<p><span style="font-size: 11pt; color: rgb(31, 73, 125);">Thanks much for quick feedback. </span></p>
<p><span style="font-size: 11pt; color: rgb(31, 73, 125);">Could you please suggest whether you plan to take this in
main-stream? Do you advise me to post a bug at: <a href="http://bugs.openswan.org/" target="_blank">bugs.openswan.org</a>?</span></p>
<p><span style="font-size: 11pt; color: rgb(31, 73, 125);">Thanks and Regards,</span></p>-hiren<br><br><div class="gmail_quote">On Tue, Mar 11, 2008 at 10:04 PM, Paul Wouters <<a href="mailto:paul@xelerance.com">paul@xelerance.com</a>> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">On Tue, 11 Mar 2008, hiren joshi wrote:<br>
<br>
It looks like the right fix, but we havent had time to fully evaluate<br>
it and apply it to our trees.<br>
<br>
Paul<br>
<br>
> Date: Tue, 11 Mar 2008 20:04:18 +0530<br>
> From: hiren joshi <<a href="mailto:joshihirenn@gmail.com">joshihirenn@gmail.com</a>><br>
> To: <<a href="mailto:dev@openswan.org">dev@openswan.org</a>><br>
> Subject: Re: [Openswan dev] kernel Oops<br>
<div><div></div><div class="Wj3C7c">><br>
> Hello All,<br>
><br>
> A quick reply would be of great help.<br>
><br>
> Thanks for your valuable time.<br>
><br>
> Regards,<br>
><br>
> -hiren<br>
><br>
><br>
> On Thu, Mar 6, 2008 at 8:44 PM, hiren joshi <<a href="mailto:joshihirenn@gmail.com">joshihirenn@gmail.com</a>> wrote:<br>
><br>
> > Hello All,<br>
> ><br>
> > Doing an Root Cause Analysis of the problem, I have concluded that when<br>
> > ipsec_sa_wipe() is called on existing ipsec_sa, it generates Oops.<br>
> ><br>
> > Is this a known issue? Could someone please help me with the solution?<br>
> ><br>
> > I am giving below all details including testbed setup used to prove the<br>
> > issue, detailed logs (klips-debug), work-around patch in ipsec.ko(linux/net/ipsec/pfkey_v2_parser.c).<br>
> ><br>
> > Thanks in advance.<br>
> ><br>
> > I am posting the details here.<br>
> ><br>
> > ------------------------ Details start here ---------------------------<br>
> ><br>
> ><br>
> > Analyzing the debug mode logs in /var/log/messages, I found that<br>
> > following lines appear each time when there is an Oops.<br>
> ><br>
> > 125934-Feb 22 21:19:29 1203695369 kernel: klips_debug:pfkey_add_parse:<br>
> > found an old ipsec_sa for <a href="mailto:SAesp.2000010@122.166.6.233">SAesp.2000010@122.166.6.233</a>, delete it first.<br>
> > 125935-Feb 22 21:19:29 1203695369 kernel:<br>
> > klips_debug:pfkey_msg_interp: message parsing failed with error -17.<br>
> > 125936-Feb 22 21:19:29 1203695369 kernel: klips_debug:ipsec_sa_wipe:<br>
> > removing SA=esp.2000010@122.166.6.233(0pc0eac000), SAref=57,<br>
> > table=0(0pde993000), entry=57 from the refTable.<br>
> > 125937-Feb 22 21:19:29 1203695369 kernel: klips_debug:ipsec_sa_put:<br>
> > ipsec_sa SA:<a href="mailto:esp.2000010@122.166.6.233">esp.2000010@122.166.6.233</a>, ref:-1 reference count decremented.<br>
> > 125938-Feb 22 21:19:29 1203695369 kernel: Unable to handle kernel NULL<br>
> > pointer dereference at virtual address 00000010<br>
> ><br>
> > From above - I inferred that when ipsec_sa_wipe() is called on<br>
> > existing ipsec_sa, it generates Oops. To prove the inference, I tried to<br>
> > regenerate the same in my testbed setup.<br>
> > The testbed setup:<br>
> ><br>
> > left PC ipsec gw-left<br>
> > router ipsec gw-right right PC<br>
> > | <a href="http://192.168.1.2" target="_blank">192.168.1.2</a> | ---- | <a href="http://192.168.1.1" target="_blank">192.168.1.1</a> & <a href="http://172.16.1.2" target="_blank">172.16.1.2</a> | ---- | <a href="http://172.16.1.1" target="_blank">172.16.1.1</a><br>
> > & <a href="http://172.16.2.1" target="_blank">172.16.2.1</a> | ---- | <a href="http://172.16.2.2" target="_blank">172.16.2.2</a> & <a href="http://192.168.2.1" target="_blank">192.168.2.1</a> | ---- | <a href="http://192.168.2.2" target="_blank">192.168.2.2</a> |<br>
> ><br>
> > A simple tunnel with preshared key protecting left PC and right PC<br>
> > created. Here is the output of `ipsec spi`<br>
> ><br>
> > [root@manage ipsec]# ipsec spi<br>
</div></div>> > <a href="mailto:esp0xcc561bf3@172.16.2.2">esp0xcc561bf3@172.16.2.2</a> ESP_3DES_HMAC_MD5: dir=out src=172.16.1.2iv_bits=64bits iv=0xfe99b0b8a1fdc2d5 ooowin=64 alen=128 aklen=128 eklen=192<br>
<div class="Ih2E3d">> > life(c,s,h)=addtime(15,0,0) natencap=none natsport=0 natdport=0 refcount=4<br>
> > ref=13 reftable=0 refentry=13<br>
> ><br>
> > <An SA having same SPI as above will be added manually><br>
</div>> > <a href="mailto:esp0x315597b4@172.16.1.2">esp0x315597b4@172.16.1.2</a> ESP_3DES_HMAC_MD5: dir=in src=172.16.2.2iv_bits=64bits iv=0x74b7ebf27d990ab4 ooowin=64 alen=128 aklen=128 eklen=192<br>
<div class="Ih2E3d">> > life(c,s,h)=addtime(28,0,0) natencap=none natsport=0 natdport=0 refcount=4<br>
> > ref=8 reftable=0 refentry=8<br>
</div>> > <a href="mailto:tun0x1002@172.16.2.2">tun0x1002@172.16.2.2</a> IPIP: dir=out src=172.16.1.2life(c,s,h)=addtime(17,0,0) natencap=none natsport=0 natdport=0 refcount=4<br>
<div><div></div><div class="Wj3C7c">> > ref=12 reftable=0 refentry=12<br>
> > <a href="mailto:tun0x1001@172.16.1.2">tun0x1001@172.16.1.2</a> IPIP: dir=in src=<a href="http://172.16.2.2" target="_blank">172.16.2.2</a> policy=<br>
> > <a href="http://192.168.2.2/32-" target="_blank">192.168.2.2/32-</a>><a href="http://192.168.1.2/32" target="_blank">192.168.1.2/32</a> flags=0x8<> life(c,s,h)=addtime(29,0,0)<br>
> > natencap=none natsport=0 natdport=0 refcount=4 ref=7 reftable=0 refentry=7<br>
> ><br>
> > To regenerate the Oops, I added an SA that was already there in the<br>
> > database <Please reffere to the same mark above>.<br>
> ><br>
> ><br>
> > [root@manage ipsec]# ipsec spi --af inet --edst <a href="http://172.16.2.2" target="_blank">172.16.2.2</a> --spi<br>
> > 0xcc561bf3 --proto esp --src <a href="http://172.16.1.2" target="_blank">172.16.1.2</a> --esp 3des-md5-96 --enckey<br>
> > 0x123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012<br>
> > --authkey<br>
> > 0x123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012<br>
> > Segmentation fault<br>
> ><br>
> > /var/log/messages:<br>
> ><br>
> > Feb 24 21:55:50 1203870350 kernel: klips_debug:pfkey_sa_process: .<br>
> > Feb 24 21:55:50 1203870350 kernel: klips_debug: ipsec_alg_sa_init()<br>
> > :entering for encalg=3, authalg=2<br>
> > Feb 24 21:55:50 1203870350 kernel: klips_debug: ipsec_alg_sa_init()<br>
> > :found ipsec_alg (ixt_e=c7bbc624) for encalg=3<br>
> > Feb 24 21:55:50 1203870350 kernel: klips_debug:pfkey_msg_interp:<br>
> > processing ext 5 0pc1eab228 with processor 0pc7b89540.<br>
> > Feb 24 21:55:50 1203870350 kernel: klips_debug:pfkey_address_process:<br>
