OPENSWAN R方打印

Plutorun started on Sun Aug 20 17:37:08 CST 2017
adjusting ipsec.d to /etc/ipsec.d
Labelled IPsec not enabled; value 32001 ignored.
Starting Pluto (Openswan Version 2.6.49.1; Vendor ID OSWhKaciWM}g) pid:22748
LEAK_DETECTIVE support [disabled]
OCF support for IKE [disabled]
SAref support [disabled]: Protocol not available
SAbind support [disabled]: Protocol not available
NSS support [disabled]
HAVE_STATSD notification support not compiled in
Setting NAT-Traversal port-4500 floating to on
port floating activation criteria nat_t=1/port_float=1
NAT-Traversal support [enabled]
| opening /dev/urandom
using /dev/urandom as source of random entropy
| inserting event EVENT_REINIT_SECRET, timeout in 3600 seconds (head of queue)
| inserting event EVENT_PENDING_DDNS, timeout in 60 seconds (head of queue)
| inserting event EVENT_PENDING_PHASE2, timeout in 120 seconds
| event added after event EVENT_PENDING_DDNS
ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0)
ike_alg_register_hash(): Activating OAKLEY_SHA2_512: Ok (ret=0)
ike_alg_register_hash(): Activating OAKLEY_SHA2_256: Ok (ret=0)
starting up 1 cryptographic helpers
started helper pid=22751 (fd:7)
Kernel interface auto-pick
Using Linux XFRM/NETKEY IPsec interface code on 3.16.0-23-generic
| process 22748 listening for PF_KEY_V2 on file descriptor 10
| finish_pfkey_msg: K_SADB_REGISTER message 1 for AH
| 02 07 00 02 02 00 00 00 01 00 00 00 dc 58 00 00
| opening /dev/urandom
using /dev/urandom as source of random entropy
! helper 0 waiting on fd: 8
| pfkey_get: K_SADB_REGISTER message 1
| AH registered with kernel.
| finish_pfkey_msg: K_SADB_REGISTER message 2 for ESP
| 02 07 00 03 02 00 00 00 02 00 00 00 dc 58 00 00
| pfkey_get: K_SADB_REGISTER message 2
| alg_init():memset(0xb7737f00, 0, 2048) memset(0xb7738700, 0, 2048)
| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: sadb_msg_len=22 sadb_supported_len=72
| kernel_alg_add():satype=3, exttype=14, alg_id=251
| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[0], exttype=14, satype=3, alg_id=251, alg_ivlen=0, alg_minbits=0, alg_maxbits=0, res=0, ret=1
| kernel_alg_add():satype=3, exttype=14, alg_id=2
| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[1], exttype=14, satype=3, alg_id=2, alg_ivlen=0, alg_minbits=128, alg_maxbits=128, res=0, ret=1
| kernel_alg_add():satype=3, exttype=14, alg_id=3
| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[2], exttype=14, satype=3, alg_id=3, alg_ivlen=0, alg_minbits=160, alg_maxbits=160, res=0, ret=1
| kernel_alg_add():satype=3, exttype=14, alg_id=5
| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[3], exttype=14, satype=3, alg_id=5, alg_ivlen=0, alg_minbits=256, alg_maxbits=256, res=0, ret=1
| kernel_alg_add():satype=3, exttype=14, alg_id=6
| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[4], exttype=14, satype=3, alg_id=6, alg_ivlen=0, alg_minbits=384, alg_maxbits=384, res=0, ret=1
| kernel_alg_add():satype=3, exttype=14, alg_id=7
| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[5], exttype=14, satype=3, alg_id=7, alg_ivlen=0, alg_minbits=512, alg_maxbits=512, res=0, ret=1
| kernel_alg_add():satype=3, exttype=14, alg_id=8
| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[6], exttype=14, satype=3, alg_id=8, alg_ivlen=0, alg_minbits=160, alg_maxbits=160, res=0, ret=1
| kernel_alg_add():satype=3, exttype=14, alg_id=9
| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[7], exttype=14, satype=3, alg_id=9, alg_ivlen=0, alg_minbits=128, alg_maxbits=128, res=0, ret=1
| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: sadb_msg_len=22 sadb_supported_len=88
| kernel_alg_add():satype=3, exttype=15, alg_id=11
| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[8], exttype=15, satype=3, alg_id=11, alg_ivlen=0, alg_minbits=0, alg_maxbits=0, res=0, ret=1
| kernel_alg_add():satype=3, exttype=15, alg_id=2
| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[9], exttype=15, satype=3, alg_id=2, alg_ivlen=8, alg_minbits=64, alg_maxbits=64, res=0, ret=1
| kernel_alg_add():satype=3, exttype=15, alg_id=3
| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[10], exttype=15, satype=3, alg_id=3, alg_ivlen=8, alg_minbits=192, alg_maxbits=192, res=0, ret=1
| kernel_alg_add():satype=3, exttype=15, alg_id=6
| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[11], exttype=15, satype=3, alg_id=6, alg_ivlen=8, alg_minbits=40, alg_maxbits=128, res=0, ret=1
| kernel_alg_add():satype=3, exttype=15, alg_id=7
| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[12], exttype=15, satype=3, alg_id=7, alg_ivlen=8, alg_minbits=40, alg_maxbits=448, res=0, ret=1
| kernel_alg_add():satype=3, exttype=15, alg_id=12
| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[13], exttype=15, satype=3, alg_id=12, alg_ivlen=8, alg_minbits=128, alg_maxbits=256, res=0, ret=1
| kernel_alg_add():satype=3, exttype=15, alg_id=252
| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[14], exttype=15, satype=3, alg_id=252, alg_ivlen=8, alg_minbits=128, alg_maxbits=256, res=0, ret=1
| kernel_alg_add():satype=3, exttype=15, alg_id=22
| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[15], exttype=15, satype=3, alg_id=22, alg_ivlen=8, alg_minbits=128, alg_maxbits=256, res=0, ret=1
| kernel_alg_add():satype=3, exttype=15, alg_id=253
| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[16], exttype=15, satype=3, alg_id=253, alg_ivlen=8, alg_minbits=128, alg_maxbits=256, res=0, ret=1
| kernel_alg_add():satype=3, exttype=15, alg_id=13
| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[17], exttype=15, satype=3, alg_id=13, alg_ivlen=8, alg_minbits=160, alg_maxbits=288, res=0, ret=1
| kernel_alg_add():satype=3, exttype=15, alg_id=18
| kernel_alg_add():satype=3, exttype=15, alg_id=19
| kernel_alg_add():satype=3, exttype=15, alg_id=20
| kernel_alg_add():satype=3, exttype=15, alg_id=14
| kernel_alg_add():satype=3, exttype=15, alg_id=15
| kernel_alg_add():satype=3, exttype=15, alg_id=16
ike_alg_register_enc(): Activating aes_ccm_8: Ok (ret=0)
ike_alg_add(): ERROR: algo_type ‘0’, algo_id ‘0’, Algorithm type already exists
ike_alg_register_enc(): Activating aes_ccm_12: FAILED (ret=-17)
ike_alg_add(): ERROR: algo_type ‘0’, algo_id ‘0’, Algorithm type already exists
ike_alg_register_enc(): Activating aes_ccm_16: FAILED (ret=-17)
ike_alg_add(): ERROR: algo_type ‘0’, algo_id ‘0’, Algorithm type already exists
ike_alg_register_enc(): Activating aes_gcm_8: FAILED (ret=-17)
ike_alg_add(): ERROR: algo_type ‘0’, algo_id ‘0’, Algorithm type already exists
ike_alg_register_enc(): Activating aes_gcm_12: FAILED (ret=-17)
ike_alg_add(): ERROR: algo_type ‘0’, algo_id ‘0’, Algorithm type already exists
ike_alg_register_enc(): Activating aes_gcm_16: FAILED (ret=-17)
| ESP registered with kernel.
| finish_pfkey_msg: K_SADB_REGISTER message 3 for IPCOMP
| 02 07 00 09 02 00 00 00 03 00 00 00 dc 58 00 00
| pfkey_get: K_SADB_REGISTER message 3
| IPCOMP registered with kernel.
| Changed path to directory ‘/etc/ipsec.d/cacerts’
loaded CA cert file ‘ca.pem~’ (700 bytes)
| file content is not binary ASN.1
| —–BEGIN CERTIFICATE—–
| —–END CERTIFICATE—–
| file coded in PEM format
| L0 - certificate:
| 30 82 01 d8 30 82 01 41 a0 03 02 01 02 02 01 01
| 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 30
| 29 31 0b 30 09 06 03 55 04 06 13 02 43 4e 31 0b
