Unable to make any real progress. Below is the output of /var/log/messages.<div><br></div><div><div>Jan 1 00:29:45 (none) daemon.err ipsec__plutorun: whack: Pluto is not running (no "/var/run/pluto/pluto.ctl")</div>
<div>Jan 1 00:29:45 (none) daemon.err ipsec__plutorun: !pluto failure!: exited with error status 1</div><div>Jan 1 00:29:45 (none) daemon.err ipsec__plutorun: restarting IPsec after pause...</div><div>Jan 1 00:29:55 (none) daemon.err ipsec_setup: Stopping Openswan IPsec...</div>
<div>Jan 1 00:29:55 (none) daemon.err ipsec_setup: rmmod: remove 'ipv6': Resource temporarily unavailable</div><div>Jan 1 00:29:55 (none) daemon.err ipsec_setup: ...Openswan IPsec stopped</div><div><br></div><div>
Jan 1 00:29:55 (none) daemon.err ipsec_setup: Starting Openswan IPsec U2.6.33/K2.6.37-svn3005...</div><div>Jan 1 00:29:55 (none) daemon.err ipsec_setup: Using NETKEY(XFRM) stack</div><div>(no "/var/run/pluto.ctl")Jan 1 00:29:56 (none) authpriv.err ipsec__plutorun: Starting Pluto subsystem...</div>
<div>Jan 1 00:29:56 (none) daemon.err ipsec_setup: ...Openswan IPsec started</div><div>Jan 1 00:29:56 (none) daemon.err ipsec__plutorun: adjusting ipsec.d to /etc/ipsec.d</div><div>Jan 1 00:29:56 (none) user.warn pluto: adjusting ipsec.d to /etc/ipsec.d</div>
<div>Jan 1 00:29:56 (none) authpriv.warn pluto[26492]: Starting Pluto (Openswan Version 2.6.33; Vendor ID OEghI_w\134ALFy) pid:26492</div><div>Jan 1 00:29:56 (none) authpriv.warn pluto[26492]: LEAK_DETECTIVE support [enabled]</div>
<div>Jan 1 00:29:56 (none) authpriv.warn pluto[26492]: OCF support for IKE [disabled]</div><div>Jan 1 00:29:56 (none) authpriv.warn pluto[26492]: SAref support [disabled]: Protocol not available</div><div>Jan 1 00:29:56 (none) authpriv.warn pluto[26492]: SAbind support [disabled]: Protocol not available</div>
<div>Jan 1 00:29:56 (none) authpriv.warn pluto[26492]: NSS support [disabled]</div><div>Jan 1 00:29:56 (none) authpriv.warn pluto[26492]: HAVE_STATSD notification support not compiled in</div><div>Jan 1 00:29:56 (none) authpriv.warn pluto[26492]: Setting NAT-Traversal port-4500 floating to on</div>
<div>Jan 1 00:29:56 (none) authpriv.warn pluto[26492]: port floating activation criteria nat_t=1/port_float=1</div><div>Jan 1 00:29:56 (none) authpriv.warn pluto[26492]: NAT-Traversal support [enabled]</div><div>
Jan 1 00:29:56 (none) authpriv.warn pluto[26492]: using /dev/urandom as source of random entropy</div><div>Jan 1 00:29:56 (none) authpriv.warn pluto[26492]: ike_alg_register_enc(): Activating OAKLEY_TWOFISH_CBC_SSH: Ok (ret=0)</div>
<div>Jan 1 00:29:56 (none) authpriv.warn pluto[26492]: ike_alg_register_enc(): Activating OAKLEY_TWOFISH_CBC: Ok (ret=0)</div><div>Jan 1 00:29:56 (none) authpriv.warn pluto[26492]: ike_alg_register_enc(): Activating OAKLEY_SERPENT_CBC: Ok (ret=0)</div>
<div>Jan 1 00:29:56 (none) authpriv.warn pluto[26492]: ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0)</div><div>Jan 1 00:29:56 (none) authpriv.warn pluto[26492]: ike_alg_register_enc(): Activating OAKLEY_BLOWFISH_CBC: Ok (ret=0)</div>
<div>Jan 1 00:29:56 (none) authpriv.warn pluto[26492]: ike_alg_register_hash(): Activating OAKLEY_SHA2_512: Ok (ret=0)</div><div>Jan 1 00:29:56 (none) authpriv.warn pluto[26492]: ike_alg_register_hash(): Activating OAKLEY_SHA2_256: Ok (ret=0)</div>
<div>Jan 1 00:29:56 (none) authpriv.warn pluto[26492]: starting up 1 cryptographic helpers</div><div>Jan 1 00:29:56 (none) authpriv.warn pluto[26492]: started helper pid=26494 (fd:7)</div><div>Jan 1 00:29:56 (none) authpriv.warn pluto[26492]: Kernel interface auto-pick</div>
<div>Jan 1 00:29:56 (none) authpriv.warn pluto[26492]: Using Linux 2.6 IPsec interface code on 2.6.37-svn3005 (experimental code)</div><div>Jan 1 00:29:56 (none) authpriv.err pluto[26492]: FATAL ERROR: socket() in init_netlink(). Errno 93: Protocol not supported</div>
