OPENSWAN I方打印

Plutorun started on Sat Aug 26 10:26:58 CST 2017
adjusting ipsec.d to /etc/ipsec.d
Labelled IPsec not enabled; value 32001 ignored.
Starting Pluto (Openswan Version 2.6.49.1; Vendor ID OSWhKaciWM}g) pid:28166
LEAK_DETECTIVE support [disabled]
OCF support for IKE [disabled]
SAref support [disabled]: Protocol not available
SAbind support [disabled]: Protocol not available
NSS support [disabled]
HAVE_STATSD notification support not compiled in
Setting NAT-Traversal port-4500 floating to on
port floating activation criteria nat_t=1/port_float=1
NAT-Traversal support [enabled]
| opening /dev/urandom
using /dev/urandom as source of random entropy
| inserting event EVENT_REINIT_SECRET, timeout in 3600 seconds (head of queue)
| inserting event EVENT_PENDING_DDNS, timeout in 60 seconds (head of queue)
| inserting event EVENT_PENDING_PHASE2, timeout in 120 seconds
| event added after event EVENT_PENDING_DDNS
ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0)
ike_alg_register_hash(): Activating OAKLEY_SHA2_512: Ok (ret=0)
ike_alg_register_hash(): Activating OAKLEY_SHA2_256: Ok (ret=0)
starting up 1 cryptographic helpers
started helper pid=28169 (fd:7)
Kernel interface auto-pick
Using Linux XFRM/NETKEY IPsec interface code on 3.16.0-23-generic
| process 28166 listening for PF_KEY_V2 on file descriptor 10
| finish_pfkey_msg: K_SADB_REGISTER message 1 for AH
| 02 07 00 02 02 00 00 00 01 00 00 00 06 6e 00 00
| opening /dev/urandom
using /dev/urandom as source of random entropy
! helper 0 waiting on fd: 8
| pfkey_get: K_SADB_REGISTER message 1
| AH registered with kernel.
| finish_pfkey_msg: K_SADB_REGISTER message 2 for ESP
| 02 07 00 03 02 00 00 00 02 00 00 00 06 6e 00 00
| pfkey_get: K_SADB_REGISTER message 2
| alg_init():memset(0xb774ff00, 0, 2048) memset(0xb7750700, 0, 2048)
| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: sadb_msg_len=22 sadb_supported_len=72
| kernel_alg_add():satype=3, exttype=14, alg_id=251
| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[0], exttype=14, satype=3, alg_id=251, alg_ivlen=0, alg_minbits=0, alg_maxbits=0, res=0, ret=1
| kernel_alg_add():satype=3, exttype=14, alg_id=2
| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[1], exttype=14, satype=3, alg_id=2, alg_ivlen=0, alg_minbits=128, alg_maxbits=128, res=0, ret=1
| kernel_alg_add():satype=3, exttype=14, alg_id=3
| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[2], exttype=14, satype=3, alg_id=3, alg_ivlen=0, alg_minbits=160, alg_maxbits=160, res=0, ret=1
| kernel_alg_add():satype=3, exttype=14, alg_id=5
| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[3], exttype=14, satype=3, alg_id=5, alg_ivlen=0, alg_minbits=256, alg_maxbits=256, res=0, ret=1
| kernel_alg_add():satype=3, exttype=14, alg_id=6
| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[4], exttype=14, satype=3, alg_id=6, alg_ivlen=0, alg_minbits=384, alg_maxbits=384, res=0, ret=1
| kernel_alg_add():satype=3, exttype=14, alg_id=7
| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[5], exttype=14, satype=3, alg_id=7, alg_ivlen=0, alg_minbits=512, alg_maxbits=512, res=0, ret=1
| kernel_alg_add():satype=3, exttype=14, alg_id=8
| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[6], exttype=14, satype=3, alg_id=8, alg_ivlen=0, alg_minbits=160, alg_maxbits=160, res=0, ret=1
| kernel_alg_add():satype=3, exttype=14, alg_id=9
| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[7], exttype=14, satype=3, alg_id=9, alg_ivlen=0, alg_minbits=128, alg_maxbits=128, res=0, ret=1
| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: sadb_msg_len=22 sadb_supported_len=88
| kernel_alg_add():satype=3, exttype=15, alg_id=11
| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[8], exttype=15, satype=3, alg_id=11, alg_ivlen=0, alg_minbits=0, alg_maxbits=0, res=0, ret=1
| kernel_alg_add():satype=3, exttype=15, alg_id=2
| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[9], exttype=15, satype=3, alg_id=2, alg_ivlen=8, alg_minbits=64, alg_maxbits=64, res=0, ret=1
| kernel_alg_add():satype=3, exttype=15, alg_id=3
| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[10], exttype=15, satype=3, alg_id=3, alg_ivlen=8, alg_minbits=192, alg_maxbits=192, res=0, ret=1
| kernel_alg_add():satype=3, exttype=15, alg_id=6
| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[11], exttype=15, satype=3, alg_id=6, alg_ivlen=8, alg_minbits=40, alg_maxbits=128, res=0, ret=1
| kernel_alg_add():satype=3, exttype=15, alg_id=7
| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[12], exttype=15, satype=3, alg_id=7, alg_ivlen=8, alg_minbits=40, alg_maxbits=448, res=0, ret=1
| kernel_alg_add():satype=3, exttype=15, alg_id=12
| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[13], exttype=15, satype=3, alg_id=12, alg_ivlen=8, alg_minbits=128, alg_maxbits=256, res=0, ret=1
| kernel_alg_add():satype=3, exttype=15, alg_id=252
| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[14], exttype=15, satype=3, alg_id=252, alg_ivlen=8, alg_minbits=128, alg_maxbits=256, res=0, ret=1
| kernel_alg_add():satype=3, exttype=15, alg_id=22
| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[15], exttype=15, satype=3, alg_id=22, alg_ivlen=8, alg_minbits=128, alg_maxbits=256, res=0, ret=1
| kernel_alg_add():satype=3, exttype=15, alg_id=253
| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[16], exttype=15, satype=3, alg_id=253, alg_ivlen=8, alg_minbits=128, alg_maxbits=256, res=0, ret=1
| kernel_alg_add():satype=3, exttype=15, alg_id=13
| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[17], exttype=15, satype=3, alg_id=13, alg_ivlen=8, alg_minbits=160, alg_maxbits=288, res=0, ret=1
| kernel_alg_add():satype=3, exttype=15, alg_id=18
| kernel_alg_add():satype=3, exttype=15, alg_id=19
| kernel_alg_add():satype=3, exttype=15, alg_id=20
| kernel_alg_add():satype=3, exttype=15, alg_id=14
| kernel_alg_add():satype=3, exttype=15, alg_id=15
| kernel_alg_add():satype=3, exttype=15, alg_id=16
ike_alg_register_enc(): Activating aes_ccm_8: Ok (ret=0)
ike_alg_add(): ERROR: algo_type ‘0’, algo_id ‘0’, Algorithm type already exists
ike_alg_register_enc(): Activating aes_ccm_12: FAILED (ret=-17)
ike_alg_add(): ERROR: algo_type ‘0’, algo_id ‘0’, Algorithm type already exists
ike_alg_register_enc(): Activating aes_ccm_16: FAILED (ret=-17)
ike_alg_add(): ERROR: algo_type ‘0’, algo_id ‘0’, Algorithm type already exists
ike_alg_register_enc(): Activating aes_gcm_8: FAILED (ret=-17)
ike_alg_add(): ERROR: algo_type ‘0’, algo_id ‘0’, Algorithm type already exists
ike_alg_register_enc(): Activating aes_gcm_12: FAILED (ret=-17)
ike_alg_add(): ERROR: algo_type ‘0’, algo_id ‘0’, Algorithm type already exists
ike_alg_register_enc(): Activating aes_gcm_16: FAILED (ret=-17)
| ESP registered with kernel.
| finish_pfkey_msg: K_SADB_REGISTER message 3 for IPCOMP
| 02 07 00 09 02 00 00 00 03 00 00 00 06 6e 00 00
| pfkey_get: K_SADB_REGISTER message 3
| IPCOMP registered with kernel.