| 30 09 06 03 55 04 0a 13 02 5a 47 31 0d 30 0b 06
| 03 55 04 03 13 04 72 6f 6f 74 30 1e 17 0d 31 37
| 30 38 30 35 31 32 35 35 30 30 5a 17 0d 32 37 30
| 38 30 35 31 32 35 35 30 30 5a 30 29 31 0b 30 09
| 06 03 55 04 06 13 02 43 4e 31 0b 30 09 06 03 55
| 04 0a 13 02 5a 47 31 0d 30 0b 06 03 55 04 03 13
| 04 72 6f 6f 74 30 81 9f 30 0d 06 09 2a 86 48 86
| f7 0d 01 01 01 05 00 03 81 8d 00 30 81 89 02 81
| 81 00 ea a2 90 dc 1b b2 e8 72 61 2f 05 12 52 ea
| c8 0b 22 16 b6 10 d8 5b d5 93 4e bc 09 54 92 50
| ef 8b 56 09 8a fa b6 8d 3c 05 43 06 72 79 bd 1f
| 30 3f 2e 93 23 84 0a 87 9d 4f 07 b1 80 b7 7f d3
| 94 77 43 a4 a5 ba a2 a0 ef aa 3a 50 34 10 e3 2a
| a7 48 47 02 cd 56 aa 96 1d 70 8f 44 63 cc e9 88
| 0a 62 65 37 93 22 d1 2d 50 af da d1 5e 01 79 84
| 7f 28 83 bb cd aa 5a 5a e3 ba a9 a4 4a 7f 9b 87
| a3 a3 02 03 01 00 01 a3 10 30 0e 30 0c 06 03 55
| 1d 13 04 05 30 03 01 01 ff 30 0d 06 09 2a 86 48
| 86 f7 0d 01 01 05 05 00 03 81 81 00 80 59 4e bd
| f0 7a d0 4d 05 0a c0 e4 2c fe 58 c5 b2 46 6b 26
| 2d 52 4b 9c 00 bf 5a 54 44 5a 10 9d 12 ab f5 ad
| 0d ea 07 64 f5 f1 a3 7c d5 5a 05 2b 04 68 a4 35
| 80 29 45 99 7f ad 8d 08 4a 0e 39 a2 14 82 23 bd
| 5b d3 a9 48 c7 93 20 d4 03 1d 15 04 5d 7c 2b 44
| 36 ca 34 98 31 fa c2 ac 78 01 c7 b5 cf 96 30 24
| bc ef 9c 07 e9 8d de 52 53 24 97 3c f2 d5 8c 98
| 4b 96 fe 03 60 4e 3c 04 94 05 dc 3b
| L1 - tbsCertificate:
| 30 82 01 41 a0 03 02 01 02 02 01 01 30 0d 06 09
| 2a 86 48 86 f7 0d 01 01 05 05 00 30 29 31 0b 30
| 09 06 03 55 04 06 13 02 43 4e 31 0b 30 09 06 03
| 55 04 0a 13 02 5a 47 31 0d 30 0b 06 03 55 04 03
| 13 04 72 6f 6f 74 30 1e 17 0d 31 37 30 38 30 35
| 31 32 35 35 30 30 5a 17 0d 32 37 30 38 30 35 31
| 32 35 35 30 30 5a 30 29 31 0b 30 09 06 03 55 04
| 06 13 02 43 4e 31 0b 30 09 06 03 55 04 0a 13 02
| 5a 47 31 0d 30 0b 06 03 55 04 03 13 04 72 6f 6f
| 74 30 81 9f 30 0d 06 09 2a 86 48 86 f7 0d 01 01
| 01 05 00 03 81 8d 00 30 81 89 02 81 81 00 ea a2
| 90 dc 1b b2 e8 72 61 2f 05 12 52 ea c8 0b 22 16
| b6 10 d8 5b d5 93 4e bc 09 54 92 50 ef 8b 56 09
| 8a fa b6 8d 3c 05 43 06 72 79 bd 1f 30 3f 2e 93
| 23 84 0a 87 9d 4f 07 b1 80 b7 7f d3 94 77 43 a4
| a5 ba a2 a0 ef aa 3a 50 34 10 e3 2a a7 48 47 02
| cd 56 aa 96 1d 70 8f 44 63 cc e9 88 0a 62 65 37
| 93 22 d1 2d 50 af da d1 5e 01 79 84 7f 28 83 bb
| cd aa 5a 5a e3 ba a9 a4 4a 7f 9b 87 a3 a3 02 03
| 01 00 01 a3 10 30 0e 30 0c 06 03 55 1d 13 04 05
| 30 03 01 01 ff
| L2 - DEFAULT v1:
| L3 - version:
| 02
| v3
| L2 - serialNumber:
| 01
| L2 - signature:
| L3 - algorithmIdentifier:
| L4 - algorithm:
| ‘sha-1WithRSAEncryption’
| L2 - issuer:
| 30 29 31 0b 30 09 06 03 55 04 06 13 02 43 4e 31
| 0b 30 09 06 03 55 04 0a 13 02 5a 47 31 0d 30 0b
| 06 03 55 04 03 13 04 72 6f 6f 74
| ‘C=CN, O=ZG, CN=root’
| L2 - validity:
| L3 - notBefore:
| L4 - utcTime:
| ‘Aug 05 12:55:00 UTC 2017’
| L3 - notAfter:
| L4 - utcTime:
| ‘Aug 05 12:55:00 UTC 2027’
| L2 - subject:
| 30 29 31 0b 30 09 06 03 55 04 06 13 02 43 4e 31
| 0b 30 09 06 03 55 04 0a 13 02 5a 47 31 0d 30 0b
| 06 03 55 04 03 13 04 72 6f 6f 74
| ‘C=CN, O=ZG, CN=root’
| L2 - subjectPublicKeyInfo:
| L3 - algorithm:
| L4 - algorithmIdentifier:
| L5 - algorithm:
| ‘rsaEncryption’
| L3 - subjectPublicKey:
| L4 - RSAPublicKey:
| L5 - modulus:
| 00 ea a2 90 dc 1b b2 e8 72 61 2f 05 12 52 ea c8
| 0b 22 16 b6 10 d8 5b d5 93 4e bc 09 54 92 50 ef
| 8b 56 09 8a fa b6 8d 3c 05 43 06 72 79 bd 1f 30
| 3f 2e 93 23 84 0a 87 9d 4f 07 b1 80 b7 7f d3 94
| 77 43 a4 a5 ba a2 a0 ef aa 3a 50 34 10 e3 2a a7
| 48 47 02 cd 56 aa 96 1d 70 8f 44 63 cc e9 88 0a
| 62 65 37 93 22 d1 2d 50 af da d1 5e 01 79 84 7f
| 28 83 bb cd aa 5a 5a e3 ba a9 a4 4a 7f 9b 87 a3
| a3
| L5 - publicExponent:
