[Users] Peer client ID returned doesn't match...

Richard Sbarro Tue, 19 Aug 2003 12:35:26 -0700

Hey all,

I was wondering if anyone on the list could possibly point me in the right direction here. I'm trying to connect to a Linksys VPN router at a friend's house from my home office. When I try to bring the connection up I get the following:

bash-2.05b# ipsec auto --up doug
104 "doug" #14: STATE_MAIN_I1: initiate
106 "doug" #14: STATE_MAIN_I2: sent MI2, expecting MR2
108 "doug" #14: STATE_MAIN_I3: sent MI3, expecting MR3
004 "doug" #14: STATE_MAIN_I4: ISAKMP SA established
112 "doug" #15: STATE_QUICK_I1: initiate
003 "doug" #15: peer client ID returned doesn't match my proposal
218 "doug" #15: STATE_QUICK_I1: INVALID_ID_INFORMATION

Also (unrelated?), it doesn't appear that anything is getting logged to /var/log/secure. Not sure why that is, but I'm sort of a linux newbie (running Gentoo this time) so if you have any ideas why...

Thanks in advance, and please see below for the output of my ipsec barf...
Rich

g2linux Tue Aug 19 15:02:06 Local time zone must be set--see zic manual page 2003 + _________________________ version + ipsec --version Linux FreeS/WAN Usuper-freeswan-1.99_kb4/Ksuper-freeswan-1.99_kb3 See `ipsec --copyright' for copyright information. + _________________________ proc/version + cat /proc/version Linux version 2.4.20-xfs-r3 ([EMAIL PROTECTED]) (gcc version 3.2.3 20030422 (Gentoo Linux 1.4 3.2.3-r1, propolice)) #7 Sun Aug 17 14:24:28 Local time zone must be set--see zic manu + _________________________ proc/net/ipsec_eroute + sort +3 /proc/net/ipsec_eroute + _________________________ netstart-rn + netstat -nr Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface 192.168.0.0 0.0.0.0 255.255.255.0 U 40 0 0 eth0 192.168.0.0 0.0.0.0 255.255.255.0 U 40 0 0 ipsec0 127.0.0.0 127.0.0.1 255.0.0.0 UG 40 0 0 lo 0.0.0.0 192.168.0.1 0.0.0.0 UG 40 0 0 eth0 + _________________________ proc/net/ipsec_spi + cat /proc/net/ipsec_spi + _________________________ proc/net/ipsec_spigrp + cat /proc/net/ipsec_spigrp + _________________________ proc/net/ipsec_tncfg + cat /proc/net/ipsec_tncfg ipsec0 -> eth0 mtu=16260(1500) -> 1500 ipsec1 -> NULL mtu=0(0) -> 0 ipsec2 -> NULL mtu=0(0) -> 0 ipsec3 -> NULL mtu=0(0) -> 0 + _________________________ proc/net/pf_key + cat /proc/net/pf_key sock pid socket next prev e n p sndbf Flags Type St d4d6c800 10674 d51d91c4 0 0 0 0 2 65535 00000000 3 1 + _________________________ proc/net/pf_key-star + cd /proc/net + egrep '^' pf_key_registered pf_key_supported pf_key_registered:satype socket pid sk pf_key_registered: 2 d51d91c4 10674 d4d6c800 pf_key_registered: 3 d51d91c4 10674 d4d6c800 pf_key_registered: 9 d51d91c4 10674 d4d6c800 pf_key_registered: 10 d51d91c4 10674 d4d6c800 pf_key_supported:satype exttype alg_id ivlen minbits maxbits pf_key_supported: 2 14 3 0 160 160 pf_key_supported: 2 14 2 0 128 128 pf_key_supported: 3 15 3 64 168 168 pf_key_supported: 3 14 3 0 160 160 pf_key_supported: 3 14 2 0 128 128 pf_key_supported: 9 15 4 0 128 128 pf_key_supported: 9 15 3 0 32 128 pf_key_supported: 9 15 2 0 128 32 pf_key_supported: 9 15 1 0 32 32 pf_key_supported: 10 15 2 0 1 1 + _________________________ proc/sys/net/ipsec-star + cd /proc/sys/net/ipsec + egrep '^' debug_ah debug_eroute debug_esp debug_ipcomp debug_netlink debug_pfkey debug_radij debug_rcv debug_spi debug_tunnel debug_verbose debug_xform icmp inbound_policy_check tos debug_ah:-1 debug_eroute:-1 debug_esp:-1 debug_ipcomp:-1 debug_netlink:2147483647 debug_pfkey:-1 debug_radij:-1 debug_rcv:-1 debug_spi:-1 debug_tunnel:-1 debug_verbose:0 debug_xform:-1 icmp:1 inbound_policy_check:1 tos:1 + _________________________ ipsec/status + ipsec auto --status 000 interface ipsec0/eth0 192.168.0.4 000 000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=64, keysizemin=168, keysizemax=168 000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5, keysizemin=128, keysizemax=128 000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1, keysizemin=160, keysizemax=160 000 000 algorithm IKE encrypt: id=65289, name=OAKLEY_SSH_PRIVATE_65289, blocksize=16, keydeflen=128 000 algorithm IKE encrypt: id=65005, name=OAKLEY_TWOFISH_CBC, blocksize=16, keydeflen=128 000 algorithm IKE encrypt: id=65004, name=OAKLEY_SERPENT_CBC, blocksize=16, keydeflen=128 000 algorithm IKE encrypt: id=6, name=OAKLEY_CAST_CBC, blocksize=8, keydeflen=128 000 algorithm IKE encrypt: id=3, name=OAKLEY_BLOWFISH_CBC, blocksize=8, keydeflen=128 000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16, keydeflen=128 000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8, keydeflen=192 000 algorithm IKE hash: id=6, name=OAKLEY_SHA2_512, hashsize=64 000 algorithm IKE hash: id=4, name=OAKLEY_SHA2_256, hashsize=32 000 algorithm IKE hash: id=2, name=OAKLEY_SHA, hashsize=20 000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16 000 algorithm IKE dh group: id=1, name=OAKLEY_GROUP_MODP768, bits=768 000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024 000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536 (extension), bits=1536 000 algorithm IKE dh group: id=42048, name=OAKLEY_GROUP_MODP2048 (extension), bits=2048 000 algorithm IKE dh group: id=43072, name=OAKLEY_GROUP_MODP3072 (extension), bits=3072 000 algorithm IKE dh group: id=44096, name=OAKLEY_GROUP_MODP4096 (extension), bits=4096 000 000 stats db_ops.c: {curr_cnt, total_cnt, maxsz} :context={0,17,36} trans={0,17,96} attrs={0,17,160} 000 000 "doug": 192.168.0.0/24===192.168.0.4...67.80.95.17===192.168.1.0/32 000 "doug": ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 3 000 "doug": policy: PSK+ENCRYPT+TUNNEL+PFS+DISABLEARRIVALCHECK; interface: eth0; unrouted 000 "doug": newest ISAKMP SA: #14; newest IPsec SA: #0; eroute owner: #0 000 "doug": IKE algorithms wanted: 5_000-1-5, 5_000-2-5, 5_000-1-2, 5_000-2-2, 5_000-1-1, 5_000-2-1, flags=-strict 000 "doug": IKE algorithms found: 5_192-1_128-5, 5_192-2_160-5, 5_192-1_128-2, 5_192-2_160-2, 5_192-1_128-1, 5_192-2_160-1, 000 "doug": IKE algorithm newest: 3DES_CBC_192-MD5-MODP1024 000 "doug": ESP algorithms wanted: 3_000-1, flags=-strict 000 "doug": ESP algorithms loaded: 3_168-1_096, 000 000 #14: "doug" STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 2516s; newest ISAKMP 000 + _________________________ ifconfig-a + ifconfig -a eql Link encap:Serial Line IP MASTER MTU:576 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:5 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)