| Changed path to directory ‘/etc/ipsec.d/cacerts’
loaded CA cert file ‘ca.pem’ (700 bytes)
| file content is not binary ASN.1
| —–BEGIN CERTIFICATE—–
| —–END CERTIFICATE—–
| file coded in PEM format
| L0 - certificate:
| 30 82 01 d8 30 82 01 41 a0 03 02 01 02 02 01 01
| 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 30
| 29 31 0b 30 09 06 03 55 04 06 13 02 43 4e 31 0b
| 30 09 06 03 55 04 0a 13 02 5a 47 31 0d 30 0b 06
| 03 55 04 03 13 04 72 6f 6f 74 30 1e 17 0d 31 37
| 30 38 30 35 31 32 35 35 30 30 5a 17 0d 32 37 30
| 38 30 35 31 32 35 35 30 30 5a 30 29 31 0b 30 09
| 06 03 55 04 06 13 02 43 4e 31 0b 30 09 06 03 55
| 04 0a 13 02 5a 47 31 0d 30 0b 06 03 55 04 03 13
| 04 72 6f 6f 74 30 81 9f 30 0d 06 09 2a 86 48 86
| f7 0d 01 01 01 05 00 03 81 8d 00 30 81 89 02 81
| 81 00 ea a2 90 dc 1b b2 e8 72 61 2f 05 12 52 ea
| c8 0b 22 16 b6 10 d8 5b d5 93 4e bc 09 54 92 50
| ef 8b 56 09 8a fa b6 8d 3c 05 43 06 72 79 bd 1f
| 30 3f 2e 93 23 84 0a 87 9d 4f 07 b1 80 b7 7f d3
| 94 77 43 a4 a5 ba a2 a0 ef aa 3a 50 34 10 e3 2a
| a7 48 47 02 cd 56 aa 96 1d 70 8f 44 63 cc e9 88
| 0a 62 65 37 93 22 d1 2d 50 af da d1 5e 01 79 84
| 7f 28 83 bb cd aa 5a 5a e3 ba a9 a4 4a 7f 9b 87
| a3 a3 02 03 01 00 01 a3 10 30 0e 30 0c 06 03 55
| 1d 13 04 05 30 03 01 01 ff 30 0d 06 09 2a 86 48
| 86 f7 0d 01 01 05 05 00 03 81 81 00 80 59 4e bd
| f0 7a d0 4d 05 0a c0 e4 2c fe 58 c5 b2 46 6b 26
| 2d 52 4b 9c 00 bf 5a 54 44 5a 10 9d 12 ab f5 ad
| 0d ea 07 64 f5 f1 a3 7c d5 5a 05 2b 04 68 a4 35
| 80 29 45 99 7f ad 8d 08 4a 0e 39 a2 14 82 23 bd
| 5b d3 a9 48 c7 93 20 d4 03 1d 15 04 5d 7c 2b 44
| 36 ca 34 98 31 fa c2 ac 78 01 c7 b5 cf 96 30 24
| bc ef 9c 07 e9 8d de 52 53 24 97 3c f2 d5 8c 98
| 4b 96 fe 03 60 4e 3c 04 94 05 dc 3b
| L1 - tbsCertificate:
| 30 82 01 41 a0 03 02 01 02 02 01 01 30 0d 06 09
| 2a 86 48 86 f7 0d 01 01 05 05 00 30 29 31 0b 30
| 09 06 03 55 04 06 13 02 43 4e 31 0b 30 09 06 03
| 55 04 0a 13 02 5a 47 31 0d 30 0b 06 03 55 04 03
| 13 04 72 6f 6f 74 30 1e 17 0d 31 37 30 38 30 35
| 31 32 35 35 30 30 5a 17 0d 32 37 30 38 30 35 31
| 32 35 35 30 30 5a 30 29 31 0b 30 09 06 03 55 04
| 06 13 02 43 4e 31 0b 30 09 06 03 55 04 0a 13 02
| 5a 47 31 0d 30 0b 06 03 55 04 03 13 04 72 6f 6f
| 74 30 81 9f 30 0d 06 09 2a 86 48 86 f7 0d 01 01
| 01 05 00 03 81 8d 00 30 81 89 02 81 81 00 ea a2
| 90 dc 1b b2 e8 72 61 2f 05 12 52 ea c8 0b 22 16
| b6 10 d8 5b d5 93 4e bc 09 54 92 50 ef 8b 56 09
| 8a fa b6 8d 3c 05 43 06 72 79 bd 1f 30 3f 2e 93
| 23 84 0a 87 9d 4f 07 b1 80 b7 7f d3 94 77 43 a4
| a5 ba a2 a0 ef aa 3a 50 34 10 e3 2a a7 48 47 02
| cd 56 aa 96 1d 70 8f 44 63 cc e9 88 0a 62 65 37
| 93 22 d1 2d 50 af da d1 5e 01 79 84 7f 28 83 bb
| cd aa 5a 5a e3 ba a9 a4 4a 7f 9b 87 a3 a3 02 03
| 01 00 01 a3 10 30 0e 30 0c 06 03 55 1d 13 04 05
| 30 03 01 01 ff
| L2 - DEFAULT v1:
| L3 - version:
| 02
| v3
| L2 - serialNumber:
| 01
| L2 - signature:
| L3 - algorithmIdentifier:
| L4 - algorithm:
