1)<br>esr is pointer to 0x0.<br>I added : if(esr!=NULL){...} to source at point of segment. fault - it's working now.<br><br>I do not know what is causing esr to be NULL, but I came up with interesting behaviour of pluto:
<br>if _updown script returns with exit code > 0, I am getting problem with esr=NULL,<br>if I do not mess with _updown, there is no such problem. Guessing that return code of _updown script has impact to esr ?<br><br>
/var/log/secure:<br>
<br>
pluto[30225]: | route_and_eroute with c: l2tp-transport (next: none)
ero:l2tp-transport esr:{(nil)} ro:l2tp-transport rosr:{(nil)} and
state: 8 <br>
pluto[30225]: | trusted_ca called with a=******<br>
pluto[30225]: "l2tp-transport"[4] xxx.xxx.xxx.xxx #8: up-host command exited with status 10<br>
ipsec__plutorun: Restarting Pluto subsystem...<br><br>2) in cases when I have sudden cut of communication between server and client (for example, power reset at client side), I have misc behaviour of openswan server when using WindowsXP and openswan as ipsec clients.
<br><br>When using Windows XP I am never getting message "cannot install eroute -- it is in use for ...", instead I have dead tunnel spi and %trap eroute. I can reconnect tunnel after that and then I have 4 spi records and regular eroute, after regular termination of the new tunnel I am getting %hold eroute and 2 old spi records. I guess they will expire in near future and I'll have clean system.
<br><br>When using openswan as client I am always getting message "cannot install eroute -- it is in use for ...", Here I have to wait expiration of spi to reconnect the tunnel successfully. DPD is disabled while testing.
<br><br>Why such misc. behaviours? Is it possible to re-use eroute when using openswan as client?<br><br><br><br><br>Regards<br>Djordje<br><br><br><div><span class="gmail_quote">On 3/13/07, <b class="gmail_sendername">Paul Wouters
</b> <<a href="mailto:paul@xelerance.com">paul@xelerance.com</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">On Tue, 13 Mar 2007, Djordje Zekovic wrote:
<br><br>> Failed to read a valid object file image from memory.<br>> Core was generated by `/usr/libexec/ipsec/pluto --nofork --secretsfile<br>> /etc/ipsec.secrets --ipsecdir /'.<br>> Program terminated with signal 11, Segmentation fault.
<br>> #0 0x0806ebc8 in route_and_eroute (c=0xa0d5118, sr=0xa0d515c, st=0xa0d6878)<br>> at kernel.c:2532<br>> 2532 if (esr->eroute_owner == SOS_NOBODY)<br>> #0 0x0806ebc8 in route_and_eroute (c=0xa0d5118, sr=0xa0d515c, st=0xa0d6878)
<br>> at kernel.c:2532<br>> #1 0x0806efad in install_ipsec_sa (st=0xa0d6878, inbound_also=0) at<br>> kernel.c:2613<br>> #2 0x08067de1 in quick_inI2 (md=0xa0d2ed0) at ikev1_quick.c:2132<br>> #3 0x0807807c in process_packet (mdp=0x80ea068) at
demux.c:2352<br>> #4 0x080788cf in comm_handle (ifp=0xa0d0cf8) at demux.c:1223<br>> #5 0x0805c2d8 in call_server () at server.c:1166<br>> #6 0x0805a4db in main (argc=1549747535, argv=0x7d6a6750) at plutomain.c
:787<br><br>Thanks, that was somewhat helpful. Can you repeat it with plutodebug=controlmore ?<br>That should give us some more information leading up to the crash.<br>Also, a dump of all the variables in gdb would help as well, or at least a print
<br>of esr.<br><br>Is this using 2.6.19 or 2.6.20? KLIPS or NETKEY?<br><br>> /var/log/secure:<br>><br>> Mar 13 05:40:46 vpn1 pluto[16901]: ERROR: pfkey write() of SADB_X_DELFLOW<br>> message 14 for flow <a href="mailto:int.0@0.0.0.0">
