Hello,<br><br>Version: openswan-2.4.9<br><br>Motivated by <a href="http://lists.openswan.org/pipermail/dev/2008-December/001994.html" target="_blank">http://lists.openswan.org/pipermail/dev/2008-December/001994.html</a>,<br>
I tried multiple road warrior connection in aggressive mode with different pre-shared secrets.<br>
<br>I found it not working as it does not allow the newly chosen connection to have different PSK than the current one.<br><br>programs/pluto/connections.c::3778<br><br> switch (auth)<br> {<br> case OAKLEY_PRESHARED_KEY:<br>
/* secret must match the one we already used */<br> {<br> const chunk_t *dpsk = get_preshared_secret(d);<br><br> if (dpsk == NULL)<br> continue; /* no secret */<br>
<br> if (psk != dpsk)<br> if (psk->len != dpsk->len<br> || memcmp(psk->ptr, dpsk->ptr, psk->len) != 0)<br> continue; /* different secret */<br>
}<br> break;<br><br><br>Should I bypass the check for Aggressive mode?<br>
<br>
--- connections.c.orig 2008-12-30 18:42:26.000000000 +0530<br>
+++ connections.c 2008-12-30 21:28:10.000000000 +0530<br>
@@ -3785,7 +3785,7 @@ refine_host_connection(const struct stat<br>
if (dpsk == NULL)<br>
continue; /* no secret */<br>
<br>
- if (psk != dpsk)<br>
+ if (!(d->policy & POLICY_AGGRESSIVE) && psk != dpsk)<br>
if (psk->len != dpsk->len<br>
|| memcmp(psk->ptr, dpsk->ptr, psk->len) != 0)<br>
continue; /* different secret */<br>
<br><br>Thanks for your time.<br>-hiren<br><br>------------------details----------------<br><br>Configuration:<br><br>version 2<br>config setup<br> interfaces="ipsec0=eth1 ipsec1=eth2 "<br> klipsdebug=none<br>
plutodebug="none"<br> uniqueids=no<br> nat_traversal=yes<br> crlcheckinterval=3600<br> nhelpers=0<br><br><br>conn %default<br> leftupdown=/usr/lib/ipsec/_updown<br> rightupdown=/usr/lib/ipsec/_updown<br>
<br>conn aggr-1<br> aggrmode=yes<br> left=172.16.1.2<br> leftsubnet=<a href="http://192.168.3.1/32">192.168.3.1/32</a><br> leftid="@local"<br> right=%any<br> rightsubnet="vhost:%v4:<a href="http://0.0.0.0/0">0.0.0.0/0</a>"<br>
rightid="@rw-1"<br> authby=secret<br> ike=3des-md5<br><br>conn aggr-2<br> aggrmode=yes<br> left=172.16.1.2<br> leftsubnet=<a href="http://192.168.3.2/32">192.168.3.2/32</a><br>
leftid="@local"<br> right=%any<br> rightsubnet="vhost:%v4:<a href="http://0.0.0.0/0">0.0.0.0/0</a>"<br> rightid="@rw-2"<br> authby=secret<br> ike=3des-md5<br>
<br>secrets:<br><br>@local @rw-1 : PSK "psk-1"<br>@local @rw-2 : PSK "psk-2"<br><br><br>------------failed to switch with different PSKs------------------<br><br>| *received 324 bytes from <a href="http://172.16.1.1:500">172.16.1.1:500</a> on eth1 (port=500)<br>
| 6d 23 1d 5b e8 24 89 9c 00 00 00 00 00 00 00 00<br>| 01 10 04 00 00 00 00 00 00 00 01 44 0d 00 00 34<br>| 00 00 00 01 00 00 00 01 00 00 00 28 01 01 00 01<br>| 00 00 00 20 00 01 00 00 80 01 00 05 80 02 00 01<br>
| 80 03 00 01 80 04 00 02 80 0b 00 01 80 0c 0e 10<br>| 0d 00 00 14 44 85 15 2d 18 b6 bb cd 0b e8 a8 46<br>| 95 79 dd cc 0d 00 00 14 90 cb 80 91 3e bb 69 6e<br>| 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 7d 94 19 a6<br>
