tk-r4k Sun Jul 27 22:35:25 IST 2008 + _________________________ version + ipsec --version Linux Openswan U2.6.15/K2.6.25-ARCH (netkey) See `ipsec --copyright' for copyright information. + _________________________ /proc/version + cat /proc/version Linux version 2.6.25-ARCH (root@workstation64) (gcc version 4.3.1 20080626 (prerelease) (GCC) ) #1 SMP PREEMPT Mon Jul 14 14:56:27 UTC 2008 + _________________________ /proc/net/ipsec_eroute + test -r /proc/net/ipsec_eroute + _________________________ netstat-rn + netstat -nr + head -n 100 Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface 10.12.62.0 0.0.0.0 255.255.255.0 U 0 0 0 wlan0 0.0.0.0 10.12.62.1 0.0.0.0 UG 0 0 0 wlan0 + _________________________ /proc/net/ipsec_spi + test -r /proc/net/ipsec_spi + _________________________ /proc/net/ipsec_spigrp + test -r /proc/net/ipsec_spigrp + _________________________ /proc/net/ipsec_tncfg + test -r /proc/net/ipsec_tncfg + _________________________ /proc/net/pfkey + test -r /proc/net/pfkey + cat /proc/net/pfkey sk RefCnt Rmem Wmem User Inode + _________________________ ip-xfrm-state + ip xfrm state + _________________________ ip-xfrm-policy + ip xfrm policy src 10.12.62.99/32 dst 0.0.0.0/0 dir out priority 2112 tmpl src 0.0.0.0 dst 0.0.0.0 proto esp reqid 0 mode transport src ::/0 dst ::/0 dir in priority 0 src 0.0.0.0/0 dst 0.0.0.0/0 dir in priority 0 src 0.0.0.0/0 dst 0.0.0.0/0 dir in priority 0 src 0.0.0.0/0 dst 0.0.0.0/0 dir in priority 0 src 0.0.0.0/0 dst 0.0.0.0/0 dir in priority 0 src ::/0 dst ::/0 dir out priority 0 src 0.0.0.0/0 dst 0.0.0.0/0 dir out priority 0 src 0.0.0.0/0 dst 0.0.0.0/0 dir out priority 0 src 0.0.0.0/0 dst 0.0.0.0/0 dir out priority 0 src 0.0.0.0/0 dst 0.0.0.0/0 dir out priority 0 + _________________________ /proc/crypto + test -r /proc/crypto + cat /proc/crypto name : sha512 driver : sha512-generic module : sha512 priority : 0 refcnt : 1 type : digest blocksize : 128 digestsize : 64 name : sha384 driver : sha384-generic module : sha512 priority : 0 refcnt : 1 type : digest blocksize : 128 digestsize : 48 name : authenc(hmac(sha1),cbc(aes)) driver : authenc(hmac(sha1-generic),cbc(aes-asm)) module : authenc priority : 2000 refcnt : 3 type : aead async : yes blocksize : 16 ivsize : 16 maxauthsize : 20 geniv : name : cbc(aes) driver : cbc(aes-asm) module : kernel priority : 200 refcnt : 3 type : givcipher async : yes blocksize : 16 min keysize : 16 max keysize : 32 ivsize : 16 geniv : chainiv name : deflate driver : deflate-generic module : deflate priority : 0 refcnt : 1 type : compression name : rfc3686(ctr(aes)) driver : rfc3686(ctr(aes-asm)) module : ctr priority : 200 refcnt : 1 type : blkcipher blocksize : 1 min keysize : 20 max keysize : 36 ivsize : 8 geniv : seqiv name : ctr(aes) driver : ctr(aes-asm) module : ctr priority : 200 refcnt : 1 type : blkcipher blocksize : 1 min keysize : 16 max keysize : 32 ivsize : 16 geniv : name : cbc(twofish) driver : cbc(twofish-generic) module : kernel priority : 100 refcnt : 1 type : blkcipher blocksize : 16 min keysize : 16 max keysize : 32 ivsize : 16 geniv : name : twofish driver : twofish-generic module : twofish priority : 100 refcnt : 1 type : cipher blocksize : 16 min keysize : 16 max keysize : 32 name : cbc(camellia) driver : cbc(camellia-generic) module : kernel priority : 100 refcnt : 1 type : blkcipher blocksize : 16 min keysize : 16 max keysize : 32 ivsize : 16 geniv : name : camellia driver : camellia-generic module : camellia priority : 100 refcnt : 1 type : cipher blocksize : 16 min keysize : 16 max keysize : 32 name : cbc(serpent) driver : cbc(serpent-generic) module : kernel priority : 0 refcnt : 1 type : blkcipher blocksize : 16 min keysize : 0 max keysize : 32 ivsize : 16 geniv : name : tnepres driver : tnepres-generic module : serpent priority : 0 refcnt : 1 type : cipher blocksize : 16 min keysize : 0 max keysize : 32 name : serpent driver : serpent-generic module : serpent priority : 0 refcnt : 1 type : cipher blocksize : 16 min keysize : 0 max keysize : 32 name : cbc(aes) driver : cbc(aes-asm) module : kernel priority : 200 refcnt : 3 type : blkcipher blocksize : 16 min keysize : 16 max keysize : 32 ivsize : 16 geniv : name : cbc(blowfish) driver : cbc(blowfish-generic) module : kernel priority : 0 refcnt : 1 type : blkcipher blocksize : 8 min keysize : 4 max keysize : 56 ivsize : 8 geniv : name : blowfish driver : blowfish-generic module : blowfish priority : 0 refcnt : 1 type : cipher blocksize : 8 min keysize : 4 max keysize : 56 name : cbc(des3_ede) driver : cbc(des3_ede-generic) module : kernel priority : 0 refcnt : 1 type : blkcipher blocksize : 8 min keysize : 24 max keysize : 24 ivsize : 8 geniv : name : cbc(des) driver : cbc(des-generic) module : kernel priority : 0 refcnt : 1 type : blkcipher blocksize : 8 min keysize : 8 max keysize : 8 ivsize : 8 geniv : name : xcbc(aes) driver : xcbc(aes-asm) module : xcbc priority : 200 refcnt : 1 type : hash blocksize : 16 digestsize : 16 name : hmac(sha256) driver : hmac(sha256-generic) module : kernel priority : 0 refcnt : 1 type : hash blocksize : 64 digestsize : 32 name : hmac(sha1) driver : hmac(sha1-generic) module : kernel priority : 0 refcnt : 3 type : hash blocksize : 64 digestsize : 20 name : hmac(md5) driver : hmac(md5-generic) module : kernel priority : 0 refcnt : 1 type : hash blocksize : 64 digestsize : 16 name : hmac(digest_null) driver : hmac(digest_null-generic) module : kernel priority : 0 refcnt : 1 type : hash blocksize : 1 digestsize : 0 name : compress_null driver : compress_null-generic module : crypto_null priority : 0 refcnt : 1 type : compression name : digest_null driver : digest_null-generic module : crypto_null priority : 0 refcnt : 1 type : digest blocksize : 1 digestsize : 0 name : ecb(cipher_null) driver : ecb-cipher_null module : crypto_null priority : 100 refcnt : 1 type : blkcipher blocksize : 1 min keysize : 0 max keysize : 0 ivsize : 0 geniv : name : cipher_null driver : cipher_null-generic module : crypto_null priority : 0 refcnt : 1 type : cipher blocksize : 1 min keysize : 0 max keysize : 0 name : aes driver : aes-asm module : aes_x86_64 priority : 200 refcnt : 3 type : cipher blocksize : 16 min keysize : 16 max keysize : 32 name : aes driver : aes-generic module : aes_generic priority : 100 refcnt : 1 type : cipher blocksize : 16 min keysize : 16 max keysize : 32 name : sha1 driver : sha1-generic module : sha1_generic priority : 0 refcnt : 3 type : digest blocksize : 64 digestsize : 20 name : sha256 driver : sha256-generic module : sha256_generic priority : 0 refcnt : 1 type : digest blocksize : 64 digestsize : 32 name : sha224 driver : sha224-generic module : sha256_generic priority : 0 refcnt : 1 type : digest blocksize : 64 digestsize : 28 name : ecb(arc4) driver : ecb(arc4-generic) module : ecb priority : 0 refcnt : 3 type : blkcipher blocksize : 1 min keysize : 1 max keysize : 256 ivsize : 0 geniv : name : arc4 driver : arc4-generic module : arc4 priority : 0 refcnt : 3 type : cipher blocksize : 1 min keysize : 1 max keysize : 256 name : des3_ede driver : des3_ede-generic module : kernel priority : 0 refcnt : 1 type : cipher blocksize : 8 min keysize : 24 max keysize : 24 name : des driver : des-generic module : kernel priority : 0 refcnt : 1 type : cipher blocksize : 8 min keysize : 8 max keysize : 8 name : md5 driver : md5-generic module : kernel priority : 0 refcnt : 1 type : digest blocksize : 64 digestsize : 16 + __________________________/proc/sys/net/core/xfrm-star /usr/lib/openswan/barf: line 191: __________________________/proc/sys/net/core/xfrm-star: No such file or directory + for i in '/proc/sys/net/core/xfrm_*' + echo -n '/proc/sys/net/core/xfrm_acq_expires: ' /proc/sys/net/core/xfrm_acq_expires: + cat /proc/sys/net/core/xfrm_acq_expires 30 + for i in '/proc/sys/net/core/xfrm_*' + echo -n '/proc/sys/net/core/xfrm_aevent_etime: ' /proc/sys/net/core/xfrm_aevent_etime: + cat /proc/sys/net/core/xfrm_aevent_etime 10 + for i in '/proc/sys/net/core/xfrm_*' + echo -n '/proc/sys/net/core/xfrm_aevent_rseqth: ' /proc/sys/net/core/xfrm_aevent_rseqth: + cat /proc/sys/net/core/xfrm_aevent_rseqth 2 + for i in '/proc/sys/net/core/xfrm_*' + echo -n '/proc/sys/net/core/xfrm_larval_drop: ' /proc/sys/net/core/xfrm_larval_drop: + cat /proc/sys/net/core/xfrm_larval_drop 0 + _________________________ /proc/sys/net/ipsec-star + test -d /proc/sys/net/ipsec + _________________________ ipsec/status + ipsec auto --status 000 using kernel interface: netkey 000 interface lo/lo ::1 000 interface lo/lo 127.0.0.1 000 interface lo/lo 127.0.0.1 000 interface wlan0/wlan0 10.12.62.99 000 interface wlan0/wlan0 10.12.62.99 000 %myid = (none) 000 debug none 000 000 algorithm ESP encrypt: id=2, name=ESP_DES, ivlen=8, keysizemin=64, keysizemax=64 000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=8, keysizemin=192, keysizemax=192 000 algorithm ESP encrypt: id=7, name=ESP_BLOWFISH, ivlen=8, keysizemin=40, keysizemax=448 000 algorithm ESP encrypt: id=11, name=ESP_NULL, ivlen=0, keysizemin=0, keysizemax=0 000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=8, keysizemin=128, keysizemax=256 000 algorithm ESP encrypt: id=13, name=ESP_AES_CTR, ivlen=8, keysizemin=128, keysizemax=256 000 algorithm ESP encrypt: id=14, name=ESP_AES_CCM_A, ivlen=8, keysizemin=128, keysizemax=256 000 algorithm ESP encrypt: id=15, name=ESP_AES_CCM_B, ivlen=8, keysizemin=128, keysizemax=256 000 algorithm ESP encrypt: id=16, name=ESP_AES_CCM_C, ivlen=8, keysizemin=128, keysizemax=256 000 algorithm ESP encrypt: id=18, name=ESP_AES_GCM_A, ivlen=8, keysizemin=128, keysizemax=256 000 algorithm ESP encrypt: id=19, name=ESP_AES_GCM_B, ivlen=8, keysizemin=128, keysizemax=256 000 algorithm ESP encrypt: id=20, name=ESP_AES_GCM_C, ivlen=8, keysizemin=128, keysizemax=256 000 algorithm ESP encrypt: id=22, name=ESP_CAMELLIA, ivlen=8, keysizemin=128, keysizemax=256 000 algorithm ESP encrypt: id=252, name=ESP_SERPENT, ivlen=8, keysizemin=128, keysizemax=256 000 algorithm ESP encrypt: id=253, name=ESP_TWOFISH, ivlen=8, keysizemin=128, keysizemax=256 000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5, keysizemin=128, keysizemax=128 000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1, keysizemin=160, keysizemax=160 000 algorithm ESP auth attr: id=5, name=AUTH_ALGORITHM_HMAC_SHA2_256, keysizemin=256, keysizemax=256 000 algorithm ESP auth attr: id=9, name=AUTH_ALGORITHM_AES_CBC, keysizemin=128, keysizemax=128 000 algorithm ESP auth attr: id=251, name=(null), keysizemin=0, keysizemax=0 000 000 algorithm IKE encrypt: id=0, name=(null), blocksize=16, keydeflen=131 000 algorithm IKE encrypt: id=3, name=OAKLEY_BLOWFISH_CBC, blocksize=8, keydeflen=128 000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8, keydeflen=192 000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16, keydeflen=128 000 algorithm IKE encrypt: id=65004, name=OAKLEY_SERPENT_CBC, blocksize=16, keydeflen=128 000 algorithm IKE encrypt: id=65005, name=OAKLEY_TWOFISH_CBC, blocksize=16, keydeflen=128 000 algorithm IKE encrypt: id=65289, name=OAKLEY_TWOFISH_CBC_SSH, blocksize=16, keydeflen=128 000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16 000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20 000 algorithm IKE hash: id=4, name=OAKLEY_SHA2_256, hashsize=32 000 algorithm IKE hash: id=6, name=OAKLEY_SHA2_512, hashsize=64 000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024 000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536 000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048 000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072 000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096 000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144 000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192 000 000 stats db_ops: {curr_cnt, total_cnt, maxsz} :context={0,0,0} trans={0,0,0} attrs={0,0,0} 000 000 "Arch2Net": 10.12.62.99<10.12.62.99>[+S=C]...10.12.62.1<10.12.62.1>[+S=C]===0.0.0.0/0; prospective erouted; eroute owner: #0 000 "Arch2Net": myip=unset; hisip=unset; mycert=/etc/ipsec.d/certs/Arch2Netcert.pem; hiscert=/etc/ipsec.d/certs/hostcert.pem; 000 "Arch2Net": CAs: 'C=IE, O=tk-on.net, CN=tk-on.net CA, E=tomk@runbox.com'...'C=IE, O=tk-on.net, CN=tk-on.net CA, E=tomk@runbox.com' 000 "Arch2Net": ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0 000 "Arch2Net": policy: RSASIG+ENCRYPT+TUNNEL+PFS+UP+IKEv2ALLOW+lKOD+rKOD; prio: 0,32; interface: wlan0; 000 "Arch2Net": dpd: action:clear; delay:30; timeout:120; 000 "Arch2Net": newest ISAKMP SA: #0; newest IPsec SA: #0; 000 "Net2Home": 10.12.62.99[C=ie, ST=wicklow, O=madhouse, OU=operations, CN=scdad,+S=C]...%dns[C=IE, O=tk-on.net, CN=ipcop.tk-on.net,+S=C]===192.168.10.0/24; unrouted; eroute owner: #0 000 "Net2Home": myip=unset; hisip=unset; mycert=/etc/ipsec.d/certs/Net2Homecert.pem; hiscert=/etc/ipsec.d/certs/hostcert.pem; 000 "Net2Home": CAs: 'C=IE, O=tk-on.net, CN=tk-on.net CA, E=tomk@runbox.com'...'C=IE, O=tk-on.net, CN=tk-on.net CA, E=tomk@runbox.com' 000 "Net2Home": ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0 000 "Net2Home": policy: RSASIG+ENCRYPT+TUNNEL+PFS+IKEv2ALLOW+lKOD+rKOD; prio: 32,24; interface: wlan0; 000 "Net2Home": dpd: action:clear; delay:30; timeout:120; 000 "Net2Home": newest ISAKMP SA: #0; newest IPsec SA: #0; 000 000 #8: "Arch2Net":500 STATE_MAIN_R2 (sent MR2, expecting MI3); EVENT_RETRANSMIT in 7s; lastdpd=-1s(seq in:0 out:0); idle; import:not set 000 #7: "Arch2Net":500 STATE_MAIN_I3 (sent MI3, expecting MR3); EVENT_RETRANSMIT in 13s; lastdpd=-1s(seq in:0 out:0); idle; import:admin initiate 000 #7: pending Phase 2 for "Arch2Net" replacing #0 000 + _________________________ ifconfig-a + ifconfig -a eth0 Link encap:Ethernet HWaddr 00:0F:B0:BA:F3:73 BROADCAST MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) Interrupt:22 Base address:0xa400 lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:544 errors:0 dropped:0 overruns:0 frame:0 TX packets:544 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:14096 (13.7 Kb) TX bytes:14096 (13.7 Kb) wlan0 Link encap:Ethernet HWaddr 00:14:A5:29:DF:CC inet addr:10.12.62.99 Bcast:10.12.62.255 Mask:255.255.255.0 inet6 addr: fe80::214:a5ff:fe29:dfcc/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:104518 errors:0 dropped:0 overruns:0 frame:0 TX packets:73217 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:121222617 (115.6 Mb) TX bytes:13986986 (13.3 Mb) wmaster0 Link encap:UNSPEC HWaddr 00-14-A5-29-DF-CC-00-00-00-00-00-00-00-00-00-00 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) + _________________________ ip-addr-list + ip addr list 1: lo: mtu 16436 qdisc noqueue state UNKNOWN link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: eth0: mtu 1500 qdisc noop state DOWN qlen 1000 link/ether 00:0f:b0:ba:f3:73 brd ff:ff:ff:ff:ff:ff 3: wmaster0: mtu 1500 qdisc ieee80211 state UNKNOWN qlen 1000 link/ieee802.11 00:14:a5:29:df:cc brd ff:ff:ff:ff:ff:ff 4: wlan0: mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 00:14:a5:29:df:cc brd ff:ff:ff:ff:ff:ff inet 10.12.62.99/24 brd 10.12.62.255 scope global wlan0 inet6 fe80::214:a5ff:fe29:dfcc/64 scope link valid_lft forever preferred_lft forever + _________________________ ip-route-list + ip route list 10.12.62.0/24 dev wlan0 proto kernel scope link src 10.12.62.99 default via 10.12.62.1 dev wlan0 + _________________________ ip-rule-list + ip rule list 0: from all lookup local 32766: from all lookup main 32767: from all lookup default + _________________________ ipsec_verify + ipsec verify --nocolour Checking your system to see if IPsec got installed and started correctly: Version check and ipsec on-path [OK] Linux Openswan U2.6.15/K2.6.25-ARCH (netkey) Checking for IPsec support in kernel [OK] Hardware RNG detected, testing if used properly [FAILED] Hardware RNG is present but 'rngd' is not running. No harware random used! NETKEY detected, testing for disabled ICMP send_redirects [FAILED] Please disable /proc/sys/net/ipv4/conf/*/send_redirects or NETKEY will cause the sending of bogus ICMP redirects! NETKEY detected, testing for disabled ICMP accept_redirects [FAILED] Please disable /proc/sys/net/ipv4/conf/*/accept_redirects or NETKEY will accept bogus ICMP redirects! Checking for RSA private key (/etc/ipsec.secrets) [OK] Checking that pluto is running [OK] Two or more interfaces found, checking IP forwarding [FAILED] Checking for 'ip' command [OK] Checking for 'iptables' command [FAILED] which: no iptables in (/sbin:/usr/bin:/usr/local/sbin:/usr/sbin:/usr/sbin:/sbin:/usr/sbin:/usr/local/bin:/bin:/usr/bin) Opportunistic Encryption Support [DISABLED] which: no iptables in (/sbin:/usr/bin:/usr/local/sbin:/usr/sbin:/usr/sbin:/sbin:/usr/sbin:/usr/local/bin:/bin:/usr/bin) + _________________________ mii-tool + '[' -x /sbin/mii-tool ']' + /sbin/mii-tool -v SIOCGMIIPHY on 'eth0' failed: Invalid argument no MII interfaces found + _________________________ ipsec/directory + ipsec --directory /usr/lib/ipsec + _________________________ hostname/fqdn + hostname --fqdn localhost.localdomain + _________________________ hostname/ipaddress + hostname --ip-address 127.0.0.1 + _________________________ uptime + uptime 22:35:25 up 9:52, 1 user, load average: 0.07, 0.14, 0.20 + _________________________ ps + ps alxwf + egrep -i 'ppid|pluto|ipsec|klips' F UID PID PPID PRI NI VSZ RSS WCHAN STAT TTY TIME COMMAND 0 1000 8136 4822 20 0 13928 1660 - S+ pts/0 0:00 | \_ most ipsec.barf.2.4.11 1 0 19296 1 20 0 13256 556 wait S pts/2 0:00 /bin/sh /usr/lib/ipsec/_plutorun --debug --uniqueids yes --force_busy no --nocrsend no --strictcrlpolicy no --nat_traversal yes --keep_alive --protostack netkey --force_keepalive --disable_port_floating no --virtual_private %v4:10.0.0.0/8,%v4:172.16.0.0/12,%v4:192.168.0.0/16,%v4:!192.168.10.0/255.255.255.0,%v4:!10.1.3.0/255.255.255.0,%v4:!10.12.62.0/255.255.255.0 --crlcheckinterval 0 --ocspuri --nhelpers --dump --opts --stderrlog --wait no --pre --post --log daemon.error --plutorestartoncrash true --pid /var/run/pluto/pluto.pid 1 0 19297 19296 20 0 13256 716 wait S pts/2 0:00 \_ /bin/sh /usr/lib/ipsec/_plutorun --debug --uniqueids yes --force_busy no --nocrsend no --strictcrlpolicy no --nat_traversal yes --keep_alive --protostack netkey --force_keepalive --disable_port_floating no --virtual_private %v4:10.0.0.0/8,%v4:172.16.0.0/12,%v4:192.168.0.0/16,%v4:!192.168.10.0/255.255.255.0,%v4:!10.1.3.0/255.255.255.0,%v4:!10.12.62.0/255.255.255.0 --crlcheckinterval 0 --ocspuri --nhelpers --dump --opts --stderrlog --wait no --pre --post --log daemon.error --plutorestartoncrash true --pid /var/run/pluto/pluto.pid 4 0 19298 19297 20 0 15608 1784 - S pts/2 0:00 | \_ /usr/lib/openswan/pluto --nofork --secretsfile /etc/ipsec.secrets --use-netkey --uniqueids --nat_traversal --virtual_private %v4:10.0.0.0/8,%v4:172.16.0.0/12,%v4:192.168.0.0/16,%v4:!192.168.10.0/255.255.255.0,%v4:!10.1.3.0/255.255.255.0,%v4:!10.12.62.0/255.255.255.0 1 0 19299 19298 30 10 9312 724 - SN pts/2 0:00 | \_ pluto helper # 0 4 0 19303 19296 20 0 13256 1456 pipe_w S pts/2 0:00 \_ /bin/sh /usr/lib/ipsec/_plutoload --wait no --post 4 0 19300 1 20 0 3780 592 pipe_w S pts/2 0:00 logger -s -p daemon.error -t ipsec__plutorun + _________________________ ipsec/showdefaults + ipsec showdefaults routephys=wlan0 routevirt=none routeaddr=10.12.62.99 routenexthop=10.12.62.1 + _________________________ ipsec/conf + ipsec _include /etc/ipsec.conf + ipsec _keycensor #< /etc/ipsec.conf 1 version 2.0 config setup interfaces=%defaultroute klipsdebug=none plutodebug=none protostack=netkey #plutoload=%search #plutostart=%search uniqueids=yes nat_traversal=yes virtual_private=%v4:10.0.0.0/8,%v4:172.16.0.0/12,%v4:192.168.0.0/16,%v4:!192.168.10.0/255.255.255.0,%v4:!10.1.3.0/255.255.255.0,%v4:!10.12.62.0/255.255.255.0 conn %default keyingtries=0 disablearrivalcheck=no conn Arch2Net left=10.12.62.1 leftsubnet=0.0.0.0/0.0.0.0 leftcert=/etc/ipsec.d/certs/hostcert.pem right=10.12.62.99 rightcert=/etc/ipsec.d/certs/Arch2Netcert.pem dpddelay=30 dpdtimeout=120 dpdaction=clear authby=rsasig auto=start conn Net2Home left=www.tk-on.net leftsubnet=192.168.10.0/255.255.255.0 leftcert=/etc/ipsec.d/certs/hostcert.pem right=%defaultroute rightcert=/etc/ipsec.d/certs/Net2Homecert.pem dpddelay=30 dpdtimeout=120 dpdaction=clear authby=rsasig auto=add #Disable OE #< /etc/ipsec.d/examples/no_oe.conf 1 # 'include' this file to disable Opportunistic Encryption. # See /usr/share/doc/openswan/policygroups.html for details. # # RCSID $Id: no_oe.conf.in,v 1.2 2004-10-03 19:33:10 paul Exp $ conn block auto=ignore conn private auto=ignore conn private-or-clear auto=ignore conn clear-or-private auto=ignore conn clear auto=ignore conn packetdefault auto=ignore #> /etc/ipsec.conf 45 + _________________________ ipsec/secrets + ipsec _include /etc/ipsec.secrets + ipsec _secretcensor #< /etc/ipsec.secrets 1 # RCSID $Id: ipsec.secrets.proto,v 1.2 2004/03/13 17:13:47 rene Exp $ # This file holds shared secrets or RSA private keys for inter-Pluto # authentication. See ipsec_pluto(8) manpage, and HTML documentation. # RSA private key for this host, authenticating it to any other host # which knows the public part. Suitable public keys, for ipsec.conf, DNS, # or configuration of other implementations, can be extracted conveniently # with "[sums to ef67...]". : RSA /etc/ipsec.d/private/tk-i5kaKey.pem + _________________________ ipsec/listall + ipsec auto --listall 000 000 List of Public Keys: 000 000 Jul 27 22:35:22 2008, 1024 RSA Key AwEAAegrc (no private key), until Jul 25 14:29:17 2020 ok 000 ID_DER_ASN1_DN 'C=IE, O=tk-on.net, CN=ipcop.tk-on.net' 000 Issuer 'C=IE, O=tk-on.net, CN=tk-on.net CA, E=tomk@runbox.com' 000 Jul 27 22:31:36 2008, 2048 RSA Key AwEAAbk5R (has private key), until Jun 23 06:31:24 2021 ok 000 ID_DER_ASN1_DN 'C=ie, ST=wicklow, O=madhouse, OU=operations, CN=scdad' 000 Issuer 'C=IE, O=tk-on.net, CN=tk-on.net CA, E=tomk@runbox.com' 000 Jul 27 22:30:56 2008, 2048 RSA Key AwEAAbk5R (has private key), until Oct 22 14:26:06 2020 ok 000 ID_IPV4_ADDR '10.12.62.99' 000 Issuer 'C=IE, O=tk-on.net, CN=tk-on.net CA, E=tomk@runbox.com' 000 Jul 27 22:30:56 2008, 2048 RSA Key AwEAAbk5R (has private key), until Oct 22 14:26:06 2020 ok 000 ID_DER_ASN1_DN 'C=IE, ST=Wicklow, O=tk-on.net, OU=HQ, CN=Tom K' 000 Issuer 'C=IE, O=tk-on.net, CN=tk-on.net CA, E=tomk@runbox.com' 000 Jul 27 22:30:56 2008, 1024 RSA Key AwEAAegrc (no private key), until Jul 25 14:29:18 2020 ok 000 ID_IPV4_ADDR '10.12.62.1' 000 Issuer 'C=IE, O=tk-on.net, CN=tk-on.net CA, E=tomk@runbox.com' 000 List of Pre-shared secrets (from /etc/ipsec.secrets) 000 9: RSA (none) (none) 000 000 List of X.509 End Certificates: 000 000 Jul 27 22:31:36 2008, count: 1 000 subject: 'C=ie, ST=wicklow, O=madhouse, OU=operations, CN=scdad' 000 issuer: 'C=IE, O=tk-on.net, CN=tk-on.net CA, E=tomk@runbox.com' 000 serial: 01 000 pubkey: 2048 RSA Key AwEAAbk5R, has private key 000 validity: not before Aug 12 15:56:44 2005 ok 000 not after Jun 23 06:31:24 2021 ok 000 subjkey: 43:6c:53:5f:e7:f0:21:d3:30:4e:7d:c1:d6:18:44:9c:25:e5:1c:92 000 authkey: 10:09:e7:cc:36:bb:1f:79:9a:68:4f:24:34:e7:77:86:a8:76:6a:27 000 aserial: 00 000 Jul 27 22:30:56 2008, count: 1 000 subject: 'C=IE, ST=Wicklow, O=tk-on.net, OU=HQ, CN=Tom K' 000 issuer: 'C=IE, O=tk-on.net, CN=tk-on.net CA, E=tomk@runbox.com' 000 serial: 01 000 pubkey: 2048 RSA Key AwEAAbk5R, has private key 000 validity: not before Dec 11 22:51:26 2004 ok 000 not after Oct 22 14:26:06 2020 ok 000 subjkey: 43:6c:53:5f:e7:f0:21:d3:30:4e:7d:c1:d6:18:44:9c:25:e5:1c:92 000 authkey: 10:09:e7:cc:36:bb:1f:79:9a:68:4f:24:34:e7:77:86:a8:76:6a:27 000 aserial: 00 000 Jul 27 22:30:56 2008, count: 2 000 subject: 'C=IE, O=tk-on.net, CN=ipcop.tk-on.net' 000 issuer: 'C=IE, O=tk-on.net, CN=tk-on.net CA, E=tomk@runbox.com' 000 serial: 01 000 pubkey: 1024 RSA Key AwEAAegrc 000 validity: not before Sep 13 23:54:38 2004 ok 000 not after Jul 25 14:29:18 2020 ok 000 subjkey: ab:f6:b8:8a:d5:6b:0b:f8:54:42:4d:c3:12:96:bc:9d:7a:ab:a3:e6 000 authkey: 10:09:e7:cc:36:bb:1f:79:9a:68:4f:24:34:e7:77:86:a8:76:6a:27 000 aserial: 00 000 000 List of X.509 CA Certificates: 000 000 Jul 27 22:30:56 2008, count: 1 000 subject: 'C=IE, O=tk-on.net, CN=tk-on.net CA, E=tomk@runbox.com' 000 issuer: 'C=IE, O=tk-on.net, CN=tk-on.net CA, E=tomk@runbox.com' 000 serial: 00 000 pubkey: 2048 RSA Key AwEAAbjj3 000 validity: not before Sep 13 23:54:37 2004 ok 000 not after Jul 25 14:29:17 2020 ok 000 subjkey: 10:09:e7:cc:36:bb:1f:79:9a:68:4f:24:34:e7:77:86:a8:76:6a:27 000 authkey: 10:09:e7:cc:36:bb:1f:79:9a:68:4f:24:34:e7:77:86:a8:76:6a:27 000 aserial: 00 000 000 List of X.509 CRLs: 000 000 Jul 27 22:30:56 2008, revoked certs: 0 000 issuer: 'C=IE, O=tk-on.net, CN=tk-on.net CA, E=tomk@runbox.com' 000 updates: this Sep 13 23:54:39 2004 000 next Oct 13 23:54:39 2004 warning (expired) + '[' /etc/ipsec.d/policies ']' + for policy in '$POLICIES/*' ++ basename /etc/ipsec.d/policies/block + base=block + _________________________ ipsec/policies/block + cat /etc/ipsec.d/policies/block # This file defines the set of CIDRs (network/mask-length) to which # communication should never be allowed. # # See /usr/share/doc/openswan/policygroups.html for details. # # $Id: block.in,v 1.4 2003/02/17 02:22:15 mcr Exp $ # + for policy in '$POLICIES/*' ++ basename /etc/ipsec.d/policies/block.pacsave + base=block.pacsave + _________________________ ipsec/policies/block.pacsave + cat /etc/ipsec.d/policies/block.pacsave # This file defines the set of CIDRs (network/mask-length) to which # communication should never be allowed. # # See /usr/share/doc/openswan/policygroups.html for details. # # $Id: block.in,v 1.4 2003/02/17 02:22:15 mcr Exp $ # + for policy in '$POLICIES/*' ++ basename /etc/ipsec.d/policies/clear + base=clear + _________________________ ipsec/policies/clear + cat /etc/ipsec.d/policies/clear # This file defines the set of CIDRs (network/mask-length) to which # communication should always be in the clear. # # See /usr/share/doc/openswan/policygroups.html for details. # # root name servers should be in the clear 192.58.128.30/32 198.41.0.4/32 192.228.79.201/32 192.33.4.12/32 128.8.10.90/32 192.203.230.10/32 192.5.5.241/32 192.112.36.4/32 128.63.2.53/32 192.36.148.17/32 193.0.14.129/32 199.7.83.42/32 202.12.27.33/32 + for policy in '$POLICIES/*' ++ basename /etc/ipsec.d/policies/clear-or-private + base=clear-or-private + _________________________ ipsec/policies/clear-or-private + cat /etc/ipsec.d/policies/clear-or-private # This file defines the set of CIDRs (network/mask-length) to which # we will communicate in the clear, or, if the other side initiates IPSEC, # using encryption. This behaviour is also called "Opportunistic Responder". # # See /usr/share/doc/openswan/policygroups.html for details. # # $Id: clear-or-private.in,v 1.4 2003/02/17 02:22:15 mcr Exp $ # + for policy in '$POLICIES/*' ++ basename /etc/ipsec.d/policies/clear-or-private.pacsave + base=clear-or-private.pacsave + _________________________ ipsec/policies/clear-or-private.pacsave + cat /etc/ipsec.d/policies/clear-or-private.pacsave # This file defines the set of CIDRs (network/mask-length) to which # we will communicate in the clear, or, if the other side initiates IPSEC, # using encryption. This behaviour is also called "Opportunistic Responder". # # See /usr/share/doc/openswan/policygroups.html for details. # # $Id: clear-or-private.in,v 1.4 2003/02/17 02:22:15 mcr Exp $ # + for policy in '$POLICIES/*' ++ basename /etc/ipsec.d/policies/clear.pacsave + base=clear.pacsave + _________________________ ipsec/policies/clear.pacsave + cat /etc/ipsec.d/policies/clear.pacsave # This file defines the set of CIDRs (network/mask-length) to which # communication should always be in the clear. # # See /usr/share/doc/openswan/policygroups.html for details. # # $Id: clear.in,v 1.4 2003/02/17 02:22:15 mcr Exp $ # + for policy in '$POLICIES/*' ++ basename /etc/ipsec.d/policies/private + base=private + _________________________ ipsec/policies/private + cat /etc/ipsec.d/policies/private # This file defines the set of CIDRs (network/mask-length) to which # communication should always be private (i.e. encrypted). # See /usr/share/doc/openswan/policygroups.html for details. # # $Id: private.in,v 1.4 2003/02/17 02:22:15 mcr Exp $ # + for policy in '$POLICIES/*' ++ basename /etc/ipsec.d/policies/private-or-clear + base=private-or-clear + _________________________ ipsec/policies/private-or-clear + cat /etc/ipsec.d/policies/private-or-clear # This file defines the set of CIDRs (network/mask-length) to which # communication should be private, if possible, but in the clear otherwise. # # If the target has a TXT (later IPSECKEY) record that specifies # authentication material, we will require private (i.e. encrypted) # communications. If no such record is found, communications will be # in the clear. # # See /usr/share/doc/openswan/policygroups.html for details. # # $Id: private-or-clear.in,v 1.5 2003/02/17 02:22:15 mcr Exp $ # 0.0.0.0/0 + for policy in '$POLICIES/*' ++ basename /etc/ipsec.d/policies/private-or-clear.pacsave + base=private-or-clear.pacsave + _________________________ ipsec/policies/private-or-clear.pacsave + cat /etc/ipsec.d/policies/private-or-clear.pacsave # This file defines the set of CIDRs (network/mask-length) to which # communication should be private, if possible, but in the clear otherwise. # # If the target has a TXT (later IPSECKEY) record that specifies # authentication material, we will require private (i.e. encrypted) # communications. If no such record is found, communications will be # in the clear. # # See /usr/share/doc/openswan/policygroups.html for details. # # $Id: private-or-clear.in,v 1.5 2003/02/17 02:22:15 mcr Exp $ # 0.0.0.0/0 + for policy in '$POLICIES/*' ++ basename /etc/ipsec.d/policies/private.pacsave + base=private.pacsave + _________________________ ipsec/policies/private.pacsave + cat /etc/ipsec.d/policies/private.pacsave # This file defines the set of CIDRs (network/mask-length) to which # communication should always be private (i.e. encrypted). # See /usr/share/doc/openswan/policygroups.html for details. # # $Id: private.in,v 1.4 2003/02/17 02:22:15 mcr Exp $ # + _________________________ ipsec/ls-libdir + ls -l /usr/lib/ipsec total 156 -rwxr-xr-x 1 root root 7296 Jul 27 22:00 _copyright -rwxr-xr-x 1 root root 2379 Jul 27 21:59 _include -rwxr-xr-x 1 root root 1475 Jul 27 21:59 _keycensor -rwxr-xr-x 1 root root 2632 Jul 27 21:59 _plutoload -rwxr-xr-x 1 root root 7597 Jul 27 21:59 _plutorun -rwxr-xr-x 1 root root 12865 Jul 27 21:59 _realsetup -rwxr-xr-x 1 root root 1975 Jul 27 21:59 _secretcensor -rwxr-xr-x 1 root root 8805 Jul 27 22:00 _startklips -rwxr-xr-x 1 root root 8805 Jul 27 21:59 _startklips.old -rwxr-xr-x 1 root root 5773 Jul 27 22:00 _startnetkey -rwxr-xr-x 1 root root 4937 Jul 27 21:59 _updown -rwxr-xr-x 1 root root 14030 Jul 27 22:00 _updown.klips -rwxr-xr-x 1 root root 14030 Jul 27 21:59 _updown.klips.old -rwxr-xr-x 1 root root 11798 Jul 27 22:00 _updown.mast -rwxr-xr-x 1 root root 11798 Jul 27 22:00 _updown.mast.old -rwxr-xr-x 1 root root 8534 Jul 27 22:00 _updown.netkey + _________________________ ipsec/ls-execdir + ls -l /usr/lib/openswan total 2544 -rwxr-xr-x 1 root root 193320 Jul 27 22:00 addconn -rwxr-xr-x 1 root root 6129 Jul 27 22:00 auto -rwxr-xr-x 1 root root 10758 Jul 27 22:00 barf -rwxr-xr-x 1 root root 96480 Jul 27 22:00 eroute -rwxr-xr-x 1 root root 24288 Jul 27 22:00 ikeping -rwxr-xr-x 1 root root 71512 Jul 27 22:00 klipsdebug -rwxr-xr-x 1 root root 1836 Jul 27 22:00 livetest -rwxr-xr-x 1 root root 2591 Jul 27 22:00 look -rwxr-xr-x 1 root root 478336 Jul 27 22:00 lwdnsq -rwxr-xr-x 1 root root 1921 Jul 27 22:00 newhostkey -rwxr-xr-x 1 root root 62800 Jul 27 22:00 pf_key -rwxr-xr-x 1 root root 889368 Jul 27 22:00 pluto -rwxr-xr-x 1 root root 11536 Jul 27 22:00 ranbits -rwxr-xr-x 1 root root 24472 Jul 27 22:00 rsasigkey -rwxr-xr-x 1 root root 766 Jul 27 22:00 secrets lrwxrwxrwx 1 root root 15 Jul 27 22:00 setup -> /etc/rc.d/ipsec -rwxr-xr-x 1 root root 1054 Jul 27 22:00 showdefaults -rwxr-xr-x 1 root root 222536 Jul 27 22:00 showhostkey -rwxr-xr-x 1 root root 26128 Jul 27 22:00 showpolicy -rwxr-xr-x 1 root root 153672 Jul 27 22:00 spi -rwxr-xr-x 1 root root 83896 Jul 27 22:00 spigrp -rwxr-xr-x 1 root root 75080 Jul 27 22:00 tncfg -rwxr-xr-x 1 root root 13020 Jul 27 22:00 verify -rwxr-xr-x 1 root root 57592 Jul 27 22:00 whack + _________________________ /proc/net/dev + cat /proc/net/dev Inter-| Receive | Transmit face |bytes packets errs drop fifo frame compressed multicast|bytes packets errs drop fifo colls carrier compressed lo: 14096 544 0 0 0 0 0 0 14096 544 0 0 0 0 0 0 eth0: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 wmaster0: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 wlan0:121222617 104518 0 0 0 0 0 0 13986986 73217 0 0 0 0 0 0 + _________________________ /proc/net/route + cat /proc/net/route Iface Destination Gateway Flags RefCnt Use Metric Mask MTU Window IRTT wlan0 003E0C0A 00000000 0001 0 0 0 00FFFFFF 0 0 0 wlan0 00000000 013E0C0A 0003 0 0 0 00000000 0 0 0 + _________________________ /proc/sys/net/ipv4/ip_no_pmtu_disc + cat /proc/sys/net/ipv4/ip_no_pmtu_disc 0 + _________________________ /proc/sys/net/ipv4/ip_forward + cat /proc/sys/net/ipv4/ip_forward 0 + _________________________ /proc/sys/net/ipv4/tcp_ecn + cat /proc/sys/net/ipv4/tcp_ecn 0 + _________________________ /proc/sys/net/ipv4/conf/star-rp_filter + cd /proc/sys/net/ipv4/conf + egrep '^' all/rp_filter default/rp_filter eth0/rp_filter lo/rp_filter wlan0/rp_filter wmaster0/rp_filter all/rp_filter:0 default/rp_filter:0 eth0/rp_filter:0 lo/rp_filter:0 wlan0/rp_filter:0 wmaster0/rp_filter:0 + _________________________ /proc/sys/net/ipv4/conf/star-star-redirects + cd /proc/sys/net/ipv4/conf + egrep '^' all/accept_redirects all/secure_redirects all/send_redirects default/accept_redirects default/secure_redirects default/send_redirects eth0/accept_redirects eth0/secure_redirects eth0/send_redirects lo/accept_redirects lo/secure_redirects lo/send_redirects wlan0/accept_redirects wlan0/secure_redirects wlan0/send_redirects wmaster0/accept_redirects wmaster0/secure_redirects wmaster0/send_redirects all/accept_redirects:1 all/secure_redirects:1 all/send_redirects:1 default/accept_redirects:1 default/secure_redirects:1 default/send_redirects:1 eth0/accept_redirects:1 eth0/secure_redirects:1 eth0/send_redirects:1 lo/accept_redirects:1 lo/secure_redirects:1 lo/send_redirects:1 wlan0/accept_redirects:1 wlan0/secure_redirects:1 wlan0/send_redirects:1 wmaster0/accept_redirects:1 wmaster0/secure_redirects:1 wmaster0/send_redirects:1 + _________________________ /proc/sys/net/ipv4/tcp_window_scaling + cat /proc/sys/net/ipv4/tcp_window_scaling 1 + _________________________ /proc/sys/net/ipv4/tcp_adv_win_scale + cat /proc/sys/net/ipv4/tcp_adv_win_scale 2 + _________________________ uname-a + uname -a Linux tk-r4k 2.6.25-ARCH #1 SMP PREEMPT Mon Jul 14 14:56:27 UTC 2008 x86_64 AMD Athlon(tm) 64 Processor 3200+ AuthenticAMD GNU/Linux + _________________________ config-built-with + test -r /proc/config_built_with + _________________________ distro-release + for distro in /etc/redhat-release /etc/debian-release /etc/SuSE-release /etc/mandrake-release /etc/mandriva-release /etc/gentoo-release + test -f /etc/redhat-release + for distro in /etc/redhat-release /etc/debian-release /etc/SuSE-release /etc/mandrake-release /etc/mandriva-release /etc/gentoo-release + test -f /etc/debian-release + for distro in /etc/redhat-release /etc/debian-release /etc/SuSE-release /etc/mandrake-release /etc/mandriva-release /etc/gentoo-release + test -f /etc/SuSE-release + for distro in /etc/redhat-release /etc/debian-release /etc/SuSE-release /etc/mandrake-release /etc/mandriva-release /etc/gentoo-release + test -f /etc/mandrake-release + for distro in /etc/redhat-release /etc/debian-release /etc/SuSE-release /etc/mandrake-release /etc/mandriva-release /etc/gentoo-release + test -f /etc/mandriva-release + for distro in /etc/redhat-release /etc/debian-release /etc/SuSE-release /etc/mandrake-release /etc/mandriva-release /etc/gentoo-release + test -f /etc/gentoo-release + _________________________ /proc/net/ipsec_version + test -r /proc/net/ipsec_version + test -r /proc/net/pfkey ++ uname -r + echo 'NETKEY (2.6.25-ARCH) support detected ' NETKEY (2.6.25-ARCH) support detected + _________________________ iptables + test -r /sbin/iptables + _________________________ /proc/modules + test -f /proc/modules + cat /proc/modules xfrm_user 24064 2 - Live 0xffffffff88515000 ipcomp6 7948 0 - Live 0xffffffff88512000 ah6 7424 0 - Live 0xffffffff8850f000 esp6 7552 0 - Live 0xffffffff8850c000 xfrm4_mode_beet 3584 0 - Live 0xffffffff8850a000 xfrm4_tunnel 3456 0 - Live 0xffffffff88508000 xfrm4_mode_transport 2816 0 - Live 0xffffffff88506000 xfrm6_mode_transport 2816 0 - Live 0xffffffff88504000 xfrm6_mode_ro 2560 0 - Live 0xffffffff88502000 xfrm6_mode_beet 3200 0 - Live 0xffffffff88500000 xfrm6_mode_tunnel 3328 0 - Live 0xffffffff882a6000 af_key 35096 0 - Live 0xffffffff88389000 ipcomp 7564 0 - Live 0xffffffff883ac000 ah4 6400 0 - Live 0xffffffff883a3000 ccm 10240 0 - Live 0xffffffff8851f000 sha512 6016 0 - Live 0xffffffff8851c000 xfrm6_tunnel 9504 1 ipcomp6, Live 0xffffffff883b5000 tunnel6 4112 1 xfrm6_tunnel, Live 0xffffffff883b2000 ipv6 308200 21 ipcomp6,ah6,esp6,xfrm6_mode_beet,xfrm6_mode_tunnel,xfrm6_tunnel,tunnel6, Live 