tk-r4k Sun Jul 27 20:39:56 IST 2008 + _________________________ version + ipsec --version Linux Openswan U2.4.11/K2.6.25-ARCH (netkey) See `ipsec --copyright' for copyright information. + _________________________ /proc/version + cat /proc/version Linux version 2.6.25-ARCH (root@workstation64) (gcc version 4.3.1 20080626 (prerelease) (GCC) ) #1 SMP PREEMPT Mon Jul 14 14:56:27 UTC 2008 + _________________________ /proc/net/ipsec_eroute + test -r /proc/net/ipsec_eroute + _________________________ netstat-rn + netstat -nr + head -n 100 Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface 10.12.62.0 0.0.0.0 255.255.255.0 U 0 0 0 wlan0 0.0.0.0 0.0.0.0 128.0.0.0 U 0 0 0 wlan0 128.0.0.0 0.0.0.0 128.0.0.0 U 0 0 0 wlan0 0.0.0.0 10.12.62.1 0.0.0.0 UG 0 0 0 wlan0 + _________________________ /proc/net/ipsec_spi + test -r /proc/net/ipsec_spi + _________________________ /proc/net/ipsec_spigrp + test -r /proc/net/ipsec_spigrp + _________________________ /proc/net/ipsec_tncfg + test -r /proc/net/ipsec_tncfg + _________________________ /proc/net/pfkey + test -r /proc/net/pfkey + cat /proc/net/pfkey sk RefCnt Rmem Wmem User Inode + _________________________ ip-xfrm-state + ip xfrm state src 10.12.62.99 dst 10.12.62.1 proto esp spi 0x0be748c8 reqid 16385 mode tunnel replay-window 32 auth hmac(sha1) 0x1c268ced3c7b4e2350cb9a43f214e81c2298a230 enc cbc(aes) 0xe39548d4c18a713ae6b53dd8b48223cd sel src 0.0.0.0/0 dst 0.0.0.0/0 src 10.12.62.1 dst 10.12.62.99 proto esp spi 0x18208a96 reqid 16385 mode tunnel replay-window 32 auth hmac(sha1) 0xa29e731ee9ba84fe0228a2460ea21aa6c508918b enc cbc(aes) 0xbf77e94ecd4699a16cbd085289a595ad sel src 0.0.0.0/0 dst 0.0.0.0/0 + _________________________ ip-xfrm-policy + ip xfrm policy src 0.0.0.0/0 dst 10.12.62.99/32 dir in priority 2112 tmpl src 10.12.62.1 dst 10.12.62.99 proto esp reqid 16385 mode tunnel src 10.12.62.99/32 dst 0.0.0.0/0 dir out priority 2112 tmpl src 10.12.62.99 dst 10.12.62.1 proto esp reqid 16385 mode tunnel src 0.0.0.0/0 dst 10.12.62.99/32 dir fwd priority 2112 tmpl src 10.12.62.1 dst 10.12.62.99 proto esp reqid 16385 mode tunnel src ::/0 dst ::/0 dir in priority 0 src 0.0.0.0/0 dst 0.0.0.0/0 dir in priority 0 src 0.0.0.0/0 dst 0.0.0.0/0 dir in priority 0 src 0.0.0.0/0 dst 0.0.0.0/0 dir in priority 0 src 0.0.0.0/0 dst 0.0.0.0/0 dir in priority 0 src ::/0 dst ::/0 dir out priority 0 src 0.0.0.0/0 dst 0.0.0.0/0 dir out priority 0 src 0.0.0.0/0 dst 0.0.0.0/0 dir out priority 0 src 0.0.0.0/0 dst 0.0.0.0/0 dir out priority 0 src 0.0.0.0/0 dst 0.0.0.0/0 dir out priority 0 + _________________________ /proc/sys/net/ipsec-star + test -d /proc/sys/net/ipsec + _________________________ ipsec/status + ipsec auto --status 000 interface lo/lo ::1 000 interface lo/lo 127.0.0.1 000 interface lo/lo 127.0.0.1 000 interface wlan0/wlan0 10.12.62.99 000 interface wlan0/wlan0 10.12.62.99 000 %myid = (none) 000 debug none 000 000 algorithm ESP encrypt: id=2, name=ESP_DES, ivlen=8, keysizemin=64, keysizemax=64 000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=8, keysizemin=192, keysizemax=192 000 algorithm ESP encrypt: id=7, name=ESP_BLOWFISH, ivlen=8, keysizemin=40, keysizemax=448 000 algorithm ESP encrypt: id=11, name=ESP_NULL, ivlen=0, keysizemin=0, keysizemax=0 000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=8, keysizemin=128, keysizemax=256 000 algorithm ESP encrypt: id=13, name=(null), ivlen=8, keysizemin=128, keysizemax=256 000 algorithm ESP encrypt: id=22, name=(null), ivlen=8, keysizemin=128, keysizemax=256 000 algorithm ESP encrypt: id=252, name=ESP_SERPENT, ivlen=8, keysizemin=128, keysizemax=256 000 algorithm ESP encrypt: id=253, name=ESP_TWOFISH, ivlen=8, keysizemin=128, keysizemax=256 000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5, keysizemin=128, keysizemax=128 000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1, keysizemin=160, keysizemax=160 000 algorithm ESP auth attr: id=5, name=AUTH_ALGORITHM_HMAC_SHA2_256, keysizemin=256, keysizemax=256 000 algorithm ESP auth attr: id=9, name=AUTH_ALGORITHM_AES_CBC, keysizemin=128, keysizemax=128 000 algorithm ESP auth attr: id=251, name=(null), keysizemin=0, keysizemax=0 000 000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8, keydeflen=192 000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16, keydeflen=128 000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16 000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20 000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024 000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536 000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048 000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072 000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096 000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144 000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192 000 000 stats db_ops.c: {curr_cnt, total_cnt, maxsz} :context={0,0,0} trans={0,0,0} attrs={0,0,0} 000 000 "Arch2Net": 10.12.62.99[C=IE, ST=Wicklow, O=tk-on.net, OU=HQ, CN=Tom K]...10.12.62.1[C=IE, O=tk-on.net, CN=ipcop.tk-on.net]===0.0.0.0/0; erouted; eroute owner: #2 000 "Arch2Net": srcip=unset; dstip=unset; srcup=ipsec _updown; dstup=ipsec _updown; 000 "Arch2Net": CAs: 'C=IE, O=tk-on.net, CN=tk-on.net CA, E=tomk@runbox.com'...'C=IE, O=tk-on.net, CN=tk-on.net CA, E=tomk@runbox.com' 000 "Arch2Net": ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0 000 "Arch2Net": policy: RSASIG+ENCRYPT+TUNNEL+PFS+UP; prio: 0,32; interface: wlan0; encap: esp; 000 "Arch2Net": dpd: action:clear; delay:30; timeout:120; 000 "Arch2Net": newest ISAKMP SA: #3; newest IPsec SA: #2; 000 "Arch2Net": IKE algorithm newest: 3DES_CBC_192-SHA1-MODP1536 000 000 #3: "Arch2Net":500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 2573s; newest ISAKMP; lastdpd=16s(seq in:6540 out:0) 000 #2: "Arch2Net":500 STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 27030s; newest IPSEC; eroute owner 000 #2: "Arch2Net" esp.be748c8@10.12.62.1 esp.18208a96@10.12.62.99 tun.0@10.12.62.1 tun.0@10.12.62.99 000 #1: "Arch2Net":500 STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 1901s; lastdpd=-1s(seq in:0 out:0) 000 + _________________________ ifconfig-a + ifconfig -a eth0 Link encap:Ethernet HWaddr 00:0F:B0:BA:F3:73 BROADCAST MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) Interrupt:22 Base address:0xa400 lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:398 errors:0 dropped:0 overruns:0 frame:0 TX packets:398 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:9428 (9.2 Kb) TX bytes:9428 (9.2 Kb) wlan0 Link encap:Ethernet HWaddr 00:14:A5:29:DF:CC inet addr:10.12.62.99 Bcast:10.12.62.255 Mask:255.255.255.0 inet6 addr: fe80::214:a5ff:fe29:dfcc/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:73241 errors:0 dropped:0 overruns:0 frame:0 TX packets:52198 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:84826563 (80.8 Mb) TX bytes:9197296 (8.7 Mb) wmaster0 Link