| 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 04 00 00 14<br>| af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00<br>| 0a 00 00 84 23 45 f8 0f cb 45 61 3b 46 9e b7 a8<br>| cd 42 ee 58 46 77 30 34 d2 47 5c 13 c3 af 8c c1<br>
| cd 6a fa 2c 8a 32 c9 35 49 b8 3f dc 92 f4 63 e6<br>| df 72 0b a4 06 13 72 d7 58 94 9e c1 55 11 48 e8<br>| 92 90 c2 bc 32 ac a1 d3 f9 51 82 8b a1 a6 8a 3f<br>| 3c 99 d7 44 28 49 1d 8d ae a3 58 cb 06 10 8b d4<br>
| 9a d9 5f 00 c9 b8 5a 89 79 7b fd 0b 52 a1 29 c4<br>| 09 96 3e 1e 27 62 f2 0a 70 36 41 4c 03 48 e2 8f<br>| 7a 3c db 9a 05 00 00 14 f9 36 74 46 95 e1 d7 ed<br>| 98 2b 53 8c 5c 1c 69 da 00 00 00 0c 02 00 00 00<br>
| 72 77 2d 31<br>| **parse ISAKMP Message:<br>| initiator cookie:<br>| 6d 23 1d 5b e8 24 89 9c<br>| responder cookie:<br>| 00 00 00 00 00 00 00 00<br>| next payload type: ISAKMP_NEXT_SA<br>| ISAKMP version: ISAKMP Version 1.0<br>
| exchange type: ISAKMP_XCHG_AGGR<br>| flags: none<br>| message ID: 00 00 00 00<br>| length: 324<br>| processing packet with exchange type=ISAKMP_XCHG_AGGR (4)<br>| np=1 and sd=0x80c198c<br>| ***parse ISAKMP Security Association Payload:<br>
| next payload type: ISAKMP_NEXT_VID<br>| length: 52<br>| DOI: ISAKMP_DOI_IPSEC<br>| np=13 and sd=0x80c1f38<br>| ***parse ISAKMP Vendor ID Payload:<br>| next payload type: ISAKMP_NEXT_VID<br>| length: 20<br>
| np=13 and sd=0x80c1f38<br>| ***parse ISAKMP Vendor ID Payload:<br>| next payload type: ISAKMP_NEXT_VID<br>| length: 20<br>| np=13 and sd=0x80c1f38<br>| ***parse ISAKMP Vendor ID Payload:<br>| next payload type: ISAKMP_NEXT_VID<br>
| length: 20<br>| np=13 and sd=0x80c1f38<br>| ***parse ISAKMP Vendor ID Payload:<br>| next payload type: ISAKMP_NEXT_KE<br>| length: 20<br>| np=4 and sd=0x80c1c40<br>| ***parse ISAKMP Key Exchange Payload:<br>| next payload type: ISAKMP_NEXT_NONCE<br>
| length: 132<br>| np=10 and sd=0x80c1e14<br>| ***parse ISAKMP Nonce Payload:<br>| next payload type: ISAKMP_NEXT_ID<br>| length: 20<br>| np=5 and sd=(nil)<br>| ***parse ISAKMP Identification Payload:<br>| next payload type: ISAKMP_NEXT_NONE<br>
| length: 12<br>| ID type: ID_FQDN<br>| DOI specific A: 0<br>| DOI specific B: 0<br>packet from <a href="http://172.16.1.1:500">172.16.1.1:500</a>: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]<br>
packet from <a href="http://172.16.1.1:500">172.16.1.1:500</a>: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] method set to=106<br>packet from <a href="http://172.16.1.1:500">172.16.1.1:500</a>: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] method set to=108<br>
packet from <a href="http://172.16.1.1:500">172.16.1.1:500</a>: received Vendor ID payload [Dead Peer Detection]<br>| find_host_connection called from aggr_inI1_outR1_common<br>| find_host_pair: comparing to <a href="http://172.16.1.2:500">172.16.1.2:500</a> <a href="http://0.0.0.0:500">0.0.0.0:500</a><br>
