Tobias Brunner
7e310e3425
In particular for the first one randomization could trigger an additional rekeying, which let the "Adding ESA ..." check fail. But even without randomization (could be seen in the second scenario that already uses `rand_time=0`) 4 seconds can apparently be too low some time.
23 lines
2.5 KiB
Plaintext
23 lines
2.5 KiB
Plaintext
moon::swanctl --list-sas --raw 2> /dev/null::conn1.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.2 remote-port=4500 remote-id=sun.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_4096.*child-sas.*conn1.*state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.1/32] remote-ts=\[192.168.0.2/32]::YES
|
|
sun:: swanctl --list-sas --raw 2> /dev/null::host-host.*version=2 state=ESTABLISHED local-host=192.168.0.2 local-port=4500 local-id=sun.strongswan.org remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_4096.*child-sas.*host-host.*state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.2/32] remote-ts=\[192.168.0.1/32]::YES
|
|
moon::sleep 5::wait for rekeying::NO
|
|
sun::cat /var/log/daemon.log::creating rekey job for CHILD_SA ESP/0x.*/192.168.0.2::YES
|
|
moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_.eq=1::YES
|
|
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
|
|
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
|
|
moon::cat /var/log/daemon.log::deleting child SA (esa: 1, spi:.*)::NO
|
|
moon::sleep 2::wait until inbound SA is deleted::NO
|
|
moon::cat /var/log/daemon.log::deleting child SA (esa: 1, spi:.*)::YES
|
|
moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_.eq=1::YES
|
|
moon::cat /tmp/tkm.log::RSA private key '/etc/tkm/moonKey.der' loaded::YES
|
|
moon::cat /tmp/tkm.log::Adding policy \[ 1, 192.168.0.1 <-> 192.168.0.2 \]::YES
|
|
moon::cat /tmp/tkm.log::Linked CC context 1 with CA certificate 1::YES
|
|
moon::cat /tmp/tkm.log::Certificate chain of CC context 1 is valid::YES
|
|
moon::cat /tmp/tkm.log::Authentication of ISA context 1 successful::YES
|
|
moon::cat /tmp/tkm.log::Creating first new ESA context with ID 1 (Isa 1, Sp 1, Ea 1, Initiator TRUE, spi_loc.*, spi_rem.*)::YES
|
|
moon::cat /tmp/tkm.log::Creating ESA context with ID 2 (Isa 1, Sp 1, Ea 1, Ke_Id 1 #1 / 1, Nc_Loc_Id 1, Initiator FALSE, spi_loc.*, spi_rem.*)::YES
|
|
moon::cat /tmp/tkm.log::Adding ESA \[ 1, 192.168.0.1 <-> 192.168.0.2, SPI_in.*, SPI_out.*, soft 30, hard 60 \]::2
|
|
moon::cat /tmp/tkm.log::Resetting ESA context 1::YES
|
|
moon::cat /tmp/tkm.log::Deleting ESA \[ 1, 192.168.0.1 <=> 192.168.0.2, SPI_in.*, SPI_out.* \]::YES
|
|
moon::cat /tmp/xfrm_proxy.log::Initiating ESA acquire for reqid 1::YES
|