> > Feb 24 21:55:50 1203870350 kernel: klips_debug:pfkey_address_process:<br>
> > found address family=2, AF_INET, <a href="http://172.16.1.2" target="_blank">172.16.1.2</a>.<br>
> > Feb 24 21:55:50 1203870350 kernel: klips_debug:pfkey_address_process:<br>
> > found src address.<br>
> > Feb 24 21:55:50 1203870350 kernel: klips_debug:pfkey_address_process:<br>
> > allocating 16 bytes for saddr.<br>
> > Feb 24 21:55:50 1203870350 kernel: klips_debug:pfkey_address_process:<br>
> > successful.<br>
> > Feb 24 21:55:50 1203870350 kernel: klips_debug:pfkey_msg_interp:<br>
> > processing ext 6 0pc1eab240 with processor 0pc7b89540.<br>
> > Feb 24 21:55:50 1203870350 kernel: klips_debug:pfkey_address_process:<br>
> > Feb 24 21:55:50 1203870350 kernel: klips_debug:pfkey_address_process:<br>
> > found address family=2, AF_INET, <a href="http://172.16.2.2" target="_blank">172.16.2.2</a>.<br>
> > Feb 24 21:55:50 1203870350 kernel: klips_debug:pfkey_address_process:<br>
> > found dst address.<br>
> > Feb 24 21:55:50 1203870350 kernel: klips_debug:pfkey_address_process:<br>
> > allocating 16 bytes for saddr.<br>
> > Feb 24 21:55:50 1203870350 kernel: klips_debug:pfkey_address_process:<br>
> > ips_said.dst set to <a href="http://172.16.2.2" target="_blank">172.16.2.2</a>.<br>
> > Feb 24 21:55:50 1203870350 kernel: klips_debug:pfkey_address_process:<br>
> > successful.<br>
> > Feb 24 21:55:50 1203870350 kernel: klips_debug:pfkey_msg_interp:<br>
> > processing ext 8 0pc1eab258 with processor 0pc7b89b00.<br>
> > Feb 24 21:55:50 1203870350 kernel: klips_debug:pfkey_key_process: .<br>
> > Feb 24 21:55:50 1203870350 kernel: klips_debug:pfkey_key_process:<br>
> > allocating 96 bytes for authkey.<br>
> > Feb 24 21:55:50 1203870350 kernel: klips_debug:pfkey_key_process:<br>
> > success.<br>
> > Feb 24 21:55:50 1203870350 kernel: klips_debug:pfkey_msg_interp:<br>
> > processing ext 9 0pc1eab2c0 with processor 0pc7b89b00.<br>
> > Feb 24 21:55:50 1203870350 kernel: klips_debug:pfkey_key_process: .<br>
> > Feb 24 21:55:50 1203870350 kernel: klips_debug:pfkey_key_process:<br>
> > allocating 96 bytes for enckey.<br>
> > Feb 24 21:55:50 1203870350 kernel: klips_debug:pfkey_key_process:<br>
> > success.<br>
> > Feb 24 21:55:50 1203870350 kernel: klips_debug:pfkey_msg_interp:<br>
> > parsing message type 3(add) with msg_parser 0pc7b84b60.<br>
> > Feb 24 21:55:50 1203870350 kernel: klips_debug:pfkey_add_parse: .<br>
> > Feb 24 21:55:50 1203870350 kernel: klips_debug:ipsec_sa_getbyid:<br>
> > linked entry in ipsec_sa table for hash=108 of SA:<a href="mailto:esp.cc561bf3@172.16.2.2requested">esp.cc561bf3@172.16.2.2requested</a>.<br>
> > Feb 24 21:55:50 1203870350 kernel: klips_debug:ipsec_sa_put: ipsec_sa<br>
> > SA:<a href="mailto:esp.cc561bf3@172.16.2.2">esp.cc561bf3@172.16.2.2</a>, ref:13 reference count decremented.<br>
> > Feb 24 21:55:50 1203870350 kernel: klips_debug:pfkey_add_parse: found<br>
> > an old ipsec_sa for <a href="mailto:SAesp.cc561bf3@172.16.2.2">SAesp.cc561bf3@172.16.2.2</a>, delete it first.<br>
> > Feb 24 21:55:50 1203870350 kernel: klips_debug:pfkey_msg_interp:<br>
> > message parsing failed with error -17.<br>
> > Feb 24 21:55:50 1203870350 kernel: klips_debug:ipsec_sa_wipe: removing<br>
> > SA=esp.cc561bf3@172.16.2.2(0pc5be1400), SAref=17, table=0(0pc79cf000),<br>
> > entry=17 from t<br>
> > he refTable.<br>
> > Feb 24 21:55:50 1203870350 kernel: klips_debug:ipsec_sa_put: ipsec_sa<br>
> > SA:<a href="mailto:esp.cc561bf3@172.16.2.2">esp.cc561bf3@172.16.2.2</a>, ref:-1 reference count decremented.<br>
> > Feb 24 21:55:50 1203870350 kernel: Unable to handle kernel paging<br>
> > request at virtual address 78563422<br>
> > Feb 24 21:55:50 1203870350 kernel: printing eip:<br>
> > Feb 24 21:55:50 1203870350 kernel: c01b1f1e<br>
> > Feb 24 21:55:50 1203870350 kernel: *pde = 00000000<br>
> > Feb 24 21:55:51 1203870351 kernel: Oops: 0000 [#4]<br>
> > Feb 24 21:55:51 1203870351 kernel: Modules linked in: ppp_deflate<br>
> > zlib_deflate zlib_inflate bsd_comp ip_nat_ftp ip_conntrack_ftp<br>
> > ip_conntrack_netlink<br>
> > ipsec sha512 ip_nat_h323 ip_conntrack_h323 ip_nat_irc<br>
> > ip_conntrack_irc ip_nat_pptp ip_conntrack_pptp ip_nat_tftp ip_conntrack_tftp<br>
> > sch_htb md5<br>
> > sha1 sha256 des blowfish cast5 serpent twofish aes pppoe pppox<br>
> > ppp_synctty ppp_asy nc crc_ccitt ppp_generic slhc ipt_MASQUERADE ipt_iprange<br>
> > ipt_ULOG<br>
> > imq ipt_mport ipt_status xt_pkttype ipt_REDIRECT arptable_filter<br>
> > arp_tables ipt_hashlimit xt_tcpudp ipt_unclean ipt_recent ipt_NOTRACK<br>
> > ipt_IMQ ipt_CONNMARK<br>
> > xt_state iptable_raw iptable_mangle ipt_ipp2p iptable_nat ip_nat<br>
> > ip_conntrack nfnetlink iptable_filter ip_tables x_tables e100 8021q<br>
> > Feb 24 21:55:51 1203870351 kernel: CPU: 0<br>
> > Feb 24 21:55:51 1203870351 kernel: EIP:<br>
> > 0060:[crypto_free_tfm+30/160] Not tainted VLI<br>
> > Feb 24 21:55:51 1203870351 kernel: EFLAGS: 00010286 (2.6.16.13-1#71)<br>
> > Feb 24 21:55:51 1203870351 kernel: EIP is at crypto_free_tfm+0x1e/0xa0<br>
> > Feb 24 21:55:51 1203870351 kernel: eax: c7bbc624 ebx: 78563412<br>
> > ecx: c1000000 edx: 00000000<br>
> > Feb 24 21:55:51 1203870351 kernel: esi: c57d48c0 edi: c57d48c0<br>
> > ebp: ffffffff esp: c5de1c7c<br>
> > Feb 24 21:55:51 1203870351 kernel: ds: 007b es: 007b ss: 0068<br>
> > Feb 24 21:55:51 1203870351 kernel: Process spi (pid: 19646,<br>
> > threadinfo=c5de0000 task=c15a3030)<br>
> > Feb 24 21:55:51 1203870351 kernel: Stack: <0>00000000 c5be1400<br>
> > 00000000 c57d48c0 ffffffff c7b75bf3 c57d48c0 c57d48c0<br>
> > Feb 24 21:55:51 1203870351 kernel: c5be1400 00000011 00000000<br>
> > c79cf000 00000011 2e707365 36356363 33666231<br>
> > Feb 24 21:55:51 1203870351 kernel: 32373140 2e36312e 00322e32<br>
> > c7bac060 00000048 00000246 c1eab2c0 00000000<br>
> > Feb 24 21:55:51 1203870351 kernel: Call Trace:<br>
> > Feb 24 21:55:51 1203870351 kernel: [pg0+125647859/1069925376]<br>
> > ipsec_sa_wipe+0x2c3/0x3e0 [ipsec]<br>
> > Feb 24 21:55:51 1203870351 kernel: [printk+23/32] printk+0x17/0x20<br>
> > Feb 24 21:55:51 1203870351 kernel: [pg0+125764973/1069925376]<br>
> > ipsec_alg_get+0x2d/0x50 [ipsec]<br>
> > Feb 24 21:55:51 1203870351 kernel: [printk+23/32] printk+0x17/0x20<br>
> > Feb 24 21:55:51 1203870351 kernel: [pg0+125726755/1069925376]<br>
> > pfkey_msg_interp+0x1a3/0x350 [ipsec]<br>
> > Feb 24 21:55:51 1203870351 kernel: [pg0+125709152/1069925376]<br>
> > pfkey_add_parse+0x0/0x6f0 [ipsec]<br>
> > Feb 24 21:55:51 1203870351 kernel: [pg0+125701282/1069925376]<br>
> > pfkey_sendmsg+0x192/0x4b0 [ipsec]<br>
> > Feb 24 21:55:51 1203870351 kernel: [do_sock_write+161/192]<br>
> > do_sock_write+0xa1/0xc0<br>