encap:UNSPEC HWaddr 00-14-A5-29-DF-CC-00-00-00-00-00-00-00-00-00-00 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) + _________________________ ip-addr-list + ip addr list 1: lo: mtu 16436 qdisc noqueue state UNKNOWN link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: eth0: mtu 1500 qdisc noop state DOWN qlen 1000 link/ether 00:0f:b0:ba:f3:73 brd ff:ff:ff:ff:ff:ff 3: wmaster0: mtu 1500 qdisc ieee80211 state UNKNOWN qlen 1000 link/ieee802.11 00:14:a5:29:df:cc brd ff:ff:ff:ff:ff:ff 4: wlan0: mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 00:14:a5:29:df:cc brd ff:ff:ff:ff:ff:ff inet 10.12.62.99/24 brd 10.12.62.255 scope global wlan0 inet6 fe80::214:a5ff:fe29:dfcc/64 scope link valid_lft forever preferred_lft forever + _________________________ ip-route-list + ip route list 10.12.62.0/24 dev wlan0 proto kernel scope link src 10.12.62.99 0.0.0.0/1 dev wlan0 scope link 128.0.0.0/1 dev wlan0 scope link default via 10.12.62.1 dev wlan0 + _________________________ ip-rule-list + ip rule list 0: from all lookup local 32766: from all lookup main 32767: from all lookup default + _________________________ ipsec_verify + ipsec verify --nocolour Checking your system to see if IPsec got installed and started correctly: Version check and ipsec on-path [OK] Linux Openswan U2.4.11/K2.6.25-ARCH (netkey) Checking for IPsec support in kernel [OK] Hardware RNG detected, testing if used properly [FAILED] Hardware RNG is present but 'rngd' is not running. No harware random used! NETKEY detected, testing for disabled ICMP send_redirects [FAILED] Please disable /proc/sys/net/ipv4/conf/*/send_redirects or NETKEY will cause the sending of bogus ICMP redirects! NETKEY detected, testing for disabled ICMP accept_redirects [FAILED] Please disable /proc/sys/net/ipv4/conf/*/accept_redirects or NETKEY will accept bogus ICMP redirects! Checking for RSA private key (/etc/ipsec.secrets) [DISABLED] ipsec showhostkey: no default key in "/etc/ipsec.secrets" Checking that pluto is running [OK] Two or more interfaces found, checking IP forwarding [FAILED] Checking for 'ip' command [OK] Checking for 'iptables' command [FAILED] which: no iptables in (/sbin:/usr/bin:/usr/local/sbin:/usr/sbin:/usr/sbin:/sbin:/usr/sbin:/usr/local/bin:/bin:/usr/bin) Opportunistic Encryption Support [DISABLED] which: no iptables in (/sbin:/usr/bin:/usr/local/sbin:/usr/sbin:/usr/sbin:/sbin:/usr/sbin:/usr/local/bin:/bin:/usr/bin) + _________________________ mii-tool + '[' -x /sbin/mii-tool ']' + /sbin/mii-tool -v SIOCGMIIPHY on 'eth0' failed: Invalid argument no MII interfaces found + _________________________ ipsec/directory + ipsec --directory /usr/lib/ipsec + _________________________ hostname/fqdn + hostname --fqdn localhost.localdomain + _________________________ hostname/ipaddress + hostname --ip-address 127.0.0.1 + _________________________ uptime + uptime 20:39:57 up 7:56, 1 user, load average: 0.09, 0.11, 0.09 + _________________________ ps + ps alxwf + egrep -i 'ppid|pluto|ipsec|klips' F UID PID PPID PRI NI VSZ RSS WCHAN STAT TTY TIME COMMAND 0 1000 7961 4916 20 0 14332 2068 - S+ pts/2 0:00 \_ most ipsec.barf.2.4.11 1 0 7599 1 20 0 13256 556 wait S pts/2 0:00 /bin/sh /usr/lib/ipsec/_plutorun --debug none --uniqueids yes --nocrsend --strictcrlpolicy --nat_traversal yes --keep_alive --protostack netkey --force_keepalive --disable_port_floating --virtual_private %v4:10.0.0.0/8,%v4:172.16.0.0/12,%v4:192.168.0.0/16,%v4:!192.168.10.0/255.255.255.0,%v4:!10.1.3.0/255.255.255.0,%v4:!10.12.62.0/255.255.255.0 --crlcheckinterval 0 --ocspuri --nhelpers --dump --opts --stderrlog --wait no --pre --post --log daemon.error --pid /var/run/pluto/pluto.pid 1 0 7600 7599 20 0 13256 748 wait S pts/2 0:00 \_ /bin/sh /usr/lib/ipsec/_plutorun --debug none --uniqueids yes --nocrsend --strictcrlpolicy --nat_traversal yes --keep_alive --protostack netkey --force_keepalive --disable_port_floating --virtual_private %v4:10.0.0.0/8,%v4:172.16.0.0/12,%v4:192.168.0.0/16,%v4:!192.168.10.0/255.255.255.0,%v4:!10.1.3.0/255.255.255.0,%v4:!10.12.62.0/255.255.255.0 --crlcheckinterval 0 --ocspuri --nhelpers --dump --opts --stderrlog --wait no --pre --post --log daemon.error --pid /var/run/pluto/pluto.pid 4 0 7601 7600 20 0 9004 1520 - S pts/2 0:00 | \_ /usr/lib/openswan/pluto --nofork --secretsfile /etc/ipsec.secrets --ipsecdir /etc/ipsec.d --debug-none --use-netkey --uniqueids --nat_traversal --virtual_private %v4:10.0.0.0/8,%v4:172.16.0.0/12,%v4:192.168.0.0/16,%v4:!192.168.10.0/255.255.255.0,%v4:!10.1.3.0/255.255.255.0,%v4:!10.12.62.0/255.255.255.0 1 0 7602 7601 30 10 8948 552 - SN pts/2 0:00 | \_ pluto helper # 0 0 0 7692 7601 20 0 5776 372 - S pts/2 0:00 | \_ _pluto_adns 4 0 7606 7599 20 0 13260 1456 pipe_w S pts/2 0:00 \_ /bin/sh /usr/lib/ipsec/_plutoload --wait no --post 4 0 7603 1 20 0 3780 592 pipe_w S pts/2 0:00 logger -s -p daemon.error -t ipsec__plutorun + _________________________ ipsec/showdefaults + ipsec showdefaults routephys=wlan0 routevirt=ipsec0 routeaddr=10.12.62.99 routenexthop=10.12.62.1 + _________________________ ipsec/conf + ipsec _include /etc/ipsec.conf + ipsec _keycensor #< /etc/ipsec.conf 1 version 2.0 config setup interfaces=%defaultroute klipsdebug=none plutodebug=none protostack=netkey #plutoload=%search #plutostart=%search uniqueids=yes nat_traversal=yes virtual_private=%v4:10.0.0.0/8,%v4:172.16.0.0/12,%v4:192.168.0.0/16,%v4:!192.168.10.0/255.255.255.0,%v4:!10.1.3.0/255.255.255.0,%v4:!10.12.62.0/255.255.255.0 conn %default keyingtries=0 disablearrivalcheck=no conn Arch2Net left=10.12.62.1 leftsubnet=0.0.0.0/0.0.0.0 leftcert=/etc/ipsec.d/certs/hostcert.pem right=10.12.62.99 rightcert=/etc/ipsec.d/certs/Arch2Netcert.pem dpddelay=30 dpdtimeout=120 dpdaction=clear authby=rsasig auto=start conn Net2Home left=www.tk-on.net leftsubnet=192.168.10.0/255.255.255.0 leftcert=/etc/ipsec.d/certs/hostcert.pem right=%defaultroute rightcert=/etc/ipsec.d/certs/Net2Homecert.pem dpddelay=30 dpdtimeout=120 dpdaction=clear authby=rsasig auto=add #Disable OE #< /etc/ipsec.d/examples/no_oe.conf 1 # 'include' this file to disable Opportunistic Encryption. # See /usr/share/doc/openswan/policygroups.html for details. # # RCSID $Id: no_oe.conf.in,v 1.2 2004-10-03 19:33:10 paul Exp $ conn block auto=ignore conn private auto=ignore conn private-or-clear auto=ignore conn clear-or-private auto=ignore conn clear auto=ignore conn packetdefault auto=ignore #> /etc/ipsec.conf 45 + _________________________ ipsec/secrets + ipsec _include /etc/ipsec.secrets + ipsec _secretcensor #< /etc/ipsec.secrets 1 # RCSID $Id: ipsec.secrets.proto,v 1.2 2004/03/13 17:13:47 rene Exp $ # This file holds shared secrets or RSA private keys for inter-Pluto # authentication. See ipsec_pluto(8) manpage, and HTML documentation. # RSA private key for this host, authenticating it to any other host # which knows the public part. Suitable public keys, for ipsec.conf, DNS, # or configuration of other