[Openswan Users] pluto core dump IKEv2 openswan 2.6.41

Alan Chester amcheste at gmail.com
Tue Aug 19 13:40:36 EDT 2014


Hello,

I am currently seeing an issue with pluto core dumping when using IKEv2.  I
am using openswan version 2.6.41.

Here is my current setup please let me know if I have something configured
in correctly:


 /etc/ipsec.conf - Openswan IPsec configuration file
#
# Manual:     ipsec.conf.5
#
# Please place your own config files in /etc/ipsec.d/ ending in .conf

version 2.0     # conforms to second version of ipsec.conf specification

# basic configuration
config setup
        # Debug-logging controls:  "none" for (almost) none, "all" for lots.
        # klipsdebug=none
        # plutodebug="control parsing"
        # For Red Hat Enterprise Linux and Fedora, leave protostack=netkey
        protostack=netkey
        nat_traversal=yes
        virtual_private=
        oe=off
        plutostderrlog=/var/log/ipsec.log
        dumpdir=/var/TKLC/core
        plutorestartoncrash=no
        # Enable this if you see "failed to find any available worker"
        # nhelpers=0

#You may put your configuration (.conf) file in the "/etc/ipsec.d/" and
uncomment this.
include /etc/ipsec.d/*.conf


Box A:
>From test.conf:
conn test
  left=192.168.165.70
  pfs=yes
  keylife=15m
  ikev2=yes
  authby=secret
  right=192.168.165.74
  auto=start
  type=tunnel
  ike=aes128-sha1;modp2048
  phase2alg=aes128-sha1

Box B:
>From test.conf:
conn test
  left=192.168.165.74
  pfs=yes
  keylife=15m
  ikev2=yes
  authby=secret
  right=192.168.165.70
  auto=start
  type=tunnel
  ike=aes128-sha1;modp2048
  phase2alg=aes128-sha1

The connection will successfully come up and function for a while but
eventually pluto will core dump.  I notice the failure faster the lower my
keylife is.

I noticed the following in /var/log/messages:
Aug 17 04:18:20 localhost ipsec_setup: Starting Openswan IPsec
U2.6.32/K2.6.32-431.17.1.el6prerel7.0.0.0.0_86.7.0.x86_64...
Aug 17 04:18:20 localhost ipsec_setup: Using NETKEY(XFRM) stack
Aug 17 04:18:20 localhost kernel: padlock: VIA PadLock not detected.
Aug 17 04:18:20 localhost kernel: padlock: VIA PadLock Hash Engine not
detected.
Aug 17 04:18:20 localhost kernel: padlock: VIA PadLock not detected.
Aug 17 04:18:20 localhost ipsec_setup: ...Openswan IPsec started
Aug 17 04:18:20 localhost pluto: adjusting ipsec.d to /etc/ipsec.d
Aug 17 04:18:21 localhost ipsec__plutorun: 002 added connection description
"test"
Aug 17 04:18:21 localhost ipsec__plutorun: 133 "test" #1: STATE_PARENT_I1:
initiate
Aug 17 04:27:06 localhost rsyslogd: -- MARK --
Aug 17 04:42:06 localhost rsyslogd: -- MARK --
Aug 17 04:57:06 localhost rsyslogd: -- MARK --
Aug 17 05:12:06 localhost rsyslogd: -- MARK --
Aug 17 05:14:25 localhost kernel: pluto[5829]: segfault at 0 ip
00007f87e7f0e676 sp 00007fffdb0aa3c0 error 4 in pluto[7f87e7ea3000+fd000]
Aug 17 05:14:25 localhost ipsec__plutorun: /usr/libexec/ipsec/_plutorun:
line 250:  5829 Segmentation fault      /usr/libexec/ipsec/pluto --nofork
--secretsfile /etc/ipsec.secrets --ipsecdir /etc/ipsec.d --use-netkey
--uniqueids --nat_traversal --virtual_private oe=off --stderrlog 2>>
/var/log/ipsec.log
Aug 17 05:14:25 localhost ipsec__plutorun: !pluto failure!:  exited with
error status 139 (signal 11)
Aug 17 05:14:25 localhost ipsec__plutorun: restarting IPsec after pause...
Aug 17 05:14:35 localhost ipsec_setup: Stopping Openswan IPsec...
Aug 17 05:14:35 localhost ipsec_setup: Removing orphaned
/var/run/pluto/pluto.pid:
Aug 17 05:14:35 localhost ipsec_setup: ...Openswan IPsec stopped