0xffffffff884b3000 radeon 134304 2 - Live 0xffffffff88491000 drm 95528 3 radeon, Live 0xffffffff88478000 nfs 278768 0 - Live 0xffffffff88432000 lockd 70576 1 nfs, Live 0xffffffff8841f000 nfs_acl 3968 1 nfs, Live 0xffffffff8841d000 sunrpc 195592 5 nfs,lockd,nfs_acl, Live 0xffffffff883ec000 authenc 6784 2 - Live 0xffffffff883e9000 xfrm4_mode_tunnel 3328 4 - Live 0xffffffff883e7000 deflate 3840 0 - Live 0xffffffff882c1000 zlib_deflate 22424 1 deflate, Live 0xffffffff883e0000 zlib_inflate 19584 1 deflate, Live 0xffffffff883da000 ctr 5504 0 - Live 0xffffffff883d7000 twofish 6912 0 - Live 0xffffffff883d4000 twofish_common 15616 1 twofish, Live 0xffffffff883cf000 camellia 19328 0 - Live 0xffffffff883c9000 serpent 18304 0 - Live 0xffffffff883c3000 blowfish 8960 0 - Live 0xffffffff883bf000 xcbc 6024 0 - Live 0xffffffff883bc000 crypto_null 4224 0 - Live 0xffffffff883b9000 tunnel4 4240 1 xfrm4_tunnel, Live 0xffffffff883af000 esp4 7808 2 - Live 0xffffffff883a9000 aead 7936 4 esp6,ccm,authenc,esp4, Live 0xffffffff883a6000 aes_x86_64 8832 2 - Live 0xffffffff8839f000 aes_generic 27688 1 aes_x86_64, Live 0xffffffff88397000 sha1_generic 3200 2 - Live 0xffffffff88269000 sha256_generic 10112 0 - Live 0xffffffff88393000 rfkill_input 5248 0 - Live 0xffffffff88386000 ext2 72336 1 - Live 0xffffffff88373000 reiserfs 242432 1 - Live 0xffffffff88336000 jfs 180944 1 - Live 0xffffffff88308000 joydev 12672 0 - Live 0xffffffff88303000 usb_storage 97216 0 - Live 0xffffffff882ea000 ohci1394 31796 0 - Live 0xffffffff882e1000 ieee1394 91768 1 ohci1394, Live 0xffffffff882c9000 sdhci 17420 0 - Live 0xffffffff882c3000 yenta_socket 26124 1 - Live 0xffffffff882b9000 rsrc_nonstatic 11648 1 yenta_socket, Live 0xffffffff882b5000 mmc_core 49120 1 sdhci, Live 0xffffffff882a8000 firewire_ohci 19584 0 - Live 0xffffffff882a0000 firewire_core 42848 1 firewire_ohci, Live 0xffffffff88294000 crc_itu_t 2688 1 firewire_core, Live 0xffffffff88292000 psmouse 43292 0 - Live 0xffffffff88286000 tifm_7xx1 7424 0 - Live 0xffffffff88283000 serio_raw 6788 0 - Live 0xffffffff88280000 tifm_core 8904 1 tifm_7xx1, Live 0xffffffff8827c000 pcspkr 3456 0 - Live 0xffffffff881e1000 k8temp 5760 0 - Live 0xffffffff88279000 video 20500 0 - Live 0xffffffff88272000 output 4096 1 video, Live 0xffffffff881c0000 wmi 7232 0 - Live 0xffffffff8826f000 i2c_piix4 9868 0 - Live 0xffffffff8826b000 ehci_hcd 38284 0 - Live 0xffffffff8825e000 ohci_hcd 24196 0 - Live 0xffffffff88257000 i2c_core 22816 1 i2c_piix4, Live 0xffffffff88250000 usbcore 152472 4 usb_storage,ehci_hcd,ohci_hcd, Live 0xffffffff88229000 shpchp 33692 0 - Live 0xffffffff8821f000 pci_hotplug 30264 1 shpchp, Live 0xffffffff88216000 sg 33120 0 - Live 0xffffffff8820c000 evdev 12032 7 - Live 0xffffffff88208000 thermal 18976 0 - Live 0xffffffff88202000 processor 37932 1 thermal, Live 0xffffffff881f7000 fan 5640 0 - Live 0xffffffff881f4000 button 8096 0 - Live 0xffffffff881f1000 battery 13192 0 - Live 0xffffffff881ec000 ac 5768 0 - Live 0xffffffff881e9000 snd_atiixp 19092 0 - Live 0xffffffff881e3000 snd_seq_oss 34176 0 - Live 0xffffffff881d7000 snd_seq_midi_event 8064 1 snd_seq_oss, Live 0xffffffff881d4000 snd_seq 57056 4 snd_seq_oss,snd_seq_midi_event, Live 0xffffffff881c5000 snd_seq_device 7956 2 snd_seq_oss,snd_seq, Live 0xffffffff881c2000 snd_atiixp_modem 14604 0 - Live 0xffffffff881bb000 snd_ac97_codec 119640 2 snd_atiixp,snd_atiixp_modem, Live 0xffffffff8819c000 snd_pcm_oss 44160 0 - Live 0xffffffff88190000 snd_pcm 81416 4 snd_atiixp,snd_atiixp_modem,snd_ac97_codec,snd_pcm_oss, Live 0xffffffff8817b000 snd_timer 23440 2 snd_seq,snd_pcm, Live 0xffffffff88174000 snd_page_alloc 9360 3 snd_atiixp,snd_atiixp_modem,snd_pcm, Live 0xffffffff88170000 snd_mixer_oss 17408 1 snd_pcm_oss, Live 0xffffffff8816a000 snd 61000 10 snd_atiixp,snd_seq_oss,snd_seq,snd_seq_device,snd_atiixp_modem,snd_ac97_codec,snd_pcm_oss,snd_pcm,snd_timer,snd_mixer_oss, Live 0xffffffff8815a000 soundcore 8096 1 snd, Live 0xffffffff88157000 ac97_bus 2560 1 snd_ac97_codec, Live 0xffffffff88151000 arc4 2688 2 - Live 0xffffffff88155000 ecb 3840 2 - Live 0xffffffff88153000 b43 155432 0 - Live 0xffffffff8812a000 ssb 36356 1 b43, Live 0xffffffff88120000 rfkill 7712 3 rfkill_input,b43, Live 0xffffffff8811d000 pcmcia 38040 2 b43,ssb, Live 0xffffffff88112000 mac80211 146444 1 b43, Live 0xffffffff880ed000 cfg80211 20112 1 mac80211, Live 0xffffffff880e7000 input_polldev 4624 1 b43, Live 0xffffffff880e4000 pcmcia_core 38564 4 yenta_socket,rsrc_nonstatic,b43,pcmcia, Live 0xffffffff880d9000 led_class 4872 1 b43, Live 0xffffffff880d6000 8139too 26368 0 - Live 0xffffffff880ce000 mii 6016 1 8139too, Live 0xffffffff880cb000 fuse 48576 0 - Live 0xffffffff880be000 rtc_cmos 10680 0 - Live 0xffffffff880ba000 rtc_core 19268 1 rtc_cmos, Live 0xffffffff880b4000 rtc_lib 3456 1 rtc_core, Live 0xffffffff8805a000 ext3 138384 1 - Live 0xffffffff88091000 jbd 54184 1 ext3, Live 0xffffffff88082000 mbcache 8964 2 ext2,ext3, Live 0xffffffff8807e000 dm_mod 61624 9 - Live 0xffffffff8806d000 sr_mod 17348 0 - Live 0xffffffff88067000 cdrom 37928 1 sr_mod, Live 0xffffffff8805c000 sd_mod 25792 3 - Live 0xffffffff88052000 ata_generic 7172 0 - Live 0xffffffff8804f000 pata_atiixp 7296 2 - Live 0xffffffff8804c000 pata_acpi 6528 0 - Live 0xffffffff88049000 libata 159792 3 ata_generic,pata_atiixp,pata_acpi, Live 0xffffffff88020000 scsi_mod 109432 5 usb_storage,sg,sr_mod,sd_mod,libata, Live 0xffffffff88004000 dock 9760 1 libata, Live 0xffffffff88000000 + _________________________ /proc/meminfo + cat /proc/meminfo MemTotal: 509336 kB MemFree: 28072 kB Buffers: 8400 kB Cached: 122444 kB SwapCached: 12952 kB Active: 311524 kB Inactive: 115228 kB SwapTotal: 2097144 kB SwapFree: 2000148 kB Dirty: 240 kB Writeback: 0 kB AnonPages: 292956 kB Mapped: 34428 kB Slab: 25600 kB SReclaimable: 17044 kB SUnreclaim: 8556 kB PageTables: 5208 kB NFS_Unstable: 0 kB Bounce: 0 kB CommitLimit: 2351812 kB Committed_AS: 493564 kB VmallocTotal: 34359738367 kB VmallocUsed: 276032 kB VmallocChunk: 34359462319 kB + _________________________ /proc/net/ipsec-ls + test -f /proc/net/ipsec_version + _________________________ usr/src/linux/.config + test -f /proc/config.gz + zcat /proc/config.gz + egrep 'CONFIG_IPSEC|CONFIG_KLIPS|CONFIG_NET_KEY|CONFIG_INET|CONFIG_IP|CONFIG_HW_RANDOM|CONFIG_CRYPTO_DEV|_XFRM' # CONFIG_IPC_NS is not set CONFIG_XFRM=y CONFIG_XFRM_USER=m # CONFIG_XFRM_SUB_POLICY is not set # CONFIG_XFRM_MIGRATE is not set # CONFIG_XFRM_STATISTICS is not set CONFIG_NET_KEY=m # CONFIG_NET_KEY_MIGRATE is not set CONFIG_INET=y CONFIG_IP_MULTICAST=y CONFIG_IP_ADVANCED_ROUTER=y # CONFIG_IP_FIB_TRIE is not set CONFIG_IP_FIB_HASH=y CONFIG_IP_MULTIPLE_TABLES=y CONFIG_IP_ROUTE_MULTIPATH=y CONFIG_IP_ROUTE_VERBOSE=y # CONFIG_IP_PNP is not set CONFIG_IP_MROUTE=y CONFIG_IP_PIMSM_V1=y CONFIG_IP_PIMSM_V2=y CONFIG_INET_AH=m CONFIG_INET_ESP=m CONFIG_INET_IPCOMP=m CONFIG_INET_XFRM_TUNNEL=m CONFIG_INET_TUNNEL=m CONFIG_INET_XFRM_MODE_TRANSPORT=m CONFIG_INET_XFRM_MODE_TUNNEL=m CONFIG_INET_XFRM_MODE_BEET=m CONFIG_INET_LRO=m CONFIG_INET_DIAG=y CONFIG_INET_TCP_DIAG=y CONFIG_IP_VS=m # CONFIG_IP_VS_DEBUG is not set CONFIG_IP_VS_TAB_BITS=12 CONFIG_IP_VS_PROTO_TCP=y CONFIG_IP_VS_PROTO_UDP=y CONFIG_IP_VS_PROTO_ESP=y CONFIG_IP_VS_PROTO_AH=y CONFIG_IP_VS_RR=m CONFIG_IP_VS_WRR=m CONFIG_IP_VS_LC=m CONFIG_IP_VS_WLC=m CONFIG_IP_VS_LBLC=m CONFIG_IP_VS_LBLCR=m CONFIG_IP_VS_DH=m CONFIG_IP_VS_SH=m CONFIG_IP_VS_SED=m CONFIG_IP_VS_NQ=m CONFIG_IP_VS_FTP=m CONFIG_IPV6=m CONFIG_IPV6_PRIVACY=y CONFIG_IPV6_ROUTER_PREF=y CONFIG_IPV6_ROUTE_INFO=y CONFIG_IPV6_OPTIMISTIC_DAD=y CONFIG_INET6_AH=m CONFIG_INET6_ESP=m CONFIG_INET6_IPCOMP=m CONFIG_IPV6_MIP6=m CONFIG_INET6_XFRM_TUNNEL=m CONFIG_INET6_TUNNEL=m CONFIG_INET6_XFRM_MODE_TRANSPORT=m CONFIG_INET6_XFRM_MODE_TUNNEL=m CONFIG_INET6_XFRM_MODE_BEET=m CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION=m CONFIG_IPV6_SIT=m CONFIG_IPV6_TUNNEL=m CONFIG_IPV6_MULTIPLE_TABLES=y CONFIG_IPV6_SUBTREES=y CONFIG_IP_NF_QUEUE=m CONFIG_IP_NF_IPTABLES=m CONFIG_IP_NF_MATCH_RECENT=m CONFIG_IP_NF_MATCH_ECN=m CONFIG_IP_NF_MATCH_AH=m CONFIG_IP_NF_MATCH_TTL=m CONFIG_IP_NF_MATCH_ADDRTYPE=m CONFIG_IP_NF_FILTER=m CONFIG_IP_NF_TARGET_REJECT=m CONFIG_IP_NF_TARGET_LOG=m CONFIG_IP_NF_TARGET_ULOG=m CONFIG_IP_NF_TARGET_MASQUERADE=m CONFIG_IP_NF_TARGET_REDIRECT=m CONFIG_IP_NF_TARGET_NETMAP=m CONFIG_IP_NF_MANGLE=m CONFIG_IP_NF_TARGET_ECN=m CONFIG_IP_NF_TARGET_TTL=m CONFIG_IP_NF_TARGET_CLUSTERIP=m CONFIG_IP_NF_RAW=m CONFIG_IP_NF_ARPTABLES=m CONFIG_IP_NF_ARPFILTER=m CONFIG_IP_NF_ARP_MANGLE=m CONFIG_IP6_NF_QUEUE=m CONFIG_IP6_NF_IPTABLES=m CONFIG_IP6_NF_MATCH_RT=m CONFIG_IP6_NF_MATCH_OPTS=m CONFIG_IP6_NF_MATCH_FRAG=m CONFIG_IP6_NF_MATCH_HL=m CONFIG_IP6_NF_MATCH_IPV6HEADER=m CONFIG_IP6_NF_MATCH_AH=m CONFIG_IP6_NF_MATCH_MH=m CONFIG_IP6_NF_MATCH_EUI64=m CONFIG_IP6_NF_FILTER=m CONFIG_IP6_NF_TARGET_LOG=m CONFIG_IP6_NF_TARGET_REJECT=m CONFIG_IP6_NF_MANGLE=m CONFIG_IP6_NF_TARGET_HL=m CONFIG_IP6_NF_RAW=m # CONFIG_IP_DCCP is not set CONFIG_IP_SCTP=m CONFIG_IPX=m # CONFIG_IPX_INTERN is not set CONFIG_IP1000=m CONFIG_IPW2100=m CONFIG_IPW2100_MONITOR=y # CONFIG_IPW2100_DEBUG is not set CONFIG_IPW2200=m CONFIG_IPW2200_MONITOR=y CONFIG_IPW2200_RADIOTAP=y CONFIG_IPW2200_PROMISCUOUS=y CONFIG_IPW2200_QOS=y # CONFIG_IPW2200_DEBUG is not set CONFIG_IPPP_FILTER=y CONFIG_IPMI_HANDLER=m # CONFIG_IPMI_PANIC_EVENT is not set CONFIG_IPMI_DEVICE_INTERFACE=m