implementations, can be extracted conveniently # with "[sums to ef67...]". : RSA /etc/ipsec.d/private/tk-i5kaKey.pem + _________________________ ipsec/listall + ipsec auto --listall 000 000 List of Public Keys: 000 000 Jul 27 20:27:19 2008, 1024 RSA Key AwEAAegrc, until Jul 25 14:29:17 2020 ok 000 ID_DER_ASN1_DN 'C=IE, O=tk-on.net, CN=ipcop.tk-on.net' 000 Issuer 'C=IE, O=tk-on.net, CN=tk-on.net CA, E=tomk@runbox.com' 000 Jul 27 20:26:50 2008, 2048 RSA Key AwEAAbk5R, until Oct 22 14:26:06 2020 ok 000 ID_DER_ASN1_DN 'C=IE, ST=Wicklow, O=tk-on.net, OU=HQ, CN=Tom K' 000 Issuer 'C=IE, O=tk-on.net, CN=tk-on.net CA, E=tomk@runbox.com' 000 000 List of X.509 End Certificates: 000 000 Jul 27 20:26:50 2008, count: 1 000 subject: 'C=IE, ST=Wicklow, O=tk-on.net, OU=HQ, CN=Tom K' 000 issuer: 'C=IE, O=tk-on.net, CN=tk-on.net CA, E=tomk@runbox.com' 000 serial: 01 000 pubkey: 2048 RSA Key AwEAAbk5R, has private key 000 validity: not before Dec 11 22:51:26 2004 ok 000 not after Oct 22 14:26:06 2020 ok 000 subjkey: 43:6c:53:5f:e7:f0:21:d3:30:4e:7d:c1:d6:18:44:9c:25:e5:1c:92 000 authkey: 10:09:e7:cc:36:bb:1f:79:9a:68:4f:24:34:e7:77:86:a8:76:6a:27 000 aserial: 00 000 Jul 27 20:26:50 2008, count: 1 000 subject: 'C=IE, O=tk-on.net, CN=ipcop.tk-on.net' 000 issuer: 'C=IE, O=tk-on.net, CN=tk-on.net CA, E=tomk@runbox.com' 000 serial: 01 000 pubkey: 1024 RSA Key AwEAAegrc 000 validity: not before Sep 13 23:54:38 2004 ok 000 not after Jul 25 14:29:18 2020 ok 000 subjkey: ab:f6:b8:8a:d5:6b:0b:f8:54:42:4d:c3:12:96:bc:9d:7a:ab:a3:e6 000 authkey: 10:09:e7:cc:36:bb:1f:79:9a:68:4f:24:34:e7:77:86:a8:76:6a:27 000 aserial: 00 000 000 List of X.509 CA Certificates: 000 000 Jul 27 20:26:50 2008, count: 1 000 subject: 'C=IE, O=tk-on.net, CN=tk-on.net CA, E=tomk@runbox.com' 000 issuer: 'C=IE, O=tk-on.net, CN=tk-on.net CA, E=tomk@runbox.com' 000 serial: 00 000 pubkey: 2048 RSA Key AwEAAbjj3 000 validity: not before Sep 13 23:54:37 2004 ok 000 not after Jul 25 14:29:17 2020 ok 000 subjkey: 10:09:e7:cc:36:bb:1f:79:9a:68:4f:24:34:e7:77:86:a8:76:6a:27 000 authkey: 10:09:e7:cc:36:bb:1f:79:9a:68:4f:24:34:e7:77:86:a8:76:6a:27 000 aserial: 00 000 000 List of X.509 CRLs: 000 000 Jul 27 20:26:50 2008, revoked certs: 0 000 issuer: 'C=IE, O=tk-on.net, CN=tk-on.net CA, E=tomk@runbox.com' 000 updates: this Sep 13 23:54:39 2004 000 next Oct 13 23:54:39 2004 warning (expired) + '[' /etc/ipsec.d/policies ']' + for policy in '$POLICIES/*' ++ basename /etc/ipsec.d/policies/block + base=block + _________________________ ipsec/policies/block + cat /etc/ipsec.d/policies/block # This file defines the set of CIDRs (network/mask-length) to which # communication should never be allowed. # # See /usr/share/doc/openswan/policygroups.html for details. # # $Id: block.in,v 1.4 2003-02-17 02:22:15 mcr Exp $ # + for policy in '$POLICIES/*' ++ basename /etc/ipsec.d/policies/block.pacsave + base=block.pacsave + _________________________ ipsec/policies/block.pacsave + cat /etc/ipsec.d/policies/block.pacsave # This file defines the set of CIDRs (network/mask-length) to which # communication should never be allowed. # # See /usr/share/doc/openswan/policygroups.html for details. # # $Id: block.in,v 1.4 2003/02/17 02:22:15 mcr Exp $ # + for policy in '$POLICIES/*' ++ basename /etc/ipsec.d/policies/clear + base=clear + _________________________ ipsec/policies/clear + cat /etc/ipsec.d/policies/clear # This file defines the set of CIDRs (network/mask-length) to which # communication should always be in the clear. # # See /usr/share/doc/openswan/policygroups.html for details. # # $Id: clear.in,v 1.4.30.3 2006-11-21 19:49:51 paul Exp $ # # # Michael's idea: Always have ROOT NAMESERVERS in the clear. # It will make OE work much better on machines running caching # resolvers. # # Based on: http://www.internic.net/zones/named.root # This file holds the information on root name servers needed to # last update: Jan 29, 2004 # related version of root zone: 2004012900 198.41.0.4/32 192.228.79.201/32 192.33.4.12/32 128.8.10.90/32 192.203.230.10/32 192.5.5.241/32 192.112.36.4/32 128.63.2.53/32 192.36.148.17/32 192.58.128.30/32 193.0.14.129/32 198.32.64.12/32 202.12.27.33/32 + for policy in '$POLICIES/*' ++ basename /etc/ipsec.d/policies/clear-or-private + base=clear-or-private + _________________________ ipsec/policies/clear-or-private + cat /etc/ipsec.d/policies/clear-or-private # This file defines the set of CIDRs (network/mask-length) to which # we will communicate in the clear, or, if the other side initiates IPSEC, # using encryption. This behaviour is also called "Opportunistic Responder". # # See /usr/share/doc/openswan/policygroups.html for details. # # $Id: clear-or-private.in,v 1.4 2003-02-17 02:22:15 mcr Exp $ # + for policy in '$POLICIES/*' ++ basename /etc/ipsec.d/policies/clear-or-private.pacsave + base=clear-or-private.pacsave + _________________________ ipsec/policies/clear-or-private.pacsave + cat /etc/ipsec.d/policies/clear-or-private.pacsave # This file defines the set of CIDRs (network/mask-length) to which # we will communicate in the clear, or, if the other side initiates IPSEC, # using encryption. This behaviour is also called "Opportunistic Responder". # # See /usr/share/doc/openswan/policygroups.html for details. # # $Id: clear-or-private.in,v 1.4 2003/02/17 02:22:15 mcr Exp $ # + for policy in '$POLICIES/*' ++ basename /etc/ipsec.d/policies/clear.pacsave + base=clear.pacsave + _________________________ ipsec/policies/clear.pacsave + cat /etc/ipsec.d/policies/clear.pacsave # This file defines the set of CIDRs (network/mask-length) to which # communication should always be in the clear. # # See /usr/share/doc/openswan/policygroups.html for details. # # $Id: clear.in,v 1.4 2003/02/17 02:22:15 mcr Exp $ # + for policy in '$POLICIES/*' ++ basename /etc/ipsec.d/policies/private + base=private + _________________________ ipsec/policies/private + cat /etc/ipsec.d/policies/private # This file defines the set of CIDRs (network/mask-length) to which # communication should always be private (i.e. encrypted). # See /usr/share/doc/openswan/policygroups.html for details. # # $Id: private.in,v 1.4 2003-02-17 02:22:15 mcr Exp $ # + for policy in '$POLICIES/*' ++ basename /etc/ipsec.d/policies/private-or-clear + base=private-or-clear + _________________________ ipsec/policies/private-or-clear + cat /etc/ipsec.d/policies/private-or-clear # This file defines the set of CIDRs (network/mask-length) to which # communication should be private, if possible, but in the clear otherwise. # # If the target has a TXT (later IPSECKEY) record that specifies # authentication material, we will require private (i.e. encrypted) # communications. If no such record is found, communications will be # in the clear. # # See /usr/share/doc/openswan/policygroups.html for details. # # $Id: private-or-clear.in,v 1.5 2003-02-17 02:22:15 mcr Exp $ # 0.0.0.0/0 + for policy in '$POLICIES/*' ++ basename /etc/ipsec.d/policies/private-or-clear.pacsave + base=private-or-clear.pacsave + _________________________ ipsec/policies/private-or-clear.pacsave + cat /etc/ipsec.d/policies/private-or-clear.pacsave # This file defines the set of CIDRs (network/mask-length) to which # communication should be private, if possible, but in the clear otherwise. # # If the target has a TXT (later IPSECKEY) record that specifies # authentication material, we will require private (i.e. encrypted) # communications. If no such record is found, communications will be # in the clear. # # See /usr/share/doc/openswan/policygroups.html for details. # # $Id: private-or-clear.in,v 1.5 2003/02/17 02:22:15 mcr Exp $ # 0.0.0.0/0 + for policy in '$POLICIES/*' ++ basename /etc/ipsec.d/policies/private.pacsave + base=private.pacsave + _________________________ ipsec/policies/private.pacsave + cat /etc/ipsec.d/policies/private.pacsave # This file defines the set of CIDRs (network/mask-length) to which # communication should always be private (i.e. encrypted). # See /usr/share/doc/openswan/policygroups.html for details. # # $Id: private.in,v 1.4 2003/02/17 02:22:15 mcr Exp $ # + _________________________ ipsec/ls-libdir + ls -l /usr/lib/ipsec total 108 -rwxr-xr-x 1 root root 15848 Dec 7 2007 _confread -rwxr-xr-x 1 root root 9819 Dec 7 2007 _copyright -rwxr-xr-x 1 root root 2379 Dec 7 2007 _include -rwxr-xr-x 1 root root 1475 Dec 7 2007 _keycensor -rwxr-xr-x 1 root root 3586 Dec 7 2007 _plutoload -rwxr-xr-x 1 root root 8056 Dec 7 2007 _plutorun -rwxr-xr-x 1 root root 12277 Dec 7 2007 _realsetup -rwxr-xr-x 1 root root 1975 Dec 7 2007 _secretcensor -rwxr-xr-x 1 root root 11071 Dec 7 2007 _startklips -rwxr-xr-x 1 root root 13918 Dec 7 2007 _updown -rwxr-xr-x 1 root root 15746 Dec 7 2007 _updown_x509 + _________________________ ipsec/ls-execdir + ls -l /usr/lib/openswan total 1492 -rwxr-xr-x 1 root root 14761 Dec 7 2007 _pluto_adns -rwxr-xr-x 1 root root 18891 Dec 7 2007 auto -rwxr-xr-x 1 root root 11367 Dec 7 2007 barf -rwxr-xr-x 1 root root 816 Dec 7 2007 calcgoo -rwxr-xr-x 1 root root 92821 Dec 7 2007 eroute -rwxr-xr-x 1 root root 25692 Dec 7 2007 ikeping -rwxr-xr-x 1 root root 70258 Dec 7 2007 klipsdebug -rwxr-xr-x 1 root root 1836 Dec 7 2007 livetest -rwxr-xr-x 1 root root 2604 Dec 7 2007 look -rwxr-xr-x 1 root root 7088 Dec 7 2007 mailkey -rwxr-xr-x 1 root root 16015 Dec 7 2007 manual -rwxr-xr-x 1 root root 1951 Dec 7 2007 newhostkey -rwxr-xr-x 1 root root 64683 Dec 7 2007 pf_key -rwxr-xr-x 1 root root 745586 Dec 7 2007 pluto -rwxr-xr-x 1 root root 14785 Dec 7 2007 ranbits -rwxr-xr-x 1 root root 27799 Dec 7 2007 rsasigkey -rwxr-xr-x 1 root root 766 Dec 7 2007 secrets lrwxrwxrwx 1 root root 15 Dec 7 2007 setup -> /etc/rc.d/ipsec -rwxr-xr-x 1 root root 1054 Dec 7 2007 showdefaults -rwxr-xr-x 1 root root 4845 Dec 7 2007 showhostkey -rwxr-xr-x 1 root root 152121 Dec 7 2007 spi -rwxr-xr-x 1 root root 78936 Dec 7 2007 spigrp -rwxr-xr-x 1 root root 15449 Dec 7 2007 tncfg -rwxr-xr-x 1 root root 13524 Dec 7 2007 verify -rwxr-xr-x 1 root root 63943 Dec 7 2007 whack + _________________________ ipsec/updowns ++ ls /usr/lib/openswan ++ egrep updown + _________________________ /proc/net/dev + cat /proc/net/dev Inter-| Receive | Transmit face |bytes packets errs drop fifo frame compressed multicast|bytes packets errs drop fifo colls carrier compressed lo: 9428 398 0 0 0 0 0 0 9428 398 0 0 0 0 0 0 eth0: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 wmaster0: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 wlan0:84826563 73241 0 0 0 0 0 0 9197296 52198 0 0 0 0 0 0 + _________________________ /proc/net/route + cat /proc/net/route Iface Destination Gateway Flags RefCnt Use Metric Mask MTU Window IRTT wlan0 003E0C0A 00000000 0001 0 0 0 00FFFFFF 0 0 0 wlan0 00000000 00000000 0001 0 0 0 00000080 0 0 0 wlan0 00000080 00000000 0001 0 0 0 00000080 0 0 0 wlan0 00000000 013E0C0A 0003 0 0 0 00000000 0 0 0 + _________________________ /proc/sys/net/ipv4/ip_forward + cat /proc/sys/net/ipv4/ip_forward 0 + _________________________ /proc/sys/net/ipv4/tcp_ecn + cat /proc/sys/net/ipv4/tcp_ecn 0 + _________________________ /proc/sys/net/ipv4/conf/star-rp_filter + cd /proc/sys/net/ipv4/conf + egrep '^' all/rp_filter default/rp_filter eth0/rp_filter lo/rp_filter wlan0/rp_filter wmaster0/rp_filter all/rp_filter:0 default/rp_filter:0 eth0/rp_filter:0 lo/rp_filter:0 wlan0/rp_filter:0 wmaster0/rp_filter:0 + _________________________ /proc/sys/net/ipv4/conf/star-rp_filter + cd /proc/sys/net/ipv4/conf + egrep '^' all/rp_filter default/rp_filter eth0/rp_filter lo/rp_filter wlan0/rp_filter wmaster0/rp_filter all/rp_filter:0 default/rp_filter:0 eth0/rp_filter:0 lo/rp_filter:0 wlan0/rp_filter:0 wmaster0/rp_filter:0 + _________________________ /proc/sys/net/ipv4/conf/star-star-redirects + cd /proc/sys/net/ipv4/conf + egrep '^' all/accept_redirects all/secure_redirects all/send_redirects default/accept_redirects default/secure_redirects default/send_redirects eth0/accept_redirects eth0/secure_redirects eth0/send_redirects lo/accept_redirects lo/secure_redirects lo/send_redirects wlan0/accept_redirects wlan0/secure_redirects wlan0/send_redirects wmaster0/accept_redirects wmaster0/secure_redirects wmaster0/send_redirects all/accept_redirects:1 all/secure_redirects:1 all/send_redirects:1 default/accept_redirects:1 default/secure_redirects:1 default/send_redirects:1 eth0/accept_redirects:1 eth0/secure_redirects:1 eth0/send_redirects:1 lo/accept_redirects:1 lo/secure_redirects:1 lo/send_redirects:1 wlan0/accept_redirects:1 wlan0/secure_redirects:1 wlan0/send_redirects:1 wmaster0/accept_redirects:1 wmaster0/secure_redirects:1 wmaster0/send_redirects:1 + _________________________ /proc/sys/net/ipv4/tcp_window_scaling + cat /proc/sys/net/ipv4/tcp_window_scaling 1 + _________________________ /proc/sys/net/ipv4/tcp_adv_win_scale + cat /proc/sys/net/ipv4/tcp_adv_win_scale 2 + _________________________ uname-a + uname -a Linux tk-r4k 2.6.25-ARCH #1 SMP PREEMPT Mon Jul 14 14:56:27 UTC 2008 x86_64 AMD Athlon(tm) 64 Processor 3200+ AuthenticAMD GNU/Linux + _________________________ config-built-with + test -r /proc/config_built_with + _________________________ distro-release + for distro in /etc/redhat-release /etc/debian-release /etc/SuSE-release /etc/mandrake-release /etc/mandriva-release /etc/gentoo-release + test -f /etc/redhat-release + for distro in /etc/redhat-release /etc/debian-release /etc/SuSE-release /etc/mandrake-release /etc/mandriva-release /etc/gentoo-release + test -f /etc/debian-release + for distro in /etc/redhat-release /etc/debian-release /etc/SuSE-release /etc/mandrake-release /etc/mandriva-release /etc/gentoo-release + test -f /etc/SuSE-release + for distro in /etc/redhat-release /etc/debian-release /etc/SuSE-release /etc/mandrake-release /etc/mandriva-release /etc/gentoo-release + test -f /etc/mandrake-release + for distro in /etc/redhat-release /etc/debian-release /etc/SuSE-release /etc/mandrake-release /etc/mandriva-release /etc/gentoo-release + test -f /etc/mandriva-release + for distro in /etc/redhat-release /etc/debian-release /etc/SuSE-release /etc/mandrake-release /etc/mandriva-release /etc/gentoo-release + test -f /etc/gentoo-release + _________________________ /proc/net/ipsec_version + test -r /proc/net/ipsec_version + test -r /proc/net/pfkey ++ uname -r + echo 'NETKEY (2.6.25-ARCH) support detected ' NETKEY (2.6.25-ARCH) support detected + _________________________ ipfwadm + test -r /sbin/ipfwadm + 'no old-style linux 1.x/2.0 ipfwadm firewall support' /usr/lib/openswan/barf: line 305: no old-style linux 1.x/2.0 ipfwadm firewall support: No such file or directory + _________________________ ipchains + test -r /sbin/ipchains + echo 'no old-style linux 2.0 ipchains firewall support' no old-style linux 2.0 ipchains firewall support + _________________________ iptables + test -r /sbin/iptables + test -r /sbin/ipchains + _________________________ /proc/modules + test -f /proc/modules + cat /proc/modules xfrm_user 24064 2 - Live 0xffffffff88500000 xfrm4_tunnel 3456 0 - Live 0xffffffff882a6000 ipcomp 7564 0 - Live 0xffffffff883ac000 ah4 6400 0 - Live 0xffffffff883a3000 af_key 35096 0 - Live 0xffffffff88389000 ccm 10240 0 - Live 0xffffffff8851f000 sha512 6016 0 - Live 0xffffffff8851c000 xfrm6_tunnel 9504 0 - Live 0xffffffff883b5000 tunnel6 4112 1 xfrm6_tunnel, Live 0xffffffff883b2000 ipv6 308200 12 xfrm6_tunnel,tunnel6, Live 0xffffffff884b3000 radeon 134304 2 - Live 0xffffffff88491000 drm 95528 3 radeon, Live 0xffffffff88478000 nfs 278768 0 - Live 0xffffffff88432000 lockd 70576 1 nfs, Live 0xffffffff8841f000 nfs_acl 3968 1 nfs, Live 0xffffffff8841d000 sunrpc 195592 5 nfs,lockd,nfs_acl, Live 0xffffffff883ec000 authenc 6784 3 - Live 0xffffffff883e9000 xfrm4_mode_tunnel 3328 6 - Live 0xffffffff883e7000 deflate 3840 0 - Live 0xffffffff882c1000 zlib_deflate 22424 1 deflate, Live 0xffffffff883e0000 zlib_inflate 19584 1 deflate, Live 0xffffffff883da000 ctr 5504 0 - Live 0xffffffff883d7000 twofish 6912 0 - Live 0xffffffff883d4000 twofish_common 15616 1 twofish, Live 0xffffffff883cf000 camellia 19328 0 - Live 0xffffffff883c9000 serpent 18304 0 - Live 0xffffffff883c3000 blowfish 8960 0 - Live 0xffffffff883bf000 xcbc 6024 0 - Live 0xffffffff883bc000 crypto_null 4224 0 - Live 0xffffffff883b9000 tunnel4 4240 1 xfrm4_tunnel, Live 0xffffffff883af000 esp4 7808 3 - Live 0xffffffff883a9000 aead 7936 3 ccm,authenc,esp4, Live 0xffffffff883a6000 aes_x86_64 8832 3 - Live 0xffffffff8839f000 aes_generic 27688 1 aes_x86_64, Live 0xffffffff88397000 sha1_generic 3200 3 - Live 0xffffffff88269000 sha256_generic 10112 0 - Live 0xffffffff88393000 rfkill_input 5248 0 - Live 0xffffffff88386000 ext2 72336 1 - Live 0xffffffff88373000 reiserfs 242432 1 - Live 0xffffffff88336000 jfs 180944 1 - Live 0xffffffff88308000 joydev 12672 0 - Live 0xffffffff88303000 usb_storage 97216 0 - Live 0xffffffff882ea000 ohci1394 31796 0 - Live 0xffffffff882e1000 ieee1394 91768 1 ohci1394, Live 0xffffffff882c9000 sdhci 17420 0 - Live 0xffffffff882c3000 yenta_socket 26124 1 - Live 0xffffffff882b9000 rsrc_nonstatic 11648 1 yenta_socket, Live 0xffffffff882b5000 mmc_core 49120 1 sdhci, Live 0xffffffff882a8000 firewire_ohci 19584 0 - Live 0xffffffff882a0000 firewire_core 42848 1 firewire_ohci, Live 0xffffffff88294000 crc_itu_t 2688 1 firewire_core, Live 0xffffffff88292000 psmouse 43292 0 - Live 0xffffffff88286000 tifm_7xx1 7424 0 - Live 0xffffffff88283000 serio_raw 6788 0 - Live 0xffffffff88280000 tifm_core 8904 1 tifm_7xx1, Live 0xffffffff8827c000 pcspkr 3456 0 - Live 0xffffffff881e1000 k8temp 5760 0 - Live 0xffffffff88279000 video 20500 0 - Live 0xffffffff88272000 output 4096 1 video, Live 0xffffffff881c0000 wmi 7232 0 - Live 0xffffffff8826f000 i2c_piix4 9868 0 - Live 0xffffffff8826b000 ehci_hcd 38284 0 - Live 0xffffffff8825e000 ohci_hcd 24196 0 - Live 0xffffffff88257000 i2c_core 22816 1 i2c_piix4, Live 0xffffffff88250000 usbcore 152472 4 usb_storage,ehci_hcd,ohci_hcd, Live 0xffffffff88229000 shpchp 33692 0 - Live 0xffffffff8821f000 pci_hotplug 30264 1 shpchp, Live 0xffffffff88216000 sg 33120 0 - Live 0xffffffff8820c000 evdev 12032 7 - Live 0xffffffff88208000 thermal 18976 0 - Live 0xffffffff88202000 processor 37932 1 thermal, Live 0xffffffff881f7000 fan 5640 0 - Live 0xffffffff881f4000 button 8096 0 - Live 0xffffffff881f1000 battery 13192 0 - Live 0xffffffff881ec000 ac 5768 0 - Live 0xffffffff881e9000 snd_atiixp 19092 0 - Live 0xffffffff881e3000 snd_seq_oss 34176 0 - Live 0xffffffff881d7000 snd_seq_midi_event 8064 1 snd_seq_oss, Live 0xffffffff881d4000 snd_seq 57056 4 snd_seq_oss,snd_seq_midi_event, Live 0xffffffff881c5000 snd_seq_device 7956 2 snd_seq_oss,snd_seq, Live 0xffffffff881c2000 snd_atiixp_modem 14604 0 - Live 0xffffffff881bb000 snd_ac97_codec 119640 2 snd_atiixp,snd_atiixp_modem, Live 0xffffffff8819c000 snd_pcm_oss 44160 0 - Live 0xffffffff88190000 snd_pcm 81416 4 snd_atiixp,snd_atiixp_modem,snd_ac97_codec,snd_pcm_oss, Live 0xffffffff8817b000 snd_timer 23440 2 snd_seq,snd_pcm, Live 0xffffffff88174000 snd_page_alloc 9360 3 snd_atiixp,snd_atiixp_modem,snd_pcm, Live 0xffffffff88170000 snd_mixer_oss 17408 1 snd_pcm_oss, Live 0xffffffff8816a000 snd 61000 10 snd_atiixp,snd_seq_oss,snd_seq,snd_seq_device,snd_atiixp_modem,snd_ac97_codec,snd_pcm_oss,snd_pcm,snd_timer,snd_mixer_oss, Live 0xffffffff8815a000 soundcore 8096 1 snd, Live 0xffffffff88157000 ac97_bus 2560 1 snd_ac97_codec, Live 0xffffffff88151000 arc4 2688 2 - Live 0xffffffff88155000 ecb 3840 2 - Live 0xffffffff88153000 b43 155432 0 - Live 0xffffffff8812a000 ssb 36356 1 b43, Live 0xffffffff88120000 rfkill 7712 3 rfkill_input,b43, Live 0xffffffff8811d000 pcmcia 38040 2 b43,ssb, Live 0xffffffff88112000 mac80211 146444 1 b43, Live 0xffffffff880ed000 cfg80211 20112 1 mac80211, Live 0xffffffff880e7000 input_polldev 4624 1 b43, Live 0xffffffff880e4000 pcmcia_core 38564 4 yenta_socket,rsrc_nonstatic,b43,pcmcia, Live 0xffffffff880d9000 led_class 4872 1 b43, Live 0xffffffff880d6000 8139too 26368 0 - Live 0xffffffff880ce000 mii 6016 1 8139too, Live 0xffffffff880cb000 fuse 48576 0 - Live 0xffffffff880be000 rtc_cmos 10680 0 - Live 0xffffffff880ba000 rtc_core 19268 1 rtc_cmos, Live 0xffffffff880b4000 rtc_lib 3456 1 rtc_core, Live 0xffffffff8805a000 ext3 138384 1 - Live 0xffffffff88091000 jbd 54184 1 ext3, Live 0xffffffff88082000 mbcache 8964 2 ext2,ext3, Live 0xffffffff8807e000 dm_mod 61624 9 - Live 0xffffffff8806d000 sr_mod 17348 0 - Live 0xffffffff88067000 cdrom 37928 1 sr_mod, Live 0xffffffff8805c000 sd_mod 25792 3 - Live 0xffffffff88052000 ata_generic 7172 0 - Live 0xffffffff8804f000 pata_atiixp 7296 2 - Live 0xffffffff8804c000 pata_acpi 6528 0 - Live 0xffffffff88049000 libata 159792 3 ata_generic,pata_atiixp,pata_acpi, Live 0xffffffff88020000 scsi_mod 109432 5 usb_storage,sg,sr_mod,sd_mod,libata, Live 0xffffffff88004000 dock 9760 1 libata, Live 