eth0 Link encap:Ethernet HWaddr 00:03:6D:11:0D:1A inet addr:192.168.0.4 Bcast:192.168.0.255 Mask:255.255.255.0 inet6 addr: fe80::203:6dff:fe11:d1a/10 Scope:Link UP BROADCAST NOTRAILERS RUNNING MULTICAST MTU:1500 Metric:1 RX packets:38131 errors:0 dropped:0 overruns:0 frame:0 TX packets:27194 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:51190781 (48.8 Mb) TX bytes:2242138 (2.1 Mb) Interrupt:10 Base address:0xb800

ipsec0 Link encap:Ethernet HWaddr 00:03:6D:11:0D:1A inet addr:192.168.0.4 Mask:255.255.255.0 inet6 addr: fe80::203:6dff:fe11:d1a/10 Scope:Link UP RUNNING NOARP MTU:16260 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:94 overruns:0 carrier:0 collisions:0 txqueuelen:10 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)

ipsec1 Link encap:IPIP Tunnel HWaddr NOARP MTU:0 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:10 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)

ipsec2 Link encap:IPIP Tunnel HWaddr NOARP MTU:0 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:10 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)

ipsec3 Link encap:IPIP Tunnel HWaddr NOARP MTU:0 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:10 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)

lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:12 errors:0 dropped:0 overruns:0 frame:0 TX packets:12 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:600 (600.0 b) TX bytes:600 (600.0 b)

sit0 Link encap:IPv6-in-IPv4 NOARP MTU:1480 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)

tap0 Link encap:Ethernet HWaddr FE:FD:00:00:00:00 BROADCAST NOARP MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)

