[Openswan Users] Assertion failure in Openswan

[Twum K. Djin]

I am unable to establish an IPSEC tunnel with a mac client because an assern failure occurs. The particular error message is:

ASSERTION FAILED at kernel.c:2402: c->kind == CK_PERMANENT || c->kind == CK_INSTANCE

Subsequently Openswan lists a number of parameters and restarts.

Does anyone have any idea what might be wrong?

I have included out the ipsec log below:

Mar 29 20:15:20 dhcp-xxx-xx pluto[5171]: "sample" #1: responding to Main Mode
Mar 29 20:15:20 dhcp-xxx-xx pluto[5171]: "sample" #1: transition from state (null) to state STATE_MAIN_R1
Mar 29 20:15:20 dhcp-xxx-xx pluto[5171]: "sample" #1: ignoring Vendor ID payload [KAME/racoon]
Mar 29 20:15:20 dhcp-xxx-xx pluto[5171]: "sample" #1: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
Mar 29 20:15:20 dhcp-xxx-xx pluto[5171]: "sample" #1: Peer ID is ID_IPV4_ADDR: '129.170.yyy.yyy'
Mar 29 20:15:20 dhcp-xxx-xx pluto[5171]: "sample" #1: I did not send a certificate because I do not have one.
Mar 29 20:15:20 dhcp-xxx-xx pluto[5171]: "sample" #1: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3
Mar 29 20:15:20 dhcp-xxx-xx pluto[5171]: "sample" #1: sent MR3, ISAKMP SA established
Mar 29 20:15:21 dhcp-xxx-xx pluto[5171]: "sample" #2: responding to Quick Mode
Mar 29 20:15:21 dhcp-xxx-xx pluto[5171]: "sample" #2: ASSERTION FAILED at kernel.c:2402: c->kind == CK_PERMANENT || c->kind == CK_INSTANCE
Mar 29 20:15:21 dhcp-xxx-xx pluto[5171]: "sample" #2: interface ipsec0/eth0 129.170.xxx.xx
Mar 29 20:15:21 dhcp-xxx-xx pluto[5171]: "sample" #2: %myid = (none)
Mar 29 20:15:21 dhcp-xxx-xx pluto[5171]: "sample" #2: debug none
Mar 29 20:15:21 dhcp-xxx-xx pluto[5171]: "sample" #2:  
Mar 29 20:15:21 dhcp-xxx-xx pluto[5171]: "sample" #2: algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=64, keysizemin=168, keysizemax=168
Mar 29 20:15:21 dhcp-xxx-xx pluto[5171]: "sample" #2: algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=128, keysizemin=128, keysizemax=256
Mar 29 20:15:21 dhcp-xxx-xx pluto[5171]: "sample" #2: algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5, keysizemin=128, keysizemax=128
Mar 29 20:15:21 dhcp-xxx-xx pluto[5171]: "sample" #2: algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1, keysizemin=160, keysizemax=160
Mar 29 20:15:21 dhcp-xxx-xx pluto[5171]: "sample" #2:  
Mar 29 20:15:21 dhcp-xxx-xx pluto[5171]: "sample" #2: algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16, keydeflen=128
Mar 29 20:15:21 dhcp-xxx-xx pluto[5171]: "sample" #2: algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8, keydeflen=192
Mar 29 20:15:21 dhcp-xxx-xx pluto[5171]: "sample" #2: algorithm IKE hash: id=2, name=OAKLEY_SHA, hashsize=20
Mar 29 20:15:21 dhcp-xxx-xx pluto[5171]: "sample" #2: algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16
Mar 29 20:15:21 dhcp-xxx-xx pluto[5171]: "sample" #2: algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024
Mar 29 20:15:21 dhcp-xxx-xx pluto[5171]: "sample" #2: algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536
Mar 29 20:15:21 dhcp-xxx-xx pluto[5171]: "sample" #2: algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048
Mar 29 20:15:21 dhcp-xxx-xx pluto[5171]: "sample" #2: algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072
