Re: linux-ipsec: Annoying problem with Pluto

| From: Hugh Daniel <hugh@road.toad.com>

Thanks for the bug report.

| The short form of this is that I was trying out the freeswan-0.8

I don't think that you gave me a transcript of *all* the runs. This would have been useful since it is only the combination that fails.

The errno from the kernel doesn't convey much information about what went wrong. I was buffaloed about what the problem could be, but I now have a theory.

It wasn't clear from your posting, but I am guessing that you ran pluto multiple times (twice) on each machine. You did not use the same pluto twice.

Pluto picks SPIs starting at 0x000000100 (in network order) and increments them by one each time (as if the SPI were in host order, but it isn't -- weird, but unimportant).

When you start a fresh copy of Pluto, it starts with 0x00000100 for the next SPI. Unfortunately, the kernel is not fresh, so it still thinks that SPI (and it's successors) are still in use. I think that the kernel is complaining about this.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related lists.freeswan.org Links 1998-fall 1998-spring 1998-summer 1998-winter 1999-winter announce briefs bugs design freeswan-list hipsec ietf-sectest users users-admin Request more information about Pantek

Supporting evidence: egrep -ni SPI from Hugh Daniel's message yields the following, after irrelevancies are removed: 469:IPsec SPI sent: 00 00 01 00
612:IPsec SPI accepted 00 00 01 00
1082:IPsec SPI accepted 00 00 01 00

Hugh Daniel: could you run your tests again without restarting Pluto?

Richard: is there a way in which we (you) can make the errno values more descriptive?

This is another reason that SPIs need to come from the kernel. For now, I am adding the following to Pluto's README:

	SPIs are generated by Pluto, not the kernel, and fresh copies of Pluto
	start generating the same SPI values.  This will confuse and annoy a
	Kernel when a second Pluto is run: the SPIs will be recycled
	illegally.

Hugh Redelmeier
hugh@mimosa.com voice: +1 416 482-8253 Received on Thu May 21 22:09:24 1998