| find_host_pair_conn (find_host_connection2): <a href="http://172.16.1.2:500">172.16.1.2:500</a> <a href="http://172.16.1.1:500">172.16.1.1:500</a> -> hp:none<br>| find_host_connection called from aggr_inI1_outR1_common<br>
| find_host_pair: comparing to <a href="http://172.16.1.2:500">172.16.1.2:500</a> <a href="http://0.0.0.0:500">0.0.0.0:500</a><br>| find_host_pair_conn (find_host_connection2): <a href="http://172.16.1.2:500">172.16.1.2:500</a> %any:500 -> hp:aggr-2<br>
| alg_info_addref() alg_info->ref_cnt=3<br>| alg_info_addref() alg_info->ref_cnt=4<br>| find_host_pair: comparing to <a href="http://172.16.1.2:500">172.16.1.2:500</a> <a href="http://0.0.0.0:500">0.0.0.0:500</a><br>
| connect_to_host_pair: <a href="http://172.16.1.2:500">172.16.1.2:500</a> <a href="http://172.16.1.1:500">172.16.1.1:500</a> -> hp:none<br>| instantiated "aggr-2" for 172.16.1.1<br>| creating state object #29 at 0x8117dd0<br>
"aggr-2"[1] 172.16.1.1 #29: Aggressive mode peer ID is ID_FQDN: '@rw-1'<br>| refine_connection: starting with aggr-2<br>| started looking for secret for @local->@rw-2 of kind PPK_PSK<br>| actually looking for secret for @local->@rw-2 of kind PPK_PSK<br>
| 1: compared PSK @rw-2 to @local / @rw-2 -> 2<br>| 2: compared PSK @local to @local / @rw-2 -> 6<br>| best_match 0>6 best=0x810bcf0 (line=2)<br>| 1: compared PSK @rw-1 to @local / @rw-2 -> 0<br>| 2: compared PSK @local to @local / @rw-2 -> 4<br>
| concluding with best_match=6 best=0x810bcf0 (lineno=2)<br>| match_id a=@rw-1<br>| b=@rw-2<br>| results fail<br>| trusted_ca called with a=(empty) b=(empty)<br>| refine_connection: checking aggr-2 against aggr-2, best=(none) with match=0(id=0/ca=1/reqca=1)<br>
| find_host_pair: comparing to <a href="http://172.16.1.2:500">172.16.1.2:500</a> <a href="http://172.16.1.1:500">172.16.1.1:500</a><br>| find_host_pair: comparing to <a href="http://172.16.1.2:500">172.16.1.2:500</a> <a href="http://0.0.0.0:500">0.0.0.0:500</a><br>
| find_host_pair_conn (refine_host_connection): <a href="http://172.16.1.2:500">172.16.1.2:500</a> %any:500 -> hp:aggr-2<br>| match_id a=@rw-1<br>| b=@rw-2<br>| results fail<br>| trusted_ca called with a=(empty) b=(empty)<br>
| refine_connection: checking aggr-2 against aggr-2, best=(none) with match=0(id=0/ca=1/reqca=1)<br>| match_id a=@rw-1<br>| b=@rw-1<br>| results matched<br>| trusted_ca called with a=(empty) b=(empty)<br>
| refine_connection: checking aggr-2 against aggr-1, best=(none) with match=1(id=1/ca=1/reqca=1)<br>| refine_connection: checked aggr-2 against aggr-1, now for see if best<br>| started looking for secret for @local->@rw-1 of kind PPK_PSK<br>
| actually looking for secret for @local->@rw-1 of kind PPK_PSK<br>| 1: compared PSK @rw-2 to @local / @rw-1 -> 0<br>| 2: compared PSK @local to @local / @rw-1 -> 4<br>| 1: compared PSK @rw-1 to @local / @rw-1 -> 2<br>
| 2: compared PSK @local to @local / @rw-1 -> 6<br>| best_match 0>6 best=0x8103d68 (line=1)<br>| concluding with best_match=6 best=0x8103d68 (lineno=1)<br>"aggr-2"[1] 172.16.1.1 #29: no suitable connection for peer '@rw-1'<br>