+ _________________________ ipsec/directory + ipsec --directory /usr/lib/ipsec + _________________________ hostname/fqdn + hostname --fqdn hostname: Unknown host + _________________________ hostname/ipaddress + hostname --ip-address hostname: Unknown host + _________________________ uptime + uptime 15:02:06 up 6:08, 1 user, load average: 1.13, 1.11, 1.16 + _________________________ ps + ps alxwf + egrep -i 'ppid|pluto|ipsec|klips' F UID PID PPID PRI NI VSZ RSS WCHAN STAT TTY TIME COMMAND 0 0 7957 10761 9 0 2180 1064 wait4 S pts/0 0:00 | \_ /bin/sh /usr/sbin/ipsec barf 0 0 7958 7957 10 0 2208 1120 wait4 S pts/0 0:00 | \_ /bin/sh /usr/lib/ipsec/barf 0 0 8036 7958 10 0 1428 468 pipe_w S pts/0 0:00 | \_ grep -E -i ppid|pluto|ipsec|klips 0 0 9753 6333 15 0 1844 588 - R ? 98:21 \_ nano ipsec.conf 1 0 10670 1 9 0 2192 944 wait4 S ? 0:00 /bin/sh /usr/lib/ipsec/_plutorun --debug all --uniqueids yes --nocrsend --strictcrlpolicy --nat_traversal --keep_alive --force_keepalive --disable_port_floating --virtual_private --dump --load %search --start %search --wait --pre --post --log daemon.error --pid /var/run/pluto.pid 1 0 10672 10670 9 0 2192 944 wait4 S ? 0:00 \_ /bin/sh /usr/lib/ipsec/_plutorun --debug all --uniqueids yes --nocrsend --strictcrlpolicy --nat_traversal --keep_alive --force_keepalive --disable_port_floating --virtual_private --dump --load %search --start %search --wait --pre --post --log daemon.error --pid /var/run/pluto.pid 4 0 10674 10672 9 0 2316 984 select S ? 0:00 | \_ /usr/lib/ipsec/pluto --nofork --debug-all --uniqueids 0 0 10676 10674 9 0 1360 208 select S ? 0:00 | \_ _pluto_adns -d 6 9 4 0 10673 10670 8 0 2184 956 pipe_w S ? 0:00 \_ /bin/sh /usr/lib/ipsec/_plutoload --load %search --start %search --wait --post 4 0 10671 1 9 0 1300 312 pipe_w S ? 0:00 logger -p daemon.error -t ipsec__plutorun + _________________________ ipsec/showdefaults + ipsec showdefaults routephys=eth0 routephys=eth0 routevirt=ipsec0 routevirt=ipsec0 routeaddr=192.168.0.4 routeaddr=192.168.0.4 routenexthop=192.168.0.1 routenexthop=192.168.0.1 defaultroutephys=eth0 defaultroutevirt=ipsec0 defaultrouteaddr=192.168.0.4 defaultroutenexthop=192.168.0.1 + _________________________ ipsec/conf + ipsec _include /etc/ipsec/ipsec.conf + ipsec _keycensor

#< /etc/ipsec/ipsec.conf 1
# /etc/ipsec.conf - FreeS/WAN IPsec configuration file

# More elaborate and more varied sample configurations can be found
# in FreeS/WAN's doc/examples file, and in the HTML documentation.

# basic configuration
config setup
   # THIS SETTING MUST BE CORRECT or almost nothing will work;
   # %defaultroute is okay for most simple cases.
   interfaces=%defaultroute
   # Debug-logging controls:  "none" for (almost) none, "all" for lots.
   klipsdebug=all
   plutodebug=all
   # Use auto= parameters in conn descriptions to control startup actions.
   plutoload=%search
   plutostart=%search
   # Close down old connection when new one using same ID shows up.
   uniqueids=yes

# defaults for subsequent connection descriptions
# (these defaults will soon go away)
#conn %default
#    keyingtries=0
#    disablearrivalcheck=no
#    authby=rsasig
#    leftrsasigkey=%dnsondemand
#    rightrsasigkey=%dnsondemand


# connection description for opportunistic encryption
# (requires KEY record in your DNS reverse map; see doc/opportunism.howto)
conn me-to-anyone
   left=%defaultroute
   right=%opportunistic
   keylife=1h
   rekey=no
   # for initiator only OE, uncomment and uncomment this
   # after putting your key in your forward map
   [EMAIL PROTECTED]
   # uncomment this next line to enable it
   #auto=route


# sample VPN connection
conn sample
   # Left security gateway, subnet behind it, next hop toward right.
   left=10.0.0.1
   leftsubnet=172.16.0.0/24
   leftnexthop=10.22.33.44
   # Right security gateway, subnet behind it, next hop toward left.
   right=10.12.12.1
   rightsubnet=192.168.0.0/24
   rightnexthop=10.101.102.103
   # To authorize this connection, but not actually start it, at startup,
   # uncomment this.
   #auto=add

conn doug left=192.168.0.4 leftsubnet=192.168.0.0/24 right=67.80.95.17 rightsubnet=192.168.1.0/32 keyexchange=ike authby=secret pfs=yes ikelifetime=3600s type=tunnel esp=3des-md5-96 + _________________________ ipsec/secrets + ipsec _include /etc/ipsec/ipsec.secrets + ipsec _secretcensor

#< /etc/ipsec/ipsec.secrets 1
# This file holds shared secrets or RSA private keys for inter-Pluto
# authentication.  See ipsec_pluto(8) manpage, and HTML documentation.

67.80.95.17 %any : PSK "[sums to 2a7f...]"
192.168.0.4 67.80.95.17 : PSK "[sums to 2a7f...]"
67.80.95.17 192.168.0.4 : PSK "[sums to 2a7f...]"