CONFIG_IPMI_SI=m CONFIG_IPMI_WATCHDOG=m CONFIG_IPMI_POWEROFF=m CONFIG_HW_RANDOM=y CONFIG_HW_RANDOM_INTEL=m CONFIG_HW_RANDOM_AMD=m CONFIG_IPWIRELESS=m # CONFIG_SECURITY_NETWORK_XFRM is not set CONFIG_CRYPTO_DEV_HIFN_795X=m CONFIG_CRYPTO_DEV_HIFN_795X_RNG=y + _________________________ etc/syslog.conf + _________________________ etc/syslog-ng/syslog-ng.conf + cat /etc/syslog-ng/syslog-ng.conf cat: /etc/syslog-ng/syslog-ng.conf: No such file or directory + cat /etc/syslog.conf cat: /etc/syslog.conf: No such file or directory + _________________________ etc/resolv.conf + cat /etc/resolv.conf # Generated by dhcpcd for interface eth0 search tk-on.net nameserver 192.168.10.1 + _________________________ lib/modules-ls + ls -ltr /lib/modules total 4 drwxr-xr-x 3 root root 4096 Jul 26 08:36 2.6.25-ARCH + _________________________ /proc/ksyms-netif_rx + test -r /proc/ksyms + test -r /proc/kallsyms + egrep netif_rx /proc/kallsyms ffffffff803d4bd0 T netif_rx ffffffff803d4ee0 T netif_rx_ni ffffffff803d4bd0 u netif_rx [ipv6] ffffffff803d4bd0 u netif_rx [mac80211] + _________________________ lib/modules-netif_rx + modulegoo kernel/net/ipv4/ipip.o netif_rx + set +x 2.6.25-ARCH: + _________________________ kern.debug + test -f /var/log/kern.debug + _________________________ klog + sed -n '108,$p' /var/log/daemon.log + egrep -i 'ipsec|klips|pluto' + case "$1" in + cat Jul 27 22:30:55 tk-r4k ipsec_setup: Starting Openswan IPsec U2.6.15/K2.6.25-ARCH... Jul 27 22:30:56 tk-r4k ipsec__plutorun: 002 loading certificate from /etc/ipsec.d/certs/hostcert.pem Jul 27 22:30:56 tk-r4k ipsec__plutorun: 002 loaded host cert file '/etc/ipsec.d/certs/hostcert.pem' (1245 bytes) Jul 27 22:30:56 tk-r4k ipsec__plutorun: 002 loading certificate from /etc/ipsec.d/certs/Arch2Netcert.pem Jul 27 22:30:56 tk-r4k ipsec__plutorun: 002 loaded host cert file '/etc/ipsec.d/certs/Arch2Netcert.pem' (1452 bytes) Jul 27 22:30:56 tk-r4k ipsec__plutorun: 002 added connection description "Arch2Net" Jul 27 22:30:56 tk-r4k ipsec__plutorun: 002 loading certificate from /etc/ipsec.d/certs/hostcert.pem Jul 27 22:30:56 tk-r4k ipsec__plutorun: 002 loaded host cert file '/etc/ipsec.d/certs/hostcert.pem' (1245 bytes) Jul 27 22:31:36 tk-r4k ipsec__plutorun: 000 failed to convert 'www.tk-on.net' at load time: does not look numeric and name lookup failed Jul 27 22:31:36 tk-r4k ipsec__plutorun: 002 loading certificate from /etc/ipsec.d/certs/Net2Homecert.pem Jul 27 22:31:36 tk-r4k ipsec__plutorun: 002 loaded host cert file '/etc/ipsec.d/certs/Net2Homecert.pem' (1460 bytes) Jul 27 22:31:36 tk-r4k ipsec__plutorun: 002 added connection description "Net2Home" Jul 27 22:31:36 tk-r4k ipsec__plutorun: 000 "Arch2Net": request to add a prospective erouted policy with netkey kernel --- experimental Jul 27 22:31:36 tk-r4k ipsec__plutorun: 104 "Arch2Net" #1: STATE_MAIN_I1: initiate + _________________________ plog + sed -n '9647,$p' /var/log/auth.log + egrep -i pluto + case "$1" in + cat Jul 27 22:30:55 tk-r4k ipsec__plutorun: Starting Pluto subsystem... Jul 27 22:30:55 tk-r4k pluto[19298]: Starting Pluto (Openswan Version 2.6.15; Vendor ID OEcGnXn_VzTW) pid:19298 Jul 27 22:30:55 tk-r4k pluto[19298]: Setting NAT-Traversal port-4500 floating to on Jul 27 22:30:55 tk-r4k pluto[19298]: port floating activation criteria nat_t=1/port_float=1 Jul 27 22:30:55 tk-r4k pluto[19298]: including NAT-Traversal patch (Version 0.6c) Jul 27 22:30:55 tk-r4k pluto[19298]: using /dev/urandom as source of random entropy Jul 27 22:30:55 tk-r4k pluto[19298]: ike_alg_register_enc(): Activating OAKLEY_TWOFISH_CBC_SSH: Ok (ret=0) Jul 27 22:30:55 tk-r4k pluto[19298]: ike_alg_register_enc(): Activating OAKLEY_TWOFISH_CBC: Ok (ret=0) Jul 27 22:30:55 tk-r4k pluto[19298]: ike_alg_register_enc(): Activating OAKLEY_SERPENT_CBC: Ok (ret=0) Jul 27 22:30:55 tk-r4k pluto[19298]: ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0) Jul 27 22:30:55 tk-r4k pluto[19298]: ike_alg_register_enc(): Activating OAKLEY_BLOWFISH_CBC: Ok (ret=0) Jul 27 22:30:55 tk-r4k pluto[19298]: ike_alg_register_hash(): Activating OAKLEY_SHA2_512: Ok (ret=0) Jul 27 22:30:55 tk-r4k pluto[19298]: ike_alg_register_hash(): Activating OAKLEY_SHA2_256: Ok (ret=0) Jul 27 22:30:55 tk-r4k pluto[19298]: starting up 1 cryptographic helpers Jul 27 22:30:55 tk-r4k pluto[19299]: using /dev/urandom as source of random entropy Jul 27 22:30:55 tk-r4k pluto[19298]: started helper pid=19299 (fd:7) Jul 27 22:30:55 tk-r4k pluto[19298]: Using Linux 2.6 IPsec interface code on 2.6.25-ARCH (experimental code) Jul 27 22:30:55 tk-r4k pluto[19298]: ike_alg_register_enc(): WARNING: enc alg=0 not found in constants.c:oakley_enc_names Jul 27 22:30:55 tk-r4k pluto[19298]: ike_alg_register_enc(): Activating : Ok (ret=0) Jul 27 22:30:55 tk-r4k pluto[19298]: ike_alg_register_enc(): WARNING: enc alg=0 not found in constants.c:oakley_enc_names Jul 27 22:30:55 tk-r4k pluto[19298]: ike_alg_add(): ERROR: Algorithm already exists Jul 27 22:30:55 tk-r4k pluto[19298]: ike_alg_register_enc(): Activating : FAILED (ret=-17) Jul 27 22:30:55 tk-r4k pluto[19298]: ike_alg_register_enc(): WARNING: enc alg=0 not found in constants.c:oakley_enc_names Jul 27 22:30:55 tk-r4k pluto[19298]: ike_alg_add(): ERROR: Algorithm already exists Jul 27 22:30:55 tk-r4k pluto[19298]: ike_alg_register_enc(): Activating : FAILED (ret=-17) Jul 27 22:30:55 tk-r4k pluto[19298]: ike_alg_register_enc(): WARNING: enc alg=0 not found in constants.c:oakley_enc_names Jul 27 22:30:55 tk-r4k pluto[19298]: ike_alg_add(): ERROR: Algorithm already exists Jul 27 22:30:55 tk-r4k pluto[19298]: ike_alg_register_enc(): Activating : FAILED (ret=-17) Jul 27 22:30:55 tk-r4k pluto[19298]: ike_alg_register_enc(): WARNING: enc alg=0 not found in constants.c:oakley_enc_names Jul 27 22:30:55 tk-r4k pluto[19298]: ike_alg_add(): ERROR: Algorithm already exists Jul 27 22:30:55 tk-r4k pluto[19298]: ike_alg_register_enc(): Activating : FAILED (ret=-17) Jul 27 22:30:55 tk-r4k pluto[19298]: ike_alg_register_enc(): WARNING: enc alg=0 not found in constants.c:oakley_enc_names Jul 27 22:30:55 tk-r4k pluto[19298]: ike_alg_add(): ERROR: Algorithm already exists Jul 27 22:30:55 tk-r4k pluto[19298]: ike_alg_register_enc(): Activating : FAILED (ret=-17) Jul 27 22:30:56 tk-r4k pluto[19298]: Changed path to directory '/etc/ipsec.d/cacerts' Jul 27 22:30:56 tk-r4k pluto[19298]: loaded CA cert file 'cacert.pem' (1403 bytes) Jul 27 22:30:56 tk-r4k pluto[19298]: Could not change to directory '/etc/ipsec.d/aacerts': /home/tomk Jul 27 22:30:56 tk-r4k pluto[19298]: Could not change to directory '/etc/ipsec.d/ocspcerts': /home/tomk Jul 27 22:30:56 tk-r4k pluto[19298]: Changing to directory '/etc/ipsec.d/crls' Jul 27 22:30:56 tk-r4k pluto[19298]: loaded crl file 'cacrl.pem' (617 bytes) Jul 27 22:30:56 tk-r4k pluto[19298]: Changing back to directory '/home/tomk' failed - (2 No such file or directory) Jul 27 22:30:56 tk-r4k pluto[19298]: Changing back to directory '/home/tomk' failed - (2 No such file or directory) Jul 27 22:30:56 tk-r4k pluto[19298]: loading certificate from /etc/ipsec.d/certs/hostcert.pem Jul 27 22:30:56 tk-r4k pluto[19298]: loaded host cert file '/etc/ipsec.d/certs/hostcert.pem' (1245 bytes) Jul 27 22:30:56 tk-r4k pluto[19298]: loading certificate from /etc/ipsec.d/certs/Arch2Netcert.pem Jul 27 22:30:56 tk-r4k pluto[19298]: loaded host cert file '/etc/ipsec.d/certs/Arch2Netcert.pem' (1452 bytes) Jul 27 22:30:56 tk-r4k pluto[19298]: added connection description "Arch2Net" Jul 27 22:30:56 tk-r4k pluto[19298]: loading certificate from /etc/ipsec.d/certs/hostcert.pem Jul 27 22:30:56 tk-r4k pluto[19298]: loaded host cert file '/etc/ipsec.d/certs/hostcert.pem' (1245 bytes) Jul 27 22:31:36 tk-r4k pluto[19298]: failed to convert 'www.tk-on.net' at load time: does not look numeric and name lookup failed Jul 27 22:31:36 tk-r4k pluto[19298]: loading certificate from /etc/ipsec.d/certs/Net2Homecert.pem Jul 27 22:31:36 tk-r4k pluto[19298]: loaded host cert file '/etc/ipsec.d/certs/Net2Homecert.pem' (1460 bytes) Jul 27 22:31:36 tk-r4k pluto[19298]: added connection description "Net2Home" Jul 27 22:31:36 tk-r4k pluto[19298]: listening for IKE messages Jul 27 22:31:36 tk-r4k pluto[19298]: adding interface wlan0/wlan0 10.12.62.99:500 Jul 27 22:31:36 tk-r4k pluto[19298]: adding interface wlan0/wlan0 10.12.62.99:4500 Jul 27 22:31:36 tk-r4k pluto[19298]: adding interface lo/lo 127.0.0.1:500 Jul 27 22:31:36 tk-r4k pluto[19298]: adding interface lo/lo 127.0.0.1:4500 Jul 27 22:31:36 tk-r4k pluto[19298]: adding interface lo/lo ::1:500 Jul 27 22:31:36 tk-r4k pluto[19298]: loading secrets from "/etc/ipsec.secrets" Jul 27 22:31:36 tk-r4k pluto[19298]: loaded private key file '/etc/ipsec.d/private/tk-i5kaKey.pem' (1675 bytes) Jul 27 22:31:36 tk-r4k pluto[19298]: loaded private key for keyid: PPK_RSA:AwEAAbk5R Jul 27 22:31:36 tk-r4k pluto[19298]: "Arch2Net": request to add a prospective erouted policy with netkey kernel --- experimental Jul 27 22:31:36 tk-r4k pluto[19298]: "Arch2Net" #1: initiating Main Mode Jul 27 22:31:36 tk-r4k pluto[19298]: "Arch2Net" #1: received Vendor ID payload [RFC 3947] method set to=109 Jul 27 22:31:36 tk-r4k pluto[19298]: "Arch2Net" #1: received Vendor ID payload [Dead Peer Detection] Jul 27 22:31:36 tk-r4k pluto[19298]: "Arch2Net" #1: enabling possible NAT-traversal with method 4 Jul 27 22:31:36 tk-r4k pluto[19298]: "Arch2Net" #1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2 Jul 27 22:31:36 tk-r4k pluto[19298]: "Arch2Net" #1: STATE_MAIN_I2: sent MI2, expecting MR2 Jul 27 22:31:36 tk-r4k pluto[19298]: "Arch2Net" #1: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): no NAT detected Jul 27 22:31:36 tk-r4k pluto[19298]: "Arch2Net" #1: I am sending my cert Jul 27 22:31:36 tk-r4k pluto[19298]: "Arch2Net" #1: I am sending a certificate request Jul 27 22:31:36 tk-r4k pluto[19298]: "Arch2Net" #1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3 Jul 27 22:31:36 tk-r4k pluto[19298]: "Arch2Net" #1: STATE_MAIN_I3: sent MI3, expecting MR3 Jul 27 22:31:36 tk-r4k pluto[19298]: "Arch2Net" #1: ignoring informational payload, type INVALID_ID_INFORMATION msgid=00000000 Jul 27 22:31:36 tk-r4k pluto[19298]: "Arch2Net" #1: received and ignored informational message Jul 27 22:31:40 tk-r4k pluto[19298]: packet from 10.12.62.1:500: received Vendor ID payload [RFC 3947] method set to=109 Jul 27 22:31:40 tk-r4k pluto[19298]: packet from 10.12.62.