<br><br>------------------successful switching after making all PSKs the same----------------------<br><br>| *received 324 bytes from <a href="http://172.16.1.1:500">172.16.1.1:500</a> on eth1 (port=500)<br>| d1 78 1f 02 1e d9 36 19 00 00 00 00 00 00 00 00<br>
| 01 10 04 00 00 00 00 00 00 00 01 44 0d 00 00 34<br>| 00 00 00 01 00 00 00 01 00 00 00 28 01 01 00 01<br>| 00 00 00 20 00 01 00 00 80 01 00 05 80 02 00 01<br>| 80 03 00 01 80 04 00 02 80 0b 00 01 80 0c 0e 10<br>
| 0d 00 00 14 44 85 15 2d 18 b6 bb cd 0b e8 a8 46<br>| 95 79 dd cc 0d 00 00 14 90 cb 80 91 3e bb 69 6e<br>| 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 7d 94 19 a6<br>| 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 04 00 00 14<br>
| af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00<br>| 0a 00 00 84 3a 34 7b 5f c0 17 28 88 2d 7f aa 57<br>| e6 39 49 20 ca 08 d5 40 dd 6b de 11 e3 7a 99 ec<br>| b7 cc 81 8a f2 ae 20 d2 9d c9 4b bd 62 5e 5a ab<br>
| 95 a9 18 2e be 87 43 29 c6 d5 5d cd d7 78 bb a7<br>| f6 f7 e6 3d 00 c6 ee 7a 7b 98 f0 2a e5 f5 e1 d0<br>| 2b 2a ad a1 5b f8 d9 4d 81 3c 51 e6 29 29 36 89<br>| 59 71 e9 fc 62 68 93 0b 8a 1c d9 05 93 b9 b4 58<br>
| 92 43 48 ea a6 36 f6 0a 74 c9 2b 0d cb a6 ee 41<br>| 17 d1 97 e3 05 00 00 14 57 b1 3d 7c 9e 69 04 86<br>| 16 ca 84 72 86 7c 10 50 00 00 00 0c 02 00 00 00<br>| 72 77 2d 31<br>| **parse ISAKMP Message:<br>
| initiator cookie:<br>| d1 78 1f 02 1e d9 36 19<br>| responder cookie:<br>| 00 00 00 00 00 00 00 00<br>| next payload type: ISAKMP_NEXT_SA<br>| ISAKMP version: ISAKMP Version 1.0<br>| exchange type: ISAKMP_XCHG_AGGR<br>
| flags: none<br>| message ID: 00 00 00 00<br>| length: 324<br>| processing packet with exchange type=ISAKMP_XCHG_AGGR (4)<br>| np=1 and sd=0x80c198c<br>| ***parse ISAKMP Security Association Payload:<br>| next payload type: ISAKMP_NEXT_VID<br>
| length: 52<br>| DOI: ISAKMP_DOI_IPSEC<br>| np=13 and sd=0x80c1f38<br>| ***parse ISAKMP Vendor ID Payload:<br>| next payload type: ISAKMP_NEXT_VID<br>| length: 20<br>| np=13 and sd=0x80c1f38<br>| ***parse ISAKMP Vendor ID Payload:<br>
| next payload type: ISAKMP_NEXT_VID<br>| length: 20<br>| np=13 and sd=0x80c1f38<br>| ***parse ISAKMP Vendor ID Payload:<br>| next payload type: ISAKMP_NEXT_VID<br>| length: 20<br>| np=13 and sd=0x80c1f38<br>| ***parse ISAKMP Vendor ID Payload:<br>
| next payload type: ISAKMP_NEXT_KE<br>| length: 20<br>| np=4 and sd=0x80c1c40<br>| ***parse ISAKMP Key Exchange Payload:<br>| next payload type: ISAKMP_NEXT_NONCE<br>| length: 132<br>| np=10 and sd=0x80c1e14<br>
| ***parse ISAKMP Nonce Payload:<br>| next payload type: ISAKMP_NEXT_ID<br>| length: 20<br>| np=5 and sd=(nil)<br>| ***parse ISAKMP Identification Payload:<br>| next payload type: ISAKMP_NEXT_NONE<br>| length: 12<br>
| ID type: ID_FQDN<br>| DOI specific A: 0<br>| DOI specific B: 0<br>packet from <a href="http://172.16.1.1:500">172.16.1.1:500</a>: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]<br>packet from <a href="http://172.16.1.1:500">172.16.1.1:500</a>: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] method set to=106<br>