| ‘sha-1WithRSAEncryption’
| L2 - issuer:
| 30 29 31 0b 30 09 06 03 55 04 06 13 02 43 4e 31
| 0b 30 09 06 03 55 04 0a 13 02 5a 47 31 0d 30 0b
| 06 03 55 04 03 13 04 72 6f 6f 74
| ‘C=CN, O=ZG, CN=root’
| L2 - validity:
| L3 - notBefore:
| L4 - utcTime:
| ‘Aug 05 12:55:00 UTC 2017’
| L3 - notAfter:
| L4 - utcTime:
| ‘Aug 05 12:55:00 UTC 2027’
| L2 - subject:
| 30 29 31 0b 30 09 06 03 55 04 06 13 02 43 4e 31
| 0b 30 09 06 03 55 04 0a 13 02 5a 47 31 0d 30 0b
| 06 03 55 04 03 13 04 72 6f 6f 74
| ‘C=CN, O=ZG, CN=root’
| L2 - subjectPublicKeyInfo:
| L3 - algorithm:
| L4 - algorithmIdentifier:
| L5 - algorithm:
| ‘rsaEncryption’
| L3 - subjectPublicKey:
| L4 - RSAPublicKey:
| L5 - modulus:
| 00 ea a2 90 dc 1b b2 e8 72 61 2f 05 12 52 ea c8
| 0b 22 16 b6 10 d8 5b d5 93 4e bc 09 54 92 50 ef
| 8b 56 09 8a fa b6 8d 3c 05 43 06 72 79 bd 1f 30
| 3f 2e 93 23 84 0a 87 9d 4f 07 b1 80 b7 7f d3 94
| 77 43 a4 a5 ba a2 a0 ef aa 3a 50 34 10 e3 2a a7
| 48 47 02 cd 56 aa 96 1d 70 8f 44 63 cc e9 88 0a
| 62 65 37 93 22 d1 2d 50 af da d1 5e 01 79 84 7f
| 28 83 bb cd aa 5a 5a e3 ba a9 a4 4a 7f 9b 87 a3
| a3
| L5 - publicExponent:
| 01 00 01
| L2 - optional extensions:
| L3 - extensions:
| L4 - extension:
| L5 - extnID:
| ‘basicConstraints’
| L5 - critical:
| FALSE
| L5 - extnValue:
| 30 03 01 01 ff
| L6 - basicConstraints:
| L7 - CA:
| ff
| TRUE
| L1 - signatureAlgorithm:
| L2 - algorithmIdentifier:
| L3 - algorithm:
| ‘sha-1WithRSAEncryption’
| L1 - signatureValue:
| 00 80 59 4e bd f0 7a d0 4d 05 0a c0 e4 2c fe 58
| c5 b2 46 6b 26 2d 52 4b 9c 00 bf 5a 54 44 5a 10
| 9d 12 ab f5 ad 0d ea 07 64 f5 f1 a3 7c d5 5a 05
| 2b 04 68 a4 35 80 29 45 99 7f ad 8d 08 4a 0e 39
| a2 14 82 23 bd 5b d3 a9 48 c7 93 20 d4 03 1d 15
| 04 5d 7c 2b 44 36 ca 34 98 31 fa c2 ac 78 01 c7
| b5 cf 96 30 24 bc ef 9c 07 e9 8d de 52 53 24 97
| 3c f2 d5 8c 98 4b 96 fe 03 60 4e 3c 04 94 05 dc
| 3b
| authcert inserted
| Changed path to directory ‘/etc/ipsec.d/aacerts’
| Changed path to directory ‘/etc/ipsec.d/ocspcerts’
| Found 0 items in directory ‘/etc/ipsec.d/crls’
| inserting event EVENT_LOG_DAILY, timeout in 48782 seconds
| event added after event EVENT_REINIT_SECRET
| next event EVENT_PENDING_DDNS in 60 seconds
|
| *received whack message
| Added new connection linux-to-linux with policy RSASIG+ENCRYPT+TUNNEL+PFS+IKEv2ALLOW+IKEv2Init+SAREFTRACK
loading certificate from /etc/ipsec.d/certs/hdcert.pem
loaded host cert file ‘/etc/ipsec.d/certs/hdcert.pem’ (721 bytes)
| file content is not binary ASN.1
| —–BEGIN CERTIFICATE—–
| —–END CERTIFICATE—–
| file coded in PEM format
| L0 - certificate:
| 30 82 01 e6 30 82 01 4f a0 03 02 01 02 02 01 02
| 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 30
| 29 31 0b 30 09 06 03 55 04 06 13 02 43 4e 31 0b
| 30 09 06 03 55 04 0a 13 02 5a 47 31 0d 30 0b 06
| 03 55 04 03 13 04 72 6f 6f 74 30 1e 17 0d 31 37
| 30 38 31 39 30 31 33 30 30 30 5a 17 0d 31 38 30