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] meth=108, but already using method 109 Jul 27 22:31:40 tk-r4k pluto[19298]: packet from 10.12.62.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] meth=107, but already using method 109 Jul 27 22:31:40 tk-r4k pluto[19298]: packet from 10.12.62.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00] Jul 27 22:31:40 tk-r4k pluto[19298]: packet from 10.12.62.1:500: received Vendor ID payload [Dead Peer Detection] Jul 27 22:31:40 tk-r4k pluto[19298]: "Arch2Net" #2: responding to Main Mode Jul 27 22:31:40 tk-r4k pluto[19298]: "Arch2Net" #2: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1 Jul 27 22:31:40 tk-r4k pluto[19298]: "Arch2Net" #2: STATE_MAIN_R1: sent MR1, expecting MI2 Jul 27 22:31:40 tk-r4k pluto[19298]: "Arch2Net" #2: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): no NAT detected Jul 27 22:31:40 tk-r4k pluto[19298]: "Arch2Net" #2: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2 Jul 27 22:31:40 tk-r4k pluto[19298]: "Arch2Net" #2: STATE_MAIN_R2: sent MR2, expecting MI3 Jul 27 22:31:40 tk-r4k pluto[19298]: "Arch2Net" #2: Main mode peer ID is ID_DER_ASN1_DN: 'C=IE, O=tk-on.net, CN=ipcop.tk-on.net' Jul 27 22:31:40 tk-r4k pluto[19298]: "Arch2Net" #2: crl update for "C=IE, O=tk-on.net, CN=tk-on.net CA, E=tomk@runbox.com" is overdue since Oct 13 22:54:39 UTC 2004 Jul 27 22:31:41 tk-r4k pluto[19298]: "Arch2Net" #2: no suitable connection for peer 'C=IE, O=tk-on.net, CN=ipcop.tk-on.net' Jul 27 22:31:41 tk-r4k pluto[19298]: "Arch2Net" #2: sending encrypted notification INVALID_ID_INFORMATION to 10.12.62.1:500 Jul 27 22:31:46 tk-r4k pluto[19298]: "Arch2Net" #1: ignoring informational payload, type INVALID_ID_INFORMATION msgid=00000000 Jul 27 22:31:46 tk-r4k pluto[19298]: "Arch2Net" #1: received and ignored informational message Jul 27 22:31:47 tk-r4k pluto[19298]: "Arch2Net" #1: discarding duplicate packet; already STATE_MAIN_I3 Jul 27 22:31:51 tk-r4k pluto[19298]: "Arch2Net" #2: Main mode peer ID is ID_DER_ASN1_DN: 'C=IE, O=tk-on.net, CN=ipcop.tk-on.net' Jul 27 22:31:51 tk-r4k pluto[19298]: "Arch2Net" #2: crl update for "C=IE, O=tk-on.net, CN=tk-on.net CA, E=tomk@runbox.com" is overdue since Oct 13 22:54:39 UTC 2004 Jul 27 22:31:51 tk-r4k pluto[19298]: "Arch2Net" #2: no suitable connection for peer 'C=IE, O=tk-on.net, CN=ipcop.tk-on.net' Jul 27 22:31:51 tk-r4k pluto[19298]: "Arch2Net" #2: sending encrypted notification INVALID_ID_INFORMATION to 10.12.62.1:500 Jul 27 22:32:06 tk-r4k pluto[19298]: "Arch2Net" #1: ignoring informational payload, type INVALID_ID_INFORMATION msgid=00000000 Jul 27 22:32:06 tk-r4k pluto[19298]: "Arch2Net" #1: received and ignored informational message Jul 27 22:32:07 tk-r4k pluto[19298]: "Arch2Net" #1: discarding duplicate packet; already STATE_MAIN_I3 Jul 27 22:32:11 tk-r4k pluto[19298]: "Arch2Net" #2: Main mode peer ID is ID_DER_ASN1_DN: 'C=IE, O=tk-on.net, CN=ipcop.tk-on.net' Jul 27 22:32:11 tk-r4k pluto[19298]: "Arch2Net" #2: crl update for "C=IE, O=tk-on.net, CN=tk-on.net CA, E=tomk@runbox.com" is overdue since Oct 13 22:54:39 UTC 2004 Jul 27 22:32:11 tk-r4k pluto[19298]: "Arch2Net" #2: no suitable connection for peer 'C=IE, O=tk-on.net, CN=ipcop.tk-on.net' Jul 27 22:32:11 tk-r4k pluto[19298]: "Arch2Net" #2: sending encrypted notification INVALID_ID_INFORMATION to 10.12.62.1:500 Jul 27 22:32:46 tk-r4k pluto[19298]: "Arch2Net" #1: max number of retransmissions (2) reached STATE_MAIN_I3. Possible authentication failure: no acceptable response to our first encrypted message Jul 27 22:32:46 tk-r4k pluto[19298]: "Arch2Net" #1: starting keying attempt 2 of an unlimited number Jul 27 22:32:46 tk-r4k pluto[19298]: "Arch2Net" #3: initiating Main Mode to replace #1 Jul 27 22:32:46 tk-r4k pluto[19298]: "Arch2Net" #3: received Vendor ID payload [RFC 3947] method set to=109 Jul 27 22:32:46 tk-r4k pluto[19298]: "Arch2Net" #3: received Vendor ID payload [Dead Peer Detection] Jul 27 22:32:46 tk-r4k pluto[19298]: "Arch2Net" #3: enabling possible NAT-traversal with method 4 Jul 27 22:32:46 tk-r4k pluto[19298]: "Arch2Net" #3: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2 Jul 27 22:32:46 tk-r4k pluto[19298]: "Arch2Net" #3: STATE_MAIN_I2: sent MI2, expecting MR2 Jul 27 22:32:46 tk-r4k pluto[19298]: "Arch2Net" #3: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): no NAT detected Jul 27 22:32:46 tk-r4k pluto[19298]: "Arch2Net" #3: I am sending my cert Jul 27 22:32:46 tk-r4k pluto[19298]: "Arch2Net" #3: I am sending a certificate request Jul 27 22:32:46 tk-r4k pluto[19298]: "Arch2Net" #3: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3 Jul 27 22:32:46 tk-r4k pluto[19298]: "Arch2Net" #3: STATE_MAIN_I3: sent MI3, expecting MR3 Jul 27 22:32:46 tk-r4k pluto[19298]: "Arch2Net" #3: ignoring informational payload, type INVALID_ID_INFORMATION msgid=00000000 Jul 27 22:32:46 tk-r4k pluto[19298]: "Arch2Net" #3: received and ignored informational message Jul 27 22:32:50 tk-r4k pluto[19298]: "Arch2Net" #2: max number of retransmissions (2) reached STATE_MAIN_R2 Jul 27 22:32:50 tk-r4k pluto[19298]: packet from 10.12.62.1:500: received Vendor ID payload [RFC 3947] method set to=109 Jul 27 22:32:50 tk-r4k pluto[19298]: packet from 10.12.62.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] meth=108, but already using method 109 Jul 27 22:32:50 tk-r4k pluto[19298]: packet from 10.12.62.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] meth=107, but already using method 109 Jul 27 22:32:50 tk-r4k pluto[19298]: packet from 10.12.62.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00] Jul 27 22:32:50 tk-r4k pluto[19298]: packet from 10.12.62.1:500: received Vendor ID payload [Dead Peer Detection] Jul 27 22:32:50 tk-r4k pluto[19298]: "Arch2Net" #4: responding to Main Mode Jul 27 22:32:50 tk-r4k pluto[19298]: "Arch2Net" #4: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1 Jul 27 22:32:50 tk-r4k pluto[19298]: "Arch2Net" #4: STATE_MAIN_R1: sent MR1, expecting MI2 Jul 27 22:32:50 tk-r4k pluto[19298]: "Arch2Net" #4: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): no NAT detected Jul 27 22:32:50 tk-r4k pluto[19298]: "Arch2Net" #4: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2 Jul 27 22:32:50 tk-r4k pluto[19298]: "Arch2Net" #4: STATE_MAIN_R2: sent MR2, expecting MI3 Jul 27 22:32:50 tk-r4k pluto[19298]: "Arch2Net" #4: Main mode peer ID is ID_DER_ASN1_DN: 'C=IE, O=tk-on.net, CN=ipcop.tk-on.net' Jul 27 22:32:50 tk-r4k pluto[19298]: "Arch2Net" #4: crl update for "C=IE, O=tk-on.net, CN=tk-on.net CA, E=tomk@runbox.com" is overdue since Oct 13 22:54:39 UTC 2004 Jul 27 22:32:50 tk-r4k pluto[19298]: "Arch2Net" #4: no suitable connection for peer 'C=IE, O=tk-on.net, CN=ipcop.tk-on.net' Jul 27 22:32:50 tk-r4k pluto[19298]: "Arch2Net" #4: sending encrypted notification INVALID_ID_INFORMATION to 10.12.62.1:500 Jul 27 22:32:55 tk-r4k pluto[19298]: "Arch2Net" #3: discarding duplicate packet; already STATE_MAIN_I3 Jul 27 22:32:56 tk-r4k pluto[19298]: "Arch2Net" #3: ignoring informational payload, type INVALID_ID_INFORMATION msgid=00000000 Jul 27 22:32:56 tk-r4k pluto[19298]: "Arch2Net" #3: received and ignored informational message Jul 27 22:33:00 tk-r4k pluto[19298]: "Arch2Net" #4: Main mode peer ID is ID_DER_ASN1_DN: 'C=IE, O=tk-on.net, CN=ipcop.tk-on.net' Jul 27 22:33:00 tk-r4k pluto[19298]: "Arch2Net" #4: crl update for "C=IE, O=tk-on.net, CN=tk-on.net CA, E=tomk@runbox.com" is overdue since Oct 13 22:54:39 UTC 2004 Jul 27 22:33:00 tk-r4k pluto[19298]: "Arch2Net" #4: no suitable connection for peer 'C=IE, O=tk-on.net, CN=ipcop.tk-on.net' Jul 27 22:33:00 tk-r4k pluto[19298]: "Arch2Net" #4: sending encrypted notification INVALID_ID_INFORMATION to 10.12.62.1:500 Jul 27 22:33:15 tk-r4k pluto[19298]: "Arch2Net" #3: discarding duplicate packet; already STATE_MAIN_I3 Jul 27 22:33:16 tk-r4k pluto[19298]: "Arch2Net" #3: ignoring informational payload, type INVALID_ID_INFORMATION msgid=00000000 Jul 27 22:33:16 tk-r4k pluto[19298]: "Arch2Net" #3: received and ignored informational message Jul 27 22:33:20 tk-r4k pluto[19298]: "Arch2Net" #4: Main mode peer ID is ID_DER_ASN1_DN: 'C=IE, O=tk-on.net, CN=ipcop.tk-on.net' Jul 27 22:33:20 tk-r4k pluto[19298]: "Arch2Net" #4: crl update for "C=IE, O=tk-on.net, CN=tk-on.net CA, E=tomk@runbox.com" is overdue since Oct 13 22:54:39 UTC 