0xffffffff88000000 + _________________________ /proc/meminfo + cat /proc/meminfo MemTotal: 509336 kB MemFree: 11580 kB Buffers: 23128 kB Cached: 84228 kB SwapCached: 10764 kB Active: 349504 kB Inactive: 104452 kB SwapTotal: 2097144 kB SwapFree: 2054320 kB Dirty: 44 kB Writeback: 0 kB AnonPages: 338088 kB Mapped: 39632 kB Slab: 15024 kB SReclaimable: 7712 kB SUnreclaim: 7312 kB PageTables: 5148 kB NFS_Unstable: 0 kB Bounce: 0 kB CommitLimit: 2351812 kB Committed_AS: 484080 kB VmallocTotal: 34359738367 kB VmallocUsed: 276032 kB VmallocChunk: 34359462319 kB + _________________________ /proc/net/ipsec-ls + test -f /proc/net/ipsec_version + _________________________ usr/src/linux/.config + test -f /proc/config.gz + zcat /proc/config.gz + egrep 'CONFIG_IPSEC|CONFIG_KLIPS|CONFIG_NET_KEY|CONFIG_INET|CONFIG_IP|CONFIG_HW_RANDOM|CONFIG_CRYPTO_DEV|_XFRM' # CONFIG_IPC_NS is not set CONFIG_XFRM=y CONFIG_XFRM_USER=m # CONFIG_XFRM_SUB_POLICY is not set # CONFIG_XFRM_MIGRATE is not set # CONFIG_XFRM_STATISTICS is not set CONFIG_NET_KEY=m # CONFIG_NET_KEY_MIGRATE is not set CONFIG_INET=y CONFIG_IP_MULTICAST=y CONFIG_IP_ADVANCED_ROUTER=y # CONFIG_IP_FIB_TRIE is not set CONFIG_IP_FIB_HASH=y CONFIG_IP_MULTIPLE_TABLES=y CONFIG_IP_ROUTE_MULTIPATH=y CONFIG_IP_ROUTE_VERBOSE=y # CONFIG_IP_PNP is not set CONFIG_IP_MROUTE=y CONFIG_IP_PIMSM_V1=y CONFIG_IP_PIMSM_V2=y CONFIG_INET_AH=m CONFIG_INET_ESP=m CONFIG_INET_IPCOMP=m CONFIG_INET_XFRM_TUNNEL=m CONFIG_INET_TUNNEL=m CONFIG_INET_XFRM_MODE_TRANSPORT=m CONFIG_INET_XFRM_MODE_TUNNEL=m CONFIG_INET_XFRM_MODE_BEET=m CONFIG_INET_LRO=m CONFIG_INET_DIAG=y CONFIG_INET_TCP_DIAG=y CONFIG_IP_VS=m # CONFIG_IP_VS_DEBUG is not set CONFIG_IP_VS_TAB_BITS=12 CONFIG_IP_VS_PROTO_TCP=y CONFIG_IP_VS_PROTO_UDP=y CONFIG_IP_VS_PROTO_ESP=y CONFIG_IP_VS_PROTO_AH=y CONFIG_IP_VS_RR=m CONFIG_IP_VS_WRR=m CONFIG_IP_VS_LC=m CONFIG_IP_VS_WLC=m CONFIG_IP_VS_LBLC=m CONFIG_IP_VS_LBLCR=m CONFIG_IP_VS_DH=m CONFIG_IP_VS_SH=m CONFIG_IP_VS_SED=m CONFIG_IP_VS_NQ=m CONFIG_IP_VS_FTP=m CONFIG_IPV6=m CONFIG_IPV6_PRIVACY=y CONFIG_IPV6_ROUTER_PREF=y CONFIG_IPV6_ROUTE_INFO=y CONFIG_IPV6_OPTIMISTIC_DAD=y CONFIG_INET6_AH=m CONFIG_INET6_ESP=m CONFIG_INET6_IPCOMP=m CONFIG_IPV6_MIP6=m CONFIG_INET6_XFRM_TUNNEL=m CONFIG_INET6_TUNNEL=m CONFIG_INET6_XFRM_MODE_TRANSPORT=m CONFIG_INET6_XFRM_MODE_TUNNEL=m CONFIG_INET6_XFRM_MODE_BEET=m CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION=m CONFIG_IPV6_SIT=m CONFIG_IPV6_TUNNEL=m CONFIG_IPV6_MULTIPLE_TABLES=y CONFIG_IPV6_SUBTREES=y CONFIG_IP_NF_QUEUE=m CONFIG_IP_NF_IPTABLES=m CONFIG_IP_NF_MATCH_RECENT=m CONFIG_IP_NF_MATCH_ECN=m CONFIG_IP_NF_MATCH_AH=m CONFIG_IP_NF_MATCH_TTL=m CONFIG_IP_NF_MATCH_ADDRTYPE=m CONFIG_IP_NF_FILTER=m CONFIG_IP_NF_TARGET_REJECT=m CONFIG_IP_NF_TARGET_LOG=m CONFIG_IP_NF_TARGET_ULOG=m CONFIG_IP_NF_TARGET_MASQUERADE=m CONFIG_IP_NF_TARGET_REDIRECT=m CONFIG_IP_NF_TARGET_NETMAP=m CONFIG_IP_NF_MANGLE=m CONFIG_IP_NF_TARGET_ECN=m CONFIG_IP_NF_TARGET_TTL=m CONFIG_IP_NF_TARGET_CLUSTERIP=m CONFIG_IP_NF_RAW=m CONFIG_IP_NF_ARPTABLES=m CONFIG_IP_NF_ARPFILTER=m CONFIG_IP_NF_ARP_MANGLE=m CONFIG_IP6_NF_QUEUE=m CONFIG_IP6_NF_IPTABLES=m CONFIG_IP6_NF_MATCH_RT=m CONFIG_IP6_NF_MATCH_OPTS=m CONFIG_IP6_NF_MATCH_FRAG=m CONFIG_IP6_NF_MATCH_HL=m CONFIG_IP6_NF_MATCH_IPV6HEADER=m CONFIG_IP6_NF_MATCH_AH=m CONFIG_IP6_NF_MATCH_MH=m CONFIG_IP6_NF_MATCH_EUI64=m CONFIG_IP6_NF_FILTER=m CONFIG_IP6_NF_TARGET_LOG=m CONFIG_IP6_NF_TARGET_REJECT=m CONFIG_IP6_NF_MANGLE=m CONFIG_IP6_NF_TARGET_HL=m CONFIG_IP6_NF_RAW=m # CONFIG_IP_DCCP is not set CONFIG_IP_SCTP=m CONFIG_IPX=m # CONFIG_IPX_INTERN is not set CONFIG_IP1000=m CONFIG_IPW2100=m CONFIG_IPW2100_MONITOR=y # CONFIG_IPW2100_DEBUG is not set CONFIG_IPW2200=m CONFIG_IPW2200_MONITOR=y CONFIG_IPW2200_RADIOTAP=y CONFIG_IPW2200_PROMISCUOUS=y CONFIG_IPW2200_QOS=y # CONFIG_IPW2200_DEBUG is not set CONFIG_IPPP_FILTER=y CONFIG_IPMI_HANDLER=m # CONFIG_IPMI_PANIC_EVENT is not set CONFIG_IPMI_DEVICE_INTERFACE=m CONFIG_IPMI_SI=m CONFIG_IPMI_WATCHDOG=m CONFIG_IPMI_POWEROFF=m CONFIG_HW_RANDOM=y CONFIG_HW_RANDOM_INTEL=m CONFIG_HW_RANDOM_AMD=m CONFIG_IPWIRELESS=m # CONFIG_SECURITY_NETWORK_XFRM is not set CONFIG_CRYPTO_DEV_HIFN_795X=m CONFIG_CRYPTO_DEV_HIFN_795X_RNG=y + _________________________ etc/syslog.conf + cat /etc/syslog.conf cat: /etc/syslog.conf: No such file or directory + _________________________ etc/syslog-ng/syslog-ng.conf + cat /etc/syslog-ng/syslog-ng.conf cat: /etc/syslog-ng/syslog-ng.conf: No such file or directory + _________________________ etc/resolv.conf + cat /etc/resolv.conf # Generated by dhcpcd for interface eth0 search tk-on.net nameserver 192.168.10.1 + _________________________ lib/modules-ls + ls -ltr /lib/modules total 4 drwxr-xr-x 3 root root 4096 Jul 26 08:36 2.6.25-ARCH + _________________________ /proc/ksyms-netif_rx + test -r /proc/ksyms + test -r /proc/kallsyms + egrep netif_rx /proc/kallsyms ffffffff803d4bd0 T netif_rx ffffffff803d4ee0 T netif_rx_ni ffffffff803d4bd0 u netif_rx [ipv6] ffffffff803d4bd0 u netif_rx [mac80211] + _________________________ lib/modules-netif_rx + modulegoo kernel/net/ipv4/ipip.o netif_rx + set +x 2.6.25-ARCH: + _________________________ kern.debug + test -f /var/log/kern.debug + _________________________ klog + sed -n '99,$p' /var/log/daemon.log + egrep -i 'ipsec|klips|pluto' + case "$1" in + cat Jul 27 20:26:49 tk-r4k ipsec_setup: Starting Openswan IPsec 2.4.11... Jul 27 20:27:10 tk-r4k ipsec__plutorun: whack error: "Net2Home" does not look numeric and name lookup failed "www.tk-on.net" Jul 27 20:27:10 tk-r4k ipsec__plutorun: ...could not add conn "Net2Home" Jul 27 20:27:10 tk-r4k ipsec__plutorun: 104 "Arch2Net" #1: STATE_MAIN_I1: initiate Jul 27 20:27:10 tk-r4k ipsec__plutorun: ...could not start conn "Arch2Net" + _________________________ plog + sed -n '8856,$p' /var/log/auth.log + egrep -i pluto + case "$1" in + cat Jul 27 20:26:48 tk-r4k ipsec__plutorun: Starting Pluto subsystem... Jul 27 20:26:48 tk-r4k pluto[7601]: Starting Pluto (Openswan Version 2.4.11 PLUTO_SENDS_VENDORID PLUTO_USES_KEYRR; Vendor ID OE{dD^fJcUvk) Jul 27 20:26:48 tk-r4k pluto[7601]: Setting NAT-Traversal port-4500 floating to on Jul 27 20:26:48 tk-r4k pluto[7601]: port floating activation criteria nat_t=1/port_fload=1 Jul 27 20:26:48 tk-r4k pluto[7601]: including NAT-Traversal patch (Version 0.6c) Jul 27 20:26:48 tk-r4k pluto[7601]: ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0) Jul 27 20:26:48 tk-r4k pluto[7601]: starting up 1 cryptographic helpers Jul 27 20:26:48 tk-r4k pluto[7601]: started helper pid=7602 (fd:6) Jul 27 20:26:48 tk-r4k pluto[7601]: Using NETKEY IPsec interface code on 2.6.25-ARCH Jul 27 20:26:50 tk-r4k pluto[7601]: Changing to directory '/etc/ipsec.d/cacerts' Jul 27 20:26:50 tk-r4k pluto[7601]: loaded CA cert file 'cacert.pem' (1403 bytes) Jul 27 20:26:50 tk-r4k pluto[7601]: Changing to directory '/etc/ipsec.d/aacerts' Jul 27 20:26:50 tk-r4k pluto[7601]: Changing to directory '/etc/ipsec.d/ocspcerts' Jul 