# RSA private key for this host, authenticating it to any other host # which knows the public part. Suitable public keys, for ipsec.conf, DNS, # or configuration of other implementations, can be extracted conveniently # with "[sums to ef67...]". : RSA { # RSA 2192 bits g2linux Sun Aug 17 12:48:14 2003 # for signatures only, UNSAFE FOR ENCRYPTION #pubkey=[keyid AQNhTVjXO] #IN KEY 0x4200 4 1 [keyid AQNhTVjXO] # (0x4200 = auth-only host-level, 4 = IPSec, 1 = RSA) Modulus: [...] PublicExponent: [...] # everything after this point is secret PrivateExponent: [...] Prime1: [...] Prime2: [...] Exponent1: [...] Exponent2: [...] Coefficient: [...] } # do not change the indenting of that "[sums to 7d9d...]" : RSA { # RSA 2192 bits 4rooseveltway.org Sun Aug 17 13:55:40 2003 # for signatures only, UNSAFE FOR ENCRYPTION #pubkey=[keyid AQOwiiqHT] #IN KEY 0x4200 4 1 [keyid AQOwiiqHT] # (0x4200 = auth-only host-level, 4 = IPSec, 1 = RSA) Modulus: [...] PublicExponent: [...] # everything after this point is secret PrivateExponent: [...] Prime1: [...] Prime2: [...] Exponent1: [...] Exponent2: [...] Coefficient: [...] } # do not change the indenting of that "[sums to 7d9d...]" + _________________________ ipsec/ls-dir + ls -l /usr/lib/ipsec total 1184 -rwxr-xr-x 1 root root 11302 Aug 19 08:57 _confread -rwxr-xr-x 1 root root 4948 Aug 19 08:57 _copyright -rwxr-xr-x 1 root root 2164 Aug 19 08:57 _include -rwxr-xr-x 1 root root 1476 Aug 19 08:57 _keycensor -rwxr-xr-x 1 root root 10424 Aug 19 08:57 _pluto_adns -rwxr-xr-x 1 root root 3497 Aug 19 08:57 _plutoload -rwxr-xr-x 1 root root 5696 Aug 19 08:57 _plutorun -rwxr-xr-x 1 root root 7759 Aug 19 08:57 _realsetup -rwxr-xr-x 1 root root 1975 Aug 19 08:57 _secretcensor -rwxr-xr-x 1 root root 7058 Aug 19 08:57 _startklips -rwxr-xr-x 1 root root 5015 Aug 19 08:57 _updown -rwxr-xr-x 1 root root 7572 Aug 19 08:57 _updown.x509 -rwxr-xr-x 1 root root 13598 Aug 19 08:57 auto -rwxr-xr-x 1 root root 7193 Aug 19 08:57 barf -rwxr-xr-x 1 root root 816 Aug 19 08:57 calcgoo -rwxr-xr-x 1 root root 75868 Aug 19 08:57 eroute -rwxr-xr-x 1 root root 21364 Aug 19 08:57 ikeping -rwxr-xr-x 1 root root 2935 Aug 19 08:57 ipsec -rw-r--r-- 1 root root 1950 Aug 19 08:57 ipsec_pr.template -rwxr-xr-x 1 root root 49536 Aug 19 08:57 klipsdebug -rwxr-xr-x 1 root root 2438 Aug 19 08:57 look -rwxr-xr-x 1 root root 16158 Aug 19 08:57 manual -rwxr-xr-x 1 root root 1847 Aug 19 08:57 newhostkey -rwxr-xr-x 1 root root 44412 Aug 19 08:57 pf_key -rwxr-xr-x 1 root root 559804 Aug 19 08:57 pluto -rwxr-xr-x 1 root root 7192 Aug 19 08:57 ranbits -rwxr-xr-x 1 root root 19356 Aug 19 08:57 rsasigkey -rwxr-xr-x 1 root root 16712 Aug 19 08:57 send-pr lrwxrwxrwx 1 root root 17 Aug 19 08:57 setup -> /etc/init.d/ipsec -rwxr-xr-x 1 root root 1043 Aug 19 08:57 showdefaults -rwxr-xr-x 1 root root 4203 Aug 19 08:57 showhostkey -rwxr-xr-x 1 root root 109316 Aug 19 08:57 spi -rwxr-xr-x 1 root root 63508 Aug 19 08:57 spigrp -rwxr-xr-x 1 root root 10452 Aug 19 08:57 tncfg -rwxr-xr-x 1 root root 3353 Aug 19 08:57 verify -rwxr-xr-x 1 root root 41524 Aug 19 08:57 whack + _________________________ ipsec/updowns ++ ls /usr/lib/ipsec ++ egrep updown + cat /usr/lib/ipsec/_updown #! /bin/sh # default updown script # Copyright (C) 2000, 2001 D. Hugh Redelmeier, Henry Spencer # # This program is free software; you can redistribute it and/or modify it # under the terms of the GNU General Public License as published by the # Free Software Foundation; either version 2 of the License, or (at your # option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. # # This program is distributed in the hope that it will be useful, but # WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY # or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License # for more details. # # RCSID $Id: _updown,v 1.1.1.1 2002/09/05 03:13:22 ken Exp $

# CAUTION:  Installing a new version of FreeS/WAN will install a new
# copy of this script, wiping out any custom changes you make.  If
# you need changes, make a copy of this under another name, and customize
# that, and use the (left/right)updown parameters in ipsec.conf to make
# FreeS/WAN use yours instead of this default one.