The following is from /var/log/ipsec:
...
"test" #1: initiating v2 parent SA
"test" #1: transition from state STATE_IKEv2_START to state STATE_PARENT_I1
"test" #1: STATE_PARENT_I1: sent v2I1, expected v2R1
"test" #2: transition from state STATE_PARENT_I1 to state STATE_PARENT_I2
"test" #2: STATE_PARENT_I2: sent v2I2, expected v2R2 {auth=IKEv2
cipher=aes_128 integ=sha1_96 prf=oakley_sha group=modp2048}
| found connection: test
"test" #3: transition from state STATE_IKEv2_START to state STATE_PARENT_R1
"test" #3: STATE_PARENT_R1: received v2I1, sent v2R1 {auth=IKEv2
cipher=aes_128 integ=sha1_96 prf=oakley_sha group=modp2048}
"test" #3: IKEv2 mode peer ID is ID_IPV4_ADDR: '192.168.165.70'
| CHILD SA proposals received
"test" #3: PAUL: this is where we have to check the TSi/TSr
| printing contents struct traffic_selector
|   ts_type: IKEv2_TS_IPV4_ADDR_RANGE
|   ipprotoid: 0
|   startport: 0
|   endport: 65535
|   ip low: 192.168.165.74
|   ip high: 192.168.165.74
| printing contents struct traffic_selector
|   ts_type: IKEv2_TS_IPV4_ADDR_RANGE
|   ipprotoid: 0
|   startport: 0
|   endport: 65535
|   ip low: 192.168.165.70
|   ip high: 192.168.165.70
"test" #4: transition from state STATE_PARENT_R1 to state STATE_PARENT_R2
"test" #4: negotiated tunnel [192.168.165.74,192.168.165.74:0-65535 0] ->
[192.168.165.70,192.168.165.70:0-65535 0]
"test" #4: STATE_PARENT_R2: received v2I2, PARENT SA established tunnel
mode {ESP=>0x14aeeb9a <0x36b9246b xfrm=AES_128-HMAC_SHA1 NATOA=none
NATD=none DPD=none}
| releasing whack for #4 (sock=-1)
| releasing whack for #3 (sock=-1)
"test" #5: initiating Main Mode
pluto_crypto_helper: helper (2) is  normal exiting
...

The following backtrace was created from the core file:

Core file created at UTC: 1408373805.
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
[New Thread 5708]
[Thread debugging using libthread_db enabled]
Core was generated by `/usr/libexec/ipsec/pluto --nofork --secretsfile
/etc/ipsec.secrets --ipsecdir /'.
Program terminated with signal 11, Segmentation fault.
#0  0x00007fd4bd53e311 in oakley_alg_makedb (ai=<value optimized out>,
base=0x7fd4bd7c8620, maxtrans=-1) at
/scratchpad/workdirs/achester/build/RPM/BUILD/openswan-2.6.41/programs/pluto/spdb_struct.c:191
191
/scratchpad/workdirs/achester/build/RPM/BUILD/openswan-2.6.41/programs/pluto/spdb_struct.c:
No such file or directory.
        in
/scratchpad/workdirs/achester/build/RPM/BUILD/openswan-2.6.41/programs/pluto/spdb_struct.c

