class=""><div class="">
<div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">--<br class="Apple-interchange-newline">Saludos / Regards / Cumprimentos</div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">António Silva</div></div><br class="Apple-interchange-newline"><br class="Apple-interchange-newline">
</div>
<div><br class=""><blockquote type="cite" class=""><div class="">On 25 Jan 2021, at 16:47, Paul Wouters <<a href="mailto:paul@nohats.ca" class="">paul@nohats.ca</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">On Mon, 25 Jan 2021, Kontakt wrote:<br class=""><br class=""><blockquote type="cite" class="">what about my case? ;)<br class="">I have no certificate and also disconnects - I have PSK.<br class=""></blockquote><br class="">Please set ikelifetime=24h as well ? This is the default value in<br class="">libreswan 4.2 (which is pending release)<br class=""><br class="">Paul<br class=""><br class=""><blockquote type="cite" class="">pon., 25 sty 2021 o 16:05 Paul Wouters <<a href="mailto:paul@nohats.ca" class="">paul@nohats.ca</a>> napisał(a):<br class=""> On Mon, 25 Jan 2021, António Silva wrote:<br class=""><br class=""> > I’m using PSK.<br class=""><br class=""> > Putting extra debug now.<br class=""><br class=""> If you are using PSK then the error CERTIFICATE_UNAVAILABLE from the<br class=""> remote peer makes no sense whatsoevef.<br class=""><br class=""> RFC 2408 states:<br class=""><br class=""> 3. Process the Certificate Request. If a requested Certificate Type<br class=""> with the specified Certificate Authority is not available, then<br class=""> the payload is discarded and the following actions are taken:<br class=""><br class=""> (a) The event, CERTIFICATE-UNAVAILABLE, MAY be logged in the<br class=""> appropriate system audit file.<br class=""><br class=""> (b) An Informational Exchange with a Notification payload<br class=""> containing the CERTIFICATE-UNAVAILABLE message type MAY be<br class=""> sent to the transmitting entity. This action is dictated by<br class=""> a system security policy.<br class=""><br class=""> I guess your debugging will show if libreswan sent any CERT or CERTREQ<br class=""> payload that might have confused the other end ?<br class=""><br class=""> Paul<br class=""> _______________________________________________<br class=""> Swan mailing list<br class=""> <a href="mailto:Swan@lists.libreswan.org" class="">Swan@lists.libreswan.org</a><br class=""> <a href="https://lists.libreswan.org/mailman/listinfo/swan" class="">https://lists.libreswan.org/mailman/listinfo/swan</a><br class=""><br class=""></blockquote></div></div></blockquote></div><br class=""></div></body></html>