<div>Jan 1 00:29:56 (none) authpriv.warn pluto[26492]: leak: pluto helpers, item size: 40</div><div>Jan 1 00:29:56 (none) authpriv.warn pluto[26492]: leak: 2 * hasher name, item size: 16</div><div>Jan 1 00:29:56 (none) authpriv.warn pluto[26492]: leak: 3 * struct event in event_schedule(), item size: 16</div>
<div>Jan 1 00:29:56 (none) authpriv.warn pluto[26492]: leak: private_net_ok subnets, item size: 128</div><div>Jan 1 00:29:56 (none) authpriv.warn pluto[26492]: leak: ipsecdir, item size: 13</div><div>Jan 1 00:29:56 (none) authpriv.warn pluto[26492]: leak detective found 8 leaks, total size 213</div>
<div>Jan 1 00:29:56 (none) authpriv.warn pluto[26494]: using /dev/urandom as source of random entropy</div><div>Jan 1 00:29:56 (none) authpriv.warn pluto[26494]: pluto_crypto_helper: helper (0) is normal exiting </div>
<div>Jan 1 00:29:56 (none) daemon.err ipsec__plutorun: whack: Pluto is not running (no "/var/run/pluto/pluto.ctl")</div><div>Jan 1 00:29:56 (none) daemon.err ipsec__plutorun: !pluto failure!: exited with error status 1</div>
<div>Jan 1 00:29:56 (none) daemon.err ipsec__plutorun: restarting IPsec after pause...</div><div><br></div><div>-SP</div><br><div class="gmail_quote">On Fri, Sep 30, 2011 at 2:44 PM, satpal parmar <span dir="ltr"><<a href="mailto:systems.satpal@gmail.com">systems.satpal@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><font face="arial, helvetica, sans-serif">Well it seems I was able to make some progress after using the lucid explanation of this behavior here :</font><a href="http://www.gentoo-wiki.info/HOWTO_OpenSwan_2.6_kernel" target="_blank"><font face="arial, helvetica, sans-serif">http://www.gentoo-wiki.info/HOWTO_OpenSwan_2.6_kernel</font></a><div>
<font face="arial, helvetica, sans-serif"><br></font></div><div><font face="arial, helvetica, sans-serif">Arm on my board is running at 600 mhz which might be slow for key generation operation.Moreover I was getting zero entropy for /proc/sys/kernel/random/entropy_avail. So I used the solution mention in link i.e convert use urandom instead of random in </font><span style="line-height:24px"><font face="arial, helvetica, sans-serif">/usr/libexec/ipsec/newhostkey. It generated ipsec.secrets in jiffies.</font></span></div>
<div><span style="line-height:24px"><font face="arial, helvetica, sans-serif"><br></font></span></div><div><font face="arial, helvetica, sans-serif"><span style="line-height:24px"></span></font><span style="line-height:24px"><font face="arial, helvetica, sans-serif">But for some reason lord pluto was not happy and I got message: </font></span><span style="line-height:24px"><font face="arial, helvetica, sans-serif">ipsec_setup: whack: Pluto is not running (no "/var/run/pluto/pluto.ctl")</font></span></div>
<div><span style="line-height:24px"><font face="arial, helvetica, sans-serif">I goggled for error and someone suggested looking in </font></span><span style="white-space:pre-wrap"><font face="arial, helvetica, sans-serif">/var/log/secure but there is no /var/log/secure.</font></span></div>
<div><span style="white-space:pre-wrap"><font face="arial, helvetica, sans-serif"><br></font></span></div><div><span style="white-space:pre-wrap"><font face="arial, helvetica, sans-serif">Any hint? </font></span></div>
<div><span style="white-space:pre-wrap"><font face="arial, helvetica, sans-serif"><br></font></span></div><div><span style="white-space:pre-wrap"><font face="arial, helvetica, sans-serif">-SP</font></span></div>
<div><font color="#008000" face="monospace"><span style="line-height:24px;font-size:medium"><br></span></font></div><div><br><div class="gmail_quote">On Fri, Sep 30, 2011 at 12:41 PM, satpal parmar <span dir="ltr"><<a href="mailto:systems.satpal@gmail.com" target="_blank">systems.satpal@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Something is really fishy. <div><br></div><div>I can see a ipsec.secrets.new file getting created in etc and with growing ' RSA {' entries. </div>