| 01 00 01
| L2 - optional extensions:
| L3 - extensions:
| L4 - extension:
| L5 - extnID:
| ‘basicConstraints’
| L5 - critical:
| FALSE
| L5 - extnValue:
| 30 03 01 01 ff
| L6 - basicConstraints:
| L7 - CA:
| ff
| TRUE
| L1 - signatureAlgorithm:
| L2 - algorithmIdentifier:
| L3 - algorithm:
| ‘sha-1WithRSAEncryption’
| L1 - signatureValue:
| 00 80 59 4e bd f0 7a d0 4d 05 0a c0 e4 2c fe 58
| c5 b2 46 6b 26 2d 52 4b 9c 00 bf 5a 54 44 5a 10
| 9d 12 ab f5 ad 0d ea 07 64 f5 f1 a3 7c d5 5a 05
| 2b 04 68 a4 35 80 29 45 99 7f ad 8d 08 4a 0e 39
| a2 14 82 23 bd 5b d3 a9 48 c7 93 20 d4 03 1d 15
| 04 5d 7c 2b 44 36 ca 34 98 31 fa c2 ac 78 01 c7
| b5 cf 96 30 24 bc ef 9c 07 e9 8d de 52 53 24 97
| 3c f2 d5 8c 98 4b 96 fe 03 60 4e 3c 04 94 05 dc
| 3b
| authcert inserted
loaded CA cert file ‘ca.pem’ (700 bytes)
| file content is not binary ASN.1
| —–BEGIN CERTIFICATE—–
| —–END CERTIFICATE—–
| file coded in PEM format
| L0 - certificate:
| 30 82 01 d8 30 82 01 41 a0 03 02 01 02 02 01 01
| 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 30
| 29 31 0b 30 09 06 03 55 04 06 13 02 43 4e 31 0b
| 30 09 06 03 55 04 0a 13 02 5a 47 31 0d 30 0b 06
| 03 55 04 03 13 04 72 6f 6f 74 30 1e 17 0d 31 37
| 30 38 30 35 31 32 35 35 30 30 5a 17 0d 32 37 30
| 38 30 35 31 32 35 35 30 30 5a 30 29 31 0b 30 09
| 06 03 55 04 06 13 02 43 4e 31 0b 30 09 06 03 55
| 04 0a 13 02 5a 47 31 0d 30 0b 06 03 55 04 03 13
| 04 72 6f 6f 74 30 81 9f 30 0d 06 09 2a 86 48 86
| f7 0d 01 01 01 05 00 03 81 8d 00 30 81 89 02 81
| 81 00 ea a2 90 dc 1b b2 e8 72 61 2f 05 12 52 ea
| c8 0b 22 16 b6 10 d8 5b d5 93 4e bc 09 54 92 50
| ef 8b 56 09 8a fa b6 8d 3c 05 43 06 72 79 bd 1f
| 30 3f 2e 93 23 84 0a 87 9d 4f 07 b1 80 b7 7f d3
| 94 77 43 a4 a5 ba a2 a0 ef aa 3a 50 34 10 e3 2a
| a7 48 47 02 cd 56 aa 96 1d 70 8f 44 63 cc e9 88
| 0a 62 65 37 93 22 d1 2d 50 af da d1 5e 01 79 84
| 7f 28 83 bb cd aa 5a 5a e3 ba a9 a4 4a 7f 9b 87
| a3 a3 02 03 01 00 01 a3 10 30 0e 30 0c 06 03 55
| 1d 13 04 05 30 03 01 01 ff 30 0d 06 09 2a 86 48
| 86 f7 0d 01 01 05 05 00 03 81 81 00 80 59 4e bd
| f0 7a d0 4d 05 0a c0 e4 2c fe 58 c5 b2 46 6b 26
| 2d 52 4b 9c 00 bf 5a 54 44 5a 10 9d 12 ab f5 ad
| 0d ea 07 64 f5 f1 a3 7c d5 5a 05 2b 04 68 a4 35
| 80 29 45 99 7f ad 8d 08 4a 0e 39 a2 14 82 23 bd
| 5b d3 a9 48 c7 93 20 d4 03 1d 15 04 5d 7c 2b 44
| 36 ca 34 98 31 fa c2 ac 78 01 c7 b5 cf 96 30 24
| bc ef 9c 07 e9 8d de 52 53 24 97 3c f2 d5 8c 98
| 4b 96 fe 03 60 4e 3c 04 94 05 dc 3b
| L1 - tbsCertificate:
| 30 82 01 41 a0 03 02 01 02 02 01 01 30 0d 06 09
| 2a 86 48 86 f7 0d 01 01 05 05 00 30 29 31 0b 30
| 09 06 03 55 04 06 13 02 43 4e 31 0b 30 09 06 03
| 55 04 0a 13 02 5a 47 31 0d 30 0b 06 03 55 04 03
| 13 04 72 6f 6f 74 30 1e 17 0d 31 37 30 38 30 35
| 31 32 35 35 30 30 5a 17 0d 32 37 30 38 30 35 31
| 32 35 35 30 30 5a 30 29 31 0b 30 09 06 03 55 04
| 06 13 02 43 4e 31 0b 30 09 06 03 55 04 0a 13 02
| 5a 47 31 0d 30 0b 06 03 55 04 03 13 04 72 6f 6f
| 74 30 81 9f 30 0d 06 09 2a 86 48 86 f7 0d 01 01
| 01 05 00 03 81 8d 00 30 81 89 02 81 81 00 ea a2
| 90 dc 1b b2 e8 72 61 2f 05 12 52 ea c8 0b 22 16
| b6 10 d8 5b d5 93 4e bc 09 54 92 50 ef 8b 56 09
| 8a fa b6 8d 3c 05 43 06 72 79 bd 1f 30 3f 2e 93
| 23 84 0a 87 9d 4f 07 b1 80 b7 7f d3 94 77 43 a4
| a5 ba a2 a0 ef aa 3a 50 34 10 e3 2a a7 48 47 02
| cd 56 aa 96 1d 70 8f 44 63 cc e9 88 0a 62 65 37
| 93 22 d1 2d 50 af da d1 5e 01 79 84 7f 28 83 bb
| cd aa 5a 5a e3 ba a9 a4 4a 7f 9b 87 a3 a3 02 03
| 01 00 01 a3 10 30 0e 30 0c 06 03 55 1d 13 04 05
| 30 03 01 01 ff
| L2 - DEFAULT v1:
| L3 - version:
| 02
| v3
| L2 - serialNumber:
| 01
| L2 - signature:
| L3 - algorithmIdentifier:
| L4 - algorithm:
| ‘sha-1WithRSAEncryption’
