/testing/guestbin/swan-prep kroot@swantest:/home/build/libreswan/testing/pluto/pluto-ipcmp-01\[root@east pluto-ipcmp-01]# ipsec start Error: Peer netns reference is invalid. Error: Peer netns reference is invalid. Error: Peer netns reference is invalid. Error: Peer netns reference is invalid. Error: Peer netns reference is invalid. Error: Peer netns reference is invalid. Error: Peer netns reference is invalid. Error: Peer netns reference is invalid. Error: Peer netns reference is invalid. Error: Peer netns reference is invalid. Error: Peer netns reference is invalid. Error: Peer netns reference is invalid. Error: Peer netns reference is invalid. Error: Peer netns reference is invalid. Error: Peer netns reference is invalid. Redirecting to: /etc/init.d/ipsec start Error: Peer netns reference is invalid. Error: Peer netns reference is invalid. Error: Peer netns reference is invalid. Error: Peer netns reference is invalid. Error: Peer netns reference is invalid. Error: Peer netns reference is invalid. Error: Peer netns reference is invalid. Error: Peer netns reference is invalid. Error: Peer netns reference is invalid. Error: Peer netns reference is invalid. Error: Peer netns reference is invalid. Error: Peer netns reference is invalid. Error: Peer netns reference is invalid. Error: Peer netns reference is invalid. Error: Peer netns reference is invalid. Starting pluto IKE daemon for IPsec: kroot@swantest:/home/build/libreswan/testing/pluto/pluto-ipcmp-01\[root@east pluto-ipcmp-01]# /testing/pluto/bin/wait-until-pluto-started kroot@swantest:/home/build/libreswan/testing/pluto/pluto-ipcmp-01\[root@east pluto-ipcmp-01]# ipsec auto --add westnet-eastnet-ipcomp 002 added connection description "westnet-eastnet-ipcomp" kroot@swantest:/home/build/libreswan/testing/pluto/pluto-ipcmp-01\[root@east pluto-ipcmp-01]# echo "initdone" initdone kroot@swantest:/home/build/libreswan/testing/pluto/pluto-ipcmp-01\[root@east pluto-ipcmp-01]# ../../pluto/bin/ipsec-look.sh ==== cut ==== start raw xfrm state: src 192.0.2.0/24 dst 192.0.1.0/24 \ dir out priority 1042407 ptype main \ tmpl src 192.1.2.23 dst 192.1.2.45\ proto comp reqid 16390 mode tunnel\ tmpl src 0.0.0.0 dst 0.0.0.0\ proto esp reqid 16389 mode transport\ src 192.0.1.0/24 dst 192.0.2.0/24 \ dir fwd priority 1042407 ptype main \ tmpl src 192.1.2.45 dst 192.1.2.23\ proto comp reqid 16390 mode tunnel\ level use \ tmpl src 0.0.0.0 dst 0.0.0.0\ proto esp reqid 16389 mode transport\ src 192.0.1.0/24 dst 192.0.2.0/24 \ dir in priority 1042407 ptype main \ tmpl src 192.1.2.45 dst 192.1.2.23\ proto comp reqid 16390 mode tunnel\ level use \ tmpl src 0.0.0.0 dst 0.0.0.0\ proto esp reqid 16389 mode transport\ src 0.0.0.0/0 dst 0.0.0.0/0 \ socket out priority 0 ptype main \ src 0.0.0.0/0 dst 0.0.0.0/0 \ socket in priority 0 ptype main \ src 0.0.0.0/0 dst 0.0.0.0/0 \ socket out priority 0 ptype main \ src 0.0.0.0/0 dst 0.0.0.0/0 \ socket in priority 0 ptype main \ src 0.0.0.0/0 dst 0.0.0.0/0 \ socket out priority 0 ptype main \ src 0.0.0.0/0 dst 0.0.0.0/0 \ socket in priority 0 ptype main \ src 0.0.0.0/0 dst 0.0.0.0/0 \ socket out priority 0 ptype main \ src 0.0.0.0/0 dst 0.0.0.0/0 \ socket in priority 0 ptype main \ src 0.0.0.0/0 dst 0.0.0.0/0 \ socket out priority 0 ptype main \ src 0.0.0.0/0 dst 0.0.0.0/0 \ socket in priority 0 ptype main \ src 0.0.0.0/0 dst 0.0.0.0/0 \ socket out priority 0 ptype main \ src 0.0.0.0/0 dst 0.0.0.0/0 \ socket in priority 0 ptype main \ end raw xfrm state: ==== tuc ==== east Mon Aug 26 18:28:36 UTC 2019 XFRM state: src 192.1.2.45 dst 192.1.2.23 proto esp spi 0x4391e85e reqid 16389 mode transport replay-window 32 auth-trunc hmac(sha1) 0xeec76fb11dd3dd6b7bb6dd79f1c41a5957e68ff0 96 enc cbc(aes) 0xb3193745b608cbc0f589d14fc8caac71 anti-replay context: seq 0x4, oseq 0x0, bitmap 0x0000000f sel src 0.0.0.0/0 dst 0.0.0.0/0 src 192.1.2.45 dst 192.1.2.23 proto comp spi 0x00000a9b reqid 16390 mode tunnel replay-window 0 flag af-unspec comp deflate anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000 src 192.1.2.45 dst 192.1.2.23 proto 4 spi 0xc001022d reqid 0 mode tunnel replay-window 0 flag af-unspec anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000 src 192.1.2.23 dst 192.1.2.45 proto esp spi 0x4bee70c8 reqid 16389 mode transport replay-window 32 auth-trunc hmac(sha1) 0x21293facbe79e362481e62003bf1dbe721003f12 96 enc cbc(aes) 0x402a1b4e7f442e7c2509db7136f5be88 anti-replay context: seq 0x0, oseq 0x4, bitmap 0x00000000 sel src 0.0.0.0/0 dst 0.0.0.0/0 src 192.1.2.23 dst 192.1.2.45 proto comp spi 0x000023d5 reqid 16390 mode tunnel replay-window 0 flag af-unspec comp deflate anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000 src 192.1.2.23 dst 192.1.2.45 proto 4 spi 0xc0010217 reqid 0 mode tunnel replay-window 0 flag af-unspec anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000 XFRM policy: src 192.0.1.0/24 dst 192.0.2.0/24 dir fwd priority 1042407 ptype main tmpl src 192.1.2.45 dst 192.1.2.23 proto comp reqid 16390 mode tunnel level use tmpl src 0.0.0.0 dst 0.0.0.0 proto esp reqid 16389 mode transport src 192.0.1.0/24 dst 192.0.2.0/24 dir in priority 1042407 ptype main tmpl src 192.1.2.45 dst 192.1.2.23 proto comp reqid 16390 mode tunnel level use tmpl src 0.0.0.0 dst 0.0.0.0 proto esp reqid 16389 mode transport src 192.0.2.0/24 dst 192.0.1.0/24 dir out priority 1042407 ptype main tmpl src 192.1.2.23 dst 192.1.2.45 proto comp reqid 16390 mode tunnel tmpl src 0.0.0.0 dst 0.0.0.0 proto esp reqid 16389 mode transport XFRM done IPSEC mangle TABLES NEW_IPSEC_CONN mangle TABLES ROUTING TABLES default via 192.1.2.254 dev eth1 192.0.1.0/24 via 192.1.2.45 dev eth1 192.0.2.0/24 dev eth0 proto kernel scope link src 192.0.2.254 192.1.2.0/24 dev eth1 proto kernel scope link src 192.1.2.23 NSS_CERTIFICATES Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI kroot@swantest:/home/build/libreswan/testing/pluto/pluto-ipcmp-01\[root@east pluto-ipcmp-01]# : ==== cut ==== kroot@swantest:/home/build/libreswan/testing/pluto/pluto-ipcmp-01\[root@east pluto-ipcmp-01]# ipsec auto --status 000 using kernel interface: netkey 000 interface lo/lo 127.0.0.1:4500 000 interface lo/lo 127.0.0.1:500 000 interface eth0/eth0 192.0.2.254:4500 000 interface eth0/eth0 192.0.2.254:500 000 interface eth1/eth1 192.1.2.23:4500 000 interface eth1/eth1 192.1.2.23:500 000 000 000 fips mode=disabled; 000 SElinux=disabled 000 seccomp=disabled 000 000 config setup options: 000 000 configdir=/etc, configfile=/etc/ipsec.conf, secrets=/etc/ipsec.secrets, ipsecdir=/etc/ipsec.d 000 nssdir=/etc/ipsec.d, dumpdir=/tmp, statsbin=unset 000 dnssec-rootkey-file=/var/lib/unbound/root.key, dnssec-trusted= 000 sbindir=/usr/local/sbin, libexecdir=/usr/local/libexec/ipsec 000 pluto_version=v3.28-685-gbfd5aef521-master-s2, pluto_vendorid=OE-Libreswan-v3.28-685, audit-log=yes 000 nhelpers=-1, uniqueids=yes, dnssec-enable=yes, perpeerlog=no, logappend=no, logip=yes, shuntlifetime=900s, xfrmlifetime=30s 000 ddos-cookies-threshold=50000, ddos-max-halfopen=25000, ddos-mode=auto 000 ikeport=500, ikebuf=0, msg_errqueue=yes, strictcrlpolicy=no, crlcheckinterval=0, listen=, nflog-all=0 000 ocsp-enable=no, ocsp-strict=no, ocsp-timeout=2, ocsp-uri= 000 ocsp-trust-name= 000 ocsp-cache-size=1000, ocsp-cache-min-age=3600, ocsp-cache-max-age=86400, ocsp-method=get 000 global-redirect=no, global-redirect-to= 000 secctx-attr-type=32001 000 debug: base+cpu-usage 000 000 nat-traversal=yes, keep-alive=20, nat-ikeport=4500 000 virtual-private (%priv): 000 000 Kernel algorithms supported: 000 000 algorithm ESP encrypt: name=3DES_CBC, keysizemin=192, keysizemax=192 000 algorithm ESP encrypt: name=AES_CBC, keysizemin=128, keysizemax=256 000 algorithm ESP encrypt: name=AES_CCM_12, keysizemin=128, keysizemax=256 000 algorithm ESP encrypt: name=AES_CCM_16, keysizemin=128, keysizemax=256 000 algorithm ESP encrypt: name=AES_CCM_8, keysizemin=128, keysizemax=256 000 algorithm ESP encrypt: name=AES_CTR, keysizemin=128, keysizemax=256 000 algorithm ESP encrypt: name=AES_GCM_12, keysizemin=128, keysizemax=256 000 algorithm ESP encrypt: name=AES_GCM_16, keysizemin=128, keysizemax=256 000 algorithm ESP encrypt: name=AES_GCM_8, keysizemin=128, keysizemax=256 000 algorithm ESP encrypt: name=CAMELLIA_CBC, keysizemin=128, keysizemax=256 000 algorithm ESP encrypt: name=CHACHA20_POLY1305, keysizemin=256, keysizemax=256 000 algorithm ESP encrypt: name=NULL, keysizemin=0, keysizemax=0 000 algorithm ESP encrypt: name=NULL_AUTH_AES_GMAC, keysizemin=128, keysizemax=256 000 algorithm ESP encrypt: name=SERPENT_CBC, keysizemin=128, keysizemax=256 000 algorithm ESP encrypt: name=TWOFISH_CBC, keysizemin=128, keysizemax=256 000 algorithm AH/ESP auth: name=AES_CMAC_96, key-length=128 000 algorithm AH/ESP auth: name=AES_XCBC_96, key-length=128 000 algorithm AH/ESP auth: name=HMAC_MD5_96, key-length=128 000 algorithm AH/ESP auth: name=HMAC_SHA1_96, key-length=160 000 algorithm