| 38 31 39 30 31 33 30 30 30 5a 30 28 31 0b 30 09
| 06 03 55 04 06 13 02 63 6e 31 0c 30 0a 06 03 55
| 04 0a 13 03 7a 74 65 31 0b 30 09 06 03 55 04 03
| 13 02 68 64 30 81 9f 30 0d 06 09 2a 86 48 86 f7
| 0d 01 01 01 05 00 03 81 8d 00 30 81 89 02 81 81
| 00 9f f0 82 74 be f4 a6 f0 09 c5 d3 03 27 3a 0f
| a0 0b 10 c3 05 fb 49 6f 5d ef 80 5b 38 ba b3 9e
| c5 db ff 64 16 28 4c 0e 2b fd 46 4a ea ad 4b b7
| c5 9d 61 65 35 46 67 6f dc a0 56 04 1e 36 e0 a5
| f7 3b 2e 17 7a 44 f4 f2 e0 1b 98 20 41 88 6a 94
| 19 9c 38 9b 2b 60 97 ea f3 20 76 96 c6 08 96 33
| 84 11 39 5f 53 d3 f9 d8 5c ef e1 1b b7 74 ca e4
| bd f8 27 be d9 f7 74 42 db 96 43 bc c6 67 5b e4
| 63 02 03 01 00 01 a3 1f 30 1d 30 09 06 03 55 1d
| 13 04 02 30 00 30 10 06 03 55 1d 11 01 01 ff 04
| 06 30 04 82 02 68 64 30 0d 06 09 2a 86 48 86 f7
| 0d 01 01 05 05 00 03 81 81 00 c7 a0 c0 00 90 e6
| 5a cb 2e 28 e8 24 0f f0 42 d9 7d 0b d2 4a ef 88
| 40 1a 31 89 8d 3a bc 36 c2 68 0e 75 31 93 74 5e
| 3c 18 3f b2 81 c8 9a ae e8 cf fc 66 25 bb 96 33
| 41 e8 31 45 22 f7 ff 6c ef c2 55 91 aa bb 83 0e
| 38 86 fa 87 bf 49 89 bf b8 bb 6a 13 3f 4e b5 a7
| df e6 ca 2a b3 cf a5 86 c0 52 a0 f6 69 63 16 cc
| c3 ff 35 55 c8 6f 91 08 c9 97 37 be 6d 02 a4 10
| ad 4e ac a2 3b 53 71 4d 3b ed
| L1 - tbsCertificate:
| 30 82 01 4f a0 03 02 01 02 02 01 02 30 0d 06 09
| 2a 86 48 86 f7 0d 01 01 05 05 00 30 29 31 0b 30
| 09 06 03 55 04 06 13 02 43 4e 31 0b 30 09 06 03
| 55 04 0a 13 02 5a 47 31 0d 30 0b 06 03 55 04 03
| 13 04 72 6f 6f 74 30 1e 17 0d 31 37 30 38 31 39
| 30 31 33 30 30 30 5a 17 0d 31 38 30 38 31 39 30
| 31 33 30 30 30 5a 30 28 31 0b 30 09 06 03 55 04
| 06 13 02 63 6e 31 0c 30 0a 06 03 55 04 0a 13 03
| 7a 74 65 31 0b 30 09 06 03 55 04 03 13 02 68 64
| 30 81 9f 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01
| 05 00 03 81 8d 00 30 81 89 02 81 81 00 9f f0 82
| 74 be f4 a6 f0 09 c5 d3 03 27 3a 0f a0 0b 10 c3
| 05 fb 49 6f 5d ef 80 5b 38 ba b3 9e c5 db ff 64
| 16 28 4c 0e 2b fd 46 4a ea ad 4b b7 c5 9d 61 65
| 35 46 67 6f dc a0 56 04 1e 36 e0 a5 f7 3b 2e 17
| 7a 44 f4 f2 e0 1b 98 20 41 88 6a 94 19 9c 38 9b
| 2b 60 97 ea f3 20 76 96 c6 08 96 33 84 11 39 5f
| 53 d3 f9 d8 5c ef e1 1b b7 74 ca e4 bd f8 27 be
| d9 f7 74 42 db 96 43 bc c6 67 5b e4 63 02 03 01
| 00 01 a3 1f 30 1d 30 09 06 03 55 1d 13 04 02 30
| 00 30 10 06 03 55 1d 11 01 01 ff 04 06 30 04 82
| 02 68 64
| L2 - DEFAULT v1:
| L3 - version:
| 02
| v3
| L2 - serialNumber:
| 02
| L2 - signature:
| L3 - algorithmIdentifier:
| L4 - algorithm:
| ‘sha-1WithRSAEncryption’
| L2 - issuer:
| 30 29 31 0b 30 09 06 03 55 04 06 13 02 43 4e 31
| 0b 30 09 06 03 55 04 0a 13 02 5a 47 31 0d 30 0b
| 06 03 55 04 03 13 04 72 6f 6f 74
| ‘C=CN, O=ZG, CN=root’
| L2 - validity:
| L3 - notBefore:
| L4 - utcTime:
| ‘Aug 19 01:30:00 UTC 2017’
| L3 - notAfter:
| L4 - utcTime:
| ‘Aug 19 01:30:00 UTC 2018’
| L2 - subject:
| 30 28 31 0b 30 09 06 03 55 04 06 13 02 63 6e 31
| 0c 30 0a 06 03 55 04 0a 13 03 7a 74 65 31 0b 30