| L2 - issuer:
| 30 29 31 0b 30 09 06 03 55 04 06 13 02 43 4e 31
| 0b 30 09 06 03 55 04 0a 13 02 5a 47 31 0d 30 0b
| 06 03 55 04 03 13 04 72 6f 6f 74
| ‘C=CN, O=ZG, CN=root’
| L2 - validity:
| L3 - notBefore:
| L4 - utcTime:
| ‘Aug 05 12:55:00 UTC 2017’
| L3 - notAfter:
| L4 - utcTime:
| ‘Aug 05 12:55:00 UTC 2027’
| L2 - subject:
| 30 29 31 0b 30 09 06 03 55 04 06 13 02 43 4e 31
| 0b 30 09 06 03 55 04 0a 13 02 5a 47 31 0d 30 0b
| 06 03 55 04 03 13 04 72 6f 6f 74
| ‘C=CN, O=ZG, CN=root’
| L2 - subjectPublicKeyInfo:
| L3 - algorithm:
| L4 - algorithmIdentifier:
| L5 - algorithm:
| ‘rsaEncryption’
| L3 - subjectPublicKey:
| L4 - RSAPublicKey:
| L5 - modulus:
| 00 ea a2 90 dc 1b b2 e8 72 61 2f 05 12 52 ea c8
| 0b 22 16 b6 10 d8 5b d5 93 4e bc 09 54 92 50 ef
| 8b 56 09 8a fa b6 8d 3c 05 43 06 72 79 bd 1f 30
| 3f 2e 93 23 84 0a 87 9d 4f 07 b1 80 b7 7f d3 94
| 77 43 a4 a5 ba a2 a0 ef aa 3a 50 34 10 e3 2a a7
| 48 47 02 cd 56 aa 96 1d 70 8f 44 63 cc e9 88 0a
| 62 65 37 93 22 d1 2d 50 af da d1 5e 01 79 84 7f
| 28 83 bb cd aa 5a 5a e3 ba a9 a4 4a 7f 9b 87 a3
| a3
| L5 - publicExponent:
| 01 00 01
| L2 - optional extensions:
| L3 - extensions:
| L4 - extension:
| L5 - extnID:
| ‘basicConstraints’
| L5 - critical:
| FALSE
| L5 - extnValue:
| 30 03 01 01 ff
| L6 - basicConstraints:
| L7 - CA:
| ff
| TRUE
| L1 - signatureAlgorithm:
| L2 - algorithmIdentifier:
| L3 - algorithm:
| ‘sha-1WithRSAEncryption’
| L1 - signatureValue:
| 00 80 59 4e bd f0 7a d0 4d 05 0a c0 e4 2c fe 58
| c5 b2 46 6b 26 2d 52 4b 9c 00 bf 5a 54 44 5a 10
| 9d 12 ab f5 ad 0d ea 07 64 f5 f1 a3 7c d5 5a 05
| 2b 04 68 a4 35 80 29 45 99 7f ad 8d 08 4a 0e 39
| a2 14 82 23 bd 5b d3 a9 48 c7 93 20 d4 03 1d 15
| 04 5d 7c 2b 44 36 ca 34 98 31 fa c2 ac 78 01 c7
| b5 cf 96 30 24 bc ef 9c 07 e9 8d de 52 53 24 97
| 3c f2 d5 8c 98 4b 96 fe 03 60 4e 3c 04 94 05 dc
| 3b
| authcert is already present and identical
| Changed path to directory ‘/etc/ipsec.d/aacerts’
| Changed path to directory ‘/etc/ipsec.d/ocspcerts’
| Found 0 items in directory ‘/etc/ipsec.d/crls’
| inserting event EVENT_LOG_DAILY, timeout in 22972 seconds
| event added after event EVENT_REINIT_SECRET
| next event EVENT_PENDING_DDNS in 60 seconds
|
| *received whack message
| Added new connection linux-to-linux with policy RSASIG+ENCRYPT+TUNNEL+PFS+IKEv2ALLOW+IKEv2Init+SAREFTRACK
conn: linux-to-linux, rekeymargin (540s) > salifetime (25s); reducing rekeymargin to 12 seconds
loading certificate from /etc/ipsec.d/certs/wqcert.pem
loaded host cert file ‘/etc/ipsec.d/certs/wqcert.pem’ (721 bytes)
| file content is not binary ASN.1
| —–BEGIN CERTIFICATE—–
| —–END CERTIFICATE—–
| file coded in PEM format
| L0 - certificate:
| 30 82 01 e6 30 82 01 4f a0 03 02 01 02 02 01 03
| 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 30
| 29 31 0b 30 09 06 03 55 04 06 13 02 43 4e 31 0b
| 30 09 06 03 55 04 0a 13 02 5a 47 31 0d 30 0b 06
| 03 55 04 03 13 04 72 6f 6f 74 30 1e 17 0d 31 37
| 30 38 31 39 30 31 33 32 30 30 5a 17 0d 31 38 30
| 38 31 39 30 31 33 32 30 30 5a 30 28 31 0b 30 09
| 06 03 55 04 06 13 02 63 6e 31 0c 30 0a 06 03 55
| 04 0a 13 03 7a 74 65 31 0b 30 09 06 03 55 04 03
| 13 02 77 71 30 81 9f 30 0d 06 09 2a 86 48 86 f7
| 0d 01 01 01 05 00 03 81 8d 00 30 81 89 02 81 81
| 00 d2 26 07 31 8a 93 9f 6f a0 25 c6 f4 1f 58 1f
| ea a8 45 18 eb 81 94 af 8a 96 4c 91 49 a0 1c 65
| d9 16 34 41 c9 a9 df 2a 58 fd 5c 2a f9 b9 1f 1b
| 12 05 fb bf b9 76 4c 15 86 f2 59 d2 48 68 f6 aa
| 83 4a 59 a2 c5 70 79 58 a9 ff 92 0a cc f3 6c e8
| a1 18 d4 98 73 81 2b b0 d9 42 79 d7 b7 f9 22 aa
| a3 41 b6 16 7e f2 c6 41 91 bd 21 b0 5d 10 49 da
| c8 a0 8f 2a 21 d6 65 43 b7 ae d1 e4 1f 03 d1 0f