AH/ESP auth: name=HMAC_SHA2_256_128, key-length=256 000 algorithm AH/ESP auth: name=HMAC_SHA2_256_TRUNCBUG, key-length=256 000 algorithm AH/ESP auth: name=HMAC_SHA2_384_192, key-length=384 000 algorithm AH/ESP auth: name=HMAC_SHA2_512_256, key-length=512 000 algorithm AH/ESP auth: name=NONE, key-length=0 000 000 IKE algorithms supported: 000 000 algorithm IKE encrypt: v1id=5, v1name=OAKLEY_3DES_CBC, v2id=3, v2name=3DES, blocksize=8, keydeflen=192 000 algorithm IKE encrypt: v1id=8, v1name=OAKLEY_CAMELLIA_CBC, v2id=23, v2name=CAMELLIA_CBC, blocksize=16, keydeflen=128 000 algorithm IKE encrypt: v1id=-1, v1name=n/a, v2id=20, v2name=AES_GCM_C, blocksize=16, keydeflen=128 000 algorithm IKE encrypt: v1id=-1, v1name=n/a, v2id=19, v2name=AES_GCM_B, blocksize=16, keydeflen=128 000 algorithm IKE encrypt: v1id=-1, v1name=n/a, v2id=18, v2name=AES_GCM_A, blocksize=16, keydeflen=128 000 algorithm IKE encrypt: v1id=13, v1name=OAKLEY_AES_CTR, v2id=13, v2name=AES_CTR, blocksize=16, keydeflen=128 000 algorithm IKE encrypt: v1id=7, v1name=OAKLEY_AES_CBC, v2id=12, v2name=AES_CBC, blocksize=16, keydeflen=128 000 algorithm IKE encrypt: v1id=65004, v1name=OAKLEY_SERPENT_CBC, v2id=65004, v2name=SERPENT_CBC, blocksize=16, keydeflen=128 000 algorithm IKE encrypt: v1id=65005, v1name=OAKLEY_TWOFISH_CBC, v2id=65005, v2name=TWOFISH_CBC, blocksize=16, keydeflen=128 000 algorithm IKE encrypt: v1id=65289, v1name=OAKLEY_TWOFISH_CBC_SSH, v2id=65289, v2name=TWOFISH_CBC_SSH, blocksize=16, keydeflen=128 000 algorithm IKE encrypt: v1id=-1, v1name=n/a, v2id=28, v2name=CHACHA20_POLY1305, blocksize=16, keydeflen=256 000 algorithm IKE PRF: name=HMAC_MD5, hashlen=16 000 algorithm IKE PRF: name=HMAC_SHA1, hashlen=20 000 algorithm IKE PRF: name=HMAC_SHA2_256, hashlen=32 000 algorithm IKE PRF: name=HMAC_SHA2_384, hashlen=48 000 algorithm IKE PRF: name=HMAC_SHA2_512, hashlen=64 000 algorithm IKE PRF: name=AES_XCBC, hashlen=16 000 algorithm IKE DH Key Exchange: name=MODP1536, bits=1536 000 algorithm IKE DH Key Exchange: name=MODP2048, bits=2048 000 algorithm IKE DH Key Exchange: name=MODP3072, bits=3072 000 algorithm IKE DH Key Exchange: name=MODP4096, bits=4096 000 algorithm IKE DH Key Exchange: name=MODP6144, bits=6144 000 algorithm IKE DH Key Exchange: name=MODP8192, bits=8192 000 algorithm IKE DH Key Exchange: name=DH19, bits=512 000 algorithm IKE DH Key Exchange: name=DH20, bits=768 000 algorithm IKE DH Key Exchange: name=DH21, bits=1056 000 algorithm IKE DH Key Exchange: name=DH31, bits=256 000 000 stats db_ops: {curr_cnt, total_cnt, maxsz} :context={0,0,0} trans={0,0,0} attrs={0,0,0} 000 000 Connection list: 000 000 "westnet-eastnet-ipcomp": 192.0.2.0/24===192.1.2.23<192.1.2.23>[@east]...192.1.2.45<192.1.2.45>[@west]===192.0.1.0/24; erouted; eroute owner: #2 000 "westnet-eastnet-ipcomp": oriented; my_ip=unset; their_ip=unset; my_updown=ipsec _updown; 000 "westnet-eastnet-ipcomp": xauth us:none, xauth them:none, my_username=[any]; their_username=[any] 