> > Feb 24 21:55:51 1203870351 kernel: [sock_aio_write+148/160]<br>
> > sock_aio_write+0x94/0xa0<br>
> > Feb 24 21:55:51 1203870351 kernel: [find_get_page+27/64]<br>
> > find_get_page+0x1b/0x40<br>
> > Feb 24 21:55:51 1203870351 kernel: [do_sync_write+209/288]<br>
> > do_sync_write+0xd1/0x120<br>
> > Feb 24 21:55:51 1203870351 kernel: [autoremove_wake_function+0/96]<br>
> > autoremove_wake_function+0x0/0x60<br>
> > Feb 24 21:55:51 1203870351 kernel: [vfs_write+364/384]<br>
> > vfs_write+0x16c/0x180<br>
> > Feb 24 21:55:51 1203870351 kernel: [sys_write+81/128]<br>
> > sys_write+0x51/0x80<br>
> > Feb 24 21:55:51 1203870351 kernel: [syscall_call+7/11]<br>
> > syscall_call+0x7/0xb<br>
> > Feb 24 21:55:51 1203870351 kernel: Code: ff 89 c5 e9 34 ff ff ff 90 8d<br>
> > 74 26 00 83 ec 14 89 74 24 08 8b 74 24 18 89 5c 24 04 89 7c 24 0c 85 f6 89<br>
> > 6c 24 10 74<br>
> > 69 8b 5e 28 <8b> 6b 10 89 34 24 e8 37 fe ff ff 8b 83 c0 00 00 00 83<br>
> > c5 2c 85<br>
> > Feb 24 21:55:51 1203870351 kernel: <6>klips_debug:pfkey_release:<br>
> > sock=0pc5fa2080 sk=0pc5167800<br>
> > Feb 24 21:55:51 1203870351 kernel: klips_debug:pfkey_destroy_socket:<br>
> > 0pc5167800<br>
> > Feb 24 21:55:51 1203870351 kernel: klips_debug:pfkey_remove_socket:<br>
> > 0pc5167800<br>
> > Feb 24 21:55:51 1203870351 kernel: klips_debug:pfkey_destroy_socket:<br>
> > pfkey_remove_socket called, sk=0pc5167800<br>
> > Feb 24 21:55:51 1203870351 kernel: klips_debug:pfkey_destroy_socket:<br>
> > sk(0pc5167800)->(&0pc5167854)receive_queue.{next=0pc5167854,prev=0pc5167854}.<br>
> > Feb 24 21:55:51 1203870351 kernel: klips_debug:pfkey_destroy_socket:<br>
> > destroyed.<br>
> > Feb 24 21:55:51 1203870351 kernel:<br>
> > klips_debug:pfkey_list_remove_socket: removing sock=0pc5fa2080<br>
> > Feb 24 21:55:51 1203870351 last message repeated 12 times<br>
> > Feb 24 21:55:51 1203870351 kernel: klips_debug:pfkey_release:<br>
> > succeeded.<br>
> ><br>
> > As the root cause is known and proven, finally, as a workaround, I<br>
> > patched the kernel (linux/net/ipsec/pfkey_v2_parser.c) to disable calling<br>
> > ipsec_sa_wipe() in case of existing ipsec_sa.<br>
> ><br>
> > Here is the diff:<br>
> ><br>
> > [root@kerneldev ipsec]# diff pfkey_v2_parser_OLD.c<br>
> > pfkey_v2_parser_NEW.c<br>
> > 2882c2882<br>
> > < if(extr.ips != NULL) {<br>
> > ---<br>
> > > KLIPS_PRINT(debug_pfkey,<br>
> > > "klips_debug:pfkey_msg_interp ::::: EXTRA ::::: "<br>
> > > "FINAL ERROR CODE IS: %d.\n",<br>
> > > error);<br>
> > ><br>
> > > if(extr.ips != NULL && (error != EEXIST && error != -EEXIST))<br>
> > {<br>
> > 2885c2885<br>
> > < if(extr.ips2 != NULL) {<br>
> > ---<br>
> > > if(extr.ips2 != NULL && (error != EEXIST && error != -EEXIST))<br>
> > {<br>
> ><br>
> > To prove the patchwork, I tried to regenerate the Oops:<br>
> ><br>
> > [root@manage ipsec]# ipsec spi<br>
</div></div>> > <a href="mailto:esp0x47e3e1bf@172.16.2.2">esp0x47e3e1bf@172.16.2.2</a> ESP_3DES_HMAC_MD5: dir=out src=172.16.1.2iv_bits=64bits iv=0xade7b400194850c7 ooowin=64 alen=128 aklen=128 eklen=192<br>
<div class="Ih2E3d">> > life(c,s,h)=addtime(87,0,0) natencap=none natsport=0 natdport=0 refcount=4<br>
> > ref=13 reftable=0 refentry=13<br>
> ><br>
> > <<An SA with the same SPI as above will be added manually>><br>
> ><br>
</div>> > <a href="mailto:tun0x1002@172.16.2.2">tun0x1002@172.16.2.2</a> IPIP: dir=out src=172.16.1.2life(c,s,h)=addtime(88,0,0) natencap=none natsport=0 natdport=0 refcount=4<br>
<div class="Ih2E3d">> > ref=12 reftable=0 refentry=12<br>
> > <a href="mailto:tun0x1001@172.16.1.2">tun0x1001@172.16.1.2</a> IPIP: dir=in src=<a href="http://172.16.2.2" target="_blank">172.16.2.2</a> policy=<br>
> > <a href="http://192.168.2.2/32-" target="_blank">192.168.2.2/32-</a>><a href="http://192.168.1.2/32" target="_blank">192.168.1.2/32</a> flags=0x8<> life(c,s,h)=addtime(101,0,0)<br>
> > natencap=none natsport=0 natdport=0 refcount=4 ref=7 reftable=0 refentry=7<br>
</div>> > <a href="mailto:esp0xe8bc3444@172.16.1.2">esp0xe8bc3444@172.16.1.2</a> ESP_3DES_HMAC_MD5: dir=in src=172.16.2.2iv_bits=64bits iv=0x3adeea59bb86710e ooowin=64 alen=128 aklen=128 eklen=192<br>
<div><div></div><div class="Wj3C7c">> > life(c,s,h)=addtime(100,0,0) natencap=none natsport=0 natdport=0 refcount=4<br>
> > ref=8 reftable=0 refentry=8<br>
> ><br>
> > [root@manage ipsec]# ipsec spi --af inet --edst <a href="http://172.16.2.2" target="_blank">172.16.2.2</a> --spi<br>
> > 0x47e3e1bf --proto esp --src <a href="http://172.16.1.2" target="_blank">172.16.1.2</a> --esp 3des-md5-96 --enckey<br>
> > 0x123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012<br>
> > --authkey<br>
> > 0x123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012<br>
> > /usr/libexec/ipsec/spi: pfkey write failed (errno=17): SA already in<br>
> > use. Delete old one first.<br>
> ><br>
> > /var/log/messages:<br>
> ><br>
> > Feb 24 22:07:28 1203871048 kernel: klips_debug:pfkey_create:<br>
> > sock=0pc5a4a200 type:3 state:1 flags:0 protocol:2<br>
> > Feb 24 22:07:29 1203871049 kernel: klips_debug:pfkey_create:<br>
> > sock->fasync_list=0p00000000 sk->sleep=0pc5a4a218.<br>
> > Feb 24 22:07:29 1203871049 kernel: klips_debug:pfkey_insert_socket:<br>
> > sk=0pc5554000<br>
> > Feb 24 22:07:29 1203871049 kernel:<br>
> > klips_debug:pfkey_list_insert_socket: allocating 8 bytes for<br>
> > socketp=0pc5a4a200<br>
> > Feb 24 22:07:29 1203871049 kernel: klips_debug:pfkey_create: Socket<br>
> > sock=0pc5a4a200 sk=0pc5554000 initialised.<br>
> > Feb 24 22:07:29 1203871049 kernel: klips_debug:pfkey_sendmsg: .<br>
> > Feb 24 22:07:29 1203871049 kernel: klips_debug:pfkey_sendmsg:<br>
> > allocating 296 bytes for downward message.<br>
> > Feb 24 22:07:29 1203871049 kernel: klips_debug:pfkey_sendmsg: msg sent<br>
> > for parsing.<br>
> > Feb 24 22:07:29 1203871049 kernel: klips_debug:pfkey_msg_interp:<br>
> > parsing message ver=2, type=3, errno=0, satype=3(ESP), len=37, res=0, seq=1,<br>
> > pid=22344.<br>
> > Feb 24 22:07:29 1203871049 kernel: klips_debug:ipsec_SAref_alloc:<br>
> > SAref requested... head=17, cont=256, tail=255, listsize=256.<br>
> > Feb 24 22:07:29 1203871049 kernel: klips_debug:ipsec_SAref_alloc:<br>
> > allocating SAref=17, table=0, entry=17 of 65536.<br>
> > Feb 24 22:07:29 1203871049 kernel: klips_debug:ipsec_sa_alloc:<br>
> > allocated 532 bytes for ipsec_sa struct=0pc1273c00 ref=17.<br>
> > Feb 24 22:07:29 1203871049 kernel: klips_debug:pfkey_msg_interp:<br>
> > allocated extr->ips=0pc1273c00.<br>
> > Feb 24 22:07:29 1203871049 kernel: klips_debug:pfkey_msg_interp:<br>
> > satype 3 lookups to proto=50.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_msg_parse:<br>
> > parsing message ver=2, type=3(add), errno=0, satype=3(ESP), len=37, res=0,<br>
