<p dir="ltr">As i known, this error always caused by kernel, your vpn config wasn't supported by your kernel</p>
<div class="gmail_quote">2015年12月28日 21:36，"Sriram Yagnaraman" <<a href="mailto:sriram.yagnaraman@ericsson.com">sriram.yagnaraman@ericsson.com</a>>写道：<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div>
<p class="MsoNormal">Hi,<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I am trying to setup an IPSEC tunnel on a linux machine with kernel (3.0.101-0.15) with extended sequence numbers, but it seems Linux rejects the XFRM_MSG_UPDSA because ESN is on.<u></u><u></u></p>
<p class="MsoNormal">It works fine with ESN off. Has anyone seen this problem?<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Dec 27 17:43:43 14[CFG] <dut-STP_H54|2> received proposals: ESP:AES_CBC_128/HMAC_MD5_96/EXT_SEQ/NO_EXT_SEQ<u></u><u></u></p>
<p class="MsoNormal">Dec 27 17:43:43 14[CFG] <dut-STP_H54|2> configured proposals: ESP:AES_CBC_128/HMAC_MD5_96/EXT_SEQ/NO_EXT_SEQ, ESP:AES_CBC_128/AES_CBC_192/AES_CBC_256/3DES_CBC/BLOWFISH_CBC_256/HMAC_SHA1_96/AES_XCBC_96/HMAC_MD5_96/NO_EXT_SEQ<u></u><u></u></p>
<p class="MsoNormal">Dec 27 17:43:43 14[CFG] <dut-STP_H54|2> selected proposal: ESP:AES_CBC_128/HMAC_MD5_96/EXT_SEQ<u></u><u></u></p>
<p class="MsoNormal">Dec 27 17:43:43 14[KNL] <dut-STP_H54|2> getting SPI for reqid {2}<u></u><u></u></p>
<p class="MsoNormal">Dec 27 17:43:43 14[KNL] <dut-STP_H54|2> got SPI c489df14 for reqid {2}<u></u><u></u></p>
<p class="MsoNormal">Dec 27 17:43:43 14[CFG] <dut-STP_H54|2> selecting traffic selectors for us:<u></u><u></u></p>
<p class="MsoNormal">Dec 27 17:43:43 14[CFG] <dut-STP_H54|2> config: <a href="http://10.91.154.0/28" target="_blank">10.91.154.0/28</a>, received: <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> => match: <a href="http://10.91.154.0/28" target="_blank">10.91.154.0/28</a><u></u><u></u></p>
<p class="MsoNormal">Dec 27 17:43:43 14[CFG] <dut-STP_H54|2> selecting traffic selectors for other:<u></u><u></u></p>
<p class="MsoNormal">Dec 27 17:43:43 14[CFG] <dut-STP_H54|2> config: <a href="http://10.91.54.66/32" target="_blank">10.91.54.66/32</a>, received: <a href="http://10.91.54.66/32" target="_blank">10.91.54.66/32</a> => match: <a href="http://10.91.54.66/32" target="_blank">10.91.54.66/32</a><u></u><u></u></p>
<p class="MsoNormal">Dec 27 17:43:43 14[CHD] <dut-STP_H54|2> using AES_CBC for encryption<u></u><u></u></p>
<p class="MsoNormal">Dec 27 17:43:43 14[CHD] <dut-STP_H54|2> using HMAC_MD5_96 for integrity<u></u><u></u></p>
<p class="MsoNormal">Dec 27 17:43:43 14[CHD] <dut-STP_H54|2> adding inbound ESP SA<u></u><u></u></p>
<p class="MsoNormal">Dec 27 17:43:43 14[CHD] <dut-STP_H54|2> SPI 0xc489df14, src 10.91.54.82 dst 10.91.54.85<u></u><u></u></p>
<p class="MsoNormal">Dec 27 17:43:43 14[KNL] <dut-STP_H54|2> adding SAD entry with SPI c489df14 and reqid {2} (mark 0/0x00000000)<u></u><u></u></p>