| 51 02 03 01 00 01 a3 1f 30 1d 30 09 06 03 55 1d
| 13 04 02 30 00 30 10 06 03 55 1d 11 01 01 ff 04
| 06 30 04 82 02 77 71 30 0d 06 09 2a 86 48 86 f7
| 0d 01 01 05 05 00 03 81 81 00 d4 09 da 11 51 7b
| 4c 6d a2 16 53 3b 74 69 50 8c c6 f6 40 53 16 8a
| 5b c4 74 41 f6 f9 05 15 bc b8 97 6f 45 4a c2 3e
| da 80 8e a5 eb 3e 78 b1 cb c7 6d d8 05 87 e0 ba
| c0 b0 81 cf e4 7a 82 d7 27 14 17 07 0e a4 50 8f
| 55 66 10 05 3a d4 3a 45 9a 80 18 4a e1 3c 92 2b
| 39 4c 45 68 e6 59 f5 02 34 22 77 20 3d e5 da 74
| b4 c1 0b d3 da 4b 23 e2 6c ad 1f 38 58 31 9b 4a
| 88 72 58 27 50 b5 fc 89 16 6d
| L1 - tbsCertificate:
| 30 82 01 4f a0 03 02 01 02 02 01 03 30 0d 06 09
| 2a 86 48 86 f7 0d 01 01 05 05 00 30 29 31 0b 30
| 09 06 03 55 04 06 13 02 43 4e 31 0b 30 09 06 03
| 55 04 0a 13 02 5a 47 31 0d 30 0b 06 03 55 04 03
| 13 04 72 6f 6f 74 30 1e 17 0d 31 37 30 38 31 39
| 30 31 33 32 30 30 5a 17 0d 31 38 30 38 31 39 30
| 31 33 32 30 30 5a 30 28 31 0b 30 09 06 03 55 04
| 06 13 02 63 6e 31 0c 30 0a 06 03 55 04 0a 13 03
| 7a 74 65 31 0b 30 09 06 03 55 04 03 13 02 77 71
| 30 81 9f 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01
| 05 00 03 81 8d 00 30 81 89 02 81 81 00 d2 26 07
| 31 8a 93 9f 6f a0 25 c6 f4 1f 58 1f ea a8 45 18
| eb 81 94 af 8a 96 4c 91 49 a0 1c 65 d9 16 34 41
| c9 a9 df 2a 58 fd 5c 2a f9 b9 1f 1b 12 05 fb bf
| b9 76 4c 15 86 f2 59 d2 48 68 f6 aa 83 4a 59 a2
| c5 70 79 58 a9 ff 92 0a cc f3 6c e8 a1 18 d4 98
| 73 81 2b b0 d9 42 79 d7 b7 f9 22 aa a3 41 b6 16
| 7e f2 c6 41 91 bd 21 b0 5d 10 49 da c8 a0 8f 2a
| 21 d6 65 43 b7 ae d1 e4 1f 03 d1 0f 51 02 03 01
| 00 01 a3 1f 30 1d 30 09 06 03 55 1d 13 04 02 30
| 00 30 10 06 03 55 1d 11 01 01 ff 04 06 30 04 82
| 02 77 71
| L2 - DEFAULT v1:
| L3 - version:
| 02
| v3
| L2 - serialNumber:
| 03
| L2 - signature:
| L3 - algorithmIdentifier:
| L4 - algorithm:
| ‘sha-1WithRSAEncryption’
| L2 - issuer:
| 30 29 31 0b 30 09 06 03 55 04 06 13 02 43 4e 31
| 0b 30 09 06 03 55 04 0a 13 02 5a 47 31 0d 30 0b
| 06 03 55 04 03 13 04 72 6f 6f 74
| ‘C=CN, O=ZG, CN=root’
| L2 - validity:
| L3 - notBefore:
| L4 - utcTime:
| ‘Aug 19 01:32:00 UTC 2017’
| L3 - notAfter:
| L4 - utcTime:
| ‘Aug 19 01:32:00 UTC 2018’
| L2 - subject:
| 30 28 31 0b 30 09 06 03 55 04 06 13 02 63 6e 31
| 0c 30 0a 06 03 55 04 0a 13 03 7a 74 65 31 0b 30
| 09 06 03 55 04 03 13 02 77 71
| ‘C=cn, O=zte, CN=wq’
| L2 - subjectPublicKeyInfo:
| L3 - algorithm:
| L4 - algorithmIdentifier:
| L5 - algorithm:
| ‘rsaEncryption’
| L3 - subjectPublicKey:
| L4 - RSAPublicKey:
| L5 - modulus:
| 00 d2 26 07 31 8a 93 9f 6f a0 25 c6 f4 1f 58 1f
| ea a8 45 18 eb 81 94 af 8a 96 4c 91 49 a0 1c 65
| d9 16 34 41 c9 a9 df 2a 58 fd 5c 2a f9 b9 1f 1b
| 12 05 fb bf b9 76 4c 15 86 f2 59 d2 48 68 f6 aa
| 83 4a 59 a2 c5 70 79 58 a9 ff 92 0a cc f3 6c e8
| a1 18 d4 98 73 81 2b b0 d9 42 79 d7 b7 f9 22 aa
| a3 41 b6 16 7e f2 c6 41 91 bd 21 b0 5d 10 49 da
| c8 a0 8f 2a 21 d6 65 43 b7 ae d1 e4 1f 03 d1 0f
| 51
| L5 - publicExponent:
| 01 00 01
| L2 - optional extensions:
| L3 - extensions:
| L4 - extension:
| L5 - extnID:
| ‘basicConstraints’
| L5 - critical:
| FALSE
| L5 - extnValue:
| 30 00
| L6 - basicConstraints:
| L7 - CA:
| FALSE
| L4 - extension:
| L5 - extnID:
| ‘subjectAltName’
| L5 - critical:
| ff
| TRUE
| L5 - extnValue:
| 30 04 82 02 77 71
| L6 - generalNames:
| L7 - generalName:
| L8 - dnsName:
| 77 71
| ‘wq’
| L1 - signatureAlgorithm:
| L2 - algorithmIdentifier:
| L3 - algorithm:
| ‘sha-1WithRSAEncryption’
| L1 - signatureValue:
| 00 d4 09 da 11 51 7b 4c 6d a2 16 53 3b 74 69 50
| 8c c6 f6 40 53 16 8a 5b c4 74 41 f6 f9 05 15 bc
| b8 97 6f 45 4a c2 3e da 80 8e a5 eb 3e 78 b1 cb
| c7 6d d8 05 87 e0 ba c0 b0 81 cf e4 7a 82 d7 27