> > seq=1, pid=22344.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_msg_parse: satype<br>
> > 3(ESP) conversion to proto gives 50 for msg_type 3(add).<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_msg_parse:<br>
> > remain=35<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_msg_parse:<br>
> > extensions permitted=78001ffb, required=00000063.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_msg_parse:<br>
> > parsing ext type=1(security-association) remain=35.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_msg_parse:<br>
> > remain=35 ext_type=1(security-association) ext_len=3 parsing ext 0pc1c4c010<br>
> > with parser pfkey_sa_parse.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_sa_parse:<br>
> > successfully found len=3 exttype=1(security-association) spi=47e3e1bf<br>
> > replay=0 state=1 auth=2 encrypt=3 flags=0 ref=-1.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_msg_parse:<br>
> > Extension 1(security-association) parsed.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_msg_parse:<br>
> > parsing ext type=5(source-address) remain=32.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_msg_parse:<br>
> > remain=32 ext_type=5(source-address) ext_len=3 parsing ext 0pc1c4c028 with<br>
> > parser pfkey_address_parse.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_address_parse:<br>
</div></div>> > found exttype=5(source-address) family=2(AF_INET) address=172.16.1.2proto=0 port=0.<br>
<div class="Ih2E3d">> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_address_parse:<br>
> > successful.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_msg_parse:<br>
> > Extension 5(source-address) parsed.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_msg_parse:<br>
> > parsing ext type=6(destination-address) remain=29.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_msg_parse:<br>
> > remain=29 ext_type=6(destination-address) ext_len=3 parsing ext 0pc1c4c040<br>
> > with parser pfkey_address_parse.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_address_parse:<br>
</div>> > found exttype=6(destination-address) family=2(AF_INET) address=172.16.2.2proto=0 port=0.<br>
<div><div></div><div class="Wj3C7c">> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_address_parse:<br>
> > successful.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_msg_parse:<br>
> > Extension 6(destination-address) parsed.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_msg_parse:<br>
> > parsing ext type=8(authentication-key) remain=26.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_msg_parse:<br>
> > remain=26 ext_type=8(authentication-key) ext_len=13 parsing ext 0pc1c4c058<br>
> > with parser pfkey_key_parse.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_key_parse:<br>
> > success, found len=13 exttype=8(authentication-key) bits=768 reserved=0.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_msg_parse:<br>
> > Extension 8(authentication-key) parsed.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_msg_parse:<br>
> > parsing ext type=9(cipher-key) remain=13.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_msg_parse:<br>
> > remain=13 ext_type=9(cipher-key) ext_len=13 parsing ext 0pc1c4c0c0 with<br>
> > parser pfkey_key_parse.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_key_parse:<br>
> > success, found len=13 exttype=9(cipher-key) bits=768 reserved=0.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_msg_parse:<br>
> > Extension 9(cipher-key) parsed.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_msg_parse:<br>
> > extensions permitted=78001ffb, seen=00000363, required=00000063.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_msg_interp:<br>
> > processing ext 1 0pc1c4c010 with processor 0pc7b89220.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_sa_process: .<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug: ipsec_alg_sa_init()<br>
> > :entering for encalg=3, authalg=2<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug: ipsec_alg_sa_init()<br>
> > :found ipsec_alg (ixt_e=c7bbc6c4) for encalg=3<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_msg_interp:<br>
> > processing ext 5 0pc1c4c028 with processor 0pc7b89590.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_address_process:<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_address_process:<br>
> > found address family=2, AF_INET, <a href="http://172.16.1.2" target="_blank">172.16.1.2</a>.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_address_process:<br>
> > found src address.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_address_process:<br>
> > allocating 16 bytes for saddr.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_address_process:<br>
> > successful.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_msg_interp:<br>
> > processing ext 6 0pc1c4c040 with processor 0pc7b89590.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_address_process:<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_address_process:<br>
> > found address family=2, AF_INET, <a href="http://172.16.2.2" target="_blank">172.16.2.2</a>.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_address_process:<br>
> > found dst address.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_address_process:<br>
> > allocating 16 bytes for saddr.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_address_process:<br>
> > ips_said.dst set to <a href="http://172.16.2.2" target="_blank">172.16.2.2</a>.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_address_process:<br>
> > successful.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_msg_interp:<br>
> > processing ext 8 0pc1c4c058 with processor 0pc7b89b50.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_key_process: .<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_key_process:<br>
> > allocating 96 bytes for authkey.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_key_process:<br>
> > success.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_msg_interp:<br>
> > processing ext 9 0pc1c4c0c0 with processor 0pc7b89b50.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_key_process: .<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_key_process:<br>
> > allocating 96 bytes for enckey.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_key_process:<br>
> > success.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_msg_interp:<br>
> > parsing message type 3(add) with msg_parser 0pc7b84b60.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_add_parse: .<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:ipsec_sa_getbyid:<br>
