<div dir="ltr"><br>Hello, <br><br>I've performed some tests with the klips stack 2.6.16 with my server based on userland 2.4.13 and are is the results :<br><br>At the startup, I got these error messages :<br><br>ipsec_setup: Starting Openswan IPsec <a href="http://2.4.13." target="_blank">2.4.13.</a>..<br>
ipsec_setup: ERROR: Failed to load or detect KLIPS and NETKEY<br>ipsec_setup: calcgoo: warning: 2.6 kernel with kallsyms not supported yet<br>ipsec_setup: insmod /lib/modules/2.6.18-k26/kernel/net/ipsec/ipsec.ko<br>ipsec_setup: /usr/local/libexec/ipsec/eroute: pfkey write failed, returning -1 with error=96<br>
ipsec_setup: Unknown socket write error 96. Please report as much detail as possible to development team.<br><br><br>However the tunnels are negociated (Ipsec SA established), but the outgoing packets sent aren't received by the opposite gateway.<br>
Here
is an example of a ping inside the tunnel sent from a remote openswan 2.4.9
gateway to the 2.4.13/2.6.16 server subnet :<br> <br>Dump on ipsec0 on REMOTE-GATEWAY-2.4.9<br>12:47:53.361741 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto: ICMP (1), length: 84) REMOTE-GATEWAY-2.4.9-SUBNET-IP > GATEWAY-2.6.16-SUBNET-IP: ICMP echo request, id 43024, seq 1, length 64<br>
<br>--> no answer received<br><br>Dump on ipsec0 on GATEWAY-2.6.16<br>12:47:53.539822 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto: ICMP (1), length: 84) REMOTE-GATEWAY-2.4.9-SUBNET-IP > GATEWAY-2.6.16-SUBNET-IP: ICMP echo request, id 43024, seq 1, length 64<br>
12:47:53.539960 IP (tos 0x0, ttl 64, id 29898, offset 0, flags [none], proto: ICMP (1), length: 84) GATEWAY-2.6.16-SUBNET-IP > REMOTE-GATEWAY-2.4.9-SUBNET-IP: ICMP echo reply, id 43024, seq 1, length 64<br><br>--> clear answer is sent<br>
<br>Dump on eth0 on GATEWAY-2.6.16<br>12:47:53.539822 IP (tos 0x0, ttl 44, id 2688, offset 0, flags [none], proto: ESP (50), length: 136) REMOTE-GATEWAY-2.4.9 > GATEWAY-2.6.16: ESP(spi=0x5640248e,seq=0x4), length 116<br>
<br>--> There is no encrypted packet for the echo reply that go outside the server.<br><br><br>Same logs with the 2.4.13/2.4.13 version :<br><br>Dump on ipsec0 on REMOTE-GATEWAY-2.4.9<br>13:06:10.281018 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto: ICMP (1), length: 84) REMOTE-GATEWAY-2.4.9-SUBNET-IP > GATEWAY-2.4.13-SUBNET-IP: ICMP echo request, id 36356, seq 1, length 64<br>
13:06:10.412048 IP (tos 0x0, ttl 64, id 4779, offset 0, flags [none], proto: ICMP (1), length: 84) GATEWAY-2.4.13-SUBNET-IP > REMOTE-GATEWAY-2.4.9-SUBNET-IP: ICMP echo reply, id 36356, seq 1, length 64<br><br>Dump on ipsec0 on GATEWAY-2.4.13<br>
13:06:10.355104 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto: ICMP (1), length: 84) REMOTE-GATEWAY-2.4.9-SUBNET-IP > GATEWAY-2.4.13-SUBNET-IP: ICMP echo request, id 36356, seq 1, length 64<br>13:06:10.355184 IP (tos 0x0, ttl 64, id 4779, offset 0, flags [none], proto: ICMP (1), length: 84) GATEWAY-2.4.13-SUBNET-IP > REMOTE-GATEWAY-2.4.9-SUBNET-IP: ICMP echo reply, id 36356, seq 1, length 64<br>
<br>Dump on eth0 on GATEWAY-2.4.13<br>13:06:10.355104 IP (tos 0x0, ttl 44, id 9276, offset 0, flags [none], proto: ESP (50), length: 136) REMOTE-GATEWAY-2.4.9 > GATEWAY-2.4.13: ESP(spi=0x11fb7634,seq=0x2), length 116<br>
13:06:10.355215 IP (tos 0x0, ttl 64, id 4780, offset 0, flags [none], proto: ESP (50), length: 136) GATEWAY-2.4.13 > REMOTE-GATEWAY-2.4.9: ESP(spi=0xcdaa611b,seq=0x2), length 116<br><br><br>Now when I try to stop ipsec on the 2.4.13/2.4.16 version :<br>
<br>
localhost:~# ipsec --version<br>
Linux Openswan U2.4.13/K2.6.16 (klips)<br>
See `ipsec --copyright' for copyright information.<br>
localhost:~# /etc/init.d/ipsec stop<br>
ipsec_setup: Stopping Openswan IPsec...<br>
ipsec_setup: /usr/local/libexec/ipsec/eroute: pfkey write failed, returning -1 with errno=96.<br>
ipsec_setup: Unknown socket write error 96. Please report as much detail as possible to development team.<br>
ipsec_setup: ERROR: Removing 'ipsec': Device or resource busy<br>
localhost:~# ipsec --version<br>
Linux Openswan U2.4.13/K2.6.16 (klips)<br>
See `ipsec --copyright' for copyright information.<br>
<br>
Pluto stops (and don't freeze with unregister_netdevice message) but the kernel stack isn't unloaded.<br>
<br>Hope it helps,<br>Jean-Michel.<br><br><br><div class="gmail_quote">2008/9/18 Paul Wouters <span dir="ltr"><<a href="mailto:paul@xelerance.com" target="_blank">paul@xelerance.com</a>></span><br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div>On Thu, 18 Sep 2008, Jean-Michel Bonnefond wrote:<br>
<br>
> You're right it come from the 2.4.13 klips stack. I've compiled 2 versions,<br>
> using the same server, same kernel, same openswan version and here is the<br>
> result :<br>
<br>
</div>Try compiling the KLIPS stack from 2.6.16 and use that with the 2.4.13<br>
userland.<br>
<font color="#888888"><br>
Paul<br>
</font></blockquote></div><br></div>