remote segfault

[AnatoliChe]

With 2.6.52.2rc1 OW it's possible to make remote Segfault

peer2 conf; conn point2-point1 esp=aes128-sha1 left=192.168.44.102 right=192.168.44.101

point2# ipsec auto --add point2-point1 004 "point2-point1" #68: STATE_QUICK_I2: sent QI2, IPsec SA established transport mode

debug on point1: "point1-poiint2" #36: STATE_QUICK_R2: IPsec SA established transport mode {ESP=>0xd66b959f <0xfa41c26e xfrm=AES_128-HMAC_SHA1 NATOA=none NATD=none DPD=enabled}

now change ipsec.conf of point2 to: conn point2-point1 esp=aes128-sha2 #yeap left=192.168.44.102 right=192.168.44.101

point2# ipsec auto --add point2-point1

002 loaded key: 1607 002 loaded key: 83B8 002 "point2-point1": deleting connection 002 "point2-point1" #54: deleting state #54 (STATE_QUICK_I2) 002 "point2-point1" #58: deleting state #58 (STATE_QUICK_I2) 002 "point2-point1" #57: deleting state #57 (STATE_QUICK_I2) 002 "point2-point1" #56: deleting state #56 (STATE_QUICK_R2) 002 "point2-point1" #53: deleting state #53 (STATE_MAIN_I4) 002 "point2-point1" #55: deleting state #55 (STATE_MAIN_R3) 034 esp string error: hash_alg not found, enc_alg="aes", auth_alg="sha2", modp=""

check debug on peer1 and see:

"point1-point2" #4: received Delete SA(0x47a0a80b) payload: deleting IPSEC State #33 "point1-point2" #4: deleting state #33 (STATE_QUICK_R2) "point1-point2" #4: received and ignored informational message "point1-point2" #4: received Delete SA payload: replace IPSEC State #36 in 10 seconds "point1-point2" #4: received and ignored informational message "point1-point2" #4: received Delete SA(0x2683de6e) payload: deleting IPSEC State #35 "point1-point2" #4: deleting state #35 (STATE_QUICK_R2) "point1-point2" #4: received and ignored informational message "point1-point2" #4: received Delete SA(0xeee0953b) payload: deleting IPSEC State #34 "point1-point2" #4: deleting state #34 (STATE_QUICK_I2) "point1-point2" #4: received and ignored informational message packet from 192.168.44.102:500: received and ignored informational message "point1-point2" #4: received Delete SA payload: deleting ISAKMP State #4 "point1-point2" #4: deleting state #4 (STATE_MAIN_I4) packet from 192.168.44.102:500: received and ignored informational message "point1-point2" #36: DPD: could not find newest phase 1 state pluto_crypto_helper: helper [nonnss] (8) is exiting normally pluto_crypto_helper: helper [nonnss] (1) is exiting normally pluto_crypto_helper: helper [nonnss] (10) is exiting normally pluto_crypto_helper: helper [nonnss] (0) is exiting normally pluto_crypto_helper: helper [nonnss] (2) is exiting normally pluto_crypto_helper: helper [nonnss] (9) is exiting normally pluto_crypto_helper: helper [nonnss] (6) is exiting normally pluto_crypto_helper: helper [nonnss] (5) is exiting normally pluto_crypto_helper: helper [nonnss] (7) is exiting normally pluto_crypto_helper: helper [nonnss] (3) is exiting normally Segmentation fault (core dumped) pluto_crypto_helper: helper [nonnss] (4) is exiting normally

dbg core dump

gdb pluto -c core

Reading symbols from /usr/local/libexec/ipsec/pluto...done. [New LWP 7808] Core was generated by `/usr/local/libexec/ipsec/pluto --nofork --secretsfile /etc/ipsec.secrets --ipse'. Program terminated with signal SIGSEGV, Segmentation fault.

0 0x00005573bad10819 in ipsecdoi_replace (st=st@entry=0x5573bcdc6e70, policy_add=policy_add@entry=0, policy_del=policy_del@entry=0, try=try@entry=1)

at programs/pluto/ipsec_doi.c:489

489 struct state *parent = find_phase1_state(c (gdb) bt

0 0x00005573bad10819 in ipsecdoi_replace (st=st@entry=0x5573bcdc6e70, policy_add=policy_add@entry=0, policy_del=policy_del@entry=0, try=try@entry=1)

at programs/pluto/ipsec_doi.c:489

1 0x00005573bad0d7a8 in sa_replace (st=st@entry=0x5573bcdc6e70, type=type@entry=5) at programs/pluto/replace.c:130

2 0x00005573bad0c82b in handle_a_timer_event (ev=0x5573bcdc3110) at programs/pluto/timer.c:518

3 0x00005573bad0d00a in handle_timer_event () at programs/pluto/timer.c:442

4 0x00005573bad0ba39 in call_server () at programs/pluto/server.c:810

5 0x00005573bacf5faf in main (argc=, argv=) at programs/pluto/plutomain.c:1134

(gdb) frame 0

0 0x00005573bad10819 in ipsecdoi_replace (st=st@entry=0x5573bcdc6e70, policy_add=policy_add@entry=0, policy_del=policy_del@entry=0, try=try@entry=1)

at programs/pluto/ipsec_doi.c:489

489 struct state parent = find_phase1_state(c (gdb) list 484 } 485 } 486 else 487 { 488 / Use the newest Parent SA / 489 struct state parent = find_phase1_state(c 490 , ISAKMP_SA_ESTABLISHED_STATES | PHASE1_INITIATOR_STATES); 491 492 if (parent->st_serialno != st->st_clonedfrom) { 493 DBG(DBG_CONTROL, DBG_log("Switched parent SA from #%lu to #%lu for rekey", (gdb) print c $1 = (struct connection *) 0x5573bcdb4780

[mohicks]

Hi Anatoli,

I can't seem to reproduce this. Could you please send 'ipsec barf' output for at least the machine that crashes? It looks like point1 is attempting a DPD action after point2 has sent delete SA messages.

Just to confirm: point1 has 2.6.52.2rc1, and the test procedure is:

• point2 initiates connection to point1
• point2 changes the esp configuration
• point2 does --add on the connection
• point1 pluto crashes immediately or soon after the notification messages are sent from point2

Is that right?

[AnatoliChe]

Reproducing is 100%. I haveit with baremetal and virtual. For testing docker is simplest one

`cat Dockerfile FROM debian:buster as build MAINTAINER Aatoli Che anatoli.che@gmail.com

RUN apt-get update > /dev/null && DEBIAN_FRONTEND=noninteractive apt-get -y -q upgrade RUN DEBIAN_FRONTEND=noninteractive apt-get -y -q install libnspr4-dev libnss3-dev libnss3-tools RUN DEBIAN_FRONTEND=noninteractive apt-get -y -q install git libgmp-dev make flex bison iproute2 iptables sed gawk bash coreutils libpcap0.8-dev libpcap0.8 electric-fence tcpdump linux-headers-amd64 gcc RUN cd /usr/src/ && git clone https://github.com/xelerance/Openswan RUN cd /usr/src/Openswan; make KERNELSRC=linux-headers-4.19.0-12-amd64 programs install

FROM debian:buster as ipsecnode MAINTAINER Aatoli Che anatoli.che@gmail.com

RUN apt-get update > /dev/null && DEBIAN_FRONTEND=noninteractive apt-get -y -q upgrade RUN DEBIAN_FRONTEND=noninteractive apt-get -y -q install gdb rsyslog COPY --from=build /usr/local /usr/local/ COPY --from=build /etc/init.d/ipsec /etc/init.d/ BUILD: docker build -t ipsec . at this point I do not want cube or swarm start point1 docker run -ti --privileged -v ~point1/ipsec.secrets:/etc/ipsec.secrets -v ~/point1/ipsec.conf:/etc/ipsec.conf ipsec ip a 172.17.0.2 /etc/init.d/rsyslog start /etc/init.d/ipsec start tail -f /dev/shm/openswan.log We will get here: "point1-to-point2" #1: received Vendor ID payload [Openswan (this version) 2.6.52.2-1-gd420cf802 ] "point1-to-point2" #1: received Vendor ID payload [Dead Peer Detection] "point1-to-point2" #1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2 "point1-to-point2" #1: STATE_MAIN_I2: sent MI2, expecting MR2 | WARNING: finish_dh_secretiv:160: encryptor 'aes' expects keylen 16/128, SA #1 INITIATOR keylen is 20 | WARNING: finish_dh_secretiv:160: encryptor 'aes' expects keylen 16/128, SA #1 RESPONDER keylen is 0 "point1-to-point2" #1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3 "point1-to-point2" #1: STATE_MAIN_I3: sent MI3, expecting MR3 "point1-to-point2" #1: received Vendor ID payload [CAN-IKEv2] "point1-to-point2" #1: Main mode peer ID is ID_FQDN: '@point2' "point1-to-point2" #1: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4 "point1-to-point2" #1: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_RSA_SIG oursig= theirsig=AQN2EwF/B cipher=aes_128 prf=oakley_sha group=modp1536} "point1-to-point2" #1: Dead Peer Detection (RFC 3706): enabled "point1-to-point2" #2: initiating Quick Mode RSASIG+ENCRYPT+PFS+UP+IKEv2ALLOW+SAREFTRACK {using isakmp#1 msgid:5ddb34c3 proposal=AES(12)_128-SHA1(2)_160 pfsgroup=OAKLEY_GROUP_MODP1536} | creating SPD to 172.17.0.3->spi=00010000@172.17.0.2 proto=4 | creating SPD to 172.17.0.2->spi=6145a640@172.17.0.3 proto=50 "point1-to-point2" #2: Dead Peer Detection (RFC 3706): enabled "point1-to-point2" #2: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2 "point1-to-point2" #2: STATE_QUICK_I2: sent QI2, IPsec SA established transport mode {ESP=>0x6145a640 <0x12e1f57c xfrm=AES_128-HMAC_SHA1 NATOA=none NATD=none DPD=enabled} "point1-to-point2" #1: received Delete SA payload: replace IPSEC State #2 in 10 seconds "point1-to-point2" #1: received and ignored informational message "point1-to-point2" #1: received Delete SA payload: deleting ISAKMP State #1 "point1-to-point2" #1: deleting state #1 (STATE_MAIN_I4) packet from 172.17.0.3:500: received and ignored informational message pluto_crypto_helper: helper [nonnss] (0) is exiting normally Segmentation fault (core dumped) tail: /dev/shm/openswan.log: file truncated Plutorun started on Wed Dec 2 21:17:18 UTC 2020 `

start point2 docker run -ti --privileged -v ~point1/ipsec.secrets:/etc/ipsec.secrets -v ~/point1/ipsec.conf:/etc/ipsec.conf ipsec ip a 172.17.0.3 /etc/init.d/rsyslog start /etc/init.d/ipsec start ipsec auto --up point2-to-point1 002 "point2-to-point1" #9: initiating Quick Mode RSASIG+ENCRYPT+PFS+UP+IKEv2ALLOW+SAREFTRACK {using isakmp#7 msgid:63c13c08 proposal=AES(12)_128-SHA1(2)_160 pfsgroup=OAKLEY_GROUP_MODP1536} 118 "point2-to-point1" #9: STATE_QUICK_I1: initiate 002 "point2-to-point1" #9: Dead Peer Detection (RFC 3706): enabled 002 "point2-to-point1" #9: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2 004 "point2-to-point1" #9: STATE_QUICK_I2: sent QI2, IPsec SA established transport mode {ESP=>0xeaf2c257 <0xc2c84384 xfrm=AES_128-HMAC_SHA1 NATOA=none NATD=none DPD=enabled}

now change esp=aes128-sha1 to esp=aes128-sha2 and do ipsec auto --add point2-to-point1 002 loaded key: 83B8 6D2B 6034 C9F5 92A2 AD39 EA51 D832 72EF 94D4 002 loaded key: 1607 9372 7F4F 5273 8EF0 EC16 D213 3C48 B440 9426 002 "point2-to-point1": deleting connection 002 "point2-to-point1" #9: deleting state #9 (STATE_QUICK_I2) 002 "point2-to-point1" #8: deleting state #8 (STATE_QUICK_R2) 002 "point2-to-point1" #7: deleting state #7 (STATE_MAIN_R3) 034 esp string error: hash_alg not found, enc_alg="aes", auth_alg="sha2", modp=""

wait 5 seconds and got Segmentation fault (core dumped) at point1

barf in next message

conf point1 config setup interfaces=%defaultroute uniqueids=yes plutostderrlog=/dev/shm/openswan.log dumpdir=/dev/shm/ nhelpers=1

defaults for subsequent connection descriptions

(these defaults will soon go away)

conn %default keyingtries=0 authby=rsasig keyexchange=ike keylife=20m pfs=yes rekeymargin=5m rekeyfuzz=50% ike=aes-sha1 esp=aes-sha1 dpddelay=30 dpdtimeout=120 dpdaction=restart

conn point1-to-point2 auto=start type=transport

direction=dpt

esp=aes128-sha1       #with E-2144G 3.91    # E-2286G 4.10
    left=172.17.0.2
    leftid=@point1
leftrsasigkey=0sAQPyMQ+ PUB KEY1 ==
right=172.17.0.3
    rightid=@point2
rightrsasigkey=0sAQN2EwF/BJSsHk PUB KEY2  ==