27 20:26:50 tk-r4k pluto[7601]: Changing to directory '/etc/ipsec.d/crls' Jul 27 20:26:50 tk-r4k pluto[7601]: loaded crl file 'cacrl.pem' (617 bytes) Jul 27 20:26:50 tk-r4k pluto[7601]: loaded host cert file '/etc/ipsec.d/certs/hostcert.pem' (1245 bytes) Jul 27 20:26:50 tk-r4k pluto[7601]: loaded host cert file '/etc/ipsec.d/certs/Arch2Netcert.pem' (1452 bytes) Jul 27 20:26:50 tk-r4k pluto[7601]: added connection description "Arch2Net" Jul 27 20:27:10 tk-r4k pluto[7601]: listening for IKE messages Jul 27 20:27:10 tk-r4k pluto[7601]: adding interface wlan0/wlan0 10.12.62.99:500 Jul 27 20:27:10 tk-r4k pluto[7601]: adding interface wlan0/wlan0 10.12.62.99:4500 Jul 27 20:27:10 tk-r4k pluto[7601]: adding interface lo/lo 127.0.0.1:500 Jul 27 20:27:10 tk-r4k pluto[7601]: adding interface lo/lo 127.0.0.1:4500 Jul 27 20:27:10 tk-r4k pluto[7601]: adding interface lo/lo ::1:500 Jul 27 20:27:10 tk-r4k pluto[7601]: loading secrets from "/etc/ipsec.secrets" Jul 27 20:27:10 tk-r4k pluto[7601]: loaded private key file '/etc/ipsec.d/private/tk-i5kaKey.pem' (1675 bytes) Jul 27 20:27:10 tk-r4k pluto[7601]: "Arch2Net" #1: initiating Main Mode Jul 27 20:27:10 tk-r4k pluto[7601]: "Arch2Net" #1: received Vendor ID payload [RFC 3947] method set to=109 Jul 27 20:27:10 tk-r4k pluto[7601]: "Arch2Net" #1: received Vendor ID payload [Dead Peer Detection] Jul 27 20:27:10 tk-r4k pluto[7601]: "Arch2Net" #1: enabling possible NAT-traversal with method RFC 3947 (NAT-Traversal) Jul 27 20:27:10 tk-r4k pluto[7601]: "Arch2Net" #1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2 Jul 27 20:27:10 tk-r4k pluto[7601]: "Arch2Net" #1: STATE_MAIN_I2: sent MI2, expecting MR2 Jul 27 20:27:10 tk-r4k pluto[7601]: "Arch2Net" #1: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): no NAT detected Jul 27 20:27:10 tk-r4k pluto[7601]: "Arch2Net" #1: I am sending my cert Jul 27 20:27:10 tk-r4k pluto[7601]: "Arch2Net" #1: I am sending a certificate request Jul 27 20:27:10 tk-r4k pluto[7601]: "Arch2Net" #1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3 Jul 27 20:27:10 tk-r4k pluto[7601]: "Arch2Net" #1: STATE_MAIN_I3: sent MI3, expecting MR3 Jul 27 20:27:10 tk-r4k pluto[7601]: "Arch2Net" #1: Main mode peer ID is ID_DER_ASN1_DN: 'C=IE, O=tk-on.net, CN=ipcop.tk-on.net' Jul 27 20:27:10 tk-r4k pluto[7601]: "Arch2Net" #1: crl update for "C=IE, O=tk-on.net, CN=tk-on.net CA, E=tomk@runbox.com" is overdue since Oct 13 22:54:39 UTC 2004 Jul 27 20:27:10 tk-r4k pluto[7601]: "Arch2Net" #1: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4 Jul 27 20:27:10 tk-r4k pluto[7601]: "Arch2Net" #1: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_RSA_SIG cipher=oakley_3des_cbc_192 prf=oakley_md5 group=modp1536} Jul 27 20:27:10 tk-r4k pluto[7601]: "Arch2Net" #1: Dead Peer Detection (RFC 3706): enabled Jul 27 20:27:10 tk-r4k pluto[7601]: "Arch2Net" #2: initiating Quick Mode RSASIG+ENCRYPT+TUNNEL+PFS+UP {using isakmp#1} Jul 27 20:27:10 tk-r4k pluto[7601]: "Arch2Net" #2: Dead Peer Detection (RFC 3706): enabled Jul 27 20:27:10 tk-r4k pluto[7601]: "Arch2Net" #2: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2 Jul 27 20:27:10 tk-r4k pluto[7601]: "Arch2Net" #2: STATE_QUICK_I2: sent QI2, IPsec SA established {ESP=>0x0be748c8 <0x18208a96 xfrm=AES_0-HMAC_SHA1 NATD=none DPD=enabled} Jul 27 20:27:18 tk-r4k pluto[7601]: packet from 10.12.62.1:500: received Vendor ID payload [RFC 3947] method set to=109 Jul 27 20:27:18 tk-r4k pluto[7601]: packet from 10.12.62.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] meth=108, but already using method 109 Jul 27 20:27:18 tk-r4k pluto[7601]: packet from 10.12.62.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] meth=107, but already using method 109 Jul 27 20:27:18 tk-r4k pluto[7601]: packet from 10.12.62.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00] Jul 27 20:27:18 tk-r4k pluto[7601]: packet from 10.12.62.1:500: received Vendor ID payload [Dead Peer Detection] Jul 27 20:27:18 tk-r4k pluto[7601]: "Arch2Net" #3: responding to Main Mode Jul 27 20:27:18 tk-r4k pluto[7601]: "Arch2Net" #3: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1 Jul 27 20:27:18 tk-r4k pluto[7601]: "Arch2Net" #3: STATE_MAIN_R1: sent MR1, expecting MI2 Jul 27 20:27:19 tk-r4k pluto[7601]: "Arch2Net" #3: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): no NAT detected Jul 27 20:27:19 tk-r4k pluto[7601]: "Arch2Net" #3: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2 Jul 27 20:27:19 tk-r4k pluto[7601]: "Arch2Net" #3: STATE_MAIN_R2: sent MR2, expecting MI3 Jul 27 20:27:19 tk-r4k pluto[7601]: "Arch2Net" #3: Main mode peer ID is ID_DER_ASN1_DN: 'C=IE, O=tk-on.net, CN=ipcop.tk-on.net' Jul 27 20:27:19 tk-r4k pluto[7601]: "Arch2Net" #3: crl update for "C=IE, O=tk-on.net, CN=tk-on.net CA, E=tomk@runbox.com" is overdue since Oct 13 22:54:39 UTC 2004 Jul 27 20:27:19 tk-r4k pluto[7601]: "Arch2Net" #3: I am sending my cert Jul 27 20:27:19 tk-r4k pluto[7601]: "Arch2Net" #3: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3 Jul 27 20:27:19 tk-r4k pluto[7601]: "Arch2Net" #3: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_RSA_SIG cipher=oakley_3des_cbc_192 prf=oakley_sha group=modp1536} Jul 27 20:27:19 tk-r4k pluto[7601]: "Arch2Net" #3: Dead Peer Detection (RFC 3706): enabled Jul 27 20:27:19 tk-r4k pluto[7601]: "Arch2Net" #4: we require PFS but Quick I1 SA specifies no GROUP_DESCRIPTION Jul 27 20:27:19 tk-r4k pluto[7601]: "Arch2Net" #4: sending encrypted notification NO_PROPOSAL_CHOSEN to 10.12.62.1:500 Jul 27 20:27:29 tk-r4k pluto[7601]: "Arch2Net" #3: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x4213ae5b (perhaps this is a duplicated packet) Jul 27 20:27:29 tk-r4k pluto[7601]: "Arch2Net" #3: sending encrypted notification INVALID_MESSAGE_ID to 10.12.62.1:500 Jul 27 20:27:49 tk-r4k pluto[7601]: "Arch2Net" #3: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x4213ae5b (perhaps this is a duplicated packet) Jul 27 20:27:49 tk-r4k pluto[7601]: "Arch2Net" #3: sending encrypted notification INVALID_MESSAGE_ID to 10.12.62.1:500 Jul 27 20:28:29 tk-r4k pluto[7601]: "Arch2Net" #5: we require PFS but Quick I1 SA specifies no GROUP_DESCRIPTION Jul 27 20:28:29 tk-r4k pluto[7601]: "Arch2Net" #5: sending encrypted notification NO_PROPOSAL_CHOSEN to 10.12.62.1:500 Jul 27 20:28:39 tk-r4k pluto[7601]: "Arch2Net" #3: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x630b60be (perhaps this is a duplicated packet) Jul 27 20:28:39 tk-r4k pluto[7601]: "Arch2Net" #3: sending encrypted notification INVALID_MESSAGE_ID to 10.12.62.1:500 Jul 27 20:28:59 tk-r4k pluto[7601]: "Arch2Net" #3: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x630b60be (perhaps this is a duplicated packet) Jul 27 20:28:59 tk-r4k pluto[7601]: "Arch2Net" #3: sending encrypted notification INVALID_MESSAGE_ID to 10.12.62.1:500 Jul 27 20:29:39 tk-r4k pluto[7601]: "Arch2Net" #6: we require PFS but Quick I1 SA specifies no GROUP_DESCRIPTION Jul 