<html>
<head>
<base href="https://bugzilla.rosalinux.ru/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_CONFIRMED "
title="CONFIRMED - Не работает IPSec"
href="https://bugzilla.rosalinux.ru/show_bug.cgi?id=14015">14015</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>Не работает IPSec
</td>
</tr>
<tr>
<th>Classification</th>
<td>ROSA-based products
</td>
</tr>
<tr>
<th>Product</th>
<td>ROSA Fresh
</td>
</tr>
<tr>
<th>Version</th>
<td>All
</td>
</tr>
<tr>
<th>Hardware</th>
<td>x86_64
</td>
</tr>
<tr>
<th>OS</th>
<td>Linux
</td>
</tr>
<tr>
<th>Status</th>
<td>CONFIRMED
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>Normal
</td>
</tr>
<tr>
<th>Component</th>
<td>Net (ssh, samba, ssl, NM...)
</td>
</tr>
<tr>
<th>Assignee</th>
<td>m.novosyolov@rosalinux.ru
</td>
</tr>
<tr>
<th>Reporter</th>
<td>yaroslav.belykh@sibgipro.ru
</td>
</tr>
<tr>
<th>QA Contact</th>
<td>bugs@lists.rosalinux.ru
</td>
</tr>
<tr>
<th>Target Milestone</th>
<td>---
</td>
</tr></table>
<p>
<div>
<pre>Сбой произошел между февралем, когда последний раз использовал неработающее
подключение и сегодняшним днем. Подключения просто отваливаются как на
libreswan, так и на strongSwan
Создать в NetworkManager новое подключение L2TP IPSec (с указанными в логе
параметрами), подключиться.
IPSec через LibreSwan
/usr/libexec/nm-l2tp-service --debug
nm-l2tp[20936] <debug> nm-l2tp-service (version 1.8.2) starting...
nm-l2tp[20936] <debug> uses default --bus-name
"org.freedesktop.NetworkManager.l2tp"
nm-l2tp[20936] <info> ipsec enable flag: yes
** Message: 13:19:21.407: Check port 1701
connection
id : 'My Need VPN'
permissions : ['user:myuser:']
type : 'vpn'
uuid : 'SAME_UUID'
vpn
data : {'gateway': 'vpn-host.remote_domain.ru', 'ipsec-enabled': 'yes',
'ipsec-esp': 'aes128-sha1!', 'ipsec-ike': 'aes128-sha1-modp1024!', 'ipsec-psk':
'VPN_PSK', 'no-vj-comp': 'yes', 'noaccomp': 'yes', 'nobsdcomp': 'yes',
'nodeflate': 'yes', 'nopcomp': 'yes', 'password-flags': '1', 'refuse-chap':
'yes', 'refuse-eap': 'yes', 'refuse-mschap': 'yes', 'refuse-mschapv2': 'yes',
'user': '<a href="mailto:remote_user@remote_domain.loc">remote_user@remote_domain.loc</a>'}
secrets : {'password': 'password'}
service-type : 'org.freedesktop.NetworkManager.l2tp'
user-name : 'myuser'
ipv4
address-data : []
dns : []
dns-search : []
method : 'auto'
route-data : []
ipv6
address-data : []
dns : []
dns-search : []
method : 'auto'
route-data : []
proxy
nm-l2tp[21799] <info> starting ipsec
whack: Pluto is not running (no "/run/pluto/pluto.ctl")
Redirecting to: systemctl restart ipsec.service
002 listening for IKE messages
002 forgetting secrets
002 loading secrets from "/etc/ipsec.secrets"
002 loading secrets from "/etc/ipsec.d/ipsec.nm-l2tp.secrets"
opening file: /var/run/nm-l2tp-SAME_UUID/ipsec.conf
debugging mode enabled
end of file /var/run/nm-l2tp-SAME_UUID/ipsec.conf
Loading conn SAME_UUID
starter: left is KH_DEFAULTROUTE
loading named conns: SAME_UUID
resolving src = <defaultroute> gateway = <defaultroute> peer REMOTE_IP
seeking gateway
query getroute +REQUEST +ROOT +MATCH
add dst REMOTE_IP (peer->addr)
src <unset-address> prefsrc <unset-address> gateway MY_GATEWAY dst
<unset-address> dev enp3s0 priority 100 pref -1 table 254
found gateway (host_nexthop): MY_GATEWAY
please-call-again: src = <defaultroute> gateway = MY_GATEWAY
resolving src = <defaultroute> gateway = MY_GATEWAY peer REMOTE_IP
seeking prefsrc
query getroute +REQUEST
add dst MY_GATEWAY (host->nexthop)
ignoring 25
src <unset-address> prefsrc MY_IP gateway <unset-address> dst MY_GATEWAY dev
enp3s0 priority -1 pref -1 table 254 +cacheinfo
found prefsrc (host_addr): MY_IP
success: src = MY_IP gateway = MY_GATEWAY
resolving src = REMOTE_IP gateway = <not-set> peer MY_IP
seeking nothing
conn: "SAME_UUID" modecfgdns=<unset>
conn: "SAME_UUID" modecfgdomains=<unset>
conn: "SAME_UUID" modecfgbanner=<unset>
conn: "SAME_UUID" mark=<unset>
conn: "SAME_UUID" mark-in=<unset>
conn: "SAME_UUID" mark-out=<unset>
conn: "SAME_UUID" vti_iface=<unset>
conn: "SAME_UUID" redirect-to=<unset>
conn: "SAME_UUID" accept-redirect-to=<unset>
conn: "SAME_UUID" esp=aes128-sha1!
