Tobias Brunner
7e310e3425
In particular for the first one randomization could trigger an additional rekeying, which let the "Adding ESA ..." check fail. But even without randomization (could be seen in the second scenario that already uses `rand_time=0`) 4 seconds can apparently be too low some time.
26 lines
2.8 KiB
Plaintext
26 lines
2.8 KiB
Plaintext
moon::swanctl --list-sas --raw 2> /dev/null::conn1.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.2 remote-port=4500 remote-id=sun.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_4096.*child-sas.*conn1.*state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.1/32] remote-ts=\[192.168.0.2/32]::YES
|
|
sun:: swanctl --list-sas --raw 2> /dev/null::host-host.*version=2 state=ESTABLISHED local-host=192.168.0.2 local-port=4500 local-id=sun.strongswan.org remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_4096.*child-sas.*host-host.*state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256.*local-ts=\[192.168.0.2/32] remote-ts=\[192.168.0.1/32]::YES
|
|
moon::sleep 5::wait for rekeying::NO
|
|
moon::cat /var/log/daemon.log::ees: acquire received for reqid 1::YES
|
|
moon::cat /var/log/daemon.log::ees: expire received for reqid 1, spi.*, dst 192.168.0.2::YES
|
|
moon::cat /var/log/daemon.log::creating rekey job for CHILD_SA ESP/0x.*/192.168.0.2::YES
|
|
moon::cat /var/log/daemon.log::deleting child SA (esa: 1, spi:.*)::NO
|
|
moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_.eq=1::YES
|
|
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
|
|
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
|
|
moon::sleep 2::wait until inbound SA is deleted::NO
|
|
moon::cat /var/log/daemon.log::deleting child SA (esa: 1, spi:.*)::YES
|
|
moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_.eq=1::YES
|
|
moon::cat /tmp/tkm.log::RSA private key '/etc/tkm/moonKey.der' loaded::YES
|
|
moon::cat /tmp/tkm.log::Adding policy \[ 1, 192.168.0.1 <-> 192.168.0.2 \]::YES
|
|
moon::cat /tmp/tkm.log::Linked CC context 1 with CA certificate 1::YES
|
|
moon::cat /tmp/tkm.log::Certificate chain of CC context 1 is valid::YES
|
|
moon::cat /tmp/tkm.log::Authentication of ISA context 1 successful::YES
|
|
moon::cat /tmp/tkm.log::Creating first new ESA context with ID 1 (Isa 1, Sp 1, Ea 1, Initiator TRUE, spi_loc.*, spi_rem.*)::YES
|
|
moon::cat /tmp/tkm.log::Creating ESA context with ID 2 (Isa 1, Sp 1, Ea 1, Ke_Id 1 #1 / 1, Nc_Loc_Id 1, Initiator TRUE, spi_loc.*, spi_rem.*)::YES
|
|
moon::cat /tmp/tkm.log::Adding ESA \[ 1, 192.168.0.1 <-> 192.168.0.2, SPI_in.*, SPI_out.*, soft 5, hard 60 \]::2
|
|
moon::cat /tmp/tkm.log::Resetting ESA context 1::YES
|
|
moon::cat /tmp/tkm.log::Deleting ESA \[ 1, 192.168.0.1 <=> 192.168.0.2, SPI_in.*, SPI_out.* \]::YES
|
|
moon::cat /tmp/xfrm_proxy.log::Initiating ESA acquire for reqid 1::YES
|
|
moon::cat /tmp/xfrm_proxy.log::Initiating ESA expire (reqid 1, proto 50, SPI.*, hard FALSE)::YES
|