[AnatoliChe]

point1 root@1fe326343f70:/# ipsec barf 1fe326343f70 Wed Dec 2 21:27:48 UTC 2020

• _____ version
• ipsec --version Linux Openswan U2.6.52.2-1-gd420cf802/K4.19.0-12-amd64 (netkey) See `ipsec --copyright' for copyright information.
• _____ /proc/version
• cat /proc/version Linux version 4.19.0-12-amd64 (debian-kernel@lists.debian.org) (gcc version 8.3.0 (Debian 8.3.0-6)) #1 SMP Debian 4.19.152-1 (2020-10-18)
• _____ /proc/net/ipsec_eroute
• test -r /proc/net/ipsec_eroute
• _____ netstat-rn
• netstat -nr /usr/local/libexec/ipsec/barf: 157: /usr/local/libexec/ipsec/barf: netstat: not found
• head -n 100
• _____ /proc/net/ipsec_spi
• test -r /proc/net/ipsec_spi
• _____ /proc/net/ipsec_spigrp
• test -r /proc/net/ipsec_spigrp
• _____ /proc/net/ipsec_tncfg
• test -r /proc/net/ipsec_tncfg
• _____ /proc/net/pfkey
• test -r /proc/net/pfkey
• cat /proc/net/pfkey sk RefCnt Rmem Wmem User Inode
• _____ ip-xfrm-state
• ip xfrm state src 172.17.0.3 dst 172.17.0.2 proto esp spi 0x2cb283ae reqid 16385 mode transport replay-window 32 auth-trunc hmac(sha1) 0xf4d1f6f24dd018cc953c12c41cd1659428b659e4 96 enc cbc(aes) 0x8be054f0ea39b847b06d6d45b1336892 anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000 sel src 0.0.0.0/0 dst 0.0.0.0/0 src 172.17.0.2 dst 172.17.0.3 proto esp spi 0x2dad48cd reqid 16385 mode transport replay-window 32 auth-trunc hmac(sha1) 0x79f5de396d29fe32e8d98697d3c19f3f450f6ecf 96 enc cbc(aes) 0xa22fd9f6a5e70c04859f9d65a768d1b4 anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000 sel src 0.0.0.0/0 dst 0.0.0.0/0
• _____ ip-xfrm-policy
• ip xfrm policy src 172.17.0.2/32 dst 172.17.0.3/32 dir out priority 2080 ptype main tmpl src 0.0.0.0 dst 0.0.0.0 proto esp reqid 16385 mode transport src 172.17.0.3/32 dst 172.17.0.2/32 dir in priority 2080 ptype main tmpl src 0.0.0.0 dst 0.0.0.0 proto esp reqid 16385 mode transport src 0.0.0.0/0 dst 0.0.0.0/0 socket out priority 0 ptype main src 0.0.0.0/0 dst 0.0.0.0/0 socket in priority 0 ptype main src 0.0.0.0/0 dst 0.0.0.0/0 socket out priority 0 ptype main src 0.0.0.0/0 dst 0.0.0.0/0 socket in priority 0 ptype main
• _____ /proc/crypto
• test -r /proc/crypto
• cat /proc/crypto name : seqiv(authenc(hmac(sha1),rfc3686(ctr(aes)))) driver : seqiv(authenc(hmac(sha1-generic),rfc3686(ctr-aes-aesni))) module : seqiv priority : 4100 refcnt : 1 selftest : passed internal : no type : aead async : yes blocksize : 1 ivsize : 8 maxauthsize : 20 geniv :

name : authenc(hmac(sha1),rfc3686(ctr(aes))) driver : authenc(hmac(sha1-generic),rfc3686(ctr-aes-aesni)) module : authenc priority : 4100 refcnt : 1 selftest : passed internal : no type : aead async : yes blocksize : 1 ivsize : 8 maxauthsize : 20 geniv :

name : echainiv(authenc(hmac(sha256),cbc(aes))) driver : echainiv(authenc(hmac(sha256-generic),cbc-aes-aesni)) module : echainiv priority : 4100 refcnt : 1 selftest : passed internal : no type : aead async : yes blocksize : 16 ivsize : 16 maxauthsize : 32 geniv :

name : authenc(hmac(sha256),cbc(aes)) driver : authenc(hmac(sha256-generic),cbc-aes-aesni) module : authenc priority : 4100 refcnt : 1 selftest : passed internal : no type : aead async : yes blocksize : 16 ivsize : 16 maxauthsize : 32 geniv :

name : echainiv(authenc(hmac(sha1),cbc(aes))) driver : echainiv(authenc(hmac(sha1-generic),cbc-aes-aesni)) module : echainiv priority : 4100 refcnt : 5 selftest : passed internal : no type : aead async : yes blocksize : 16 ivsize : 16 maxauthsize : 20 geniv :

name : authenc(hmac(sha1),cbc(aes)) driver : authenc(hmac(sha1-generic),cbc-aes-aesni) module : authenc priority : 4100 refcnt : 5 selftest : passed internal : no type : aead async : yes blocksize : 16 ivsize : 16 maxauthsize : 20 geniv :

name : echainiv(authenc(digest_null,cbc(aes))) driver : echainiv(authenc(digest_null-generic,cbc-aes-aesni)) module : echainiv priority : 4000 refcnt : 1 selftest : passed internal : no type : aead async : yes blocksize : 16 ivsize : 16 maxauthsize : 0 geniv :

name : authenc(digest_null,cbc(aes)) driver : authenc(digest_null-generic,cbc-aes-aesni) module : authenc priority : 4000 refcnt : 1 selftest : passed internal : no type : aead async : yes blocksize : 16 ivsize : 16 maxauthsize : 0 geniv :

name : stdrng driver : drbg_nopr_hmac_sha256 module : drbg priority : 207 refcnt : 2 selftest : passed internal : no type : rng seedsize : 0

name : stdrng driver : drbg_nopr_hmac_sha512 module : drbg priority : 206 refcnt : 1 selftest : passed internal : no type : rng seedsize : 0

name : stdrng driver : drbg_nopr_hmac_sha384 module : drbg priority : 205 refcnt : 1 selftest : passed internal : no type : rng seedsize : 0

name : stdrng driver : drbg_nopr_hmac_sha1 module : drbg priority : 204 refcnt : 1 selftest : passed internal : no type : rng seedsize : 0

name : stdrng driver : drbg_pr_hmac_sha256 module : drbg priority : 203 refcnt : 1 selftest : passed internal : no type : rng seedsize : 0

name : stdrng driver : drbg_pr_hmac_sha512 module : drbg priority : 202 refcnt : 1 selftest : passed internal : no type : rng seedsize : 0

name : stdrng driver : drbg_pr_hmac_sha384 module : drbg priority : 201 refcnt : 1 selftest : passed internal : no type : rng seedsize : 0

name : stdrng driver : drbg_pr_hmac_sha1 module : drbg priority : 200 refcnt : 1 selftest : passed internal : no type : rng seedsize : 0

name : fips(ansi_cprng) driver : fips_ansi_cprng module : ansi_cprng priority : 300 refcnt : 1 selftest : passed internal : no type : rng seedsize : 48

name : stdrng driver : ansi_cprng module : ansi_cprng priority : 100 refcnt : 1 selftest : passed internal : no type : rng seedsize : 48

name : seqiv(authenc(digest_null,rfc3686(ctr(aes)))) driver : seqiv(authenc(digest_null-generic,rfc3686(ctr-aes-aesni))) module : seqiv priority : 4000 refcnt : 1 selftest : passed internal : no type : aead async : yes blocksize : 1 ivsize : 8 maxauthsize : 0 geniv :

name : authenc(digest_null,rfc3686(ctr(aes))) driver : authenc(digest_null-generic,rfc3686(ctr-aes-aesni)) module : authenc priority : 4000 refcnt : 1 selftest : passed internal : no type : aead async : yes blocksize : 1 ivsize : 8 maxauthsize : 0 geniv :

name : rfc3686(ctr(aes)) driver : rfc3686(ctr-aes-aesni) module : ctr priority : 400 refcnt : 1 selftest : passed internal : no type : skcipher async : yes blocksize : 1 min keysize : 20 max keysize : 36 ivsize : 8 chunksize : 16 walksize : 16

name : cbc(twofish) driver : cbc(twofish-asm) module : cbc priority : 200 refcnt : 1 selftest : passed internal : no type : skcipher async : no blocksize : 16 min keysize : 16 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : twofish driver : twofish-generic module : twofish_generic priority : 100 refcnt : 1 selftest : passed internal : no type : cipher blocksize : 16 min keysize : 16 max keysize : 32

name : xts(twofish) driver : cryptd(xts-twofish-avx) module : cryptd priority : 450 refcnt : 1 selftest : passed internal : yes type : skcipher async : yes blocksize : 16 min keysize : 32 max keysize : 64 ivsize : 16 chunksize : 16 walksize : 16

name : xts(twofish) driver : xts-twofish-avx module : twofish_avx_x86_64 priority : 400 refcnt : 1 selftest : passed internal : no type : skcipher async : yes blocksize : 16 min keysize : 32 max keysize : 64 ivsize : 16 chunksize : 16 walksize : 16

name : ctr(twofish) driver : cryptd(ctr-twofish-avx) module : cryptd priority : 450 refcnt : 1 selftest : passed internal : yes type : skcipher async : yes blocksize : 1 min keysize : 16 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : ctr(twofish) driver : ctr-twofish-avx module : twofish_avx_x86_64 priority : 400 refcnt : 1 selftest : passed internal : no type : skcipher async : yes blocksize : 1 min keysize : 16 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : cbc(twofish) driver : cryptd(cbc-twofish-avx) module : cryptd priority : 450 refcnt : 1 selftest : passed internal : yes type : skcipher async : yes blocksize : 16 min keysize : 16 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : cbc(twofish) driver : cbc-twofish-avx module : twofish_avx_x86_64 priority : 400 refcnt : 1 selftest : passed internal : no type : skcipher async : yes blocksize : 16 min keysize : 16 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : ecb(twofish) driver : cryptd(ecb-twofish-avx) module : cryptd priority : 450 refcnt : 1 selftest : passed internal : yes type : skcipher async : yes blocksize : 16 min keysize : 16 max keysize : 32 ivsize : 0 chunksize : 16 walksize : 16

name : ecb(twofish) driver : ecb-twofish-avx module : twofish_avx_x86_64 priority : 400 refcnt : 1 selftest : passed internal : no type : skcipher async : yes blocksize : 16 min keysize : 16 max keysize : 32 ivsize : 0 chunksize : 16 walksize : 16

name : xts(twofish) driver : xts-twofish-avx module : twofish_avx_x86_64 priority : 400 refcnt : 1 selftest : passed internal : yes type : skcipher async : no blocksize : 16 min keysize : 32 max keysize : 64 ivsize : 16 chunksize : 16 walksize : 16

name : ctr(twofish) driver : ctr-twofish-avx module : twofish_avx_x86_64 priority : 400 refcnt : 1 selftest : passed internal : yes type : skcipher async : no blocksize : 1 min keysize : 16 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : cbc(twofish) driver : cbc-twofish-avx module : twofish_avx_x86_64 priority : 400 refcnt : 1 selftest : passed internal : yes type : skcipher async : no blocksize : 16 min keysize : 16 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : ecb(twofish) driver : ecb-twofish-avx module : twofish_avx_x86_64 priority : 400 refcnt : 1 selftest : passed internal : yes type : skcipher async : no blocksize : 16 min keysize : 16 max keysize : 32 ivsize : 0 chunksize : 16 walksize : 16