conn: "SAME_UUID" ike=aes128-sha1-modp1024!
036 "SAME_UUID": failed to add connection: IKE DH algorithm 'modp1024!' is not
recognized
nm-l2tp[21799] <warn> Could not establish IPsec tunnel.
(nm-l2tp-service:21799): GLib-GIO-CRITICAL **: 13:34:39.234:
g_dbus_method_invocation_take_error: assertion 'error != NULL' failed
IPSec через StrongSwan
/usr/libexec/nm-l2tp-service --debug
nm-l2tp[20936] <debug> nm-l2tp-service (version 1.8.2) starting...
nm-l2tp[20936] <debug> uses default --bus-name
"org.freedesktop.NetworkManager.l2tp"
nm-l2tp[20936] <info> ipsec enable flag: yes
** Message: 13:19:21.407: Check port 1701
connection
id : 'My Need VPN'
permissions : ['user:myuser:']
type : 'vpn'
uuid : 'SAME_UUID'
vpn
data : {'gateway': 'vpn-host.remote_domain.ru', 'ipsec-enabled': 'yes',
'ipsec-esp': 'aes128-sha1!', 'ipsec-ike': 'aes128-sha1-modp1024!', 'ipsec-psk':
'VPN_PSK', 'no-vj-comp': 'yes', 'noaccomp': 'yes', 'nobsdcomp': 'yes',
'nodeflate': 'yes', 'nopcomp': 'yes', 'password-flags': '1', 'refuse-chap':
'yes', 'refuse-eap': 'yes', 'refuse-mschap': 'yes', 'refuse-mschapv2': 'yes',
'user': '<a href="mailto:remote_user@remote_domain.loc">remote_user@remote_domain.loc</a>'}
secrets : {'password': 'password'}
service-type : 'org.freedesktop.NetworkManager.l2tp'
user-name : 'myuser'
ipv4
address-data : []
dns : []
dns-search : []
method : 'auto'
route-data : []
ipv6
address-data : []
dns : []
dns-search : []
method : 'auto'
route-data : []
proxy
nm-l2tp[20936] <info> starting ipsec
Stopping strongSwan IPsec failed: starter is not running
Starting strongSwan 5.9.10 IPsec [starter]...
Loading config setup
Loading conn 'SAME_UUID'
nm-l2tp[20936] <info> Spawned ipsec up script with PID 20986.