| 09 06 03 55 04 03 13 02 68 64
| ‘C=cn, O=zte, CN=hd’
| L2 - subjectPublicKeyInfo:
| L3 - algorithm:
| L4 - algorithmIdentifier:
| L5 - algorithm:
| ‘rsaEncryption’
| L3 - subjectPublicKey:
| L4 - RSAPublicKey:
| L5 - modulus:
| 00 9f f0 82 74 be f4 a6 f0 09 c5 d3 03 27 3a 0f
| a0 0b 10 c3 05 fb 49 6f 5d ef 80 5b 38 ba b3 9e
| c5 db ff 64 16 28 4c 0e 2b fd 46 4a ea ad 4b b7
| c5 9d 61 65 35 46 67 6f dc a0 56 04 1e 36 e0 a5
| f7 3b 2e 17 7a 44 f4 f2 e0 1b 98 20 41 88 6a 94
| 19 9c 38 9b 2b 60 97 ea f3 20 76 96 c6 08 96 33
| 84 11 39 5f 53 d3 f9 d8 5c ef e1 1b b7 74 ca e4
| bd f8 27 be d9 f7 74 42 db 96 43 bc c6 67 5b e4
| 63
| L5 - publicExponent:
| 01 00 01
| L2 - optional extensions:
| L3 - extensions:
| L4 - extension:
| L5 - extnID:
| ‘basicConstraints’
| L5 - critical:
| FALSE
| L5 - extnValue:
| 30 00
| L6 - basicConstraints:
| L7 - CA:
| FALSE
| L4 - extension:
| L5 - extnID:
| ‘subjectAltName’
| L5 - critical:
| ff
| TRUE
| L5 - extnValue:
| 30 04 82 02 68 64
| L6 - generalNames:
| L7 - generalName:
| L8 - dnsName:
| 68 64
| ‘hd’
| L1 - signatureAlgorithm:
| L2 - algorithmIdentifier:
| L3 - algorithm:
| ‘sha-1WithRSAEncryption’
| L1 - signatureValue:
| 00 c7 a0 c0 00 90 e6 5a cb 2e 28 e8 24 0f f0 42
| d9 7d 0b d2 4a ef 88 40 1a 31 89 8d 3a bc 36 c2
| 68 0e 75 31 93 74 5e 3c 18 3f b2 81 c8 9a ae e8
| cf fc 66 25 bb 96 33 41 e8 31 45 22 f7 ff 6c ef
| c2 55 91 aa bb 83 0e 38 86 fa 87 bf 49 89 bf b8
| bb 6a 13 3f 4e b5 a7 df e6 ca 2a b3 cf a5 86 c0
| 52 a0 f6 69 63 16 cc c3 ff 35 55 c8 6f 91 08 c9
| 97 37 be 6d 02 a4 10 ad 4e ac a2 3b 53 71 4d 3b
| ed
| not before : Aug 19 01:30:00 UTC 2017
| current time: Aug 26 02:26:58 UTC 2017
| not after : Aug 19 01:30:00 UTC 2018
| certificate is valid
| counting wild cards for C=cn, O=zte, CN=hd is 0
| counting wild cards for C=cn, O=zte, CN=wq is 0
| orient linux-to-linux matching on public/private keys: this=no[%address] that=no[%address]
| orient linux-to-linux finished with: 0 [none]
| find_ID_host_pair: looking for me=C=cn, O=zte, CN=hd him=C=cn, O=zte, CN=wq (exact)
| concluded with
adding connection: “linux-to-linux”
| 192.168.1.102[C=cn, O=zte, CN=hd]…192.168.1.101[C=cn, O=zte, CN=wq]
| ike_life: 28800s; ipsec_life: 3600s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0; policy: RSASIG+ENCRYPT+TUNNEL+PFS+IKEv2ALLOW+IKEv2Init+SAREFTRACK
| * processed 0 messages from cryptographic helpers
| next event EVENT_PENDING_DDNS in 60 seconds
| next event EVENT_PENDING_DDNS in 60 seconds
|
| *received whack message
listening for IKE messages
| found lo with address 127.0.0.1
| found eth0 with address 192.168.1.102
| NAT-Traversal: Trying new style NAT-T
| NAT-Traversal: ESPINUDP(1) setup succeeded for new style NAT-T family IPv4
adding interface eth0/eth0 192.168.1.102:500 (AF_INET)
| NAT-Traversal: Trying new style NAT-T
| NAT-Traversal: ESPINUDP(2) setup succeeded for new style NAT-T family IPv4