int.0@0.0.0.0</a> failed. Errno 14: Bad address<br>> Mar 13 05:40:46 vpn1 pluto[16901]: | 02 0f 00 0b 0e 00 00 00 0e 00 00<br>> 00 05 42 00 00<br>> Mar 13 05:40:46 vpn1 pluto[16901]: | 03 00 15 00 00 00 00 00 02 00 06
<br>> a5 48 37 92 95<br>> Mar 13 05:40:46 vpn1 pluto[16901]: | 00 00 00 00 00 00 00 00 03 00 16<br>> 00 00 00 00 00<br>> Mar 13 05:40:46 vpn1 pluto[16901]: | 02 00 06 a5 c3 42 a4 bd 00 00 00<br>> 00 00 00 00 00
<br>> Mar 13 05:40:46 vpn1 pluto[16901]: | 03 00 17 00 00 00 00 00 02 00 ff<br>> ff ff ff ff ff<br>> Mar 13 05:40:46 vpn1 pluto[16901]: | 38 1a 90 bf ca 1a 90 bf 03 00 18<br>> 00 00 00 00 00<br>> Mar 13 05:40:46 vpn1 pluto[16901]: | 02 00 ff ff ff ff ff ff 00 00 00
<br>> 00 00 00 00 00<br>> Mar 13 05:40:55 vpn1 pluto[16901]: packet from xxx.xxx.xxx.xxx:44: ignoring<br>> Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]<br>> Mar 13 05:40:55 vpn1 pluto[16901]: packet from
xxx.xxx.xxx.xxx:44: ignoring<br>> Vendor ID payload [FRAGMENTATION]<br>> Mar 13 05:40:55 vpn1 pluto[16901]: packet from xxx.xxx.xxx.xxx:44: received<br>> Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] method set to=106
<br>> Mar 13 05:40:55 vpn1 pluto[16901]: packet from xxx.xxx.xxx.xxx:44: ignoring<br>> Vendor ID payload [Vid-Initial-Contact]<br>> Mar 13 05:40:55 vpn1 pluto[16901]: "l2tp-transport"[2] xxx.xxx.xxx.xxx
#5:<br>> responding to Main Mode from unknown peer xxx.xxx.xxx.xxx<br>> Mar 13 05:40:55 vpn1 pluto[16901]: "l2tp-transport"[2] xxx.xxx.xxx.xxx #5:<br>> transition from state STATE_MAIN_R0 to state STATE_MAIN_R1
<br>> Mar 13 05:40:55 vpn1 pluto[16901]: "l2tp-transport"[2] xxx.xxx.xxx.xxx #5:<br>> STATE_MAIN_R1: sent MR1, expecting MI2<br>> Mar 13 05:40:55 vpn1 pluto[16901]: "l2tp-transport"[2] xxx.xxx.xxx.xxx
#5:<br>> NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: peer is NATed<br>> Mar 13 05:40:55 vpn1 pluto[16901]: "l2tp-transport"[2] xxx.xxx.xxx.xxx #5:<br>> transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
<br>> Mar 13 05:40:55 vpn1 pluto[16901]: "l2tp-transport"[2] xxx.xxx.xxx.xxx #5:<br>> STATE_MAIN_R2: sent MR2, expecting MI3<br>> Mar 13 05:40:56 vpn1 pluto[16901]: "l2tp-transport"[2] xxx.xxx.xxx.xxx
#5:<br>> Main mode peer ID is ID_DER_ASN1_DN: '*******'<br>> Mar 13 05:40:56 vpn1 pluto[16901]: "l2tp-transport"[2] xxx.xxx.xxx.xxx #5: I<br>> am sending my cert<br>> Mar 13 05:40:56 vpn1 pluto[16901]: "l2tp-transport"[2]
xxx.xxx.xxx.xxx #5:<br>> transition from state STATE_MAIN_R2 to state STATE_MAIN_R3<br>> Mar 13 05:40:56 vpn1 pluto[16901]: | NAT-T: new mapping xxx.xxx.xxx.xxx<br>> /1558)<br>> Mar 13 05:40:56 vpn1 pluto[16901]: "l2tp-transport"[2]
xxx.xxx.xxx.xxx #5:<br>> STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_RSA_SIG<br>> cipher=oakley_3des_cbc_192 prf=oakley_sha group=modp2048}<br>> Mar 13 05:40:56 vpn1 pluto[16901]: "l2tp-transport"[2]
xxx.xxx.xxx.xxx #6:<br>> responding to Quick Mode {msgid:c366edd3}<br>> Mar 13 05:40:56 vpn1 pluto[16901]: "l2tp-transport"[2] xxx.xxx.xxx.xxx #6:<br>> transition from state STATE_QUICK_R0 to state STATE_QUICK_R1
<br>> Mar 13 05:40:56 vpn1 pluto[16901]: "l2tp-transport"[2] xxx.xxx.xxx.xxx #6:<br>> STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2<br>> Mar 13 05:41:07 vpn1 ipsec__plutorun: Restarting Pluto subsystem...