<div>Something like:</div><div><br></div><div><div>: RSA {</div>
<div>: RSA {</div><div>: RSA {</div><div>: RSA {</div><div>: RSA {</div><div>: RSA {</div><div>: RSA {</div><div>: RSA </div></div><div><br></div><div>I know about ipsec.secrets but ipsec.secrets.new is something I read about. </div>
<div><br></div><div>I am not sure how useful is this info but thought of share it with you all. Still clueless about whats going on.</div><div><br></div><font color="#888888"><div>-SP </div></font><div><div></div><div>
<div><br><div class="gmail_quote">On Fri, Sep 30, 2011 at 10:59 AM, satpal parmar <span dir="ltr"><<a href="mailto:systems.satpal@gmail.com" target="_blank">systems.satpal@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi all<div><br></div><div>I am trying to port IPsec 2.6.33 on ARM11 soc running linux kernel 2.6.37 (Netkey IPsec stack). I am experiencing strange behavior.When I start ipsec (/etc/init.d/ipsec start) console become unresponsive for long period of time (5+min). I run same thing in background and check the output of ps and I observed this: </div>
<div><br></div><div><div>58 root 0:00 /bin/sh /usr/local/lib/ipsec/_plutorun --debug --uniquei</div><div> 962 root 0:00 /bin/sh /usr/local/libexec/ipsec/newhostkey --quiet</div><div> 971 root 0:00 /bin/sh /usr/local/libexec/ipsec/newhostkey --quiet</div>
<div> 972 root 0:00 /bin/sh /usr/local/libexec/ipsec/newhostkey --quiet</div><div> 973 root 0:00 cat</div><div> 974 root 0:00 /usr/local/libexec/ipsec/rsasigkey --random /dev/random 2</div><div> 988 root 0:00 /bin/sh /usr/local/libexec/ipsec/setup restart</div>
<div> 1047 root 0:00 logger -s -p daemon.error -t ipsec_setup</div><div> 1131 root 0:00 /bin/sh /usr/local/lib/ipsec/_plutorun --debug --uniquei</div><div> 1135 root 0:00 /bin/sh /usr/local/libexec/ipsec/newhostkey --quiet</div>
<div> 1136 root 0:00 /bin/sh /usr/local/libexec/ipsec/newhostkey --quiet</div><div> 1137 root 0:00 /bin/sh /usr/local/libexec/ipsec/newhostkey --quiet</div><div> 1138 root 0:00 cat</div><div> 1146 root 0:00 /usr/local/libexec/ipsec/rsasigkey --random /dev/random 2</div>
<div> 1161 root 0:00 /bin/sh /usr/local/libexec/ipsec/setup restart</div><div> 1222 root 0:00 logger -s -p daemon.error -t ipsec_setup</div><div> 1306 root 0:00 /bin/sh /usr/local/lib/ipsec/_plutorun --debug --uniquei</div>
<div> 1318 root 0:00 /bin/sh /usr/local/libexec/ipsec/newhostkey --quiet</div><div> 1323 root 0:00 /bin/sh /usr/local/libexec/ipsec/newhostkey --quiet</div><div> 1324 root 0:00 /bin/sh /usr/local/libexec/ipsec/newhostkey --quiet</div>
<div> 1325 root 0:00 cat</div><div> 1326 root 0:00 /usr/local/libexec/ipsec/rsasigkey --random /dev/random 2</div><div> 1336 root 0:00 /bin/sh /usr/local/libexec/ipsec/setup restart</div><div> 1395 root 0:00 logger -s -p daemon.error -t ipsec_setup</div>
<div> 1479 root 0:00 /bin/sh /usr/local/lib/ipsec/_plutorun --debug --uniquei</div><div> 1481 root 0:00 /bin/sh /usr/local/libexec/ipsec/newhostkey --quiet</div><div> 1482 root 0:00 /bin/sh /usr/local/libexec/ipsec/newhostkey --quiet</div>
<div> 1483 root 0:00 /bin/sh /usr/local/libexec/ipsec/newhostkey --quiet</div></div><div><br></div><div>Is it an expected behavior? Is anything missing? </div><div><br></div><div>I do not have perl support on my setup so I can not use verfy. </div>
<div><br></div><div>Ipsec status giving me a cryptic response:</div><div><br></div><div><span style="font-family:verdana, geneva, lucida, 'lucida grande', arial, helvetica, sans-serif, sans;font-size:11px"># ipsec setup --status<br>
IPsec stopped<br>but...<br>has subsystem lock (/var/lock/subsys/ipsec)!</span></div><div><br></div><div>Anyone got any Idea whats going on? Any help will be highly appreciated.</div><div><br></div><font color="#888888"><div>
-SP</div>
</font></blockquote></div><br></div>
</div></div></blockquote></div><br></div>
</blockquote></div><br></div>