name : ctr(twofish) driver : ctr-twofish-3way module : twofish_x86_64_3way priority : 300 refcnt : 1 selftest : passed internal : no type : skcipher async : no blocksize : 1 min keysize : 16 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : cbc(twofish) driver : cbc-twofish-3way module : twofish_x86_64_3way priority : 300 refcnt : 1 selftest : passed internal : no type : skcipher async : no blocksize : 16 min keysize : 16 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : ecb(twofish) driver : ecb-twofish-3way module : twofish_x86_64_3way priority : 300 refcnt : 1 selftest : passed internal : no type : skcipher async : no blocksize : 16 min keysize : 16 max keysize : 32 ivsize : 0 chunksize : 16 walksize : 16

name : twofish driver : twofish-asm module : twofish_x86_64 priority : 200 refcnt : 1 selftest : passed internal : no type : cipher blocksize : 16 min keysize : 16 max keysize : 32

name : cbc(camellia) driver : cbc(camellia-asm) module : cbc priority : 200 refcnt : 1 selftest : passed internal : no type : skcipher async : no blocksize : 16 min keysize : 16 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : camellia driver : camellia-generic module : camellia_generic priority : 100 refcnt : 1 selftest : passed internal : no type : cipher blocksize : 16 min keysize : 16 max keysize : 32

name : xts(camellia) driver : cryptd(xts-camellia-aesni-avx2) module : cryptd priority : 550 refcnt : 1 selftest : passed internal : yes type : skcipher async : yes blocksize : 16 min keysize : 32 max keysize : 64 ivsize : 16 chunksize : 16 walksize : 16

name : xts(camellia) driver : xts-camellia-aesni-avx2 module : camellia_aesni_avx2 priority : 500 refcnt : 1 selftest : passed internal : no type : skcipher async : yes blocksize : 16 min keysize : 32 max keysize : 64 ivsize : 16 chunksize : 16 walksize : 16

name : ctr(camellia) driver : cryptd(ctr-camellia-aesni-avx2) module : cryptd priority : 550 refcnt : 1 selftest : passed internal : yes type : skcipher async : yes blocksize : 1 min keysize : 16 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : ctr(camellia) driver : ctr-camellia-aesni-avx2 module : camellia_aesni_avx2 priority : 500 refcnt : 1 selftest : passed internal : no type : skcipher async : yes blocksize : 1 min keysize : 16 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : cbc(camellia) driver : cryptd(cbc-camellia-aesni-avx2) module : cryptd priority : 550 refcnt : 1 selftest : passed internal : yes type : skcipher async : yes blocksize : 16 min keysize : 16 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : cbc(camellia) driver : cbc-camellia-aesni-avx2 module : camellia_aesni_avx2 priority : 500 refcnt : 1 selftest : passed internal : no type : skcipher async : yes blocksize : 16 min keysize : 16 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : ecb(camellia) driver : cryptd(ecb-camellia-aesni-avx2) module : cryptd priority : 550 refcnt : 1 selftest : passed internal : yes type : skcipher async : yes blocksize : 16 min keysize : 16 max keysize : 32 ivsize : 0 chunksize : 16 walksize : 16

name : ecb(camellia) driver : ecb-camellia-aesni-avx2 module : camellia_aesni_avx2 priority : 500 refcnt : 1 selftest : passed internal : no type : skcipher async : yes blocksize : 16 min keysize : 16 max keysize : 32 ivsize : 0 chunksize : 16 walksize : 16

name : xts(camellia) driver : xts-camellia-aesni-avx2 module : camellia_aesni_avx2 priority : 500 refcnt : 1 selftest : passed internal : yes type : skcipher async : no blocksize : 16 min keysize : 32 max keysize : 64 ivsize : 16 chunksize : 16 walksize : 16

name : ctr(camellia) driver : ctr-camellia-aesni-avx2 module : camellia_aesni_avx2 priority : 500 refcnt : 1 selftest : passed internal : yes type : skcipher async : no blocksize : 1 min keysize : 16 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : cbc(camellia) driver : cbc-camellia-aesni-avx2 module : camellia_aesni_avx2 priority : 500 refcnt : 1 selftest : passed internal : yes type : skcipher async : no blocksize : 16 min keysize : 16 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : ecb(camellia) driver : ecb-camellia-aesni-avx2 module : camellia_aesni_avx2 priority : 500 refcnt : 1 selftest : passed internal : yes type : skcipher async : no blocksize : 16 min keysize : 16 max keysize : 32 ivsize : 0 chunksize : 16 walksize : 16

name : xts(camellia) driver : xts-camellia-aesni module : camellia_aesni_avx_x86_64 priority : 400 refcnt : 1 selftest : passed internal : no type : skcipher async : yes blocksize : 16 min keysize : 32 max keysize : 64 ivsize : 16 chunksize : 16 walksize : 16

name : ctr(camellia) driver : ctr-camellia-aesni module : camellia_aesni_avx_x86_64 priority : 400 refcnt : 1 selftest : passed internal : no type : skcipher async : yes blocksize : 1 min keysize : 16 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : cbc(camellia) driver : cbc-camellia-aesni module : camellia_aesni_avx_x86_64 priority : 400 refcnt : 1 selftest : passed internal : no type : skcipher async : yes blocksize : 16 min keysize : 16 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : ecb(camellia) driver : ecb-camellia-aesni module : camellia_aesni_avx_x86_64 priority : 400 refcnt : 1 selftest : passed internal : no type : skcipher async : yes blocksize : 16 min keysize : 16 max keysize : 32 ivsize : 0 chunksize : 16 walksize : 16

name : xts(camellia) driver : xts-camellia-aesni module : camellia_aesni_avx_x86_64 priority : 400 refcnt : 1 selftest : passed internal : yes type : skcipher async : no blocksize : 16 min keysize : 32 max keysize : 64 ivsize : 16 chunksize : 16 walksize : 16

name : ctr(camellia) driver : ctr-camellia-aesni module : camellia_aesni_avx_x86_64 priority : 400 refcnt : 1 selftest : passed internal : yes type : skcipher async : no blocksize : 1 min keysize : 16 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : cbc(camellia) driver : cbc-camellia-aesni module : camellia_aesni_avx_x86_64 priority : 400 refcnt : 1 selftest : passed internal : yes type : skcipher async : no blocksize : 16 min keysize : 16 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : ecb(camellia) driver : ecb-camellia-aesni module : camellia_aesni_avx_x86_64 priority : 400 refcnt : 1 selftest : passed internal : yes type : skcipher async : no blocksize : 16 min keysize : 16 max keysize : 32 ivsize : 0 chunksize : 16 walksize : 16

name : ctr(camellia) driver : ctr-camellia-asm module : camellia_x86_64 priority : 300 refcnt : 1 selftest : passed internal : no type : skcipher async : no blocksize : 1 min keysize : 16 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : cbc(camellia) driver : cbc-camellia-asm module : camellia_x86_64 priority : 300 refcnt : 1 selftest : passed internal : no type : skcipher async : no blocksize : 16 min keysize : 16 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : ecb(camellia) driver : ecb-camellia-asm module : camellia_x86_64 priority : 300 refcnt : 1 selftest : passed internal : no type : skcipher async : no blocksize : 16 min keysize : 16 max keysize : 32 ivsize : 0 chunksize : 16 walksize : 16

name : camellia driver : camellia-asm module : camellia_x86_64 priority : 200 refcnt : 1 selftest : passed internal : no type : cipher blocksize : 16 min keysize : 16 max keysize : 32

name : cbc(serpent) driver : cbc(serpent-generic) module : cbc priority : 100 refcnt : 1 selftest : passed internal : no type : skcipher async : no blocksize : 16 min keysize : 0 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : xts(serpent) driver : cryptd(xts-serpent-avx2) module : cryptd priority : 650 refcnt : 1 selftest : passed internal : yes type : skcipher async : yes blocksize : 16 min keysize : 0 max keysize : 64 ivsize : 16 chunksize : 16 walksize : 16

name : xts(serpent) driver : xts-serpent-avx2 module : serpent_avx2 priority : 600 refcnt : 1 selftest : passed internal : no type : skcipher async : yes blocksize : 16 min keysize : 0 max keysize : 64 ivsize : 16 chunksize : 16 walksize : 16

name : ctr(serpent) driver : cryptd(ctr-serpent-avx2) module : cryptd priority : 650 refcnt : 1 selftest : passed internal : yes type : skcipher async : yes blocksize : 1 min keysize : 0 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : ctr(serpent) driver : ctr-serpent-avx2 module : serpent_avx2 priority : 600 refcnt : 1 selftest : passed internal : no type : skcipher async : yes blocksize : 1 min keysize : 0 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : cbc(serpent) driver : cryptd(cbc-serpent-avx2) module : cryptd priority : 650 refcnt : 1 selftest : passed internal : yes type : skcipher async : yes blocksize : 16 min keysize : 0 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : cbc(serpent) driver : cbc-serpent-avx2 module : serpent_avx2 priority : 600 refcnt : 1 selftest : passed internal : no type : skcipher async : yes blocksize : 16 min keysize : 0 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : ecb(serpent) driver : cryptd(ecb-serpent-avx2) module : cryptd priority : 650 refcnt : 1 selftest : passed internal : yes type : skcipher async : yes blocksize : 16 min keysize : 0 max keysize : 32 ivsize : 0 chunksize : 16 walksize : 16

name : ecb(serpent) driver : ecb-serpent-avx2 module : serpent_avx2 priority : 600 refcnt : 1 selftest : passed internal : no type : skcipher async : yes blocksize : 16 min keysize : 0 max keysize : 32 ivsize : 0 chunksize : 16 walksize : 16

name : xts(serpent) driver : xts-serpent-avx2 module : serpent_avx2 priority : 600 refcnt : 1 selftest : passed internal : yes type : skcipher async : no blocksize : 16 min keysize : 0 max keysize : 64 ivsize : 16 chunksize : 16 walksize : 16

name : ctr(serpent) driver : ctr-serpent-avx2 module : serpent_avx2 priority : 600 refcnt : 1 selftest : passed internal : yes type : skcipher async : no blocksize : 1 min keysize : 0 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : cbc(serpent) driver : cbc-serpent-avx2 module : serpent_avx2 priority : 600 refcnt : 1 selftest : passed internal : yes type : skcipher async : no blocksize : 16 min keysize : 0 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : ecb(serpent) driver : ecb-serpent-avx2 module : serpent_avx2 priority : 600 refcnt : 1 selftest : passed internal : yes type : skcipher async : no blocksize : 16 min keysize : 0 max keysize : 32 ivsize : 0 chunksize : 16 walksize : 16

name : xts(serpent) driver : xts-serpent-avx module : serpent_avx_x86_64 priority : 500 refcnt : 1 selftest : passed internal : no type : skcipher async : yes blocksize : 16 min keysize : 0 max keysize : 64 ivsize : 16 chunksize : 16 walksize : 16

name : ctr(serpent) driver : ctr-serpent-avx module : serpent_avx_x86_64 priority : 500 refcnt : 1 selftest : passed internal : no type : skcipher async : yes blocksize : 1 min keysize : 0 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : cbc(serpent) driver : cbc-serpent-avx module : serpent_avx_x86_64 priority : 500 refcnt : 1 selftest : passed internal : no type : skcipher async : yes blocksize : 16 min keysize : 0 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : ecb(serpent) driver : ecb-serpent-avx module : serpent_avx_x86_64 priority : 500 refcnt : 1 selftest : passed internal : no type : skcipher async : yes blocksize : 16 min keysize : 0 max keysize : 32 ivsize : 0 chunksize : 16 walksize : 16

name : xts(serpent) driver : xts-serpent-avx module : serpent_avx_x86_64 priority : 500 refcnt : 1 selftest : passed internal : yes type : skcipher async : no blocksize : 16 min keysize : 0 max keysize : 64 ivsize : 16 chunksize : 16 walksize : 16