# check interface version
case "$PLUTO_VERSION" in
1.[0])    # Older Pluto?!?  Play it safe, script may be using new features.
   echo "$0: obsolete interface version \`$PLUTO_VERSION'," >&2
   echo "$0:     called by obsolete Pluto?" >&2
   exit 2
   ;;
1.*)    ;;
*)    echo "$0: unknown interface version \`$PLUTO_VERSION'" >&2
   exit 2
   ;;
esac

# check parameter(s)
case "$1:$*" in
':')            # no parameters
   ;;
ipfwadm:ipfwadm)    # due to (left/right)firewall; for default script only
   ;;
custom:*)        # custom parameters (see above CAUTION comment)
   ;;
*)    echo "$0: unknown parameters \`$*'" >&2
   exit 2
   ;;
esac

# utility functions for route manipulation
# Meddling with this stuff should not be necessary and requires great care.
uproute() {
   doroute add
}
downroute() {
   doroute del
}
doroute() {
   parms="-net $PLUTO_PEER_CLIENT_NET netmask $PLUTO_PEER_CLIENT_MASK"
   parms2="dev $PLUTO_INTERFACE gw $PLUTO_NEXT_HOP"
   case "$PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK" in
   "0.0.0.0/0.0.0.0")
       # horrible kludge for obscure routing bug with opportunistic
       it="route $1 -net 0.0.0.0 netmask 128.0.0.0 $parms2 &&
           route $1 -net 128.0.0.0 netmask 128.0.0.0 $parms2"
       ;;
   *)    it="route $1 $parms $parms2"
       ;;
   esac
   eval $it
   st=$?
   if test $st -ne 0
   then
       # route has already given its own cryptic message
       echo "$0: \`$it' failed" >&2
       if test " $1 $st" = " add 7"
       then
           # another totally undocumented interface -- 7 and
           # "SIOCADDRT: Network is unreachable" means that
           # the gateway isn't reachable.
           echo "$0: (incorrect or missing nexthop setting??)" >&2
       fi
   fi
   return $st
}

# the big choice
case "$PLUTO_VERB:$1" in
prepare-host:*|prepare-client:*)
   # delete possibly-existing route (preliminary to adding a route)
   case "$PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK" in
   "0.0.0.0/0.0.0.0")
       # horrible kludge for obscure routing bug with opportunistic
       it="route del -net 0.0.0.0 netmask 128.0.0.0 2>&1 ;
           route del -net 128.0.0.0 netmask 128.0.0.0 2>&1"
       ;;
   *)
       it="route del -net $PLUTO_PEER_CLIENT_NET \
                   netmask $PLUTO_PEER_CLIENT_MASK 2>&1"
       ;;
   esac
   oops="`eval $it`"
   status="$?"
   if test " $oops" = " " -a " $status" != " 0"
   then
       oops="silent error, exit status $status"
   fi
   case "$oops" in
   'SIOCDELRT: No such process'*)
       # This is what route (currently -- not documented!) gives
       # for "could not find such a route".
       oops=
       status=0
       ;;
   esac
   if test " $oops" != " " -o " $status" != " 0"
   then
       echo "$0: \`$it' failed ($oops)" >&2
   fi
   exit $status
   ;;
route-host:*|route-client:*)
   # connection to me or my client subnet being routed
   uproute
   ;;
unroute-host:*|unroute-client:*)
   # connection to me or my client subnet being unrouted
   downroute
   ;;
up-host:*)
   # connection to me coming up
   # If you are doing a custom version, firewall commands go here.
   ;;
down-host:*)
   # connection to me going down
   # If you are doing a custom version, firewall commands go here.
   ;;
up-client:)
   # connection to my client subnet coming up
   # If you are doing a custom version, firewall commands go here.
   ;;
down-client:)
   # connection to my client subnet going down
   # If you are doing a custom version, firewall commands go here.
   ;;
up-client:ipfwadm)
   # connection to client subnet, with (left/right)firewall=yes, coming up
   # This is used only by the default updown script, not by your custom
   # ones, so do not mess with it; see CAUTION comment up at top.
   ipfwadm -F -i accept -b -S $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK \
       -D $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK
   ;;
down-client:ipfwadm)
   # connection to client subnet, with (left/right)firewall=yes, going down
   # This is used only by the default updown script, not by your custom
   # ones, so do not mess with it; see CAUTION comment up at top.
   ipfwadm -F -d accept -b -S $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK \
       -D $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK
   ;;
*)    echo "$0: unknown verb \`$PLUTO_VERB' or parameter \`$1'" >&2
   exit 1
   ;;
esac
+ cat /usr/lib/ipsec/_updown.x509
#! /bin/sh
#
# customized updown script
#

# logging of VPN connections
#
# tag put in front of each log entry:
TAG=vpn
#
# syslog facility and priority used:
FAC_PRIO=local0.notice
#
# to create a special vpn logging file, put the following line into
# the syslog configuration file /etc/syslog.conf:
#
# local0.notice                   -/var/log/vpn
#
# check interface version
case "$PLUTO_VERSION" in
1.[0])    # Older Pluto?!?  Play it safe, script may be using new features.
   echo "$0: obsolete interface version \`$PLUTO_VERSION'," >&2
   echo "$0:     called by obsolete Pluto?" >&2
   exit 2
   ;;
1.*)    ;;
*)    echo "$0: unknown interface version \`$PLUTO_VERSION'" >&2
   exit 2
   ;;
esac

# check parameter(s)
case "$1:$*" in
':')            # no parameters
   ;;
ipfwadm:ipfwadm)    # due to (left/right)firewall; for default script only
   ;;
custom:*)        # custom parameters (see above CAUTION comment)
   ;;
*)    echo "$0: unknown parameters \`$*'" >&2
   exit 2
   ;;
esac