packet from <a href="http://172.16.1.1:500">172.16.1.1:500</a>: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] method set to=108<br>packet from <a href="http://172.16.1.1:500">172.16.1.1:500</a>: received Vendor ID payload [Dead Peer Detection]<br>
| find_host_connection called from aggr_inI1_outR1_common<br>| find_host_pair: comparing to <a href="http://172.16.1.2:500">172.16.1.2:500</a> <a href="http://0.0.0.0:500">0.0.0.0:500</a><br>| find_host_pair: comparing to <a href="http://172.16.1.2:500">172.16.1.2:500</a> <a href="http://172.16.1.1:500">172.16.1.1:500</a><br>
| find_host_pair_conn (find_host_connection2): <a href="http://172.16.1.2:500">172.16.1.2:500</a> <a href="http://172.16.1.1:500">172.16.1.1:500</a> -> hp:aggr-2<br>| creating state object #31 at 0x8118510<br>"aggr-2"[1] 172.16.1.1 #31: Aggressive mode peer ID is ID_FQDN: '@rw-1'<br>
| refine_connection: starting with aggr-2<br>| started looking for secret for @local->@rw-2 of kind PPK_PSK<br>| actually looking for secret for @local->@rw-2 of kind PPK_PSK<br>| 1: compared PSK @rw-2 to @local / @rw-2 -> 2<br>
| 2: compared PSK @local to @local / @rw-2 -> 6<br>| best_match 0>6 best=0x81098a0 (line=2)<br>| 1: compared PSK @rw-1 to @local / @rw-2 -> 0<br>| 2: compared PSK @local to @local / @rw-2 -> 4<br>| concluding with best_match=6 best=0x81098a0 (lineno=2)<br>
| match_id a=@rw-1<br>| b=@rw-2<br>| results fail<br>| trusted_ca called with a=(empty) b=(empty)<br>| refine_connection: checking aggr-2 against aggr-2, best=(none) with match=0(id=0/ca=1/reqca=1)<br>
| find_host_pair: comparing to <a href="http://172.16.1.2:500">172.16.1.2:500</a> <a href="http://172.16.1.1:500">172.16.1.1:500</a><br>| find_host_pair: comparing to <a href="http://172.16.1.2:500">172.16.1.2:500</a> <a href="http://0.0.0.0:500">0.0.0.0:500</a><br>
| find_host_pair_conn (refine_host_connection): <a href="http://172.16.1.2:500">172.16.1.2:500</a> %any:500 -> hp:aggr-2<br>| match_id a=@rw-1<br>| b=@rw-2<br>| results fail<br>| trusted_ca called with a=(empty) b=(empty)<br>
| refine_connection: checking aggr-2 against aggr-2, best=(none) with match=0(id=0/ca=1/reqca=1)<br>| match_id a=@rw-1<br>| b=@rw-1<br>| results matched<br>| trusted_ca called with a=(empty) b=(empty)<br>
| refine_connection: checking aggr-2 against aggr-1, best=(none) with match=1(id=1/ca=1/reqca=1)<br>| refine_connection: checked aggr-2 against aggr-1, now for see if best<br>| started looking for secret for @local->@rw-1 of kind PPK_PSK<br>
| actually looking for secret for @local->@rw-1 of kind PPK_PSK<br>| 1: compared PSK @rw-2 to @local / @rw-1 -> 0<br>| 2: compared PSK @local to @local / @rw-1 -> 4<br>| 1: compared PSK @rw-1 to @local / @rw-1 -> 2<br>
| 2: compared PSK @local to @local / @rw-1 -> 6<br>| best_match 0>6 best=0x8103d68 (line=1)<br>| concluding with best_match=6 best=0x8103d68 (lineno=1)<br>| offered CA: '%none'<br>"aggr-2"[1] 172.16.1.1 #31: switched from "aggr-2" to "aggr-1"<br>