[Openswan Users] ipsec subsyslock cann't be created.

Mon Aug 31 22:34:33 EDT 2009

 
on 2009-08-31，"Paul Wouters" <paul at xelerance.com> wrote：
>On Mon, 31 Aug 2009, weiruyao wrote:
>
>> Every thing is OK ,I see "IPsec SA established" from logs.And?packets encapsulated with ESP are going up and down.But when I excute "ipsec setup --status " the result is:
>> /tmp/run/pluto $ /ipsec/sbin/ipsec setup --status
>> IPsec stopped
>> but...
>
>I believe there was a bug in that script false claiming so in the past. What
>version is this?
It's openswan-2.6.23dr1.I have checked the script file in _realsetup.The pseudocode is below :
if test "$hassublock" -a "$haslock" -a "$plutokind" = "normal" -a \( "$klips" = "yes" -o "$lk26sec" = "yes" \)? -a "$hasinfo"
then
    .....
else
   echo "IPsec stopped"
   if test ! "$hassublock" -a ! "$hasinfo" -a "$plutokind" = "no" -a "$eroutes" -eq 0
    then
        exit 3
    fi
    if test "$hassublock"
    then 
        has subsystem lock
     fi
    if test "$hasinfo"
    then
        has info file
    if
    if test "$plutokind" != "no"
    then
        An ${plutokind} Pluto is active?
    fi
    if test "$eroutes" -gt 0
    then
        some (${eroutes}) eroutes exist!
    fi
fi
I have check the variables in the script above ,"$hassublock" is false ,so it goes to "IPsec stopped".After IPsec SA established ,"/var/lock/subsys/ipsec" didn't exist,so the $hassublock is false.
>
>> has /var/run/pluto/ipsec.info file!
>> An normal Pluto is active?
>> some (1) eroutes exist!
>> I can give you more info:
>> "plutopid=/var/run/pluto/pluto.pid" exists;
>> "lock=/var/run/pluto/ipsec_setup.pid" exists;
>> "info=/var/run/pluto/ipsec.info" exists;
>> plutokind is normal,because "/proc/31282" (31282 is the pid of the pluto)exists
>> "/var/lock/subsys/ipsec" doesn't exists; I think this may be the reason.
>> Can any one help me?Thanks very much.
>
>You can get other information on whether it is running using: ipsec auto --status
>
>Paul
I confirm that it's running ,I excute ipsec auto --status :
/ipsec/conf $ /ipsec/sbin/ipsec auto --status
000 using kernel interface: netkey
000 interface lo/lo 127.0.0.1
000 interface lo/lo 127.0.0.1
000 interface eth0/eth0 192.168.1.3
000 interface eth0/eth0 192.168.1.3
000 interface ppp0/ppp0 200.1.1.1
000 interface ppp0/ppp0 200.1.1.1
000 %myid = (none)
000 debug none
000? 
000 virtual_private (%priv):
000 - allowed 0 subnets: 
000 - disallowed 0 subnets: 
000 WARNING: Either virtual_private= was not specified, or there was a syntax 
000????????? error in that line. 'left/rightsubnet=%priv' will not work!
000? 
000 algorithm ESP encrypt: id=2, name=ESP_DES, ivlen=8, keysizemin=64, keysizemax=64
000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=8, keysizemin=192, keysizemax=192
000 algorithm ESP encrypt: id=7, name=ESP_BLOWFISH, ivlen=8, keysizemin=40, keysizemax=448
000 algorithm ESP encrypt: id=11, name=ESP_NULL, ivlen=0, keysizemin=0, keysizemax=0
000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=14, name=ESP_AES_CCM_A, ivlen=8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=15, name=ESP_AES_CCM_B, ivlen=8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=16, name=ESP_AES_CCM_C, ivlen=8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=18, name=ESP_AES_GCM_A, ivlen=8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=19, name=ESP_AES_GCM_B, ivlen=8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=20, name=ESP_AES_GCM_C, ivlen=8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=22, name=ESP_CAMELLIA, ivlen=8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=252, name=ESP_SERPENT, ivlen=8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=253, name=ESP_TWOFISH, ivlen=8, keysizemin=128, keysizemax=256
000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5, keysizemin=128, keysizemax=128
000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1, keysizemin=160, keysizemax=160
000 algorithm ESP auth attr: id=5, name=AUTH_ALGORITHM_HMAC_SHA2_256, keysizemin=256, keysizemax=256
000 algorithm ESP auth attr: id=9, name=AUTH_ALGORITHM_AES_CBC, keysizemin=128, keysizemax=128
000 algorithm ESP auth attr: id=251, name=(null), keysizemin=0, keysizemax=0
000? 
000 algorithm IKE encrypt: id=0, name=(null), blocksize=16, keydeflen=131
000 algorithm IKE encrypt: id=3, name=OAKLEY_BLOWFISH_CBC, blocksize=8, keydeflen=128
000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8, keydeflen=192
000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: id=65004, name=OAKLEY_SERPENT_CBC, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: id=65005, name=OAKLEY_TWOFISH_CBC, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: id=65289, name=OAKLEY_TWOFISH_CBC_SSH, blocksize=16, keydeflen=128
000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16
000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20
000 algorithm IKE hash: id=4, name=OAKLEY_SHA2_256, hashsize=32
000 algorithm IKE hash: id=6, name=OAKLEY_SHA2_512, hashsize=64
000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024
000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536
000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048
000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072
000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096
000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144
000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192
000? 
000 stats db_ops: {curr_cnt, total_cnt, maxsz} :context={0,0,0} trans={0,0,0} attrs={0,0,0} 
000? 
000 "tunnelipsec": 10.69.1.0/24===200.1.1.1<200.1.1.1>[+S=C]...200.1.1.2<200.1.1.2>[+S=C]===10.7.3.0/24; erouted; eroute owner: #4
000 "tunnelipsec":???? myip=unset; hisip=unset;
000 "tunnelipsec":?? ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0
000 "tunnelipsec":?? policy: PSK+ENCRYPT+TUNNEL+PFS+UP+IKEv2ALLOW+lKOD+rKOD; prio: 24,24; interface: ppp0; 
000 "tunnelipsec":?? newest ISAKMP SA: #1; newest IPsec SA: #4; 
000 "tunnelipsec":?? IKE algorithm newest: 3DES_CBC_192-MD5-MODP1024
000? 
000 #4: "tunnelipsec":500 STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 28121s; newest IPSEC; eroute owner; isakmp#1; idle; import:admin initiate
000 #4: "tunnelipsec" esp.6ceb0cf1 at 200.1.1.2esp.d2fe7bd9@200.1.1.1tun.0 at 200.1.1.2tun.0@200.1.1.1 ref=0 refhim=4294901761
000 #1: "tunnelipsec":500 STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 2488s; newest ISAKMP; lastdpd=-1s(seq in:0 out:0); idle; import:admin initiate
000? 
Thank you Paul.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.openswan.org/pipermail/users/attachments/20090901/caaf7521/attachment-0001.html