name : ctr(serpent) driver : ctr-serpent-avx module : serpent_avx_x86_64 priority : 500 refcnt : 1 selftest : passed internal : yes type : skcipher async : no blocksize : 1 min keysize : 0 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : cbc(serpent) driver : cbc-serpent-avx module : serpent_avx_x86_64 priority : 500 refcnt : 1 selftest : passed internal : yes type : skcipher async : no blocksize : 16 min keysize : 0 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : ecb(serpent) driver : ecb-serpent-avx module : serpent_avx_x86_64 priority : 500 refcnt : 1 selftest : passed internal : yes type : skcipher async : no blocksize : 16 min keysize : 0 max keysize : 32 ivsize : 0 chunksize : 16 walksize : 16

name : ctr(serpent) driver : ctr-serpent-sse2 module : serpent_sse2_x86_64 priority : 400 refcnt : 1 selftest : passed internal : no type : skcipher async : yes blocksize : 1 min keysize : 0 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : cbc(serpent) driver : cbc-serpent-sse2 module : serpent_sse2_x86_64 priority : 400 refcnt : 1 selftest : passed internal : no type : skcipher async : yes blocksize : 16 min keysize : 0 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : ecb(serpent) driver : ecb-serpent-sse2 module : serpent_sse2_x86_64 priority : 400 refcnt : 1 selftest : passed internal : no type : skcipher async : yes blocksize : 16 min keysize : 0 max keysize : 32 ivsize : 0 chunksize : 16 walksize : 16

name : ctr(serpent) driver : ctr-serpent-sse2 module : serpent_sse2_x86_64 priority : 400 refcnt : 1 selftest : passed internal : yes type : skcipher async : no blocksize : 1 min keysize : 0 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : cbc(serpent) driver : cbc-serpent-sse2 module : serpent_sse2_x86_64 priority : 400 refcnt : 1 selftest : passed internal : yes type : skcipher async : no blocksize : 16 min keysize : 0 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : ecb(serpent) driver : ecb-serpent-sse2 module : serpent_sse2_x86_64 priority : 400 refcnt : 1 selftest : passed internal : yes type : skcipher async : no blocksize : 16 min keysize : 0 max keysize : 32 ivsize : 0 chunksize : 16 walksize : 16

name : tnepres driver : tnepres-generic module : serpent_generic priority : 0 refcnt : 1 selftest : passed internal : no type : cipher blocksize : 16 min keysize : 0 max keysize : 32

name : serpent driver : serpent-generic module : serpent_generic priority : 100 refcnt : 1 selftest : passed internal : no type : cipher blocksize : 16 min keysize : 0 max keysize : 32

name : cbc(blowfish) driver : cbc(blowfish-asm) module : cbc priority : 200 refcnt : 1 selftest : passed internal : no type : skcipher async : no blocksize : 8 min keysize : 4 max keysize : 56 ivsize : 8 chunksize : 8 walksize : 8

name : blowfish driver : blowfish-generic module : blowfish_generic priority : 100 refcnt : 1 selftest : passed internal : no type : cipher blocksize : 8 min keysize : 4 max keysize : 56

name : ctr(blowfish) driver : ctr-blowfish-asm module : blowfish_x86_64 priority : 300 refcnt : 1 selftest : passed internal : no type : skcipher async : no blocksize : 1 min keysize : 4 max keysize : 56 ivsize : 8 chunksize : 8 walksize : 8

name : cbc(blowfish) driver : cbc-blowfish-asm module : blowfish_x86_64 priority : 300 refcnt : 1 selftest : passed internal : no type : skcipher async : no blocksize : 8 min keysize : 4 max keysize : 56 ivsize : 8 chunksize : 8 walksize : 8

name : ecb(blowfish) driver : ecb-blowfish-asm module : blowfish_x86_64 priority : 300 refcnt : 1 selftest : passed internal : no type : skcipher async : no blocksize : 8 min keysize : 4 max keysize : 56 ivsize : 0 chunksize : 8 walksize : 8

name : blowfish driver : blowfish-asm module : blowfish_x86_64 priority : 200 refcnt : 1 selftest : passed internal : no type : cipher blocksize : 8 min keysize : 4 max keysize : 56

name : cbc(cast5) driver : cbc(cast5-generic) module : cbc priority : 100 refcnt : 1 selftest : passed internal : no type : skcipher async : no blocksize : 8 min keysize : 5 max keysize : 16 ivsize : 8 chunksize : 8 walksize : 8

name : ctr(cast5) driver : cryptd(ctr-cast5-avx) module : cryptd priority : 250 refcnt : 1 selftest : passed internal : yes type : skcipher async : yes blocksize : 1 min keysize : 5 max keysize : 16 ivsize : 8 chunksize : 8 walksize : 8

name : ctr(cast5) driver : ctr-cast5-avx module : cast5_avx_x86_64 priority : 200 refcnt : 1 selftest : passed internal : no type : skcipher async : yes blocksize : 1 min keysize : 5 max keysize : 16 ivsize : 8 chunksize : 8 walksize : 8

name : cbc(cast5) driver : cryptd(cbc-cast5-avx) module : cryptd priority : 250 refcnt : 1 selftest : passed internal : yes type : skcipher async : yes blocksize : 8 min keysize : 5 max keysize : 16 ivsize : 8 chunksize : 8 walksize : 8

name : cbc(cast5) driver : cbc-cast5-avx module : cast5_avx_x86_64 priority : 200 refcnt : 1 selftest : passed internal : no type : skcipher async : yes blocksize : 8 min keysize : 5 max keysize : 16 ivsize : 8 chunksize : 8 walksize : 8

name : ecb(cast5) driver : cryptd(ecb-cast5-avx) module : cryptd priority : 250 refcnt : 1 selftest : passed internal : yes type : skcipher async : yes blocksize : 8 min keysize : 5 max keysize : 16 ivsize : 0 chunksize : 8 walksize : 8

name : ecb(cast5) driver : ecb-cast5-avx module : cast5_avx_x86_64 priority : 200 refcnt : 1 selftest : passed internal : no type : skcipher async : yes blocksize : 8 min keysize : 5 max keysize : 16 ivsize : 0 chunksize : 8 walksize : 8

name : ctr(cast5) driver : ctr-cast5-avx module : cast5_avx_x86_64 priority : 200 refcnt : 1 selftest : passed internal : yes type : skcipher async : no blocksize : 1 min keysize : 5 max keysize : 16 ivsize : 8 chunksize : 8 walksize : 8

name : cbc(cast5) driver : cbc-cast5-avx module : cast5_avx_x86_64 priority : 200 refcnt : 1 selftest : passed internal : yes type : skcipher async : no blocksize : 8 min keysize : 5 max keysize : 16 ivsize : 8 chunksize : 8 walksize : 8

name : ecb(cast5) driver : ecb-cast5-avx module : cast5_avx_x86_64 priority : 200 refcnt : 1 selftest : passed internal : yes type : skcipher async : no blocksize : 8 min keysize : 5 max keysize : 16 ivsize : 0 chunksize : 8 walksize : 8

name : cast5 driver : cast5-generic module : cast5_generic priority : 100 refcnt : 1 selftest : passed internal : no type : cipher blocksize : 8 min keysize : 5 max keysize : 16

name : cbc(des3_ede) driver : cbc(des3_ede-generic) module : cbc priority : 100 refcnt : 1 selftest : passed internal : no type : skcipher async : no blocksize : 8 min keysize : 24 max keysize : 24 ivsize : 8 chunksize : 8 walksize : 8

name : cbc(des) driver : cbc(des-generic) module : cbc priority : 100 refcnt : 1 selftest : passed internal : no type : skcipher async : no blocksize : 8 min keysize : 8 max keysize : 8 ivsize : 8 chunksize : 8 walksize : 8

name : des3_ede driver : des3_ede-generic module : des_generic priority : 100 refcnt : 1 selftest : passed internal : no type : cipher blocksize : 8 min keysize : 24 max keysize : 24

name : des driver : des-generic module : des_generic priority : 100 refcnt : 1 selftest : passed internal : no type : cipher blocksize : 8 min keysize : 8 max keysize : 8

name : cmac(aes) driver : cmac(aes-aesni) module : cmac priority : 300 refcnt : 1 selftest : passed internal : no type : shash blocksize : 16 digestsize : 16

name : xcbc(aes) driver : xcbc(aes-aesni) module : xcbc priority : 300 refcnt : 1 selftest : passed internal : no type : shash blocksize : 16 digestsize : 16

name : hmac(rmd160) driver : hmac(rmd160-generic) module : kernel priority : 0 refcnt : 1 selftest : passed internal : no type : shash blocksize : 64 digestsize : 20

name : rmd160 driver : rmd160-generic module : rmd160 priority : 0 refcnt : 1 selftest : passed internal : no type : shash blocksize : 64 digestsize : 20

name : hmac(sha512) driver : hmac(sha512-avx2) module : kernel priority : 170 refcnt : 1 selftest : passed internal : no type : shash blocksize : 128 digestsize : 64

name : hmac(sha384) driver : hmac(sha384-avx2) module : kernel priority : 170 refcnt : 1 selftest : passed internal : no type : shash blocksize : 128 digestsize : 48

name : sha384 driver : sha384-avx2 module : sha512_ssse3 priority : 170 refcnt : 1 selftest : passed internal : no type : shash blocksize : 128 digestsize : 48

name : sha512 driver : sha512-avx2 module : sha512_ssse3 priority : 170 refcnt : 1 selftest : passed internal : no type : shash blocksize : 128 digestsize : 64

name : sha384 driver : sha384-avx module : sha512_ssse3 priority : 160 refcnt : 1 selftest : passed internal : no type : shash blocksize : 128 digestsize : 48

name : sha512 driver : sha512-avx module : sha512_ssse3 priority : 160 refcnt : 1 selftest : passed internal : no type : shash blocksize : 128 digestsize : 64

name : sha384 driver : sha384-ssse3 module : sha512_ssse3 priority : 150 refcnt : 1 selftest : passed internal : no type : shash blocksize : 128 digestsize : 48

name : sha512 driver : sha512-ssse3 module : sha512_ssse3 priority : 150 refcnt : 1 selftest : passed internal : no type : shash blocksize : 128 digestsize : 64

name : sha384 driver : sha384-generic module : sha512_generic priority : 100 refcnt : 1 selftest : passed internal : no type : shash blocksize : 128 digestsize : 48

name : sha512 driver : sha512-generic module : sha512_generic priority : 100 refcnt : 1 selftest : passed internal : no type : shash blocksize : 128 digestsize : 64

name : hmac(md5) driver : hmac(md5-generic) module : kernel priority : 0 refcnt : 1 selftest : passed internal : no type : shash blocksize : 64 digestsize : 16

name : crct10dif driver : crct10dif-pclmul module : crct10dif_pclmul priority : 200 refcnt : 1 selftest : passed internal : no type : shash blocksize : 1 digestsize : 2

name : crc32 driver : crc32-pclmul module : crc32_pclmul priority : 200 refcnt : 1 selftest : passed internal : no type : shash blocksize : 1 digestsize : 4

name : ghash driver : cryptd(ghash-pclmulqdqni) module : cryptd priority : 50 refcnt : 1 selftest : passed internal : yes type : ahash async : yes blocksize : 16 digestsize : 16

name : ghash driver : ghash-clmulni module : ghash_clmulni_intel priority : 400 refcnt : 1 selftest : passed internal : no type : ahash async : yes blocksize : 16 digestsize : 16

name : ghash driver : ghash-pclmulqdqni module : ghash_clmulni_intel priority : 0 refcnt : 1 selftest : passed internal : yes type : shash blocksize : 16 digestsize : 16

name : crc32c driver : crc32c-generic module : crc32c_generic priority : 100 refcnt : 1 selftest : passed internal : no type : shash blocksize : 1 digestsize : 4

name : crc32c driver : crc32c-intel module : crc32c_intel priority : 200 refcnt : 5 selftest : passed internal : no type : shash blocksize : 1 digestsize : 4

name : xts(aes) driver : cryptd(xts-aes-aesni) module : cryptd priority : 451 refcnt : 1 selftest : passed internal : yes type : skcipher async : yes blocksize : 16 min keysize : 32 max keysize : 64 ivsize : 16 chunksize : 16 walksize : 16