| 14 17 07 0e a4 50 8f 55 66 10 05 3a d4 3a 45 9a
| 80 18 4a e1 3c 92 2b 39 4c 45 68 e6 59 f5 02 34
| 22 77 20 3d e5 da 74 b4 c1 0b d3 da 4b 23 e2 6c
| ad 1f 38 58 31 9b 4a 88 72 58 27 50 b5 fc 89 16
| 6d
| not before : Aug 19 01:32:00 UTC 2017
| current time: Aug 20 09:37:08 UTC 2017
| not after : Aug 19 01:32:00 UTC 2018
| certificate is valid
| counting wild cards for C=cn, O=zte, CN=wq is 0
| counting wild cards for C=cn, O=zte, CN=hd is 0
| orient linux-to-linux matching on public/private keys: this=no[%address] that=no[%address]
| orient linux-to-linux finished with: 0 [none]
| find_ID_host_pair: looking for me=C=cn, O=zte, CN=wq him=C=cn, O=zte, CN=hd (exact)
| concluded with
adding connection: “linux-to-linux”
| 192.168.1.101[C=cn, O=zte, CN=wq]…192.168.1.102[C=cn, O=zte, CN=hd]
| ike_life: 10s; ipsec_life: 25s; rekey_margin: 12s; rekey_fuzz: 100%; keyingtries: 0; policy: RSASIG+ENCRYPT+TUNNEL+PFS+IKEv2ALLOW+IKEv2Init+SAREFTRACK
| * processed 0 messages from cryptographic helpers
| next event EVENT_PENDING_DDNS in 60 seconds
| next event EVENT_PENDING_DDNS in 60 seconds
|
| *received whack message
listening for IKE messages
| found lo with address 127.0.0.1
| found eth0 with address 192.168.1.101
| NAT-Traversal: Trying new style NAT-T
| NAT-Traversal: ESPINUDP(1) setup succeeded for new style NAT-T family IPv4
adding interface eth0/eth0 192.168.1.101:500 (AF_INET)
| NAT-Traversal: Trying new style NAT-T
| NAT-Traversal: ESPINUDP(2) setup succeeded for new style NAT-T family IPv4
adding interface eth0/eth0 192.168.1.101:4500
| NAT-Traversal: Trying new style NAT-T
| NAT-Traversal: ESPINUDP(1) setup succeeded for new style NAT-T family IPv4
adding interface lo/lo 127.0.0.1:500 (AF_INET)
| NAT-Traversal: Trying new style NAT-T
| NAT-Traversal: ESPINUDP(2) setup succeeded for new style NAT-T family IPv4
adding interface lo/lo 127.0.0.1:4500
| found lo with address 0000:0000:0000:0000:0000:0000:0000:0001
adding interface lo/lo ::1:500 (AF_INET6)
| orient linux-to-linux checking against if: lo (AF_INET6:::1:500)
| orient linux-to-linux checking against if: lo (AF_INET:127.0.0.1:4500)
| orient linux-to-linux checking against if: lo (AF_INET:127.0.0.1:500)
| orient linux-to-linux checking against if: eth0 (AF_INET:192.168.1.101:4500)
| orient linux-to-linux checking against if: eth0 (AF_INET:192.168.1.101:500)
| orient matched on IP
| orient linux-to-linux finished with: 1 [192.168.1.101]
| connection linux-to-linux is now oriented
| find_host_pair: looking for me=192.168.1.101:500 %address him=192.168.1.102:500 exact-match
| find_host_pair: concluded with
| connect_to_host_pair: 192.168.1.101:500 %address 192.168.1.102:500 -> hp:none
| find_ID_host_pair: looking for me=C=cn, O=zte, CN=wq him=C=cn, O=zte, CN=hd (exact)
| comparing to me=C=cn, O=zte, CN=wq him=C=cn, O=zte, CN=hd (linux-to-linux)
| concluded with linux-to-linux
loading secrets from “/etc/ipsec.secrets”
loaded private key file ‘/etc/ipsec.d/private/wqkey.key’ (888 bytes)
| file content is not binary ASN.1
| —–BEGIN RSA PRIVATE KEY—–
| —–END RSA PRIVATE KEY—–
| file coded in PEM format
| L0 - RSAPrivateKey:
| L1 - version:
| L1 - modulus:
| L1 - publicExponent:
| L1 - privateExponent:
| L1 - prime1:
| L1 - prime2:
| L1 - exponent1:
| L1 - exponent2:
| L1 - coefficient:
loaded private key for keyid: PPK_RSA:AwEAAdImB
| * processed 0 messages from cryptographic helpers
| next event EVENT_PENDING_DDNS in 60 seconds
| next event EVENT_PENDING_DDNS in 60 seconds
|
| *received whack message
| processing connection linux-to-linux
| route owner of “linux-to-linux” unrouted: NULL; eroute owner: NULL