initiating Main Mode IKE_SA SAME_UUID[1] to <REMOTE_ADDRESS>
generating ID_PROT request 0 [ SA V V V V V ]
sending packet: from <MY_LOCAL_IP>[500] to <REMOTE_ADDRESS>[500] (180 bytes)
received packet: from <REMOTE_ADDRESS>[500] to <MY_LOCAL_IP>[500] (276 bytes)
parsed ID_PROT response 0 [ SA V V V V V V V V V V ]
received NAT-T (RFC 3947) vendor ID
received draft-ietf-ipsec-nat-t-ike-03 vendor ID
received draft-ietf-ipsec-nat-t-ike-02\n vendor ID
received draft-ietf-ipsec-nat-t-ike-02 vendor ID
received draft-ietf-ipsec-nat-t-ike-00 vendor ID
received FRAGMENTATION vendor ID
received DPD vendor ID
received XAuth vendor ID
received unknown vendor ID: 03:10:17:e0:7f:7a:82:e3:aa:69:50:c9:99:99:01:01
received unknown vendor ID: 1d:c0:10:31:3c:49:35:59:e2:d0:87:a7:5b:9b:de:ca
selected proposal: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
generating ID_PROT request 0 [ KE No NAT-D NAT-D ]
sending packet: from <MY_LOCAL_IP>[500] to <REMOTE_ADDRESS>[500] (244 bytes)
received packet: from <REMOTE_ADDRESS>[500] to <MY_LOCAL_IP>[500] (244 bytes)
parsed ID_PROT response 0 [ KE No NAT-D NAT-D ]
local host is behind NAT, sending keep alives
generating ID_PROT request 0 [ ID HASH ]
sending packet: from <MY_LOCAL_IP>[4500] to <REMOTE_ADDRESS>[4500] (76 bytes)
received packet: from <REMOTE_ADDRESS>[4500] to <MY_LOCAL_IP>[4500] (76 bytes)
parsed ID_PROT response 0 [ ID HASH ]
IKE_SA SAME_UUID[1] established between
<MY_LOCAL_IP>[<MY_LOCAL_IP>]...<REMOTE_ADDRESS>[<REMOTE_ADDRESS>]
scheduling reauthentication in 9763s
maximum IKE_SA lifetime 10303s
generating QUICK_MODE request 993333236 [ HASH SA No ID ID NAT-OA NAT-OA ]
sending packet: from <MY_LOCAL_IP>[4500] to <REMOTE_ADDRESS>[4500] (204 bytes)
received packet: from <REMOTE_ADDRESS>[4500] to <MY_LOCAL_IP>[4500] (204 bytes)
parsed QUICK_MODE response 993333236 [ HASH SA No ID ID NAT-OA NAT-OA ]
selected proposal: ESP:AES_CBC_128/HMAC_SHA1_96/NO_EXT_SEQ
IPsec SA: unsupported mode
failed to create SAD entry
IPsec SA: unsupported mode
failed to create SAD entry
unable to install inbound and outbound IPsec SA (SAD) in kernel
establishing connection 'SAME_UUID' failed
nm-l2tp[20936] <info> strongSwan IPsec tunnel is up.
** Message: 13:19:24.771: xl2tpd started with pid 20995
xl2tpd[20995]: Not looking for kernel SAref support.
xl2tpd[20995]: This binary does not support kernel L2TP.
xl2tpd[20995]: xl2tpd version xl2tpd-1.3.16 started on host.myuser.zone
PID:20995
xl2tpd[20995]: Written by Mark Spencer, Copyright (C) 1998, Adtran, Inc.
xl2tpd[20995]: Forked by Scott Balmos and David Stipp, (C) 2001
xl2tpd[20995]: Inherited by Jeff McAdams, (C) 2002
xl2tpd[20995]: Forked again by Xelerance (www.xelerance.com) (C) 2006-2016
xl2tpd[20995]: Listening on IP address 0.0.0.0, port 1701
xl2tpd[20995]: get_call: allocating new tunnel for host <REMOTE_ADDRESS>, port
1701.
xl2tpd[20995]: Connecting to host <REMOTE_ADDRESS>, port 1701
xl2tpd[20995]: control_finish: message type is (null)(0). Tunnel is 0, call is
0.
xl2tpd[20995]: control_finish: sending SCCRQ
nm-l2tp[20936] <warn> Looks like pppd didn't initialize our dbus module
nm-l2tp[20936] <info> Terminated xl2tpd daemon with PID 20995.
xl2tpd[20995]: death_handler: Fatal signal 15 received
Stopping strongSwan IPsec...
** Message: 13:19:38.902: ipsec shut down
nm-l2tp[20936] <warn> xl2tpd exited with error code 1
Stopping strongSwan IPsec failed: starter is not running
** Message: 13:19:38.918: ipsec shut down
Текущие пакеты
rpm -qa | grep l2tp
openl2tp-1.8-14.x86_64
xl2tpd-1.3.16-3.x86_64
networkmanager-l2tp-1.8.2-3.x86_64
rpm -qa | grep swan
networkmanager-strongswan-1.6.0-1.x86_64
networkmanager-openswan-1.2.12-3.x86_64
lib64strongswan0-5.9.10-1.x86_64
strongswan-charon-nm-5.9.10-1.x86_64
strongswan-5.9.10-1.x86_64
libreswan-4.6-2.x86_64
Как исправить?</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the QA Contact for the bug.</li>
</ul>
</body>
</html>