> > linked entry in ipsec_sa table for hash=84 of SA:<a href="mailto:esp.47e3e1bf@172.16.2.2requested">esp.47e3e1bf@172.16.2.2requested</a>.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:ipsec_sa_put: ipsec_sa<br>
> > SA:<a href="mailto:esp.47e3e1bf@172.16.2.2">esp.47e3e1bf@172.16.2.2</a>, ref:13 reference count decremented.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_add_parse: found<br>
> > an old ipsec_sa for <a href="mailto:SAesp.47e3e1bf@172.16.2.2">SAesp.47e3e1bf@172.16.2.2</a>, delete it first.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_msg_interp:<br>
> > message parsing failed with error -17.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_msg_interp :::::<br>
> > EXTRA ::::: FINAL ERROR CODE IS: -17.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_sendmsg:<br>
> > pfkey_msg_parse returns -17.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_sendmsg: sending<br>
> > up error=-17 message=0pc6187220 to socket=0pc5a4a200.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_upmsg: allocating<br>
> > 16 bytes...<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_upmsg:<br>
> > ...allocated at 0pc5990380.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_sendmsg: sending<br>
> > up error message to socket=0pc5a4a200 succeeded.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_sendmsg: sending<br>
> > up error=-17 message=0pc6187220 to socket=0pc24c8800.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_upmsg: allocating<br>
> > 16 bytes...<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_upmsg:<br>
> > ...allocated at 0pc30b3780.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_sendmsg: sending<br>
> > up error message to socket=0pc24c8800 succeeded.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_release:<br>
> > sock=0pc5a4a200 sk=0pc5554000<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_destroy_socket:<br>
> > 0pc5554000<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_remove_socket:<br>
> > 0pc5554000<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_destroy_socket:<br>
> > pfkey_remove_socket called, sk=0pc5554000<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_destroy_socket:<br>
> > sk(0pc5554000)->(&0pc5554054)receive_queue.{next=0pc5990380,prev=0pc5990380}.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_destroy_socket:<br>
> > skb=0pc5990380 freed.<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_destroy_socket:<br>
> > destroyed.<br>
> > Feb 24 22:07:30 1203871050 kernel:<br>
> > klips_debug:pfkey_list_remove_socket: removing sock=0pc5a4a200<br>
> > Feb 24 22:07:30 1203871050 last message repeated 12 times<br>
> > Feb 24 22:07:30 1203871050 kernel: klips_debug:pfkey_release:<br>
> > succeeded.<br>
> ><br>
> > This is just a work-around and can have side-effects. I observed<br>
> > following logs in /var/log/secure which I am not sure whether they are<br>
> > result of the patch I did:<br>
> > Mar 06 09:49:07 1204777147 pluto[14814]: packet from<br>
> > <a href="http://122.167.236.87:500" target="_blank">122.167.236.87:500</a>: Quick Mode message is for a non-existent (expired?)<br>
> > ISAKMP SA<br>
> ><br>
> > I am not aware of the actual code-flow. Request help for a solution on<br>
> > this. A quick reply would be of great help.<br>
> ><br>
> > ------------------------ Details end here ---------------------------<br>
> ><br>
> ><br>
> > On Wed, Mar 5, 2008 at 2:38 PM, hiren joshi <<a href="mailto:joshihirenn@gmail.com">joshihirenn@gmail.com</a>> wrote:<br>
> ><br>
> > > barf available on request.<br>
> > ><br>
> > > Thanks.<br>
> > ><br>
> > ><br>
> > > On Wed, Mar 5, 2008 at 2:33 PM, hiren joshi <<a href="mailto:joshihirenn@gmail.com">joshihirenn@gmail.com</a>><br>
> > > wrote:<br>
> > ><br>
> > > ><br>
> > > ><br>
> > > > On Tue, Feb 26, 2008 at 8:20 PM, hiren joshi <<a href="mailto:joshihirenn@gmail.com">joshihirenn@gmail.com</a>><br>
> > > > wrote:<br>
> > > ><br>
> > > > > uploading debug mode logs:<br>
> > > > ><br>
> > > > > KLIPS - /var/log/messages:<br>
> > > > ><br>
> > > > > 125894-Feb 22 21:19:29 1203695369 kernel:<br>
> > > > > klips_debug:pfkey_address_parse: successful.<br>
> > > > > 125895-Feb 22 21:19:29 1203695369 kernel:<br>
> > > > > klips_debug:pfkey_msg_parse: Extension 6(destination-address) parsed.<br>
> > > > > 125896-Feb 22 21:19:29 1203695369 kernel:<br>
> > > > > klips_debug:pfkey_msg_parse: parsing ext type=8(authentication-key)<br>
> > > > > remain=7.<br>
> > > > > 125897-Feb 22 21:19:29 1203695369 kernel:<br>
> > > > > klips_debug:pfkey_msg_parse: remain=7 ext_type=8(authentication-key)<br>
> > > > > ext_len=3 parsing ext 0pdde3b2b8 with parser pfkey_key_parse.<br>
> > > > > 125898-Feb 22 21:19:29 1203695369 kernel:<br>
> > > > > klips_debug:pfkey_key_parse: success, found len=3<br>
> > > > > exttype=8(authentication-key) bits=128 reserved=0.<br>
> > > > > 125899-Feb 22 21:19:29 1203695369 kernel:<br>
> > > > > klips_debug:pfkey_msg_parse: Extension 8(authentication-key) parsed.<br>
> > > > > 125900-Feb 22 21:19:29 1203695369 kernel:<br>
> > > > > klips_debug:pfkey_msg_parse: parsing ext type=9(cipher-key) remain=4.<br>
> > > > > 125901-Feb 22 21:19:29 1203695369 kernel:<br>
> > > > > klips_debug:pfkey_msg_parse: remain=4 ext_type=9(cipher-key) ext_len=4<br>
> > > > > parsing ext 0pdde3b2d0 with parser pfkey_key_parse.<br>
> > > > > 125902-Feb 22 21:19:29 1203695369 kernel:<br>
> > > > > klips_debug:pfkey_key_parse: success, found len=4 exttype=9(cipher-key)<br>
> > > > > bits=192 reserved=0.<br>
> > > > > 125903-Feb 22 21:19:29 1203695369 kernel:<br>
> > > > > klips_debug:pfkey_msg_parse: Extension 9(cipher-key) parsed.<br>
> > > > > 125904-Feb 22 21:19:29 1203695369 kernel:<br>
> > > > > klips_debug:pfkey_msg_parse: extensions permitted=78001ffb, seen=00000363,<br>
> > > > > required=00000063.<br>
> > > > > 125905-Feb 22 21:19:29 1203695369 kernel:<br>
> > > > > klips_debug:pfkey_msg_interp: processing ext 1 0pdde3b270 with processor<br>
> > > > > 0pdf237390.<br>
> > > > > 125906-Feb 22 21:19:29 1203695369 kernel:<br>
> > > > > klips_debug:pfkey_sa_process: .<br>
> > > > > 125907-Feb 22 21:19:29 1203695369 kernel: klips_debug:<br>
> > > > > ipsec_alg_sa_init() :entering for encalg=3, authalg=2<br>
> > > > > 125908-Feb 22 21:19:29 1203695369 kernel: klips_debug:<br>
> > > > > ipsec_alg_sa_init() :found ipsec_alg (ixt_e=df26aa04) for encalg=3<br>
> > > > > 125909-Feb 22 21:19:29 1203695369 kernel:<br>
> > > > > klips_debug:pfkey_msg_interp: processing ext 5 0pdde3b288 with processor<br>
> > > > > 0pdf237700.<br>
> > > > > 125910-Feb 22 21:19:29 1203695369 kernel:<br>
> > > > > klips_debug:pfkey_address_process:<br>
> > > > > 125911-Feb 22 21:19:29 1203695369 kernel:<br>
> > > > > klips_debug:pfkey_address_process: found address family=2, AF_INET,<br>