name : xts(aes) driver : xts-aes-aesni module : aesni_intel priority : 401 refcnt : 1 selftest : passed internal : no type : skcipher async : yes blocksize : 16 min keysize : 32 max keysize : 64 ivsize : 16 chunksize : 16 walksize : 16

name : ctr(aes) driver : cryptd(ctr-aes-aesni) module : cryptd priority : 450 refcnt : 1 selftest : passed internal : yes type : skcipher async : yes blocksize : 1 min keysize : 16 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : ctr(aes) driver : ctr-aes-aesni module : aesni_intel priority : 400 refcnt : 1 selftest : passed internal : no type : skcipher async : yes blocksize : 1 min keysize : 16 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : cbc(aes) driver : cryptd(cbc-aes-aesni) module : cryptd priority : 450 refcnt : 5 selftest : passed internal : yes type : skcipher async : yes blocksize : 16 min keysize : 16 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : cbc(aes) driver : cbc-aes-aesni module : aesni_intel priority : 400 refcnt : 5 selftest : passed internal : no type : skcipher async : yes blocksize : 16 min keysize : 16 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : ecb(aes) driver : cryptd(ecb-aes-aesni) module : cryptd priority : 450 refcnt : 1 selftest : passed internal : yes type : skcipher async : yes blocksize : 16 min keysize : 16 max keysize : 32 ivsize : 0 chunksize : 16 walksize : 16

name : ecb(aes) driver : ecb-aes-aesni module : aesni_intel priority : 400 refcnt : 1 selftest : passed internal : no type : skcipher async : yes blocksize : 16 min keysize : 16 max keysize : 32 ivsize : 0 chunksize : 16 walksize : 16

name : generic-gcm-aes-aesni driver : cryptd(driver-generic-gcm-aes-aesni) module : cryptd priority : 50 refcnt : 1 selftest : passed internal : yes type : aead async : yes blocksize : 1 ivsize : 12 maxauthsize : 16 geniv :

name : gcm(aes) driver : generic-gcm-aesni module : aesni_intel priority : 400 refcnt : 1 selftest : passed internal : no type : aead async : yes blocksize : 1 ivsize : 12 maxauthsize : 16 geniv :

name : generic-gcm-aes-aesni driver : driver-generic-gcm-aes-aesni module : aesni_intel priority : 0 refcnt : 1 selftest : passed internal : yes type : aead async : no blocksize : 1 ivsize : 12 maxauthsize : 16 geniv :

name : gcm-aes-aesni driver : cryptd(driver-gcm-aes-aesni) module : cryptd priority : 50 refcnt : 1 selftest : passed internal : yes type : aead async : yes blocksize : 1 ivsize : 8 maxauthsize : 16 geniv :

name : rfc4106(gcm(aes)) driver : rfc4106-gcm-aesni module : aesni_intel priority : 400 refcnt : 1 selftest : passed internal : no type : aead async : yes blocksize : 1 ivsize : 8 maxauthsize : 16 geniv :

name : gcm-aes-aesni driver : driver-gcm-aes-aesni module : aesni_intel priority : 0 refcnt : 1 selftest : passed internal : yes type : aead async : no blocksize : 1 ivsize : 8 maxauthsize : 16 geniv :

name : xts(aes) driver : xts-aes-aesni module : aesni_intel priority : 401 refcnt : 1 selftest : passed internal : yes type : skcipher async : no blocksize : 16 min keysize : 32 max keysize : 64 ivsize : 16 chunksize : 16 walksize : 16

name : ctr(aes) driver : ctr-aes-aesni module : aesni_intel priority : 400 refcnt : 1 selftest : passed internal : yes type : skcipher async : no blocksize : 1 min keysize : 16 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : cbc(aes) driver : cbc-aes-aesni module : aesni_intel priority : 400 refcnt : 5 selftest : passed internal : yes type : skcipher async : no blocksize : 16 min keysize : 16 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16

name : ecb(aes) driver : ecb-aes-aesni module : aesni_intel priority : 400 refcnt : 1 selftest : passed internal : yes type : skcipher async : no blocksize : 16 min keysize : 16 max keysize : 32 ivsize : 0 chunksize : 16 walksize : 16

name : aes driver : aes-aesni module : aesni_intel priority : 300 refcnt : 1 selftest : passed internal : yes type : cipher blocksize : 16 min keysize : 16 max keysize : 32

name : aes driver : aes-aesni module : aesni_intel priority : 300 refcnt : 1 selftest : passed internal : no type : cipher blocksize : 16 min keysize : 16 max keysize : 32

name : aes driver : aes-asm module : aes_x86_64 priority : 200 refcnt : 1 selftest : passed internal : no type : cipher blocksize : 16 min keysize : 16 max keysize : 32

name : pkcs1pad(rsa,sha256) driver : pkcs1pad(rsa-generic,sha256) module : kernel priority : 100 refcnt : 1 selftest : passed internal : no type : akcipher

name : hmac(sha256) driver : hmac(sha256-generic) module : kernel priority : 100 refcnt : 50 selftest : passed internal : no type : shash blocksize : 64 digestsize : 32

name : hmac(sha1) driver : hmac(sha1-generic) module : kernel priority : 100 refcnt : 57 selftest : passed internal : no type : shash blocksize : 64 digestsize : 20

name : lzo driver : lzo-scomp module : kernel priority : 0 refcnt : 1 selftest : passed internal : no type : scomp

name : lzo driver : lzo-generic module : kernel priority : 0 refcnt : 49 selftest : passed internal : no type : compression

name : crct10dif driver : crct10dif-generic module : kernel priority : 100 refcnt : 2 selftest : passed internal : no type : shash blocksize : 1 digestsize : 2

name : zlib-deflate driver : zlib-deflate-scomp module : kernel priority : 0 refcnt : 1 selftest : passed internal : no type : scomp

name : deflate driver : deflate-scomp module : kernel priority : 0 refcnt : 1 selftest : passed internal : no type : scomp

name : deflate driver : deflate-generic module : kernel priority : 0 refcnt : 2 selftest : passed internal : no type : compression

name : aes driver : aes-generic module : kernel priority : 100 refcnt : 1 selftest : passed internal : no type : cipher blocksize : 16 min keysize : 16 max keysize : 32

name : sha224 driver : sha224-generic module : kernel priority : 100 refcnt : 1 selftest : passed internal : no type : shash blocksize : 64 digestsize : 28

name : sha256 driver : sha256-generic module : kernel priority : 100 refcnt : 50 selftest : passed internal : no type : shash blocksize : 64 digestsize : 32

name : sha1 driver : sha1-generic module : kernel priority : 100 refcnt : 55 selftest : passed internal : no type : shash blocksize : 64 digestsize : 20

name : md5 driver : md5-generic module : kernel priority : 0 refcnt : 1 selftest : passed internal : no type : shash blocksize : 64 digestsize : 16

name : digest_null driver : digest_null-generic module : kernel priority : 0 refcnt : 1 selftest : passed internal : no type : shash blocksize : 1 digestsize : 0

name : compress_null driver : compress_null-generic module : kernel priority : 0 refcnt : 1 selftest : passed internal : no type : compression

name : ecb(cipher_null) driver : ecb-cipher_null module : kernel priority : 100 refcnt : 3 selftest : passed internal : no type : blkcipher blocksize : 1 min keysize : 0 max keysize : 0 ivsize : 0 geniv :

name : cipher_null driver : cipher_null-generic module : kernel priority : 0 refcnt : 1 selftest : passed internal : no type : cipher blocksize : 1 min keysize : 0 max keysize : 0

name : rsa driver : rsa-generic module : kernel priority : 100 refcnt : 1 selftest : passed internal : no type : akcipher

name : dh driver : dh-generic module : kernel priority : 100 refcnt : 1 selftest : passed internal : no type : kpp