2004 Jul 27 22:33:20 tk-r4k pluto[19298]: "Arch2Net" #4: no suitable connection for peer 'C=IE, O=tk-on.net, CN=ipcop.tk-on.net' Jul 27 22:33:20 tk-r4k pluto[19298]: "Arch2Net" #4: sending encrypted notification INVALID_ID_INFORMATION to 10.12.62.1:500 Jul 27 22:33:56 tk-r4k pluto[19298]: "Arch2Net" #3: max number of retransmissions (2) reached STATE_MAIN_I3. Possible authentication failure: no acceptable response to our first encrypted message Jul 27 22:33:56 tk-r4k pluto[19298]: "Arch2Net" #3: starting keying attempt 3 of an unlimited number Jul 27 22:33:56 tk-r4k pluto[19298]: "Arch2Net" #5: initiating Main Mode to replace #3 Jul 27 22:33:56 tk-r4k pluto[19298]: "Arch2Net" #5: received Vendor ID payload [RFC 3947] method set to=109 Jul 27 22:33:56 tk-r4k pluto[19298]: "Arch2Net" #5: received Vendor ID payload [Dead Peer Detection] Jul 27 22:33:56 tk-r4k pluto[19298]: "Arch2Net" #5: enabling possible NAT-traversal with method 4 Jul 27 22:33:56 tk-r4k pluto[19298]: "Arch2Net" #5: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2 Jul 27 22:33:56 tk-r4k pluto[19298]: "Arch2Net" #5: STATE_MAIN_I2: sent MI2, expecting MR2 Jul 27 22:33:57 tk-r4k pluto[19298]: "Arch2Net" #5: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): no NAT detected Jul 27 22:33:57 tk-r4k pluto[19298]: "Arch2Net" #5: I am sending my cert Jul 27 22:33:57 tk-r4k pluto[19298]: "Arch2Net" #5: I am sending a certificate request Jul 27 22:33:57 tk-r4k pluto[19298]: "Arch2Net" #5: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3 Jul 27 22:33:57 tk-r4k pluto[19298]: "Arch2Net" #5: STATE_MAIN_I3: sent MI3, expecting MR3 Jul 27 22:33:57 tk-r4k pluto[19298]: "Arch2Net" #5: ignoring informational payload, type INVALID_ID_INFORMATION msgid=00000000 Jul 27 22:33:57 tk-r4k pluto[19298]: "Arch2Net" #5: received and ignored informational message Jul 27 22:34:00 tk-r4k pluto[19298]: "Arch2Net" #4: max number of retransmissions (2) reached STATE_MAIN_R2 Jul 27 22:34:07 tk-r4k pluto[19298]: "Arch2Net" #5: discarding duplicate packet; already STATE_MAIN_I3 Jul 27 22:34:07 tk-r4k pluto[19298]: "Arch2Net" #5: ignoring informational payload, type INVALID_ID_INFORMATION msgid=00000000 Jul 27 22:34:07 tk-r4k pluto[19298]: "Arch2Net" #5: received and ignored informational message Jul 27 22:34:11 tk-r4k pluto[19298]: packet from 10.12.62.1:500: received Vendor ID payload [RFC 3947] method set to=109 Jul 27 22:34:11 tk-r4k pluto[19298]: packet from 10.12.62.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] meth=108, but already using method 109 Jul 27 22:34:11 tk-r4k pluto[19298]: packet from 10.12.62.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] meth=107, but already using method 109 Jul 27 22:34:11 tk-r4k pluto[19298]: packet from 10.12.62.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00] Jul 27 22:34:11 tk-r4k pluto[19298]: packet from 10.12.62.1:500: received Vendor ID payload [Dead Peer Detection] Jul 27 22:34:11 tk-r4k pluto[19298]: "Arch2Net" #6: responding to Main Mode Jul 27 22:34:11 tk-r4k pluto[19298]: "Arch2Net" #6: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1 Jul 27 22:34:11 tk-r4k pluto[19298]: "Arch2Net" #6: STATE_MAIN_R1: sent MR1, expecting MI2 Jul 27 22:34:11 tk-r4k pluto[19298]: "Arch2Net" #6: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): no NAT detected Jul 27 22:34:11 tk-r4k pluto[19298]: "Arch2Net" #6: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2 Jul 27 22:34:11 tk-r4k pluto[19298]: "Arch2Net" #6: STATE_MAIN_R2: sent MR2, expecting MI3 Jul 27 22:34:11 tk-r4k pluto[19298]: "Arch2Net" #6: Main mode peer ID is ID_DER_ASN1_DN: 'C=IE, O=tk-on.net, CN=ipcop.tk-on.net' Jul 27 22:34:11 tk-r4k pluto[19298]: "Arch2Net" #6: crl update for "C=IE, O=tk-on.net, CN=tk-on.net CA, E=tomk@runbox.com" is overdue since Oct 13 22:54:39 UTC 2004 Jul 27 22:34:11 tk-r4k pluto[19298]: "Arch2Net" #6: no suitable connection for peer 'C=IE, O=tk-on.net, CN=ipcop.tk-on.net' Jul 27 22:34:11 tk-r4k pluto[19298]: "Arch2Net" #6: sending encrypted notification INVALID_ID_INFORMATION to 10.12.62.1:500 Jul 27 22:34:21 tk-r4k pluto[19298]: "Arch2Net" #6: Main mode peer ID is ID_DER_ASN1_DN: 'C=IE, O=tk-on.net, CN=ipcop.tk-on.net' Jul 27 22:34:21 tk-r4k pluto[19298]: "Arch2Net" #6: crl update for "C=IE, O=tk-on.net, CN=tk-on.net CA, E=tomk@runbox.com" is overdue since Oct 13 22:54:39 UTC 2004 Jul 27 22:34:21 tk-r4k pluto[19298]: "Arch2Net" #6: no suitable connection for peer 'C=IE, O=tk-on.net, CN=ipcop.tk-on.net' Jul 27 22:34:21 tk-r4k pluto[19298]: "Arch2Net" #6: sending encrypted notification INVALID_ID_INFORMATION to 10.12.62.1:500 Jul 27 22:34:26 tk-r4k pluto[19298]: "Arch2Net" #5: discarding duplicate packet; already STATE_MAIN_I3 Jul 27 22:34:27 tk-r4k pluto[19298]: "Arch2Net" #5: ignoring informational payload, type INVALID_ID_INFORMATION msgid=00000000 Jul 27 22:34:27 tk-r4k pluto[19298]: "Arch2Net" #5: received and ignored informational message Jul 27 22:34:41 tk-r4k pluto[19298]: "Arch2Net" #6: Main mode peer ID is ID_DER_ASN1_DN: 'C=IE, O=tk-on.net, CN=ipcop.tk-on.net' Jul 27 22:34:41 tk-r4k pluto[19298]: "Arch2Net" #6: crl update for "C=IE, O=tk-on.net, CN=tk-on.net CA, E=tomk@runbox.com" is overdue since Oct 13 22:54:39 UTC 2004 Jul 27 22:34:41 tk-r4k pluto[19298]: "Arch2Net" #6: no suitable connection for peer 'C=IE, O=tk-on.net, CN=ipcop.tk-on.net' Jul 27 22:34:41 tk-r4k pluto[19298]: "Arch2Net" #6: sending encrypted notification INVALID_ID_INFORMATION to 10.12.62.1:500 Jul 27 22:35:07 tk-r4k pluto[19298]: "Arch2Net" #5: max number of retransmissions (2) reached STATE_MAIN_I3. Possible authentication failure: no acceptable response to our first encrypted message Jul 27 22:35:07 tk-r4k pluto[19298]: "Arch2Net" #5: starting keying attempt 4 of an unlimited number Jul 27 22:35:07 tk-r4k pluto[19298]: "Arch2Net" #7: initiating Main Mode to replace #5 Jul 27 22:35:07 tk-r4k pluto[19298]: "Arch2Net" #7: received Vendor ID payload [RFC 3947] method set to=109 Jul 27 22:35:07 tk-r4k pluto[19298]: "Arch2Net" #7: received Vendor ID payload [Dead Peer Detection] Jul 27 22:35:07 tk-r4k pluto[19298]: "Arch2Net" #7: enabling possible NAT-traversal with method 4 Jul 27 22:35:07 tk-r4k pluto[19298]: "Arch2Net" #7: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2 Jul 27 22:35:07 tk-r4k pluto[19298]: "Arch2Net" #7: STATE_MAIN_I2: sent MI2, expecting MR2 Jul 27 22:35:08 tk-r4k pluto[19298]: "Arch2Net" #7: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): no NAT detected Jul 27 22:35:08 tk-r4k pluto[19298]: "Arch2Net" #7: I am sending my cert Jul 27 22:35:08 tk-r4k pluto[19298]: "Arch2Net" #7: I am sending a certificate request Jul 27 22:35:08 tk-r4k pluto[19298]: "Arch2Net" #7: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3 Jul 27 22:35:08 tk-r4k pluto[19298]: "Arch2Net" #7: STATE_MAIN_I3: sent MI3, expecting MR3 Jul 27 22:35:08 tk-r4k pluto[19298]: "Arch2Net" #7: ignoring informational payload, type INVALID_ID_INFORMATION msgid=00000000 Jul 27 22:35:08 tk-r4k pluto[19298]: "Arch2Net" #7: received and ignored informational message Jul 27 22:35:18 tk-r4k pluto[19298]: "Arch2Net" #7: discarding duplicate packet; already STATE_MAIN_I3 Jul 27 22:35:18 tk-r4k pluto[19298]: "Arch2Net" #7: ignoring informational payload, type INVALID_ID_INFORMATION msgid=00000000 Jul 27 22:35:18 tk-r4k pluto[19298]: "Arch2Net" #7: received and ignored informational message Jul 27 22:35:21 tk-r4k pluto[19298]: "Arch2Net" #6: max number of retransmissions (2) reached STATE_MAIN_R2 Jul 27 22:35:22 tk-r4k pluto[19298]: packet from 10.12.62.1:500: received Vendor ID payload [RFC 3947] method set to=109 Jul 27 22:35:22 tk-r4k pluto[19298]: packet from 10.12.62.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] meth=108, but already using method 109 Jul 27 22:35:22 tk-r4k pluto[19298]: packet from 10.12.62.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] meth=107, but already using method 109 Jul 27 22:35:22 tk-r4k pluto[19298]: packet from 10.12.62.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00] Jul 27 22:35:22 tk-r4k pluto[19298]: packet from 10.12.62.1:500: received Vendor ID payload [Dead Peer Detection] Jul 27 22:35:22 tk-r4k pluto[19298]: "Arch2Net" #8: responding to Main Mode Jul 27 22:35:22 tk-r4k pluto[19298]: "Arch2Net" #8: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1 Jul 27 22:35:22 tk-r4k pluto[19298]: "Arch2Net" #8: STATE_MAIN_R1: sent MR1, expecting MI2 Jul 27 22:35:22 tk-r4k pluto[19298]: "Arch2Net" #8: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): no NAT detected Jul 27 22:35:22 tk-r4k pluto[19298]: "Arch2Net" #8: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2 Jul 27 22:35:22 tk-r4k pluto[19298]: "Arch2Net" #8: STATE_MAIN_R2: sent MR2, expecting MI3 Jul 27 22:35:22 tk-r4k pluto[19298]: "Arch2Net" #8: Main mode peer ID is ID_DER_ASN1_DN: 'C=IE, O=tk-on.net, CN=ipcop.tk-on.net' Jul 27 22:35:22 tk-r4k pluto[19298]: "Arch2Net" #8: crl update for "C=IE, O=tk-on.net, CN=tk-on.net CA, E=tomk@runbox.com" is overdue since Oct 13 22:54:39 UTC 2004 Jul 27 22:35:22 tk-r4k pluto[19298]: "Arch2Net" #8: no suitable connection for peer 'C=IE, O=tk-on.net, CN=ipcop.tk-on.net' Jul 27 22:35:22 tk-r4k pluto[19298]: "Arch2Net" #8: sending encrypted notification INVALID_ID_INFORMATION to 10.12.62.1:500 + _________________________ date + date Sun Jul 27 22:35:26 IST 2008