| could_route called for linux-to-linux (kind=CK_PERMANENT)
| route owner of “linux-to-linux” unrouted: NULL; eroute owner: NULL
| route_and_eroute with c: linux-to-linux (next: none) ero:null esr:{(nil)} ro:null rosr:{(nil)} and state: 0
| request to add a prospective erouted policy with netkey kernel — experimental
| creating SPD to 192.168.1.101->spi=00000104@0.0.0.0 proto=61
| creating SPD to 192.168.1.101->spi=00000104@0.0.0.0 proto=61
| route_and_eroute: firewall_notified: true
| command executing prepare-host
| executing prepare-host: 2>&1 PLUTO_VERB=’prepare-host’ PLUTO_VERSION=’2.0’ PLUTO_CONNECTION=’linux-to-linux’ PLUTO_INTERFACE=’eth0’ PLUTO_NEXT_HOP=’192.168.1.102’ PLUTO_ME=’192.168.1.101’ PLUTO_MY_ID=’C=cn, O=zte, CN=wq’ PLUTO_MY_CLIENT=’192.168.1.101/32’ PLUTO_MY_CLIENT_NET=’192.168.1.101’ PLUTO_MY_CLIENT_MASK=’255.255.255.255’ PLUTO_MY_PORT=’0’ PLUTO_MY_PROTOCOL=’0’ PLUTO_PEER=’192.168.1.102’ PLUTO_PEER_ID=’C=cn, O=zte, CN=hd’ PLUTO_PEER_CLIENT=’192.168.1.102/32’ PLUTO_PEER_CLIENT_NET=’192.168.1.102’ PLUTO_PEER_CLIENT_MASK=’255.255.255.255’ PLUTO_PEER_PORT=’0’ PLUTO_PEER_PROTOCOL=’0’ PLUTO_PEER_CA=” PLUTO_STACK=’netkey’ PLUTO_CONN_POLICY=’RSASIG+ENCRYPT+TUNNEL+PFS+IKEv2ALLOW+IKEv2Init+SAREFTRACK’ PLUTO_CONN_ADDRFAMILY=’ipv4’ PLUTO_IS_PEER_CISCO=’0’ PLUTO_CISCO_DNS_INFO=” PLUTO_CISCO_DOMAIN_INFO=” PLUTO_PEER_BANNER=” PLUTO_NM_CONFIGURED=’0’ ipsec _updown
| command executing route-host
| executing route-host: 2>&1 PLUTO_VERB=’route-host’ PLUTO_VERSION=’2.0’ PLUTO_CONNECTION=’linux-to-linux’ PLUTO_INTERFACE=’eth0’ PLUTO_NEXT_HOP=’192.168.1.102’ PLUTO_ME=’192.168.1.101’ PLUTO_MY_ID=’C=cn, O=zte, CN=wq’ PLUTO_MY_CLIENT=’192.168.1.101/32’ PLUTO_MY_CLIENT_NET=’192.168.1.101’ PLUTO_MY_CLIENT_MASK=’255.255.255.255’ PLUTO_MY_PORT=’0’ PLUTO_MY_PROTOCOL=’0’ PLUTO_PEER=’192.168.1.102’ PLUTO_PEER_ID=’C=cn, O=zte, CN=hd’ PLUTO_PEER_CLIENT=’192.168.1.102/32’ PLUTO_PEER_CLIENT_NET=’192.168.1.102’ PLUTO_PEER_CLIENT_MASK=’255.255.255.255’ PLUTO_PEER_PORT=’0’ PLUTO_PEER_PROTOCOL=’0’ PLUTO_PEER_CA=” PLUTO_STACK=’netkey’ PLUTO_CONN_POLICY=’RSASIG+ENCRYPT+TUNNEL+PFS+IKEv2ALLOW+IKEv2Init+SAREFTRACK’ PLUTO_CONN_ADDRFAMILY=’ipv4’ PLUTO_IS_PEER_CISCO=’0’ PLUTO_CISCO_DNS_INFO=” PLUTO_CISCO_DOMAIN_INFO=” PLUTO_PEER_BANNER=” PLUTO_NM_CONFIGURED=’0’ ipsec _updown
| * processed 0 messages from cryptographic helpers
| next event EVENT_PENDING_DDNS in 60 seconds
| next event EVENT_PENDING_DDNS in 60 seconds
|
| *received whack message
| processing connection linux-to-linux
| empty esp_info, returning defaults
| creating state object #1 at 0xb7e66060
| orient linux-to-linux checking against if: lo (AF_INET6:::1:500)
| orient linux-to-linux checking against if: lo (AF_INET:127.0.0.1:4500)
| orient linux-to-linux checking against if: lo (AF_INET:127.0.0.1:500)
| orient linux-to-linux checking against if: eth0 (AF_INET:192.168.1.101:4500)
| orient linux-to-linux checking against if: eth0 (AF_INET:192.168.1.101:500)
| orient matched on IP
| orient linux-to-linux finished with: 1 [192.168.1.101]
| processing connection linux-to-linux
| ICOOKIE: b3 e7 ea c2 f8 1d cb 23
| RCOOKIE: 00 00 00 00 00 00 00 00
| state hash entry 25
| inserting state object #1 bucket: 25
| inserting event EVENT_SO_DISCARD, timeout in 0 seconds for #1 (head of queue)
| processing connection linux-to-linux
| Queuing pending Quick Mode with 192.168.1.102 “linux-to-linux”
“linux-to-linux” #1: initiating v2 parent SA
“linux-to-linux” #1: STATE_PARENT_I1: initiate
| no IKE algorithms for this connection
| 0: w->pcw_dead: 0 w->pcw_work: 0 cnt: 1
| asking helper 0 to do build_kenonce op on seq: 1 (len=2672, pcw_work=1)
| crypto helper write of request: cnt=2672