27 20:29:39 tk-r4k pluto[7601]: "Arch2Net" #6: sending encrypted notification NO_PROPOSAL_CHOSEN to 10.12.62.1:500 Jul 27 20:29:49 tk-r4k pluto[7601]: "Arch2Net" #3: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x19e511cb (perhaps this is a duplicated packet) Jul 27 20:29:49 tk-r4k pluto[7601]: "Arch2Net" #3: sending encrypted notification INVALID_MESSAGE_ID to 10.12.62.1:500 Jul 27 20:30:09 tk-r4k pluto[7601]: "Arch2Net" #3: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x19e511cb (perhaps this is a duplicated packet) Jul 27 20:30:09 tk-r4k pluto[7601]: "Arch2Net" #3: sending encrypted notification INVALID_MESSAGE_ID to 10.12.62.1:500 Jul 27 20:30:49 tk-r4k pluto[7601]: "Arch2Net" #7: we require PFS but Quick I1 SA specifies no GROUP_DESCRIPTION Jul 27 20:30:49 tk-r4k pluto[7601]: "Arch2Net" #7: sending encrypted notification NO_PROPOSAL_CHOSEN to 10.12.62.1:500 Jul 27 20:30:59 tk-r4k pluto[7601]: "Arch2Net" #3: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0xb7c34921 (perhaps this is a duplicated packet) Jul 27 20:30:59 tk-r4k pluto[7601]: "Arch2Net" #3: sending encrypted notification INVALID_MESSAGE_ID to 10.12.62.1:500 Jul 27 20:31:19 tk-r4k pluto[7601]: "Arch2Net" #3: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0xb7c34921 (perhaps this is a duplicated packet) Jul 27 20:31:19 tk-r4k pluto[7601]: "Arch2Net" #3: sending encrypted notification INVALID_MESSAGE_ID to 10.12.62.1:500 Jul 27 20:31:59 tk-r4k pluto[7601]: "Arch2Net" #8: we require PFS but Quick I1 SA specifies no GROUP_DESCRIPTION Jul 27 20:31:59 tk-r4k pluto[7601]: "Arch2Net" #8: sending encrypted notification NO_PROPOSAL_CHOSEN to 10.12.62.1:500 Jul 27 20:32:09 tk-r4k pluto[7601]: "Arch2Net" #3: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x306106e7 (perhaps this is a duplicated packet) Jul 27 20:32:09 tk-r4k pluto[7601]: "Arch2Net" #3: sending encrypted notification INVALID_MESSAGE_ID to 10.12.62.1:500 Jul 27 20:32:29 tk-r4k pluto[7601]: "Arch2Net" #3: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x306106e7 (perhaps this is a duplicated packet) Jul 27 20:32:29 tk-r4k pluto[7601]: "Arch2Net" #3: sending encrypted notification INVALID_MESSAGE_ID to 10.12.62.1:500 Jul 27 20:33:09 tk-r4k pluto[7601]: "Arch2Net" #9: we require PFS but Quick I1 SA specifies no GROUP_DESCRIPTION Jul 27 20:33:09 tk-r4k pluto[7601]: "Arch2Net" #9: sending encrypted notification NO_PROPOSAL_CHOSEN to 10.12.62.1:500 Jul 27 20:33:19 tk-r4k pluto[7601]: "Arch2Net" #3: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0xed1eb8bd (perhaps this is a duplicated packet) Jul 27 20:33:19 tk-r4k pluto[7601]: "Arch2Net" #3: sending encrypted notification INVALID_MESSAGE_ID to 10.12.62.1:500 Jul 27 20:33:39 tk-r4k pluto[7601]: "Arch2Net" #3: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0xed1eb8bd (perhaps this is a duplicated packet) Jul 27 20:33:39 tk-r4k pluto[7601]: "Arch2Net" #3: sending encrypted notification INVALID_MESSAGE_ID to 10.12.62.1:500 Jul 27 20:34:19 tk-r4k pluto[7601]: "Arch2Net" #10: we require PFS but Quick I1 SA specifies no GROUP_DESCRIPTION Jul 27 20:34:19 tk-r4k pluto[7601]: "Arch2Net" #10: sending encrypted notification NO_PROPOSAL_CHOSEN to 10.12.62.1:500 Jul 27 20:34:29 tk-r4k pluto[7601]: "Arch2Net" #3: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x93e6dca0 (perhaps this is a duplicated packet) Jul 27 20:34:29 tk-r4k pluto[7601]: "Arch2Net" #3: sending encrypted notification INVALID_MESSAGE_ID to 10.12.62.1:500 Jul 27 20:34:49 tk-r4k pluto[7601]: "Arch2Net" #3: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x93e6dca0 (perhaps this is a duplicated packet) Jul 27 20:34:49 tk-r4k pluto[7601]: "Arch2Net" #3: sending encrypted notification INVALID_MESSAGE_ID to 10.12.62.1:500 Jul 27 20:35:29 tk-r4k pluto[7601]: "Arch2Net" #11: we require PFS but Quick I1 SA specifies no GROUP_DESCRIPTION Jul 27 20:35:29 tk-r4k pluto[7601]: "Arch2Net" #11: sending encrypted notification NO_PROPOSAL_CHOSEN to 10.12.62.1:500 Jul 27 20:35:39 tk-r4k pluto[7601]: "Arch2Net" #3: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0xd144ddc3 (perhaps this is a duplicated packet) Jul 27 20:35:39 tk-r4k pluto[7601]: "Arch2Net" #3: sending encrypted notification INVALID_MESSAGE_ID to 10.12.62.1:500 Jul 27 20:35:59 tk-r4k pluto[7601]: "Arch2Net" #3: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0xd144ddc3 (perhaps this is a duplicated packet) Jul 27 20:35:59 tk-r4k pluto[7601]: "Arch2Net" #3: sending encrypted notification INVALID_MESSAGE_ID to 10.12.62.1:500 Jul 27 20:36:39 tk-r4k pluto[7601]: "Arch2Net" #12: we require PFS but Quick I1 SA specifies no GROUP_DESCRIPTION Jul 27 20:36:39 tk-r4k pluto[7601]: "Arch2Net" #12: sending encrypted notification NO_PROPOSAL_CHOSEN to 10.12.62.1:500 Jul 27 20:36:49 tk-r4k pluto[7601]: "Arch2Net" #3: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x1cf7024e (perhaps this is a duplicated packet) Jul 27 20:36:49 tk-r4k pluto[7601]: "Arch2Net" #3: sending encrypted notification INVALID_MESSAGE_ID to 10.12.62.1:500 Jul 27 20:37:09 tk-r4k pluto[7601]: "Arch2Net" #3: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x1cf7024e (perhaps this is a duplicated packet) Jul 27 20:37:09 tk-r4k pluto[7601]: "Arch2Net" #3: sending encrypted notification INVALID_MESSAGE_ID to 10.12.62.1:500 Jul 27 20:37:49 tk-r4k pluto[7601]: "Arch2Net" #13: we require PFS but Quick I1 SA specifies no GROUP_DESCRIPTION Jul 27 20:37:49 tk-r4k pluto[7601]: "Arch2Net" #13: sending encrypted notification NO_PROPOSAL_CHOSEN to 10.12.62.1:500 Jul 27 20:37:59 tk-r4k pluto[7601]: "Arch2Net" #3: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0xf18493f9 (perhaps this is a duplicated packet) Jul 27 20:37:59 tk-r4k pluto[7601]: "Arch2Net" #3: sending encrypted notification INVALID_MESSAGE_ID to 10.12.62.1:500 Jul 27 20:38:19 tk-r4k pluto[7601]: "Arch2Net" #3: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0xf18493f9 (perhaps this is a duplicated packet) Jul 27 20:38:19 tk-r4k pluto[7601]: "Arch2Net" #3: sending encrypted notification INVALID_MESSAGE_ID to 10.12.62.1:500 Jul 27 20:38:59 tk-r4k pluto[7601]: "Arch2Net" #14: we require PFS but Quick I1 SA specifies no GROUP_DESCRIPTION Jul 27 20:38:59 tk-r4k pluto[7601]: "Arch2Net" #14: sending encrypted notification NO_PROPOSAL_CHOSEN to 10.12.62.1:500 Jul 27 20:39:09 tk-r4k pluto[7601]: "Arch2Net" #3: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0xd5484100 (perhaps this is a duplicated packet) Jul 27 20:39:09 tk-r4k pluto[7601]: "Arch2Net" #3: sending encrypted notification INVALID_MESSAGE_ID to 10.12.62.1:500 Jul 27 20:39:29 tk-r4k pluto[7601]: "Arch2Net" #3: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0xd5484100 (perhaps this is a duplicated packet) Jul 27 20:39:29 tk-r4k pluto[7601]: "Arch2Net" #3: sending encrypted notification INVALID_MESSAGE_ID to 10.12.62.1:500 + _________________________ date + date Sun Jul 27 20:39:57 IST 2008