<br>><br>><br>><br>><br>> /var/log/messages:<br>><br>> Mar 13 02:45:51 vpn1 ipsec_setup: Restarting Openswan IPsec 2.4.8rc1...<br>> Mar 13 05:40:56 vpn1 ipsec__plutorun: /usr/lib/ipsec/_plutorun: line 237:
<br>> 16901 Segmentation fault (core dumped) /usr/libexec/ipsec/pluto<br>> --nofork --secretsfile /etc/ipsec.secrets --ipsecdir /etc/ipsec<br>> Mar 13 05:40:56 vpn1 ipsec__plutorun: !pluto failure!: exited with error
<br>> status 139 (signal 11)<br>> Mar 13 05:40:56 vpn1 ipsec__plutorun: restarting IPsec after pause...<br>><br>><br>> On 3/13/07, Paul Wouters <<a href="mailto:paul@xelerance.com">paul@xelerance.com</a>
> wrote:<br>> ><br>> > On Tue, 13 Mar 2007, Djordje Zekovic wrote:<br>> ><br>> > > I have also pluto segmentation fault with 2.4.7 version.<br>> > > Bug segm.fault still there using
2.4.8rc1 version.<br>> > ><br>> > > I can repeat bug any time: I am connected using Windows XP IPSEC/l2tp<br>> > > Client, then I disable local area network, after enabling it again I<br>> > > re-connect to VPN server, and wholaaa - segm. fault. I should receive
<br>> > > message "Cannot eroute"<br>> > ><br>> > > Here is dump:<br>> ><br>> > > GNU gdb Red Hat Linux (6.5-15.fc6rh)<br>> ><br>> > > warning: Can't read pathname for load map: Input/output error.
<br>> > > Reading symbols from /usr/lib/sse2/libgmp.so.3...done.<br>> > > Loaded symbols for /usr/lib/sse2/libgmp.so.3<br>> > > Reading symbols from /lib/libresolv.so.2...done.<br>> > > Loaded symbols for /lib/libresolv.so.2
<br>> > > Reading symbols from /lib/libc.so.6...done.<br>> > > Loaded symbols for /lib/libc.so.6<br>> > > Reading symbols from /lib/ld-linux.so.2...done.<br>> > > Loaded symbols for /lib/ld-
linux.so.2<br>> > > Failed to read a valid object file image from memory.<br>> > > Core was generated by `/usr/libexec/ipsec/pluto --nofork --secretsfile<br>> > > /etc/ipsec.secrets --ipsecdir /'.
<br>> > > Program terminated with signal 11, Segmentation fault.<br>> > > #0 0x0806ebc8 in route_and_eroute (c=0x8145108, sr=0x814514c,<br>> > st=0x8145b40)<br>> > > at kernel.c:2532<br>> > > 2532
kernel.c: No such file or directory.<br>> > > in kernel.c<br>> > > (gdb)<br>> ><br>> > Please run it so that gdb has access to the source, then give us a<br>> > backtrace<br>> > and a dump of the variables involved.
<br>> ><br>> > Thanks,<br>> ><br>> > Paul<br>> ><br>><br><br>--<br>Building and integrating Virtual Private Networks with Openswan:<br><a href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155">
http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a><br></blockquote></div><br>