> > > > > <a href="http://122.166.6.187" target="_blank">122.166.6.187</a>.<br>
> > > > > 125912-Feb 22 21:19:29 1203695369 kernel:<br>
> > > > > klips_debug:pfkey_address_process: found src address.<br>
> > > > > 125913-Feb 22 21:19:29 1203695369 kernel:<br>
> > > > > klips_debug:pfkey_address_process: allocating 16 bytes for saddr.<br>
> > > > > 125914-Feb 22 21:19:29 1203695369 kernel:<br>
> > > > > klips_debug:pfkey_address_process: successful.<br>
> > > > > 125915-Feb 22 21:19:29 1203695369 kernel:<br>
> > > > > klips_debug:pfkey_msg_interp: processing ext 6 0pdde3b2a0 with processor<br>
> > > > > 0pdf237700.<br>
> > > > > 125916-Feb 22 21:19:29 1203695369 kernel:<br>
> > > > > klips_debug:pfkey_address_process:<br>
> > > > > 125917-Feb 22 21:19:29 1203695369 kernel:<br>
> > > > > klips_debug:pfkey_address_process: found address family=2, AF_INET,<br>
> > > > > <a href="http://122.166.6.233" target="_blank">122.166.6.233</a>.<br>
> > > > > 125918-Feb 22 21:19:29 1203695369 kernel:<br>
> > > > > klips_debug:pfkey_address_process: found dst address.<br>
> > > > > 125919-Feb 22 21:19:29 1203695369 kernel:<br>
> > > > > klips_debug:pfkey_address_process: allocating 16 bytes for saddr.<br>
> > > > > 125920-Feb 22 21:19:29 1203695369 kernel:<br>
> > > > > klips_debug:pfkey_address_process: ips_said.dst set to <a href="http://122.166.6.233" target="_blank">122.166.6.233</a>.<br>
> > > > ><br>
> > > > > 125921-Feb 22 21:19:29 1203695369 kernel:<br>
> > > > > klips_debug:pfkey_address_process: successful.<br>
> > > > > 125922-Feb 22 21:19:29 1203695369 kernel:<br>
> > > > > klips_debug:pfkey_msg_interp: processing ext 8 0pdde3b2b8 with processor<br>
> > > > > 0pdf237cc0.<br>
> > > > > 125923-Feb 22 21:19:29 1203695369 kernel:<br>
> > > > > klips_debug:pfkey_key_process: .<br>
> > > > > 125924-Feb 22 21:19:29 1203695369 kernel:<br>
> > > > > klips_debug:pfkey_key_process: allocating 16 bytes for authkey.<br>
> > > > > 125925-Feb 22 21:19:29 1203695369 kernel:<br>
> > > > > klips_debug:pfkey_key_process: success.<br>
> > > > > 125926-Feb 22 21:19:29 1203695369 kernel:<br>
> > > > > klips_debug:pfkey_msg_interp: processing ext 9 0pdde3b2d0 with processor<br>
> > > > > 0pdf237cc0.<br>
> > > > > 125927-Feb 22 21:19:29 1203695369 kernel:<br>
> > > > > klips_debug:pfkey_key_process: .<br>
> > > > > 125928-Feb 22 21:19:29 1203695369 kernel:<br>
> > > > > klips_debug:pfkey_key_process: allocating 24 bytes for enckey.<br>
> > > > > 125929-Feb 22 21:19:29 1203695369 kernel:<br>
> > > > > klips_debug:pfkey_key_process: success.<br>
> > > > > 125930-Feb 22 21:19:29 1203695369 kernel:<br>
> > > > > klips_debug:pfkey_msg_interp: parsing message type 3(add) with msg_parser<br>
> > > > > 0pdf232ce0.<br>
> > > > > 125931-Feb 22 21:19:29 1203695369 kernel:<br>
> > > > > klips_debug:pfkey_add_parse: .<br>
> > > > > 125932-Feb 22 21:19:29 1203695369 kernel:<br>
> > > > > klips_debug:ipsec_sa_getbyid: linked entry in ipsec_sa table for hash=22 of<br>
> > > > > SA:<a href="mailto:esp.2000010@122.166.6.233">esp.2000010@122.166.6.233</a> requested.<br>
> > > > > 125933-Feb 22 21:19:29 1203695369 kernel: klips_debug:ipsec_sa_put:<br>
> > > > > ipsec_sa SA:<a href="mailto:esp.2000010@122.166.6.233">esp.2000010@122.166.6.233</a>, ref:33 reference count<br>
> > > > > decremented.<br>
> > > > > 125934-Feb 22 21:19:29 1203695369 kernel:<br>
> > > > > klips_debug:pfkey_add_parse: found an old ipsec_sa for<br>
> > > > > <a href="mailto:SAesp.2000010@122.166.6.233">SAesp.2000010@122.166.6.233</a>, delete it first.<br>
> > > > > 125935-Feb 22 21:19:29 1203695369 kernel:<br>
> > > > > klips_debug:pfkey_msg_interp: message parsing failed with error -17.<br>
> > > > > 125936-Feb 22 21:19:29 1203695369 kernel: klips_debug:ipsec_sa_wipe:<br>
> > > > > removing SA=esp.2000010@122.166.6.233(0pc0eac000), SAref=57,<br>
> > > > > table=0(0pde993000), entry=57 from the refTable.<br>
> > > > > 125937-Feb 22 21:19:29 1203695369 kernel: klips_debug:ipsec_sa_put:<br>
> > > > > ipsec_sa SA:<a href="mailto:esp.2000010@122.166.6.233">esp.2000010@122.166.6.233</a>, ref:-1 reference count<br>
> > > > > decremented.<br>
> > > > > 125938-Feb 22 21:19:29 1203695369 kernel: Unable to handle kernel<br>
> > > > > NULL pointer dereference at virtual address 00000010<br>
> > > > > 125939-Feb 22 21:19:29 1203695369 kernel: printing eip:<br>
> > > > > 125940-Feb 22 21:19:29 1203695369 kernel: c01bfafe<br>
> > > > > 125941-Feb 22 21:19:29 1203695369 kernel: *pde = 00000000<br>
> > > > > 125942:Feb 22 21:19:29 1203695369 kernel: Oops: 0000 [#1]<br>
> > > > ><br>
> > > > > pluto (/var/log/secure):<br>
> > > > ><br>
> > > > > 10643648-Feb 22 21:19:26 1203695366 pluto[9041]: |<br>
> > > > > pfkey_lib_debug:pfkey_key_build:<br>
> > > > > 10643649-Feb 22 21:19:26 1203695366 pluto[9041]: |<br>
> > > > > pfkey_lib_debug:pfkey_msg_build: pfkey_msg=0p0x814bad8 allocated 144 bytes,<br>
> > > > > &(extensions[0])=0p0xbf8324d0<br>
> > > > > 10643650-Feb 22 21:19:26 1203695366 pluto[9041]: |<br>
> > > > > pfkey_lib_debug:pfkey_msg_build: copying 24 bytes from extensions[1]<br>
> > > > > (type=1)<br>
> > > > > 10643651-Feb 22 21:19:26 1203695366 pluto[9041]: |<br>
> > > > > pfkey_lib_debug:pfkey_msg_build: copying 24 bytes from extensions[5]<br>
> > > > > (type=5)<br>
> > > > > 10643652-Feb 22 21:19:26 1203695366 pluto[9041]: |<br>
> > > > > pfkey_lib_debug:pfkey_msg_build: copying 24 bytes from extensions[6]<br>
> > > > > (type=6)<br>
> > > > > 10643653-Feb 22 21:19:26 1203695366 pluto[9041]: |<br>
> > > > > pfkey_lib_debug:pfkey_msg_build: copying 24 bytes from extensions[8]<br>
> > > > > (type=8)<br>
> > > > > 10643654-Feb 22 21:19:26 1203695366 pluto[9041]: |<br>
> > > > > pfkey_lib_debug:pfkey_msg_build: copying 32 bytes from extensions[9]<br>
> > > > > (type=9)<br>
> > > > > 10643655-Feb 22 21:19:26 1203695366 pluto[9041]: |<br>
> > > > > pfkey_lib_debug:pfkey_msg_build: extensions permitted=78001ffb,<br>
> > > > > seen=00000363, required=00000063.<br>
> > > > > 10643656-Feb 22 21:19:26 1203695366 pluto[9041]: |<br>
> > > > > pfkey_lib_debug:pfkey_msg_parse: parsing message ver=2, type=3(add),<br>
> > > > > errno=0, satype=3(ESP), len=18, res=0, seq=46, pid=9041.<br>
> > > > > 10643657-Feb 22 21:19:26 1203695366 pluto[9041]: |<br>
> > > > > pfkey_lib_debug:pfkey_msg_parse: satype 3(ESP) conversion to proto gives 50<br>
> > > > > for msg_type 3(add).<br>
> > > > > 10643658-Feb 22 21:19:26 1203695366 pluto[9041]: |<br>
> > > > > pfkey_lib_debug:pfkey_msg_parse: remain=16<br>
> > > > > 10643659-Feb 22 21:19:26 1203695366 pluto[9041]: |<br>
> > > > > pfkey_lib_debug:pfkey_msg_parse: extensions permitted=78001ffb,<br>
> > > > > required=00000063.<br>