• __/proc/sys/net/core/xfrm-star /usr/local/libexec/ipsec/barf: 190: /usr/local/libexec/ipsec/barf: __/proc/sys/net/core/xfrm-star: not found
• echo -n /proc/sys/net/core/xfrm_acq_expires: /proc/sys/net/core/xfrm_acq_expires: + cat /proc/sys/net/core/xfrm_acq_expires 30
• echo -n /proc/sys/net/core/xfrm_aevent_etime: /proc/sys/net/core/xfrm_aevent_etime: + cat /proc/sys/net/core/xfrm_aevent_etime 10
• echo -n /proc/sys/net/core/xfrm_aevent_rseqth: /proc/sys/net/core/xfrm_aevent_rseqth: + cat /proc/sys/net/core/xfrm_aevent_rseqth 2
• echo -n /proc/sys/net/core/xfrm_larval_drop: /proc/sys/net/core/xfrm_larval_drop: + cat /proc/sys/net/core/xfrm_larval_drop 1
• _____ /proc/sys/net/ipsec-star
• test -d /proc/sys/net/ipsec
• _____ ipsec/status
• ipsec auto --status 000 using kernel interface: netkey 000 interface lo/lo 127.0.0.1 (AF_INET) 000 interface eth0/eth0 172.17.0.2 (AF_INET) 000 using secrets file: /etc/ipsec.secrets 000 %myid = (none) 000 debug none 000
  000 virtual_private (%priv): 000 - allowed 0 subnets: 000 - disallowed 0 subnets: 000 WARNING: Either virtual_private= is not specified, or there is a syntax 000 error in that line. 'left/rightsubnet=vhost:%priv' will not work! 000 WARNING: Disallowed subnets in virtual_private= is empty. If you have 000 private address space in internal use, it should be excluded! 000
  000 algorithm ESP encrypt: id=2, name=ESP_DES, ivlen=8, keysizemin=64, keysizemax=64 000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=8, keysizemin=192, keysizemax=192 000 algorithm ESP encrypt: id=6, name=ESP_CAST, ivlen=8, keysizemin=40, keysizemax=128 000 algorithm ESP encrypt: id=7, name=ESP_BLOWFISH, ivlen=8, keysizemin=40, keysizemax=448 000 algorithm ESP encrypt: id=11, name=ESP_NULL, ivlen=0, keysizemin=0, keysizemax=0 000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=8, keysizemin=128, keysizemax=256 000 algorithm ESP encrypt: id=13, name=ESP_AES_CTR, ivlen=8, keysizemin=160, keysizemax=288 000 algorithm ESP encrypt: id=14, name=ESP_AES_CCM_A, ivlen=8, keysizemin=128, keysizemax=256 000 algorithm ESP encrypt: id=15, name=ESP_AES_CCM_B, ivlen=8, keysizemin=128, keysizemax=256 000 algorithm ESP encrypt: id=16, name=ESP_AES_CCM_C, ivlen=8, keysizemin=128, keysizemax=256 000 algorithm ESP encrypt: id=18, name=ESP_AES_GCM_A, ivlen=8, keysizemin=160, keysizemax=288 000 algorithm ESP encrypt: id=19, name=ESP_AES_GCM_B, ivlen=12, keysizemin=160, keysizemax=288 000 algorithm ESP encrypt: id=20, name=ESP_AES_GCM_C, ivlen=16, keysizemin=160, keysizemax=288 000 algorithm ESP encrypt: id=22, name=ESP_CAMELLIA, ivlen=8, keysizemin=128, keysizemax=256 000 algorithm ESP encrypt: id=252, name=ESP_SERPENT, ivlen=8, keysizemin=128, keysizemax=256 000 algorithm ESP encrypt: id=253, name=ESP_TWOFISH, ivlen=8, keysizemin=128, keysizemax=256 000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5, keysizemin=128, keysizemax=128 000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1, keysizemin=160, keysizemax=160 000 algorithm ESP auth attr: id=5, name=AUTH_ALGORITHM_HMAC_SHA2_256, keysizemin=256, keysizemax=256 000 algorithm ESP auth attr: id=6, name=AUTH_ALGORITHM_HMAC_SHA2_384, keysizemin=384, keysizemax=384 000 algorithm ESP auth attr: id=7, name=AUTH_ALGORITHM_HMAC_SHA2_512, keysizemin=512, keysizemax=512 000 algorithm ESP auth attr: id=8, name=AUTH_ALGORITHM_HMAC_RIPEMD, keysizemin=160, keysizemax=160 000 algorithm ESP auth attr: id=9, name=AUTH_ALGORITHM_AES_CBC, keysizemin=128, keysizemax=128 000 algorithm ESP auth attr: id=251, name=AUTH_ALGORITHM_NULL_KAME, keysizemin=0, keysizemax=0 000
  000 algorithm IKE encrypt: id=0, name=(null), blocksize=16, keydeflen=131 000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8, keydeflen=192 000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16, keydeflen=128 000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16 000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20 000 algorithm IKE hash: id=4, name=OAKLEY_SHA2_256, hashsize=32 000 algorithm IKE hash: id=6, name=OAKLEY_SHA2_512, hashsize=64 000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024 000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536 000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048 000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072 000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096 000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144 000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192 000 algorithm IKE dh group: id=22, name=OAKLEY_GROUP_DH22, bits=1024 000 algorithm IKE dh group: id=23, name=OAKLEY_GROUP_DH23, bits=2048 000 algorithm IKE dh group: id=24, name=OAKLEY_GROUP_DH24, bits=2048 000
  000 stats db_ops: {curr_cnt, total_cnt, maxsz} :context={0,2,64} trans={0,2,3072} attrs={0,2,2048} 000
  000 "point1-to-point2": 172.17.0.2[@point1]...172.17.0.3[@point2]; erouted; eroute owner: #2 000 "point1-to-point2": myip=unset; hisip=unset; 000 "point1-to-point2": keys: 1:1607 9372 7F4F 5273 8EF0 EC16 D213 3C48 B440 9426 2:none... 000 "point1-to-point2": ....1:83B8 6D2B 6034 C9F5 92A2 AD39 EA51 D832 72EF 94D4 2:none 000 "point1-to-point2": ike_life: 3600s; ipsec_life: 1200s; rekey_margin: 300s; rekey_fuzz: 50%; keyingtries: 0; firstmsgid: 0 000 "point1-to-point2": policy: RSASIG+ENCRYPT+PFS+UP+IKEv2ALLOW+SAREFTRACK; prio: 32,32; interface: eth0; kind=CK_PERMANENT 000 "point1-to-point2": dpd: action:restart; delay:30; timeout:120;
  000 "point1-to-point2": newest ISAKMP SA: #1; newest IPsec SA: #2; eroute owner: #2; 000 "point1-to-point2": IKE algorithms wanted: AES_CBC(7)_000-SHA1(2)_000-MODP1536(5), AES_CBC(7)_000-SHA1(2)_000-MODP1024(2); flags=-strict 000 "point1-to-point2": IKE algorithms found: AES_CBC(7)_128-SHA1(2)_160-MODP1536(5)AES_CBC(7)_128-SHA1(2)_160-MODP1024(2) 000 "point1-to-point2": IKE algorithm newest: AES_CBC_128-SHA1-MODP1536 000 "point1-to-point2": ESP algorithms wanted: AES(12)_128-SHA1(2)_000; flags=-strict 000 "point1-to-point2": ESP algorithms loaded: AES(12)_128-SHA1(2)_160 000 "point1-to-point2": ESP algorithm newest: AES_128-HMAC_SHA1; pfsgroup= 000
  000 #2: "point1-to-point2":500 IKEv1.0 STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 690s; newest IPSEC; eroute owner; isakmp#1; idle; import:admin initiate 000 #2: "point1-to-point2" esp.2dad48cd@172.17.0.3 esp.2cb283ae@172.17.0.2 ref=0 refhim=4294901761 000 #1: "point1-to-point2":500 IKEv1.0 STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 3128s; newest ISAKMP; lastdpd=12s(seq in:106 out:0); idle; import:admin initiate 000
• _____ ifconfig-a
• ifconfig -a /usr/local/libexec/ipsec/barf: 204: /usr/local/libexec/ipsec/barf: ifconfig: not found
• _____ ip-addr-list
• ip addr list 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever 223: eth0@if224: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff link-netnsid 0 inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0 valid_lft forever preferred_lft forever
• _____ ip-route-list
• ip route list default via 172.17.0.1 dev eth0 172.17.0.0/16 dev eth0 proto kernel scope link src 172.17.0.2
• _____ ip-rule-list
• ip rule list 0: from all lookup local 32766: from all lookup main 32767: from all lookup default
• _____ ipsec_verify
• ipsec verify --nocolour /usr/local/sbin/ipsec: 148: exec: /usr/local/libexec/ipsec/verify: not found
• _____ mii-tool
• [ -x /sbin/mii-tool ]
• [ -x /usr/sbin/mii-tool ]
• mii-tool -v /usr/local/libexec/ipsec/barf: 221: /usr/local/libexec/ipsec/barf: mii-tool: not found
• _____ ipsec/directory
• ipsec --directory /usr/local/lib/ipsec
• _____ hostname/fqdn
• hostname --fqdn 1fe326343f70
• _____ hostname/ipaddress
• hostname --ip-address 172.17.0.2
• _____ uptime
• uptime 21:27:48 up 12 days, 7:43, 0 users, load average: 0.00, 0.00, 0.00
• _____ ps
• ps alxwf
• egrep -i ppid|pluto|ipsec|klips F UID PID PPID PRI NI VSZ RSS WCHAN STAT TTY TIME COMMAND 1 0 579 1 20 0 2388 108 - S pts/0 0:00 /bin/sh /usr/local/lib/ipsec/_plutorun --debug --uniqueids yes --force_busy no --nocrsend no --strictcrlpolicy no --nat_traversal no --keep_alive --protostack auto --force_keepalive no --disable_port_floating no --virtual_private --listen --crlcheckinterval 0 --ocspuri --nhelpers 1 --secctx_attrvalue 32001 --dump /dev/shm/ --opts --stderrlog /dev/shm/openswan.log --wait no --plutostderrlogtime no --pre --post --log daemon.error --plutorestartoncrash true --pid /var/run/pluto/pluto.pid 1 0 581 579 20 0 2388 108 - S pts/0 0:00 \ /bin/sh /usr/local/lib/ipsec/_plutorun --debug --uniqueids yes --force_busy no --nocrsend no --strictcrlpolicy no --nat_traversal no --keep_alive --protostack auto --force_keepalive no --disable_port_floating no --virtual_private --listen --crlcheckinterval 0 --ocspuri --nhelpers 1 --secctx_attr_value 32001 --dump /dev/shm/ --opts --stderrlog /dev/shm/openswan.log --wait no --plutostderrlogtime no --pre --post --log daemon.error --plutorestartoncrash true --pid /var/run/pluto/pluto.pid 4 0 585 581 20 0 4444 3688 cores S pts/0 0:00 | \ /usr/local/libexec/ipsec/pluto --nofork --secretsfile /etc/ipsec.secrets --ipsecdir /etc/ipsec.d --use-auto --uniqueids --nhelpers 1 --secctx_attr_value 32001 --stderrlog 1 0 589 585 20 0 4340 224 cores S pts/0 0:00 | \ _plutoadns -- 1 0 590 585 30 10 4340 2480 - SN pts/0 0:00 | _ /usr/local/libexec/ipsec/pluto -- pluto helper # 0 0 0 582 579 20 0 2388 1584 - S pts/0 0:00 \ /bin/sh /usr/local/lib/ipsec/_plutoload --wait no --post 0 0 580 1 20 0 4708 1108 - S pts/0 0:00 logger -s -p daemon error -t ipsec_plutorun 4 0 694 1 20 0 2388 1608 - S+ pts/0 0:00 /bin/sh /usr/local/libexec/ipsec/barf 0 0 734 694 20 0 3084 828 - S+ pts/0 0:00 \ grep -E -i ppid|pluto|ipsec|klips
• _____ ipsec/showdefaults
• ipsec showdefaults routephys=eth0 routevirt=none routeaddr=172.17.0.2 routenexthop=172.17.0.1
• _____ ipsec/conf
• ipsec _include /etc/ipsec.conf
• ipsec _keycensor

< /etc/ipsec.conf 1

version 2

/etc/ipsec.conf - FreeS/WAN IPsec configuration file

More elaborate and more varied sample configurations can be found

in FreeS/WAN's doc/examples file, and in the HTML documentation.

basic configuration

config setup interfaces=%defaultroute uniqueids=yes plutostderrlog=/dev/shm/openswan.log dumpdir=/dev/shm/ nhelpers=1

defaults for subsequent connection descriptions

(these defaults will soon go away)

conn %default keyingtries=0 authby=rsasig keyexchange=ike keylife=20m pfs=yes rekeymargin=5m rekeyfuzz=50% ike=aes-sha1 esp=aes-sha1 dpddelay=30 dpdtimeout=120 dpdaction=restart

conn point1-to-point2 auto=start type=transport esp=aes128-sha1
left=172.17.0.2 leftid=@point1 leftrsasigkey=[keyid AQPyMQ+eW] right=172.17.0.3 rightid=@point2 rightrsasigkey=[keyid AQN2EwF/B]

• _____ ipsec/secrets
• ipsec _include /etc/ipsec.secrets
• ipsec _secretcensor

< /etc/ipsec.secrets 1

: RSA {

RSA 4096 bits ntz.ipsec.interpipe Tue Sep 20 12:18:47 2005

# for signatures only, UNSAFE FOR ENCRYPTION
#pubkey=[keyid AQPyMQ+eW]
Modulus: [...]
PublicExponent: [...]
# everything after this point is secret
PrivateExponent: [...]
Prime1: [...]
Prime2: [...]
Exponent1: [...]
Exponent2: [...]
Coefficient: [...]
}

do not change the indenting of that "[sums to 7d9d...]"