Thread 1 (Thread 0x7fd4bd4cb700 (LWP 5708)):
#0  0x00007fd4bd53e311 in oakley_alg_makedb (ai=<value optimized out>,
base=0x7fd4bd7c8620, maxtrans=-1) at
/scratchpad/workdirs/achester/build/RPM/BUILD/openswan-2.6.41/programs/pluto/spdb_struct.c:191
        hash = <value optimized out>
        auth = 0x7fd4bdd5a3d0
        grp = <value optimized out>
        enc = <value optimized out>
        enc_keylen = <value optimized out>
        new_auth = <value optimized out>
        trans = 0x7fd4bdd5a3a0
        prop = 0x7fd4bdd5a380
        cprop = 0x7fd4bdd5c540
        gsp = <value optimized out>
        emp_sp = 0x7fd4bdd5a350
        ike_info = <value optimized out>
        ealg = 7
        halg = 2
        modp = <value optimized out>
        eklen = <value optimized out>
        last_modp = <value optimized out>
        wrong_modp = <value optimized out>
        enc_desc = <value optimized out>
        transcnt = <value optimized out>
        i = <value optimized out>
#1  0x00007fd4bd5418cf in out_sa (outs=0x7fff24fcdb08, sadb=0x7fd4bd7c8620,
st=0x7fd4bdd5d420, oakley_mode=1, aggressive_mode=<value optimized out>,
np=13 '\r') at
/scratchpad/workdirs/achester/build/RPM/BUILD/openswan-2.6.41/programs/pluto/spdb_v1_struct.c:259
        sa_pbs = {container = 0x7fff24fce76c, desc = 0x7fff24fcdb08, name =
0x7fff24fce750 "\257\264\017Q\372\312R\306", start = 0x0, cur = 0x53f2142d
<Address 0x53f2142d out of bounds>, roof = 0x0, lenfld = 0x7fd4bd7e27a0 "",
lenfld_desc = 0x7fd4bd7c33d0}
        pcn = <value optimized out>
        ret = 0
        ah_spi_generated = 0
        esp_spi_generated = 0
        ipcomp_cpi_generated = 0
        revised_sadb = <value optimized out>
#2  0x00007fd4bd515243 in main_outI1 (whack_sock=<value optimized out>,
c=0x7fd4bdd56f60, predecessor=0x0, policy=<value optimized out>,
try=140551688890300, importance=<value optimized out>) at
/scratchpad/workdirs/achester/build/RPM/BUILD/openswan-2.6.41/programs/pluto/ikev1_main.c:192
        sa_start = 0x7fd4bd7d27bc "$"
        np = 13
        st = 0x7fd4bdd5d420
#3  0x00007fd4bd50a98b in handle_next_timer_event () at
/scratchpad/workdirs/achester/build/RPM/BUILD/openswan-2.6.41/programs/pluto/timer.c:584
        c = <value optimized out>
        newest = <value optimized out>
        ev = 0x7fd4bdd5c990
        tm = 1408373805
        type = 5
        st = 0x7fd4bdd5ca90
#4  0x00007fd4bd50ad7a in handle_timer_event () at
/scratchpad/workdirs/achester/build/RPM/BUILD/openswan-2.6.41/programs/pluto/timer.c:435
        tm = <value optimized out>
        ev = <value optimized out>
        type = 5
#5  0x00007fd4bd5088e1 in call_server () at
/scratchpad/workdirs/achester/build/RPM/BUILD/openswan-2.6.41/programs/pluto/server.c:806
        readfds = {__osfds_bits = {0 <repeats 128 times>}}
        writefds = {__osfds_bits = {0 <repeats 128 times>}}
        ndes = <value optimized out>
        ifp = <value optimized out>
#6  0x00007fd4bd50567a in main (argc=12, argv=0x7fff24fcf488) at
/scratchpad/workdirs/achester/build/RPM/BUILD/openswan-2.6.41/programs/pluto/plutomain.c:1110
        fork_desired = <value optimized out>
        lockfd = -1119045976
        ocspuri = 0x0
        nhelpers = -1
        coredir = <value optimized out>
        oco = 0x7fd4bd7d22a0
        nat_traversal = 1
        nat_t_spf = 1
        keep_alive = 0
        force_keepalive = 0
        virtual_private = 0x7fff24fd0c56 "oe=off"

Is there something wrong with my configuration?  I am just passing ICMP
traffic.  I do not notice this area with IKEv1.


Alan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openswan.org/pipermail/users/attachments/20140819/ead74677/attachment.html>


More information about the Users mailing list