> > > > > 10643660-Feb 22 21:19:26 1203695366 pluto[9041]: |<br>
> > > > > pfkey_lib_debug:pfkey_msg_parse: parsing ext type=1(security-association)<br>
> > > > > remain=16.<br>
> > > > > 10643661-Feb 22 21:19:26 1203695366 pluto[9041]: |<br>
> > > > > pfkey_lib_debug:pfkey_msg_parse: remain=16 ext_type=1(security-association)<br>
> > > > > ext_len=3 parsing ext 0p0x814bae8 with parser pfkey_sa_parse.<br>
> > > > > 10643662-Feb 22 21:19:26 1203695366 pluto[9041]: |<br>
> > > > > pfkey_lib_debug:pfkey_sa_parse: successfully found len=3<br>
> > > > > exttype=1(security-association) spi=02000010 replay=64 state=1 auth=2<br>
> > > > > encrypt=3 flags=0 ref=-1.<br>
> > > > > 10643663-Feb 22 21:19:26 1203695366 pluto[9041]: |<br>
> > > > > pfkey_lib_debug:pfkey_msg_parse: Extension 1(security-association) parsed.<br>
> > > > > 10643664-Feb 22 21:19:26 1203695366 pluto[9041]: |<br>
> > > > > pfkey_lib_debug:pfkey_msg_parse: parsing ext type=5(source-address)<br>
> > > > > remain=13.<br>
> > > > > 10643665-Feb 22 21:19:26 1203695366 pluto[9041]: |<br>
> > > > > pfkey_lib_debug:pfkey_msg_parse: remain=13 ext_type=5(source-address)<br>
> > > > > ext_len=3 parsing ext 0p0x814bb00 with parser pfkey_address_parse.<br>
> > > > > 10643666-Feb 22 21:19:26 1203695366 pluto[9041]: |<br>
> > > > > pfkey_lib_debug:pfkey_address_parse: found exttype=5(source-address)<br>
> > > > > family=2(AF_INET) address=<a href="http://122.166.6.187" target="_blank">122.166.6.187</a> proto=0 port=0.<br>
> > > > > 10643667-Feb 22 21:19:26 1203695366 pluto[9041]: |<br>
> > > > > pfkey_lib_debug:pfkey_address_parse: successful.<br>
> > > > > 10643668-Feb 22 21:19:26 1203695366 pluto[9041]: |<br>
> > > > > pfkey_lib_debug:pfkey_msg_parse: Extension 5(source-address) parsed.<br>
> > > > > 10643669-Feb 22 21:19:26 1203695366 pluto[9041]: |<br>
> > > > > pfkey_lib_debug:pfkey_msg_parse: parsing ext type=6(destination-address)<br>
> > > > > remain=10.<br>
> > > > > 10643670-Feb 22 21:19:26 1203695366 pluto[9041]: |<br>
> > > > > pfkey_lib_debug:pfkey_msg_parse: remain=10 ext_type=6(destination-address)<br>
> > > > > ext_len=3 parsing ext 0p0x814bb18 with parser pfkey_address_parse.<br>
> > > > > 10643671-Feb 22 21:19:26 1203695366 pluto[9041]: |<br>
> > > > > pfkey_lib_debug:pfkey_address_parse: found exttype=6(destination-address)<br>
> > > > > family=2(AF_INET) address=<a href="http://122.166.6.233" target="_blank">122.166.6.233</a> proto=0 port=0.<br>
> > > > > 10643672-Feb 22 21:19:26 1203695366 pluto[9041]: |<br>
> > > > > pfkey_lib_debug:pfkey_address_parse: successful.<br>
> > > > > 10643673-Feb 22 21:19:26 1203695366 pluto[9041]: |<br>
> > > > > pfkey_lib_debug:pfkey_msg_parse: Extension 6(destination-address) parsed.<br>
> > > > > 10643674-Feb 22 21:19:26 1203695366 pluto[9041]: |<br>
> > > > > pfkey_lib_debug:pfkey_msg_parse: parsing ext type=8(authentication-key)<br>
> > > > > remain=7.<br>
> > > > > 10643675-Feb 22 21:19:26 1203695366 pluto[9041]: |<br>
> > > > > pfkey_lib_debug:pfkey_msg_parse: remain=7 ext_type=8(authentication-key)<br>
> > > > > ext_len=3 parsing ext 0p0x814bb30 with parser pfkey_key_parse.<br>
> > > > > 10643676-Feb 22 21:19:26 1203695366 pluto[9041]: |<br>
> > > > > pfkey_lib_debug:pfkey_key_parse: success, found len=3<br>
> > > > > exttype=8(authentication-key) bits=128 reserved=0.<br>
> > > > > 10643677-Feb 22 21:19:26 1203695366 pluto[9041]: |<br>
> > > > > pfkey_lib_debug:pfkey_msg_parse: Extension 8(authentication-key) parsed.<br>
> > > > > 10643678-Feb 22 21:19:26 1203695366 pluto[9041]: |<br>
> > > > > pfkey_lib_debug:pfkey_msg_parse: parsing ext type=9(cipher-key) remain=4.<br>
> > > > > 10643679-Feb 22 21:19:26 1203695366 pluto[9041]: |<br>
> > > > > pfkey_lib_debug:pfkey_msg_parse: remain=4 ext_type=9(cipher-key) ext_len=4<br>
> > > > > parsing ext 0p0x814bb48 with parser pfkey_key_parse.<br>
> > > > > 10643680-Feb 22 21:19:26 1203695366 pluto[9041]: |<br>
> > > > > pfkey_lib_debug:pfkey_key_parse: success, found len=4 exttype=9(cipher-key)<br>
> > > > > bits=192 reserved=0.<br>
> > > > > 10643681-Feb 22 21:19:26 1203695366 pluto[9041]: |<br>
> > > > > pfkey_lib_debug:pfkey_msg_parse: Extension 9(cipher-key) parsed.<br>
> > > > > 10643682-Feb 22 21:19:26 1203695366 pluto[9041]: |<br>
> > > > > pfkey_lib_debug:pfkey_msg_parse: extensions permitted=78001ffb,<br>
> > > > > seen=00000363, required=00000063.<br>
> > > > > 10643683-Feb 22 21:19:26 1203695366 pluto[9041]: | finish_pfkey_msg:<br>
> > > > > SADB_ADD message 46 for Add SA <a href="mailto:esp.2000010@122.166.6.233">esp.2000010@122.166.6.233</a><br>
> > > > > 10643684-Feb 22 21:19:26 1203695366 pluto[9041]: | 02 03 00 03 12<br>
> > > > > 00 00 00 2e 00 00 00 51 23 00 00<br>
> > > > > 10643685-Feb 22 21:19:26 1203695366 pluto[9041]: | 03 00 01 00 02<br>
> > > > > 00 00 10 40 01 02 03 00 00 00 00<br>
> > > > > 10643686-Feb 22 21:19:26 1203695366 pluto[9041]: | ff ff ff ff 00<br>
> > > > > 00 00 00 03 00 05 00 00 00 00 00<br>
> > > > > 10643687:Feb 22 21:19:29 1203695369 pluto[9041]: | 02 00 00 00 7a<br>
> > > > > a6 06 bb 00 00 00 00 00 00 00 00<br>
> > > > > 10643688:Feb 22 21:19:29 1203695369 pluto[9041]: | 03 00 06 00 00<br>
> > > > > 00 00 00 02 00 00 00 7a a6 06 e9<br>
> > > > > 10643689:Feb 22 21:19:29 1203695369 pluto[9041]: | 00 00 00 00 00<br>
> > > > > 00 00 00 03 00 08 00 80 00 00 00<br>
> > > > > 10643690:Feb 22 21:19:29 1203695369 pluto[9041]: | a8 de 04 00 3a<br>
> > > > > 4c 1d 9d 7f 63 c9 d0 83 1e bf ad<br>
> > > > > 10643691:Feb 22 21:19:29 1203695369 pluto[9041]: | 04 00 09 00 c0<br>
> > > > > 00 00 00 79 3c 43 09 86 3e 06 a6<br>
> > > > > 10643692:Feb 22 21:19:29 1203695369 pluto[9041]: | 3a 40 53 2e 94<br>
> > > > > 61 b1 a5 77 08 eb df 09 9f 0d 3d<br>
> > > > ><br>
> > > > ><br>
> > > > ><br>
> > > > ><br>
> > > > ><br>
> > > > > On Fri, Feb 22, 2008 at 5:00 PM, hiren joshi <<a href="mailto:joshihirenn@gmail.com">joshihirenn@gmail.com</a>><br>
> > > > > wrote:<br>
> > > > ><br>
> > > > > > hello,<br>
> > > > > ><br>
> > > > > > kernel (using KLIPS) generates Oops:<br>
> > > > > ><br>
> > > > > > Dec 18 07:48:34 1197944314 kernel: Unable to handle kernel paging<br>
> > > > > > request at virtual address 00676673<br>
> > > > > > Dec 18 07:48:35 1197944315 kernel: printing eip:<br>
> > > > > > Dec 18 07:48:35 1197944315 kernel: c01bfafe<br>
> > > > > > Dec 18 07:48:35 1197944315 kernel: *pde = 00000000<br>
> > > > > > Dec 18 07:48:35 1197944315 kernel: Oops: 0000 [#1]<br>
> > > > > > Dec 18 07:48:35 1197944315 kernel: Modules linked in: ppp_deflate<br>
> > > > > > zlib_deflate zlib_inflate bsd_comp ip_nat_ftp ip_conntrack_ftp ipsec<br>
> > > > > > ip_conntrack_netlink sha512 crypto_null ip_nat_h323 ip_conntrack_h323<br>