Mar 29 20:15:21 dhcp-xxx-xx pluto[5171]: "sample" #2: algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096
Mar 29 20:15:21 dhcp-xxx-xx pluto[5171]: "sample" #2: algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144
Mar 29 20:15:21 dhcp-xxx-xx pluto[5171]: "sample" #2: algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192
Mar 29 20:15:21 dhcp-xxx-xx pluto[5171]: "sample" #2:  
Mar 29 20:15:21 dhcp-xxx-xx pluto[5171]: "sample" #2: stats db_ops.c: {curr_cnt, total_cnt, maxsz} :context={0,0,0} trans={0,0,0} attrs={0,0,0} 
Mar 29 20:15:21 dhcp-xxx-xx pluto[5171]: "sample" #2:  
Mar 29 20:15:21 dhcp-xxx-xx pluto[5171]: "sample" #2: "sample": 129.170.xxx.xx:17/1701...129.170.yyy.yyy:17/49568; unrouted; eroute owner: #0
Mar 29 20:15:21 dhcp-xxx-xx pluto[5171]: "sample" #2: "sample":   ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 3
Mar 29 20:15:21 dhcp-xxx-xx pluto[5171]: "sample" #2: "sample":   policy: PSK+ENCRYPT+TUNNEL; prio: 32,32; interface: eth0; 
Mar 29 20:15:21 dhcp-xxx-xx pluto[5171]: "sample" #2: "sample":   newest ISAKMP SA: #1; newest IPsec SA: #0; 
Mar 29 20:15:21 dhcp-xxx-xx pluto[5171]: "sample" #2: "sample":   IKE algorithms wanted: 5_000-1-5, 5_000-1-2, 5_000-2-5, 5_000-2-2, flags=-strict
Mar 29 20:15:21 dhcp-xxx-xx pluto[5171]: "sample" #2: "sample":   IKE algorithms found:  5_192-1_128-5, 5_192-1_128-2, 5_192-2_160-5, 5_192-2_160-2, 
Mar 29 20:15:21 dhcp-xxx-xx pluto[5171]: "sample" #2: "sample":   IKE algorithm newest: 3DES_CBC_192-SHA-MODP1024
Mar 29 20:15:21 dhcp-xxx-xx pluto[5171]: "sample" #2: "sample":   ESP algorithms wanted: 3_000-1, 3_000-2, flags=-strict
Mar 29 20:15:21 dhcp-xxx-xx pluto[5171]: "sample" #2: "sample":   ESP algorithms loaded: 3_000-1, 3_000-2, flags=-strict
Mar 29 20:15:21 dhcp-xxx-xx pluto[5171]: "sample" #2:  
Mar 29 20:15:32 dhcp-xxx-xx ipsec__plutorun: Restarting Pluto subsystem...
Mar 29 20:15:32 dhcp-xxx-xx pluto[5404]: Starting Pluto (Openswan Version 2.2.1 X.509-1.5.4 PLUTO_USES_KEYRR)
Mar 29 20:15:32 dhcp-xxx-xx pluto[5404]:   including NAT-Traversal patch (Version 0.6c) [disabled]
Mar 29 20:15:32 dhcp-xxx-xx pluto[5404]: ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0)
Mar 29 20:15:32 dhcp-xxx-xx pluto[5404]: Using KLIPS IPsec interface code
Mar 29 20:15:32 dhcp-xxx-xx pluto[5404]: Changing to directory '/etc/ipsec.d/cacerts'
Mar 29 20:15:32 dhcp-xxx-xx pluto[5404]: Changing to directory '/etc/ipsec.d/aacerts'
Mar 29 20:15:32 dhcp-xxx-xx pluto[5404]: Changing to directory '/etc/ipsec.d/ocspcerts'
Mar 29 20:15:32 dhcp-xxx-xx pluto[5404]: Changing to directory '/etc/ipsec.d/crls'
Mar 29 20:15:32 dhcp-xxx-xx pluto[5404]:   Warning: empty directory
Mar 29 20:15:32 dhcp-xxx-xx pluto[5404]: Changing to directory '/etc/ipsec.d/acerts'
Mar 29 20:15:32 dhcp-xxx-xx pluto[5404]: added connection description "sample"
Mar 29 20:15:32 dhcp-xxx-xx pluto[5404]: listening for IKE messages
Mar 29 20:15:32 dhcp-xxx-xx pluto[5404]: adding interface ipsec0/eth0 129.170.xxx.xx
Mar 29 20:15:32 dhcp-xxx-xx pluto[5404]: loading secrets from "/etc/ipsec.secrets"
Mar 29 20:15:33 dhcp-xxx-xx pluto[5404]: packet from 129.170.yyy.yyy:500: Quick Mode message is for a non-existent (expired?) ISAKMP SA
Mar 29 20:16:07 dhcp-xxx-xx last message repeated 6 times
Mar 29 20:16:17 dhcp-xxx-xx last message repeated 3 times