adding interface eth0/eth0 192.168.1.102:4500
| NAT-Traversal: Trying new style NAT-T
| NAT-Traversal: ESPINUDP(1) setup succeeded for new style NAT-T family IPv4
adding interface lo/lo 127.0.0.1:500 (AF_INET)
| NAT-Traversal: Trying new style NAT-T
| NAT-Traversal: ESPINUDP(2) setup succeeded for new style NAT-T family IPv4
adding interface lo/lo 127.0.0.1:4500
| found lo with address 0000:0000:0000:0000:0000:0000:0000:0001
adding interface lo/lo ::1:500 (AF_INET6)
| orient linux-to-linux checking against if: lo (AF_INET6:::1:500)
| orient linux-to-linux checking against if: lo (AF_INET:127.0.0.1:4500)
| orient linux-to-linux checking against if: lo (AF_INET:127.0.0.1:500)
| orient linux-to-linux checking against if: eth0 (AF_INET:192.168.1.102:4500)
| orient linux-to-linux checking against if: eth0 (AF_INET:192.168.1.102:500)
| orient matched on IP
| orient linux-to-linux finished with: 1 [192.168.1.102]
| connection linux-to-linux is now oriented
| find_host_pair: looking for me=192.168.1.102:500 %address him=192.168.1.101:500 exact-match
| find_host_pair: concluded with
| connect_to_host_pair: 192.168.1.102:500 %address 192.168.1.101:500 -> hp:none
| find_ID_host_pair: looking for me=C=cn, O=zte, CN=hd him=C=cn, O=zte, CN=wq (exact)
| comparing to me=C=cn, O=zte, CN=hd him=C=cn, O=zte, CN=wq (linux-to-linux)
| concluded with linux-to-linux
loading secrets from “/etc/ipsec.secrets”
loaded private key file ‘/etc/ipsec.d/private/hdkey.key’ (887 bytes)
| file content is not binary ASN.1
| —–BEGIN RSA PRIVATE KEY—–
| —–END RSA PRIVATE KEY—–
| file coded in PEM format
| L0 - RSAPrivateKey:
| L1 - version:
| L1 - modulus:
| L1 - publicExponent:
| L1 - privateExponent:
| L1 - prime1:
| L1 - prime2:
| L1 - exponent1:
| L1 - exponent2:
| L1 - coefficient:
loaded private key for keyid: PPK_RSA:AwEAAZ/wg
| * processed 0 messages from cryptographic helpers
| next event EVENT_PENDING_DDNS in 60 seconds
| next event EVENT_PENDING_DDNS in 60 seconds
|
| *received whack message
| processing connection linux-to-linux
| route owner of “linux-to-linux” unrouted: NULL; eroute owner: NULL
| could_route called for linux-to-linux (kind=CK_PERMANENT)
| route owner of “linux-to-linux” unrouted: NULL; eroute owner: NULL
| route_and_eroute with c: linux-to-linux (next: none) ero:null esr:{(nil)} ro:null rosr:{(nil)} and state: 0
| request to add a prospective erouted policy with netkey kernel — experimental
| creating SPD to 192.168.1.102->spi=00000104@0.0.0.0 proto=61
| creating SPD to 192.168.1.102->spi=00000104@0.0.0.0 proto=61
| route_and_eroute: firewall_notified: true
| command executing prepare-host