> > > > > > ip_nat_irc ip_conntrack_irc ip_nat_pptp ip_conntrack_pptp ip_nat_tftp<br>
> > > > > > ip_conntrack_tftp sch_htb md5 sha1 sha256 des blowfish cast5 serpent twofish<br>
> > > > > > aes ipt_MASQUERADE ipt_iprange pppoe pppox ppp_synctty ppp_async crc_ccitt<br>
> > > > > > ppp_generic slhc ipt_ULOG imq ipt_mport ipt_status xt_pkttype<br>
> > > > > > ip_conntrack_elite_proxy ipt_REDIRECT arptable_filter arp_tables<br>
> > > > > > ipt_hashlimit xt_tcpudp ipt_unclean ipt_recent ipt_NOTRACK ipt_IMQ<br>
> > > > > > ipt_CONNMARK ipt_set ipt_OUTDEV ipt_ENTITY xt_state ipt_entity<br>
> > > > > > ip_conntrack_master_fillup ip_conntrack_direction_helper ip_set_markipmap<br>
> > > > > > ip_set ipt_APPCLASS iptable_raw iptable_mangle ipt_ipp2p iptable_nat ip_nat<br>
> > > > > > ip_conntrack nfnetlink iptable_filter ip_tables x_tables e100 8021q<br>
> > > > > > Dec 18 07:48:35 1197944315 kernel: CPU: 0<br>
> > > > > > Dec 18 07:48:35 1197944315 kernel: EIP:<br>
> > > > > > 0060:[crypto_free_tfm+30/160] Not tainted VLI<br>
> > > > > > Dec 18 07:48:35 1197944315 kernel: EFLAGS: 00010282 (2.6.16.13-1#66)<br>
> > > > > > Dec 18 07:48:35 1197944315 kernel: EIP is at<br>
> > > > > > crypto_free_tfm+0x1e/0xa0<br>
> > > > > > Dec 18 07:48:35 1197944315 kernel: eax: deb08a04 ebx: 00676663<br>
> > > > > > ecx: 00000000 edx: 00000000<br>
> > > > > > Dec 18 07:48:35 1197944315 kernel: esi: c60adc20 edi: c60adc20<br>
> > > > > > ebp: 00000000 esp: d16e3c7c<br>
> > > > > > Dec 18 07:48:35 1197944315 kernel: ds: 007b es: 007b ss: 0068<br>
> > > > > > Dec 18 07:48:35 1197944315 kernel: Process pluto (pid: 9289,<br>
> > > > > > threadinfo=d16e2000 task=c7ecc580)<br>
> > > > > > Dec 18 07:48:35 1197944315 kernel: Stack: <0>00000020 d5e44800<br>
> > > > > > 00000000 c60adc20 00000000 deac1c43 c60adc20 c60adc20<br>
> > > > > > Dec 18 07:48:35 1197944315 kernel: d16e3cb0 00000064<br>
> > > > > > 00000000 00000000 c699984c 2e707365 30303032 40303130<br>
> > > > > > Dec 18 07:48:35 1197944315 kernel: 2e323231 2e363631<br>
> > > > > > 33392e36 c143f500 c6999800 00000286 00000286 deb0b480<br>
> > > > > > Dec 18 07:48:35 1197944315 ipsec__plutorun: !pluto failure!:<br>
> > > > > > exited with error status 139 (signal 11)<br>
> > > > > > Dec 18 07:48:35 1197944315 kernel: Call Trace:<br>
> > > > > > Dec 18 07:48:35 1197944315 ipsec__plutorun: restarting IPsec after<br>
> > > > > > pause...<br>
> > > > > > Dec 18 07:48:35 1197944315 kernel: [pg0+510307395/1069446144]<br>
> > > > > > ipsec_sa_wipe+0x2c3/0x3e0 [ipsec]<br>
> > > > > > Dec 18 07:48:35 1197944315 kernel: [_read_unlock+11/16]<br>
> > > > > > _read_unlock+0xb/0x10<br>
> > > > > > Dec 18 07:48:35 1197944315 kernel: [pg0+510424935/1069446144]<br>
> > > > > > ipsec_alg_get+0x57/0x70 [ipsec]<br>
> > > > > > Dec 18 07:48:35 1197944315 kernel: [pg0+510389633/1069446144]<br>
> > > > > > pfkey_key_process+0xc1/0x1f0 [ipsec]<br>
> > > > > > Dec 18 07:48:35 1197944315 kernel: [pg0+510386659/1069446144]<br>
> > > > > > pfkey_msg_interp+0x1a3/0x350 [ipsec]<br>
> > > > > > Dec 18 07:48:35 1197944315 kernel: [pg0+510361090/1069446144]<br>
> > > > > > pfkey_sendmsg+0x192/0x4b0 [ipsec]<br>
> > > > > > Dec 18 07:48:35 1197944315 kernel: [do_sock_write+161/192]<br>
> > > > > > do_sock_write+0xa1/0xc0<br>
> > > > > > Dec 18 07:48:35 1197944315 kernel: [sock_aio_write+148/160]<br>
> > > > > > sock_aio_write+0x94/0xa0<br>
> > > > > > Dec 18 07:48:35 1197944315 kernel: [do_sync_write+209/288]<br>
> > > > > > do_sync_write+0xd1/0x120<br>
> > > > > > Dec 18 07:48:35 1197944315 kernel:<br>
> > > > > > [autoremove_wake_function+0/96] autoremove_wake_function+0x0/0x60<br>
> > > > > > Dec 18 07:48:35 1197944315 kernel: [_spin_lock+11/16]<br>
> > > > > > _spin_lock+0xb/0x10<br>
> > > > > > Dec 18 07:48:35 1197944315 kernel: [vfs_write+364/384]<br>
> > > > > > vfs_write+0x16c/0x180<br>
> > > > > > Dec 18 07:48:35 1197944315 kernel: [sys_write+81/128]<br>
> > > > > > sys_write+0x51/0x80<br>
> > > > > > Dec 18 07:48:35 1197944315 kernel: [syscall_call+7/11]<br>
> > > > > > syscall_call+0x7/0xb<br>
> > > > > > Dec 18 07:48:35 1197944315 kernel: Code: ff 89 c5 e9 34 ff ff ff<br>
> > > > > > 90 8d 74 26 00 83 ec 14 89 74 24 08 8b 74 24 18 89 5c 24 04 89 7c 24 0c 85<br>
> > > > > > f6 89 6c 24 10 74 69 8b 5e 28 <8b> 6b 10 89 34 24 e8 37 fe ff ff 8b 83 c0 00<br>
> > > > > > 00 00 83 c5 2c 85<br>
> > > > > > Dec 18 07:48:45 1197944325 kernel: <2>IPSEC EVENT: KLIPS device<br>
> > > > > > ipsec0 shut down.<br>
> > > > > > Dec 18 07:48:45 1197944325 kernel: IPSEC EVENT: KLIPS device<br>
> > > > > > ipsec1 shut down.<br>
> > > > > > Dec 18 07:48:45 1197944325 kernel:<br>
> > > > > > Dec 18 07:48:45 1197944325 ipsec_setup: ...Openswan IPsec stopped<br>
> > > > > > Dec 18 07:48:45 1197944325 ipsec_setup: Stopping Openswan IPsec...<br>
> > > > > > Dec 18 07:48:45 1197944325 ipsec_setup: Removing orphaned<br>
> > > > > > /var/run/pluto/pluto.pid:<br>
> > > > > > Dec 18 07:48:45 1197944325 ipsec_setup: ERROR: Module ipsec is in<br>
> > > > > > use<br>
> > > > > > Dec 18 07:48:45 1197944325 ipsec_setup: Error: an inet prefix is<br>
> > > > > > expected rather than "dev".<br>
> > > > > > Dec 18 07:48:45 1197944325 ipsec_setup: RTNETLINK answers: Cannot<br>
> > > > > > assign requested address<br>
> > > > > ><br>
> > > > > > the last line in /var/log/secure before Oops is always -<br>
> > > > > ><br>
> > > > > > Dec 18 07:48:32 1197944312 pluto[9289]: "T-1" #995:<br>
> > > > > > STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2<br>
> > > > > ><br>
> > > > > > after Oops pluto restarts:<br>
> > > > > ><br>
> > > > > > Dec 18 07:48:48 1197944328 ipsec__plutorun: Restarting Pluto<br>
> > > > > > subsystem...<br>
> > > > > > Dec 18 07:48:48 1197944328 ipsec__plutorun: Unknown default RSA<br>
> > > > > > hostkey scheme, not generating a default hostkey<br>
> > > > > > Dec 18 07:48:48 1197944328 pluto[17193]: Starting Pluto (Openswan<br>
> > > > > > Version 2.4.8 LDAP_V3 PLUTO_SENDS_VENDORID PLUTO_USES_KEYRR;<br>
> > > > > > Vendor ID OE]bWX`QBruL)<br>
> > > > > ><br>
> > > > > > kernel: 2.6.16.13-1<br>
> > > > > > Openswan: 2.4.8<br>
> > > > > ><br>
> > > > > > it is only when i use a D-Link router at the other end.<br>
> > > > > ><br>
> > > > > > any clue?<br>
> > > > > ><br>
> > > > > > regards,<br>
> > > > > > -hiren<br>
> > > > > ><br>
> > > > ><br>
> > > > ><br>
> > > ><br>
> > ><br>
> ><br>
><br>
<br>
</div></div><font color="#888888">--<br>
Building and integrating Virtual Private Networks with Openswan:<br>
<a href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155" target="_blank">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a><br>
</font></blockquote></div><br>