# utility functions for route manipulation
# Meddling with this stuff should not be necessary and requires great care.
uproute() {
   doroute add
}
downroute() {
   doroute del
}
doroute() {
   parms="-net $PLUTO_PEER_CLIENT_NET netmask $PLUTO_PEER_CLIENT_MASK"
   parms2="dev $PLUTO_INTERFACE gw $PLUTO_NEXT_HOP"
   case "$PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK" in
   "0.0.0.0/0.0.0.0")
       # horrible kludge for obscure routing bug with opportunistic
       it="route $1 -net 0.0.0.0 netmask 128.0.0.0 $parms2 &&"
       it="$it route $1 -net 128.0.0.0 netmask 128.0.0.0 $parms2"
       route $1 -net 0.0.0.0 netmask 128.0.0.0 $parms2 &&
           route $1 -net 128.0.0.0 netmask 128.0.0.0 $parms2
       ;;
   *)    it="route $1 $parms $parms2"
       route $1 $parms $parms2
       ;;
   esac
   st=$?
   if test $st -ne 0
   then
       # route has already given its own cryptic message
       echo "$0: \`$it' failed" >&2
       if test " $1 $st" = " add 7"
       then
           # another totally undocumented interface -- 7 and
           # "SIOCADDRT: Network is unreachable" means that
           # the gateway isn't reachable.
           echo "$0: (incorrect or missing nexthop setting??)" >&2
       fi
   fi
   return $st
}

# are there port numbers?
if [ "$PLUTO_MY_PORT" != 0 ]
then
   S_MY_PORT="--sport $PLUTO_MY_PORT"
   D_MY_PORT="--dport $PLUTO_MY_PORT"
fi
if [ "$PLUTO_PEER_PORT" != 0 ]
then
   S_PEER_PORT="--sport $PLUTO_PEER_PORT"
   D_PEER_PORT="--dport $PLUTO_PEER_PORT"
fi

# the big choice case "$PLUTO_VERB:$1" in prepare-host:*|prepare-client:*) # delete possibly-existing route (preliminary to adding a route) case "$PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK" in "0.0.0.0/0.0.0.0") # horrible kludge for obscure routing bug with opportunistic parms1="-net 0.0.0.0 netmask 128.0.0.0" parms2="-net 128.0.0.0 netmask 128.0.0.0" it="route del $parms1 2>&1 ; route del $parms2 2>&1" oops="`route del $parms1 2>&1 ; route del $parms2 2>&1`" ;; *) parms="-net $PLUTO_PEER_CLIENT_NET netmask $PLUTO_PEER_CLIENT_MASK" it="route del $parms 2>&1" oops="`route del $parms 2>&1`" ;; esac status="$?" if test " $oops" = " " -a " $status" != " 0" then oops="silent error, exit status $status" fi case "$oops" in 'SIOCDELRT: No such process'*) # This is what route (currently -- not documented!) gives # for "could not find such a route". oops= status=0 ;; esac if test " $oops" != " " -o " $status" != " 0" then echo "$0: \`$it' failed ($oops)" >&2 fi exit $status ;; route-host:*|route-client:*) # connection to me or my client subnet being routed uproute ;; unroute-host:*|unroute-client:*) # connection to me or my client subnet being unrouted downroute ;; up-host:*) # connection to me coming up # If you are doing a custom version, firewall commands go here. iptables -I INPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \ -s $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK $S_PEER_PORT \ -d $PLUTO_ME $D_MY_PORT -j ACCEPT iptables -I OUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \ -s $PLUTO_ME $S_MY_PORT \ -d $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK $D_PEER_PORT -j ACCEPT # if [ "$PLUTO_PEER_CLIENT" == "$PLUTO_PEER/32" ] then logger -t $TAG -p $FAC_PRIO \ "+ `echo -e $PLUTO_PEER_ID` $PLUTO_PEER -- $PLUTO_ME" else logger -t $TAG -p $FAC_PRIO \ "+ `echo -e $PLUTO_PEER_ID` $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME" fi ;; down-host:*) # connection to me going down # If you are doing a custom version, firewall commands go here. iptables -D INPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \ -s $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK $S_PEER_PORT \ -d $PLUTO_ME $D_MY_PORT -j ACCEPT iptables -D OUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \ -s $PLUTO_ME $S_MY_PORT \ -d $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK $D_PEER_PORT -j ACCEPT # if [ "$PLUTO_PEER_CLIENT" == "$PLUTO_PEER/32" ] then logger -t $TAG -p $FAC_PRIO -- \ "- `echo -e $PLUTO_PEER_ID` $PLUTO_PEER -- $PLUTO_ME" else logger -t $TAG -p $FAC_PRIO -- \ "- `echo -e $PLUTO_PEER_ID` $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME" fi ;; up-client:) # connection to my client subnet coming up # If you are doing a custom version, firewall commands go here. iptables -I FORWARD 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \ -s $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK $S_MY_PORT \ -d $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK $D_PEER_PORT -j ACCEPT iptables -I FORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \ -s $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK $S_PEER_PORT \ -d $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK $D_MY_PORT -j ACCEPT # if [ "$PLUTO_PEER_CLIENT" == "$PLUTO_PEER/32" ] then logger -t $TAG -p $FAC_PRIO \ "+ `echo -e $PLUTO_PEER_ID` $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT" else logger -t $TAG -p $FAC_PRIO \ "+ `echo -e $PLUTO_PEER_ID` $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT" fi ;; down-client:) # connection to my client subnet going down # If you are doing a custom version, firewall commands go here. iptables -D FORWARD -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \ -s $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK $S_MY_PORT \ -d $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK $D_PEER_PORT -j ACCEPT iptables -D FORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \ -s $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK $S_PEER_PORT \ -d $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK $D_MY_PORT -j ACCEPT # if [ "$PLUTO_PEER_CLIENT" == "$PLUTO_PEER/32" ] then logger -t $TAG -p $FAC_PRIO -- \ "- `echo -e $PLUTO_PEER_ID` $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT" else logger -t $TAG -p $FAC_PRIO -- \ "- `echo -e $PLUTO_PEER_ID` $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT" fi ;; up-client:ipfwadm) # connection to client subnet, with (left/right)firewall=yes, coming up # This is used only by the default updown script, not by your custom # ones, so do not mess with it; see CAUTION comment up at top. ipfwadm -F -i accept -b -S $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK \ -D $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK ;; down-client:ipfwadm) # connection to client subnet, with (left/right)firewall=yes, going down # This is used only by the default updown script, not by your custom # ones, so do not mess with it; see CAUTION comment up at top. ipfwadm -F -d accept -b -S $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK \ -D $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK ;; *) echo "$0: unknown verb \`$PLUTO_VERB' or parameter \`$1'" >&2 exit 1 ;; esac + _________________________ proc/net/dev + cat /proc/net/dev Inter-| Receive | Transmit face |bytes packets errs drop fifo frame compressed multicast|bytes packets errs drop fifo colls carrier compressed lo: 600 12 0 0 0 0 0 0 600 12 0 0 0 0 0 0 tap0: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 eql: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ipsec0: 0 0 0 0 0 0 0 0 0 0 0 94 0 0 0 0 ipsec1: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ipsec2: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ipsec3: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 sit0: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 eth0:51191365 38135 0 0 0 0 0 0 2242454 27198 0 0 0 0 0 0 + _________________________ proc/net/route + cat /proc/net/route Iface Destination Gateway Flags RefCnt Use Metric Mask MTU Window IRTT eth0 0000A8C0 00000000 0001 0 0 0 00FFFFFF 40 0 0