000 "westnet-eastnet-ipcomp": our auth:rsasig, their auth:rsasig 000 "westnet-eastnet-ipcomp": modecfg info: us:none, them:none, modecfg policy:push, dns:unset, domains:unset, banner:unset, cat:unset; 000 "westnet-eastnet-ipcomp": labeled_ipsec:no; 000 "westnet-eastnet-ipcomp": policy_label:unset; 000 "westnet-eastnet-ipcomp": ike_life: 3600s; ipsec_life: 28800s; replay_window: 32; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0; 000 "westnet-eastnet-ipcomp": retransmit-interval: 500ms; retransmit-timeout: 60s; 000 "westnet-eastnet-ipcomp": initial-contact:no; cisco-unity:no; fake-strongswan:no; send-vendorid:no; send-no-esp-tfc:no; 000 "westnet-eastnet-ipcomp": policy: RSASIG+ENCRYPT+COMPRESS+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO; 000 "westnet-eastnet-ipcomp": conn_prio: 24,24; interface: eth1; metric: 0; mtu: unset; sa_prio:auto; sa_tfc:none; 000 "westnet-eastnet-ipcomp": nflog-group: unset; mark: unset; vti-iface:unset; vti-routing:no; vti-shared:no; nic-offload:auto; 000 "westnet-eastnet-ipcomp": our idtype: ID_FQDN; our id=@east; their idtype: ID_FQDN; their id=@west 000 "westnet-eastnet-ipcomp": dpd: action:hold; delay:0; timeout:0; nat-t: encaps:auto; nat_keepalive:yes; ikev1_natt:both 000 "westnet-eastnet-ipcomp": newest ISAKMP SA: #1; newest IPsec SA: #2; 000 "westnet-eastnet-ipcomp": IKEv1 algorithm newest: AES_CBC_256-HMAC_SHA2_256-MODP2048 000 "westnet-eastnet-ipcomp": ESP algorithm newest: AES_CBC_128-HMAC_SHA1_96; pfsgroup= 000 000 Total IPsec connections: loaded 1, active 1 000 000 State Information: DDoS cookies not required, Accepting new IKE connections 000 IKE SAs: total(1), half-open(0), open(0), authenticated(1), anonymous(0) 000 IPsec SAs: total(1), authenticated(1), anonymous(0) 000 000 #1: "westnet-eastnet-ipcomp":500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 3326s; newest ISAKMP; lastdpd=-1s(seq in:0 out:0); idle; 000 #2: "westnet-eastnet-ipcomp":500 STATE_QUICK_R2 (IPsec SA established); EVENT_SA_REPLACE in 28526s; newest IPSEC; eroute owner; isakmp#1; idle; 000 #2: "westnet-eastnet-ipcomp" esp.4bee70c8@192.1.2.45 esp.4391e85e@192.1.2.23 comp.23d5@192.1.2.45 comp.a9b@192.1.2.23 tun.0@192.1.2.45 tun.0@192.1.2.23 ref=0 refhim=0 Traffic: ESPin=336B ESPout=336B! ESPmax=4194303B IPCOMPout=0B IPCOMPin=0B! IPCOMPmax=4194303B 000 000 Bare Shunt list: 000 kroot@swantest:/home/build/libreswan/testing/pluto/pluto-ipcmp-01\[root@east pluto-ipcmp-01]# : ==== tuc ==== kroot@swantest:/home/build/libreswan/testing/pluto/pluto-ipcmp-01\[root@east pluto-ipcmp-01]# ../bin/check-for-core.sh kroot@swantest:/home/build/libreswan/testing/pluto/pluto-ipcmp-01\[root@east pluto-ipcmp-01]# if [ -f /sbin/ausearch ]; then ausearch -r -m avc -ts recent ; fi kroot@swantest:/home/build/libreswan/testing/pluto/pluto-ipcmp-01\[root@east pluto-ipcmp-01 1]# >>>>>>>>>>cutnonzeroexit>>>>>>>>>> exit status 1 final.sh 'if [ -f /sbin/ausearch ]; then ausearch -r -m avc -ts recent ; fi' <<<<<<<<<