• _____ ipsec/listall
• ipsec auto --listall 000
  000 List of Public Keys: 000
  000 Dec 02 21:23:26 2020, 4096 RSA localf key AQN2EwF/B/83B8 6D2B 6034 C9F5 92A2 AD39 EA51 D832 72EF 94D4 (no private key), until --- -- --:--:-- ---- ok (expires never) 000 ID_FQDN '@point2' 000 Dec 02 21:23:26 2020, 4096 RSA localf key AQPyMQ+eW/1607 9372 7F4F 5273 8EF0 EC16 D213 3C48 B440 9426 (has private key), until --- -- --:--:-- ---- ok (expires never) 000 ID_FQDN '@point1' 000 List of Pre-shared secrets (from /etc/ipsec.secrets) 000 1: RSA (none) (none)
• [ ]
• _____ ipsec/ls-libdir
• ls -l /usr/local/lib/ipsec total 160 -rwxr-xr-x 1 root root 27088 Nov 25 20:27 _copyright -rwxr-xr-x 1 root root 2366 Nov 25 20:27 _include -rwxr-xr-x 1 root root 1410 Nov 25 20:27 _keycensor -rwxr-xr-x 1 root root 2747 Nov 25 20:27 _plutoload -rwxr-xr-x 1 root root 8754 Nov 25 20:27 _plutorun -rwxr-xr-x 1 root root 13880 Nov 25 20:27 _realsetup -rwxr-xr-x 1 root root 1906 Nov 25 20:27 _secretcensor -rwxr-xr-x 1 root root 12380 Nov 25 20:27 _startklips -rwxr-xr-x 1 root root 7982 Nov 25 20:27 _startnetkey -rwxr-xr-x 1 root root 4929 Nov 25 20:27 _updown -rwxr-xr-x 1 root root 18501 Nov 25 20:27 _updown.klips -rwxr-xr-x 1 root root 18263 Nov 25 20:27 _updown.mast -rwxr-xr-x 1 root root 14598 Nov 25 20:27 _updown.netkey
• _____ ipsec/ls-execdir
• ls -l /usr/local/libexec/ipsec total 11748 -rwxr-xr-x 1 root root 1629576 Nov 25 20:27 addconn -rwxr-xr-x 1 root root 5122 Nov 25 20:27 auto -rwxr-xr-x 1 root root 11297 Nov 25 20:27 barf -rwxr-xr-x 1 root root 405968 Nov 25 20:27 eroute -rwxr-xr-x 1 root root 145528 Nov 25 20:27 ikeping -rwxr-xr-x 1 root root 1028 Nov 25 20:27 initnss -rwxr-xr-x 1 root root 297392 Nov 25 20:27 klipsdebug -rwxr-xr-x 1 root root 2783 Nov 25 20:27 look -rwxr-xr-x 1 root root 2480 Nov 25 20:27 newhostkey -rwxr-xr-x 1 root root 268120 Nov 25 20:27 pf_key -rwxr-xr-x 1 root root 5926928 Nov 25 20:27 pluto -rwxr-xr-x 1 root root 12349 Nov 25 20:27 policy -rwxr-xr-x 1 root root 41456 Nov 25 20:27 ranbits -rwxr-xr-x 1 root root 128608 Nov 25 20:27 rsasigkey -rwxr-xr-x 1 root root 704 Nov 25 20:27 secrets lrwxrwxrwx 1 root root 17 Nov 25 20:27 setup -> /etc/init.d/ipsec -rwxr-xr-x 1 root root 1126 Nov 25 20:27 showdefaults -rwxr-xr-x 1 root root 1346136 Nov 25 20:27 showhostkey -rwxr-xr-x 1 root root 752952 Nov 25 20:27 spi -rwxr-xr-x 1 root root 349664 Nov 25 20:27 spigrp -rwxr-xr-x 1 root root 1064 Nov 25 20:27 status -rwxr-xr-x 1 root root 334232 Nov 25 20:27 tncfg -rwxr-xr-x 1 root root 16879 Nov 25 20:27 verify -rwxr-xr-x 1 root root 291048 Nov 25 20:27 whack
• _____ /proc/net/dev
• cat /proc/net/dev Inter-| Receive | Transmit face |bytes packets errs drop fifo frame compressed multicast|bytes packets errs drop fifo colls carrier compressed eth0: 16556 104 0 0 0 0 0 0 20610 115 0 0 0 0 0 0 lo: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
• _____ /proc/net/route
• cat /proc/net/route Iface Destination Gateway Flags RefCnt Use Metric Mask MTU Window IRTT
  eth0 00000000 010011AC 0003 0 0 0 00000000 0 0 0
  eth0 000011AC 00000000 0001 0 0 0 0000FFFF 0 0 0
• _____ /proc/sys/net/ipv4/ip_no_pmtu_disc
• cat /proc/sys/net/ipv4/ip_no_pmtu_disc 0
• _____ /proc/sys/net/ipv4/ip_forward
• cat /proc/sys/net/ipv4/ip_forward 1
• _____ /proc/sys/net/ipv4/tcp_ecn
• cat /proc/sys/net/ipv4/tcp_ecn 2
• _____ /proc/sys/net/ipv4/conf/star-rp_filter
• cd /proc/sys/net/ipv4/conf
• egrep ^ all/rp_filter default/rp_filter eth0/rp_filter lo/rp_filter all/rp_filter:0 default/rp_filter:0 eth0/rp_filter:0 lo/rp_filter:0
• _____ /proc/sys/net/ipv4/conf/star-star-redirects
• cd /proc/sys/net/ipv4/conf
• egrep ^ all/accept_redirects all/secure_redirects all/send_redirects default/accept_redirects default/secure_redirects default/send_redirects eth0/accept_redirects eth0/secure_redirects eth0/send_redirects lo/accept_redirects lo/secure_redirects lo/send_redirects all/accept_redirects:0 all/secure_redirects:1 all/send_redirects:1 default/accept_redirects:1 default/secure_redirects:1 default/send_redirects:1 eth0/accept_redirects:1 eth0/secure_redirects:1 eth0/send_redirects:1 lo/accept_redirects:1 lo/secure_redirects:1 lo/send_redirects:1
• _____ /proc/sys/net/ipv4/tcp_window_scaling
• cat /proc/sys/net/ipv4/tcp_window_scaling 1
• _____ /proc/sys/net/ipv4/tcp_adv_win_scale
• cat /proc/sys/net/ipv4/tcp_adv_win_scale 1
• _____ uname-a
• uname -a Linux 1fe326343f70 4.19.0-12-amd64 #1 SMP Debian 4.19.152-1 (2020-10-18) x86_64 GNU/Linux
• _____ config-built-with
• test -r /proc/config_built_with
• _____ distro-release
• test -f /etc/redhat-release
• test -f /etc/debian-release
• test -f /etc/SuSE-release
• test -f /etc/mandrake-release
• test -f /etc/mandriva-release
• test -f /etc/gentoo-release
• _____ /proc/net/ipsec_version
• test -r /proc/net/ipsec_version
• test -r /proc/net/pfkey
• uname -r
• echo NETKEY (4.19.0-12-amd64) support detected NETKEY (4.19.0-12-amd64) support detected
• _____ iptables
• test -r /sbin/iptables-save -o -r /usr/sbin/iptables-save
• test -r /sbin/iptables -o -r /usr/sbin/iptables
• _____ ip6tables
• test -r /sbin/ip6tables-save -o -r /usr/sbin/ip6tables-save
• test -r /sbin/ip6tables -o -r /usr/sbin/ip6tables
• _____ ip6tables
• _____ /proc/modules
• test -f /proc/modules
• cat /proc/modules echainiv 16384 4 - Live 0xffffffffc0bfb000 drbg 28672 1 - Live 0xffffffffc0bf3000 ansi_cprng 16384 0 - Live 0xffffffffc0bee000 authenc 16384 4 - Live 0xffffffffc0be9000 seqiv 16384 0 - Live 0xffffffffc0be4000 esp4 20480 4 - Live 0xffffffffc0bda000 ctr 16384 0 - Live 0xffffffffc0bd5000 twofish_generic 20480 0 - Live 0xffffffffc0bcf000 twofish_avx_x86_64 53248 0 - Live 0xffffffffc0bc1000 twofish_x86_64_3way 28672 1 twofish_avx_x86_64, Live 0xffffffffc0bb9000 twofish_x86_64 16384 2 twofish_avx_x86_64,twofish_x86_64_3way, Live 0xffffffffc0bb4000 twofish_common 24576 4 twofish_generic,twofish_avx_x86_64,twofish_x86_64_3way,twofish_x86_64, Live 0xffffffffc0bad000 camellia_generic 28672 0 - Live 0xffffffffc0ba5000 camellia_aesni_avx2 28672 0 - Live 0xffffffffc0b9d000 camellia_aesni_avx_x86_64 28672 1 camellia_aesni_avx2, Live 0xffffffffc0b6f000 camellia_x86_64 53248 2 camellia_aesni_avx2,camellia_aesni_avx_x86_64, Live 0xffffffffc0b8b000 serpent_avx2 49152 0 - Live 0xffffffffc0b7e000 serpent_avx_x86_64 49152 1 serpent_avx2, Live 0xffffffffc0b5e000 serpent_sse2_x86_64 53248 0 - Live 0xffffffffc0b50000 serpent_generic 32768 3 serpent_avx2,serpent_avx_x86_64,serpent_sse2_x86_64, Live 0xffffffffc0b47000 blowfish_generic 16384 0 - Live 0xffffffffc0b42000 blowfish_x86_64 24576 0 - Live 0xffffffffc0b3b000 blowfish_common 20480 2 blowfish_generic,blowfish_x86_64, Live 0xffffffffc0b35000 cast5_avx_x86_64 49152 0 - Live 0xffffffffc0b28000 cast5_generic 24576 1 cast5_avx_x86_64, Live 0xffffffffc0b21000 cast_common 16384 2 cast5_avx_x86_64,cast5_generic, Live 0xffffffffc0b1c000 des_generic 24576 0 - Live 0xffffffffc0b15000 cbc 16384 0 - Live 0xffffffffc0b10000 cmac 16384 0 - Live 0xffffffffc0b0b000 xcbc 16384 0 - Live 0xffffffffc0b06000 rmd160 20480 0 - Live 0xffffffffc0b00000 sha512_ssse3 45056 0 - Live 0xffffffffc0af0000 sha512_generic 16384 1 sha512_ssse3, Live 0xffffffffc0aeb000 xfrm4_mode_beet 16384 0 - Live 0xffffffffc0ae6000 xfrm4_mode_transport 16384 8 - Live 0xffffffffc0ae1000 xfrm4_mode_tunnel 16384 0 - Live 0xffffffffc0adc000 xfrm4_tunnel 16384 0 - Live 0xffffffffc0ad7000 tunnel4 16384 1 xfrm4_tunnel, Live 0xffffffffc0a60000 xfrm_ipcomp 16384 0 - Live 0xffffffffc0a50000 xfrm_interface 20480 0 - Live 0xffffffffc0ad1000 af_key 45056 0 - Live 0xffffffffc0ac5000 veth 20480 0 - Live 0xffffffffc0a5a000 xt_conntrack 16384 1 - Live 0xffffffffc0a0f000 ipt_MASQUERADE 16384 1 - Live 0xffffffffc0a55000 nf_conntrack_netlink 49152 0 - Live 0xffffffffc0a43000 xfrm_user 40960 5 - Live 0xffffffffc09fd000 xfrm_algo 16384 4 esp4,xfrm_ipcomp,af_key,xfrm_user, Live 0xffffffffc09bd000 xt_addrtype 16384 2 - Live 0xffffffffc09f8000 nft_chain_nat_ipv4 16384 4 - Live 0xffffffffc0a0a000 nf_nat_ipv4 16384 2 ipt_MASQUERADE,nft_chain_nat_ipv4, Live 0xffffffffc09c6000 nf_nat 36864 1 nf_nat_ipv4, Live 0xffffffffc0837000 nf_conntrack 172032 5 xt_conntrack,ipt_MASQUERADE,nf_conntrack_netlink,nf_nat_ipv4,nf_nat, Live 0xffffffffc0a9a000 nf_defrag_ipv6 20480 1 nf_conntrack, Live 0xffffffffc09b7000 nf_defrag_ipv4 16384 1 nf_conntrack, Live 0xffffffffc0863000 libcrc32c 16384 2 nf_nat,nf_conntrack, Live 0xffffffffc085e000 br_netfilter 24576 0 - Live 0xffffffffc0844000 bridge 188416 1 br_netfilter, Live 0xffffffffc0a6b000 stp 16384 1 bridge, Live 0xffffffffc07f5000 llc 16384 2 bridge,stp, Live 0xffffffffc0688000 overlay 131072 2 - Live 0xffffffffc0a22000 xt_set 16384 0 - Live 0xffffffffc05eb000 nft_compat 20480 4 - Live 0xffffffffc06c3000 ip_set_hash_ip 36864 1 - Live 0xffffffffc05c0000 ip_set 45056 2 xt_set,ip_set_hash_ip, Live 0xffffffffc07e9000 iptable_filter 16384 0 - Live 0xffffffffc05b2000 nft_counter 16384 15 - Live 0xffffffffc05bb000 nf_tables 143360 45 nft_chain_nat_ipv4,nft_compat,nft_counter, Live 0xffffffffc09d4000 nfnetlink 16384 5 nf_conntrack_netlink,nft_compat,ip_set,nf_tables, Live 0xffffffffc0499000 sr_mod 28672 0 - Live 0xffffffffc05aa000 cdrom 65536 1 sr_mod, Live 0xffffffffc0599000 ipmi_ssif 32768 0 - Live 0xffffffffc09cb000 nls_ascii 16384 1 - Live 0xffffffffc0b79000 nls_cp437 20480 1 - Live 0xffffffffc06a8000 vfat 20480 1 - Live 0xffffffffc0651000 fat 86016 1 vfat, Live 0xffffffffc0c66000 joydev 24576 0 - Live 0xffffffffc0670000 edac_mce_amd 28672 0 - Live 0xffffffffc10a2000 kvm_amd 106496 0 - Live 0xffffffffc068d000 hid_generic 16384 0 - Live 0xffffffffc0647000 mgag200 53248 1 - Live 0xffffffffc0e5a000 uas 28672 0 - Live 0xffffffffc0e1e000 ttm 126976 1 mgag200, Live 0xffffffffc118b000 kvm 757760 1 kvm_amd, Live 0xffffffffc08fd000 usbhid 57344 0 - Live 0xffffffffc084b000 drm_kms_helper 208896 1 mgag200, Live 0xffffffffc0803000 hid 139264 2 hid_generic,usbhid, Live 0xffffffffc07c6000 usb_storage 73728 1 uas, Live 0xffffffffc06b0000 dell_smbios 28672 0 - Live 0xffffffffc0678000 drm 495616 4 mgag200,ttm,drm_kms_helper, Live 0xffffffffc0883000 dell_wmi_descriptor 16384 1 dell_smbios, Live 0xffffffffc064c000 dcdbas 16384 1 dell_smbios, Live 0xffffffffc05f5000 ccp 98304 1 kvm_amd, Live 0xffffffffc0657000 evdev 28672 2 - Live 0xffffffffc063f000 wmi_bmof 16384 0 - Live 0xffffffffc05f0000 sg 36864 0 - Live 0xffffffffc05e1000 i2c_algo_bit 16384 1 mgag200, Live 0xffffffffc05dc000 rng_core 16384 1 ccp, Live 0xffffffffc087a000 irqbypass 16384 1 kvm, Live 0xffffffffc05d0000 efi_pstore 16384 0 - Live 0xffffffffc04b3000 sp5100_tco 16384 0 - Live 0xffffffffc04ae000 crct10dif_pclmul 16384 0 - Live 0xffffffffc07fe000 crc32_pclmul 16384 0 - Live 0xffffffffc0872000 efivars 20480 1 efi_pstore, Live 0xffffffffc0869000 ghash_clmulni_intel 16384 0 - Live 0xffffffffc0494000 pcspkr 16384 0 - Live 0xffffffffc0551000 ipmi_si 65536 0 - Live 0xffffffffc0588000 wmi 28672 3 dell_smbios,dell_wmi_descriptor,wmi_bmof, Live 0xffffffffc053e000 ipmi_devintf 20480 0 - Live 0xffffffffc046e000 ipmi_msghandler 65536 3 ipmi_ssif,ipmi_si,ipmi_devintf, Live 0xffffffffc0501000 acpi_power_meter 20480 0 - Live 0xffffffffc0a65000 pcc_cpufreq 16384 0 - Live 0xffffffffc109d000 acpi_cpufreq 24576 0 - Live 0xffffffffc048d000 button 16384 0 - Live 0xffffffffc0469000 efivarfs 16384 1 - Live 0xffffffffc03e1000 ip_tables 28672 1 iptable_filter, Live 0xffffffffc0485000 x_tables 45056 7 xt_conntrack,ipt_MASQUERADE,xt_addrtype,xt_set,nft_compat,iptable_filter,ip_tables, Live 0xffffffffc0479000 autofs4 49152 2 - Live 0xffffffffc04a1000 ext4 745472 2 - Live 0xffffffffc070f000 crc16 16384 1 ext4, Live 0xffffffffc0474000 mbcache 16384 1 ext4, Live 0xffffffffc03eb000 jbd2 122880 1 ext4, Live 0xffffffffc044a000 crc32c_generic 16384 0 - Live 0xffffffffc03e6000 fscrypto 32768 1 ext4, Live 0xffffffffc0390000 ecb 16384 0 - Live 0xffffffffc038b000 dm_mod 155648 7 - Live 0xffffffffc0423000 sd_mod 61440 4 - Live 0xffffffffc037b000 crc32c_intel 24576 4 - Live 0xffffffffc11df000 ahci 40960 0 - Live 0xffffffffc0ea9000 xhci_pci 16384 0 - Live 0xffffffffc05d7000 libahci 40960 1 ahci, Live 0xffffffffc0a17000 aesni_intel 200704 8 - Live 0xffffffffc0556000 xhci_hcd 266240 1 xhci_pci, Live 0xffffffffc06cd000 aes_x86_64 20480 1 aesni_intel, Live 0xffffffffc0682000 libata 270336 2 ahci,libahci, Live 0xffffffffc05fc000 crypto_simd 16384 8 twofish_avx_x86_64,camellia_aesni_avx2,camellia_aesni_avx_x86_64,serpent_avx2,serpent_avx_x86_64,serpent_sse2_x86_64,cast5_avx_x86_64,aesni_intel, Live 0xffffffffc05cb000 cryptd 28672 7 ghash_clmulni_intel,aesni_intel,crypto_simd, Live 0xffffffffc0549000 glue_helper 16384 9 twofish_avx_x86_64,twofish_x86_64_3way,camellia_aesni_avx2,camellia_aesni_avx_x86_64,camellia_x86_64,serpent_avx2,serpent_avx_x86_64,serpent_sse2_x86_64,aesni_intel, Live 0xffffffffc039d000 megaraid_sas 159744 3 - Live 0xffffffffc0516000 usbcore 294912 5 uas,usbhid,usb_storage,xhci_pci,xhci_hcd, Live 0xffffffffc04b8000 tg3 188416 0 - Live 0xffffffffc03f4000 scsi_mod 249856 7 sr_mod,uas,usb_storage,sg,sd_mod,libata,megaraid_sas, Live 0xffffffffc03a3000 libphy 77824 1 tg3, Live 0xffffffffc0367000 i2c_piix4 24576 0 - Live 0xffffffffc035c000 usb_common 16384 1 usbcore, Live 0xffffffffc0354000
• _____ /proc/meminfo
• cat /proc/meminfo MemTotal: 65621456 kB MemFree: 56058448 kB MemAvailable: 63779776 kB Buffers: 451240 kB Cached: 7052356 kB SwapCached: 0 kB Active: 1927324 kB Inactive: 5865468 kB Active(anon): 237880 kB Inactive(anon): 26740 kB Active(file): 1689444 kB Inactive(file): 5838728 kB Unevictable: 0 kB Mlocked: 0 kB SwapTotal: 66695164 kB SwapFree: 66695164 kB Dirty: 68 kB Writeback: 0 kB AnonPages: 289876 kB Mapped: 167732 kB Shmem: 27064 kB Slab: 1415432 kB SReclaimable: 919872 kB SUnreclaim: 495560 kB KernelStack: 12364 kB PageTables: 5968 kB NFS_Unstable: 0 kB Bounce: 0 kB WritebackTmp: 0 kB CommitLimit: 99505892 kB Committed_AS: 2298304 kB VmallocTotal: 34359738367 kB VmallocUsed: 0 kB VmallocChunk: 0 kB Percpu: 67200 kB HardwareCorrupted: 0 kB AnonHugePages: 71680 kB ShmemHugePages: 0 kB ShmemPmdMapped: 0 kB HugePages_Total: 0 HugePages_Free: 0 HugePages_Rsvd: 0 HugePages_Surp: 0 Hugepagesize: 2048 kB Hugetlb: 0 kB DirectMap4k: 523072 kB DirectMap2M: 9549824 kB DirectMap1G: 56623104 kB
• _____ /proc/net/ipsec-ls
• test -f /proc/net/ipsec_version
• _____ usr/src/linux/.config
• test -f /proc/config.gz
• uname -r
• test -f /lib/modules/4.19.0-12-amd64/build/.config
• echo no .config file found, cannot list kernel properties no .config file found, cannot list kernel properties
• _____ etc/syslog.conf
• _____ etc/syslog-ng/syslog-ng.conf
• cat /etc/syslog-ng/syslog-ng.conf cat: /etc/syslog-ng/syslog-ng.conf: No such file or directory
• cat /etc/syslog.conf cat: /etc/syslog.conf: No such file or directory
• _____ etc/resolv.conf
• cat /etc/resolv.conf search dmz.tkb nameserver 192.168.91.12
• _____ lib/modules-ls
• ls -ltr /lib/modules ls: cannot access '/lib/modules': No such file or directory
• _____ fipscheck
• cat /proc/sys/crypto/fips_enabled 0
• _____ /proc/ksyms-netif_rx
• test -r /proc/ksyms
• test -r /proc/kallsyms
• egrep netif_rx /proc/kallsyms ffffffffb31e2a40 t netif_rx_internal ffffffffb31e2b60 T netif_rx ffffffffb31e2bc0 T netif_rx_ni ffffffffb3af4dd0 r tpstrtab_netif_rx_ni_entry ffffffffb3af4de8 r tpstrtab_netif_rx_entry ffffffffb3af4e78 r tpstrtab_netif_rx ffffffffb3afd180 r ksymtab_netif_rx ffffffffb3afd188 r ksymtab_netif_rx_ni ffffffffb3b335df r __kstrtab_netif_rx_ni ffffffffb3b335eb r kstrtab_netif_rx ffffffffb3ce6160 d event_netif_rx_ni_entry ffffffffb3ce6200 d event_netif_rx_entry ffffffffb3ce6520 d event_netif_rx ffffffffb3d03680 D tracepoint_netif_rx_ni_entry ffffffffb3d036c0 D tracepoint_netif_rx_entry ffffffffb3d03800 D tracepoint_netif_rx ffffffffb3d2be80 d bpf_trace_tp_map_netif_rx_ni_entry ffffffffb3d2bea0 d bpf_trace_tp_map_netif_rx_entry ffffffffb3d2bf40 d bpf_trace_tp_map_netif_rx ffffffffb4198620 t event_netif_rx_ni_entry ffffffffb4198628 t event_netif_rx_entry ffffffffb4198650 t __event_netif_rx
• _____ lib/modules-netif_rx
• modulegoo kernel/net/ipv4/ipip.o netif_rx
• set +x ls: cannot access '/lib/modules': No such file or directory
• _____ kern.debug
• test -f /var/log/kern.debug
• _____ klog
• sed -n 91,$p /var/log/syslog
• egrep -i ipsec|klips|pluto
• cat Dec 2 21:23:26 1fe326343f70 ipsec_setup: Starting Openswan IPsec U2.6.52.2-1-gd420cf802/K4.19.0-12-amd64... Dec 2 21:23:26 1fe326343f70 ipsec_setup: Using NETKEY(XFRM) stack Dec 2 21:23:26 1fe326343f70 pluto: adjusting ipsec.d to /etc/ipsec.d Dec 2 21:23:26 1fe326343f70 pluto: Labelled IPsec not enabled; value 32001 ignored. Dec 2 21:23:26 1fe326343f70 ipsec_setup: ...Openswan IPsec started Dec 2 21:23:26 1fe326343f70 ipsecplutorun: 002 loaded key: 1607 9372 7F4F 5273 8EF0 EC16 D213 3C48 B440 9426 Dec 2 21:23:26 1fe326343f70 ipsecplutorun: 002 loaded key: 83B8 6D2B 6034 C9F5 92A2 AD39 EA51 D832 72EF 94D4 Dec 2 21:23:26 1fe326343f70 ipsecplutorun: 002 use keyid: 1:1607 9372 7F4F 5273 8EF0 EC16 D213 3C48 B440 9426 / 2:<> Dec 2 21:23:26 1fe326343f70 ipsecplutorun: 002 use keyid: 1:83B8 6D2B 6034 C9F5 92A2 AD39 EA51 D832 72EF 94D4 / 2:<> Dec 2 21:23:26 1fe326343f70 ipsecplutorun: 002 adding connection: "point1-to-point2" Dec 2 21:23:26 1fe326343f70 ipsecplutorun: 002 listening for IKE messages Dec 2 21:23:26 1fe326343f70 ipsecplutorun: 002 adding interface eth0/eth0 172.17.0.2:500 (AF_INET) Dec 2 21:23:26 1fe326343f70 ipsec__plutorun: 002 adding interface lo/lo 127.0.0.1:500 (AF_INET) Dec 2 21:23:26 1fe326343f70 ipsecplutorun: 002 loading secrets from "/etc/ipsec.secrets" Dec 2 21:23:26 1fe326343f70 ipsec__plutorun: 002 loaded private key for keyid: PPK_RSA:AQPyMQ+eW/1607 9372 7F4F 5273 8EF0 EC16 D213 3C48 B440 9426 Dec 2 21:23:26 1fe326343f70 ipsecplutorun: 002 "point1-to-point2" #1: initiating Main Mode Dec 2 21:23:26 1fe326343f70 ipsecplutorun: 105 "point1-to-point2" #1: STATE_MAIN_I1: initiate
• _____ plog
• sed -n 5,$p /var/log/auth.log
• egrep -i pluto
• cat Dec 2 21:23:26 1fe326343f70 ipsec__plutorun: Starting Pluto subsystem...
• _____ date
• date Wed Dec 2 21:27:49 UTC 2020 root@1fe326343f70:/#

[AnatoliChe]

point2 changes the esp configuration change to wrong hash algo ( from esp=aes128-sha1 to esp=aes128-sha2 ) Is that right? Yes I can see it with intel and amd CPU's with Debian 10 and Gentoo, bare metal and virtual machines.

[mohicks]

Thanks for the great directions. I've got the crash now, based on your docker directions, and will investigate.

[shussain]

@mohicks has implemented a fix in the 2.6.52.3 branch

@AnatoliChe can you please test it at your convenience?

[AnatoliChe]

Thank you for patch. Now it's ok.

[shussain]

Great, thank you for reporting the issue.