ipsec0 0000A8C0 00000000 0001 0 0 0 00FFFFFF 40 0 0

lo 0000007F 0100007F 0003 0 0 0 000000FF 40 0 0

eth0 00000000 0100A8C0 0003 0 0 0 00000000 40 0 0

+ _________________________ proc/sys/net/ipv4/ip_forward + cat /proc/sys/net/ipv4/ip_forward 0 + _________________________ proc/sys/net/ipv4/conf/star-rp_filter + cd /proc/sys/net/ipv4/conf + egrep '^' all/rp_filter default/rp_filter eth0/rp_filter ipsec0/rp_filter lo/rp_filter all/rp_filter:0 default/rp_filter:0 eth0/rp_filter:0 ipsec0/rp_filter:0 lo/rp_filter:0 + _________________________ uname-a + uname -a Linux g2linux 2.4.20-xfs-r3 #7 Sun Aug 17 14:24:28 Local time zone must be set--see zic manu i686 AMD Athlon(TM) XP2100+ AuthenticAMD GNU/Linux + _________________________ redhat-release + test -r /etc/redhat-release + _________________________ proc/net/ipsec_version + cat /proc/net/ipsec_version FreeS/WAN version: super-freeswan-1.99_kb3 + _________________________ iptables/list + iptables -L -v -n /usr/lib/ipsec/barf: line 195: iptables: command not found + _________________________ ipchains/list + ipchains -L -v -n /usr/lib/ipsec/barf: line 197: ipchains: command not found + _________________________ ipfwadm/forward + ipfwadm -F -l -n -e /usr/lib/ipsec/barf: line 199: ipfwadm: command not found + _________________________ ipfwadm/input + ipfwadm -I -l -n -e /usr/lib/ipsec/barf: line 201: ipfwadm: command not found + _________________________ ipfwadm/output + ipfwadm -O -l -n -e /usr/lib/ipsec/barf: line 203: ipfwadm: command not found + _________________________ iptables/nat + iptables -t nat -L -v -n /usr/lib/ipsec/barf: line 205: iptables: command not found + _________________________ ipchains/masq + ipchains -M -L -v -n /usr/lib/ipsec/barf: line 207: ipchains: command not found + _________________________ ipfwadm/masq + ipfwadm -M -l -n -e /usr/lib/ipsec/barf: line 209: ipfwadm: command not found + _________________________ iptables/mangle + iptables -t mangle -L -v -n /usr/lib/ipsec/barf: line 211: iptables: command not found + _________________________ proc/modules + cat /proc/modules tulip 39168 1 emu10k1 49448 0 ac97_codec 9800 0 [emu10k1] soundcore 3332 4 [emu10k1] nls_iso8859-1 2780 1 (autoclean) nls_cp437 4316 1 (autoclean) msdos 5132 1 (autoclean) fat 29816 0 (autoclean) [msdos] nvidia 1537984 10 usb-storage 55608 0 (unused) hid 12468 0 (unused) usb-ohci 17184 0 (unused) usbcore 55456 1 [usb-storage hid usb-ohci] + _________________________ proc/meminfo + cat /proc/meminfo total: used: free: shared: buffers: cached: Mem: 527994880 394153984 133840896 0 104091648 169758720 Swap: 776200192 7729152 768471040 MemTotal: 515620 kB MemFree: 130704 kB MemShared: 0 kB Buffers: 101652 kB Cached: 163612 kB SwapCached: 2168 kB Active: 227664 kB Inactive: 122356 kB HighTotal: 0 kB HighFree: 0 kB LowTotal: 515620 kB LowFree: 130704 kB SwapTotal: 758008 kB SwapFree: 750460 kB + _________________________ dev/ipsec-ls + ls -l '/dev/ipsec*' ls: /dev/ipsec*: No such file or directory + _________________________ proc/net/ipsec-ls + ls -l /proc/net/ipsec_eroute /proc/net/ipsec_klipsdebug /proc/net/ipsec_spi /proc/net/ipsec_spigrp /proc/net/ipsec_tncfg /proc/net/ipsec_version -r--r--r-- 1 root root 0 Aug 19 15:02 /proc/net/ipsec_eroute -r--r--r-- 1 root root 0 Aug 19 15:02 /proc/net/ipsec_klipsdebug -r--r--r-- 1 root root 0 Aug 19 15:02 /proc/net/ipsec_spi -r--r--r-- 1 root root 0 Aug 19 15:02 /proc/net/ipsec_spigrp -r--r--r-- 1 root root 0 Aug 19 15:02 /proc/net/ipsec_tncfg -r--r--r-- 1 root root 0 Aug 19 15:02 /proc/net/ipsec_version + _________________________ usr/src/linux/.config + test -f /usr/src/linux/.config + egrep 'IP|NETLINK' /usr/src/linux/.config # CONFIG_MWINCHIPC6 is not set # CONFIG_MWINCHIP2 is not set # CONFIG_MWINCHIP3D is not set CONFIG_SYSVIPC=y CONFIG_MD_MULTIPATH=m # CONFIG_CIPHERS is not set # CONFIG_NETLINK_DEV is not set # CONFIG_IP_MULTICAST is not set # CONFIG_IP_ADVANCED_ROUTER is not set # CONFIG_IP_PNP is not set # CONFIG_NET_IPIP is not set # CONFIG_NET_IPGRE is not set CONFIG_IPV6=y # CONFIG_IPX is not set CONFIG_IPSEC=y CONFIG_IPSEC_IPIP=y CONFIG_IPSEC_AH=y CONFIG_IPSEC_AUTH_HMAC_MD5=y CONFIG_IPSEC_AUTH_HMAC_SHA1=y CONFIG_IPSEC_ESP=y CONFIG_IPSEC_ENC_3DES=y CONFIG_IPSEC_ALG=y CONFIG_IPSEC_ALG_MD5=m CONFIG_IPSEC_ALG_SHA1=m CONFIG_IPSEC_ALG_SHA2=m CONFIG_IPSEC_ALG_3DES=m CONFIG_IPSEC_ALG_AES=m CONFIG_IPSEC_ALG_BLOWFISH=m CONFIG_IPSEC_ALG_TWOFISH=m CONFIG_IPSEC_ALG_SERPENT=m # CONFIG_IPSEC_ALG_CAST is not set # CONFIG_IPSEC_ALG_NULL is not set CONFIG_IPSEC_IPCOMP=y CONFIG_IPSEC_DEBUG=y CONFIG_IPSEC_NAT_TRAVERSAL=y # CONFIG_IDEDMA_PCI_WIP is not set # CONFIG_IDE_CHIPSETS is not set CONFIG_SCSI_IPS=m CONFIG_SCSI_IZIP_EPP16=y # CONFIG_SCSI_IZIP_SLOW_CTR is not set CONFIG_TULIP=m # CONFIG_TULIP_MWI is not set # CONFIG_TULIP_MMIO is not set CONFIG_HIPPI=y CONFIG_PLIP=m # CONFIG_SLIP is not set # CONFIG_STRIP is not set # CONFIG_IPHASE5526 is not set CONFIG_HISAX_FRITZ_PCIPNP=m # CONFIG_INPUT_GRIP is not set # CONFIG_USB_AIPTEK is not set + _________________________ etc/syslog.conf + cat /etc/syslog.conf cat: /etc/syslog.conf: No such file or directory + _________________________ etc/resolv.conf + cat /etc/resolv.conf nameserver 68.39.224.6 nameserver 68.39.224.5 search ebrnsw01.nj.comcast.net + _________________________ lib/modules-ls + ls -ltr /lib/modules total 1 drwxr-xr-x 4 root root 416 Aug 17 13:49 2.4.20-gentoo-r6 drwxr-xr-x 5 root root 440 Aug 17 14:52 2.4.20-xfs-r3 + _________________________ proc/ksyms-netif_rx + egrep netif_rx /proc/ksyms c02b92f0 netif_rx_R7b27b1c8 + _________________________ lib/modules-netif_rx + modulegoo kernel/net/ipv4/ipip.o netif_rx + set +x 2.4.20-gentoo-r6: 2.4.20-xfs-r3: + _________________________ kern.debug + test -f /var/log/kern.debug + _________________________ klog + sed -n '1169,$p' /var/log/emerge.log + egrep -i 'ipsec|klips|pluto' + cat 1061129763: *** emerge search klips + _________________________ plog + sed -n '1,$p' /dev/null + egrep -i pluto + cat + _________________________ date + date Tue Aug 19 15:02:07 Local time zone must be set--see zic manual page 2003


_______________________________________________
FreeS/WAN Users mailing list
[EMAIL PROTECTED]
https://mj2.freeswan.org/cgi-bin/mj_wwwusr

[Users] Peer client ID returned doesn't match...

Reply via email to