| executing prepare-host: 2>&1 PLUTO_VERB=’prepare-host’ PLUTO_VERSION=’2.0’ PLUTO_CONNECTION=’linux-to-linux’ PLUTO_INTERFACE=’eth0’ PLUTO_NEXT_HOP=’192.168.1.101’ PLUTO_ME=’192.168.1.102’ PLUTO_MY_ID=’C=cn, O=zte, CN=hd’ PLUTO_MY_CLIENT=’192.168.1.102/32’ PLUTO_MY_CLIENT_NET=’192.168.1.102’ PLUTO_MY_CLIENT_MASK=’255.255.255.255’ PLUTO_MY_PORT=’0’ PLUTO_MY_PROTOCOL=’0’ PLUTO_PEER=’192.168.1.101’ PLUTO_PEER_ID=’C=cn, O=zte, CN=wq’ PLUTO_PEER_CLIENT=’192.168.1.101/32’ PLUTO_PEER_CLIENT_NET=’192.168.1.101’ PLUTO_PEER_CLIENT_MASK=’255.255.255.255’ PLUTO_PEER_PORT=’0’ PLUTO_PEER_PROTOCOL=’0’ PLUTO_PEER_CA=” PLUTO_STACK=’netkey’ PLUTO_CONN_POLICY=’RSASIG+ENCRYPT+TUNNEL+PFS+IKEv2ALLOW+IKEv2Init+SAREFTRACK’ PLUTO_CONN_ADDRFAMILY=’ipv4’ PLUTO_IS_PEER_CISCO=’0’ PLUTO_CISCO_DNS_INFO=” PLUTO_CISCO_DOMAIN_INFO=” PLUTO_PEER_BANNER=” PLUTO_NM_CONFIGURED=’0’ ipsec _updown
| command executing route-host
| executing route-host: 2>&1 PLUTO_VERB=’route-host’ PLUTO_VERSION=’2.0’ PLUTO_CONNECTION=’linux-to-linux’ PLUTO_INTERFACE=’eth0’ PLUTO_NEXT_HOP=’192.168.1.101’ PLUTO_ME=’192.168.1.102’ PLUTO_MY_ID=’C=cn, O=zte, CN=hd’ PLUTO_MY_CLIENT=’192.168.1.102/32’ PLUTO_MY_CLIENT_NET=’192.168.1.102’ PLUTO_MY_CLIENT_MASK=’255.255.255.255’ PLUTO_MY_PORT=’0’ PLUTO_MY_PROTOCOL=’0’ PLUTO_PEER=’192.168.1.101’ PLUTO_PEER_ID=’C=cn, O=zte, CN=wq’ PLUTO_PEER_CLIENT=’192.168.1.101/32’ PLUTO_PEER_CLIENT_NET=’192.168.1.101’ PLUTO_PEER_CLIENT_MASK=’255.255.255.255’ PLUTO_PEER_PORT=’0’ PLUTO_PEER_PROTOCOL=’0’ PLUTO_PEER_CA=” PLUTO_STACK=’netkey’ PLUTO_CONN_POLICY=’RSASIG+ENCRYPT+TUNNEL+PFS+IKEv2ALLOW+IKEv2Init+SAREFTRACK’ PLUTO_CONN_ADDRFAMILY=’ipv4’ PLUTO_IS_PEER_CISCO=’0’ PLUTO_CISCO_DNS_INFO=” PLUTO_CISCO_DOMAIN_INFO=” PLUTO_PEER_BANNER=” PLUTO_NM_CONFIGURED=’0’ ipsec _updown
| * processed 0 messages from cryptographic helpers
| next event EVENT_PENDING_DDNS in 60 seconds
| next event EVENT_PENDING_DDNS in 60 seconds
|
| *received whack message
| processing connection linux-to-linux
| empty esp_info, returning defaults
| creating state object #1 at 0xb8c31058
| orient linux-to-linux checking against if: lo (AF_INET6:::1:500)
| orient linux-to-linux checking against if: lo (AF_INET:127.0.0.1:4500)
| orient linux-to-linux checking against if: lo (AF_INET:127.0.0.1:500)
| orient linux-to-linux checking against if: eth0 (AF_INET:192.168.1.102:4500)
| orient linux-to-linux checking against if: eth0 (AF_INET:192.168.1.102:500)
| orient matched on IP
| orient linux-to-linux finished with: 1 [192.168.1.102]
| processing connection linux-to-linux
| ICOOKIE: 8f d8 7d 3b c5 f0 f1 0b
| RCOOKIE: 00 00 00 00 00 00 00 00
| state hash entry 28
| inserting state object #1 bucket: 28
| inserting event EVENT_SO_DISCARD, timeout in 0 seconds for #1 (head of queue)
| processing connection linux-to-linux
| Queuing pending Quick Mode with 192.168.1.101 “linux-to-linux”
“linux-to-linux” #1: initiating v2 parent SA
“linux-to-linux” #1: STATE_PARENT_I1: initiate
| no IKE algorithms for this connection
| 0: w->pcw_dead: 0 w->pcw_work: 0 cnt: 1
| asking helper 0 to do build_kenonce op on seq: 1 (len=2672, pcw_work=1)
| crypto helper write of request: cnt=2672