<p class="MsoNormal">Dec 27 17:43:43 14[KNL] <dut-STP_H54|2> using encryption algorithm AES_CBC with key size 128<u></u><u></u></p>
<p class="MsoNormal">Dec 27 17:43:43 14[KNL] <dut-STP_H54|2> using integrity algorithm HMAC_MD5_96 with key size 128<u></u><u></u></p>
<p class="MsoNormal">Dec 27 17:43:43 14[KNL] <dut-STP_H54|2> using replay window of 32 packets<u></u><u></u></p>
<p class="MsoNormal"><span style="color:red">Dec 27 17:43:43 14[KNL] <dut-STP_H54|2> using extended sequence numbers (ESN)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:red">Dec 27 17:43:43 14[KNL] <dut-STP_H54|2> received netlink error: No such file or directory (2)<u></u><u></u></span></p>
<p class="MsoNormal">Dec 27 17:43:43 14[KNL] <dut-STP_H54|2> unable to add SAD entry with SPI c489df14<u></u><u></u></p>
<p class="MsoNormal">Dec 27 17:43:43 14[CHD] <dut-STP_H54|2> adding outbound ESP SA<u></u><u></u></p>
<p class="MsoNormal">Dec 27 17:43:43 14[CHD] <dut-STP_H54|2> SPI 0x393bf12c, src 10.91.54.85 dst 10.91.54.82<u></u><u></u></p>
<p class="MsoNormal">Dec 27 17:43:43 14[KNL] <dut-STP_H54|2> adding SAD entry with SPI 393bf12c and reqid {2} (mark 0/0x00000000)<u></u><u></u></p>
<p class="MsoNormal">Dec 27 17:43:43 14[KNL] <dut-STP_H54|2> using encryption algorithm AES_CBC with key size 128<u></u><u></u></p>
<p class="MsoNormal">Dec 27 17:43:43 14[KNL] <dut-STP_H54|2> using integrity algorithm HMAC_MD5_96 with key size 128<u></u><u></u></p>
<p class="MsoNormal">Dec 27 17:43:43 14[KNL] <dut-STP_H54|2> using replay window of 32 packets<u></u><u></u></p>
<p class="MsoNormal"><span style="color:red">Dec 27 17:43:43 14[KNL] <dut-STP_H54|2> using extended sequence numbers (ESN)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:red">Dec 27 17:43:43 14[KNL] <dut-STP_H54|2> received netlink error: No such file or directory (2)<u></u><u></u></span></p>
<p class="MsoNormal">Dec 27 17:43:43 14[KNL] <dut-STP_H54|2> unable to add SAD entry with SPI 393bf12c<u></u><u></u></p>
<p class="MsoNormal">Dec 27 17:43:43 14[IKE] <dut-STP_H54|2> unable to install inbound and outbound IPsec SA (SAD) in kernel<u></u><u></u></p>
<p class="MsoNormal">Dec 27 17:43:43 14[ENC] <dut-STP_H54|2> added payload of type NOTIFY to message<u></u><u></u></p>
<p class="MsoNormal">Dec 27 17:43:43 14[IKE] <dut-STP_H54|2> failed to establish CHILD_SA, keeping IKE_SA<u></u><u></u></p>
<p class="MsoNormal">Dec 27 17:43:43 14[KNL] <dut-STP_H54|2> deleting SAD entry with SPI c489df14 (mark 0/0x00000000)<u></u><u></u></p>
<p class="MsoNormal">Dec 27 17:43:43 14[KNL] <dut-STP_H54|2> deleted SAD entry with SPI c489df14 (mark 0/0x00000000)<u></u><u></u></p>
<p class="MsoNormal">Dec 27 17:43:43 14[KNL] <dut-STP_H54|2> deleting SAD entry with SPI 393bf12c (mark 0/0x00000000)<u></u><u></u></p>
<p class="MsoNormal">Dec 27 17:43:43 14[ENC] <dut-STP_H54|2> added payload of type ID_RESPONDER to message<u></u><u></u></p>
<p class="MsoNormal">Dec 27 17:43:43 14[ENC] <dut-STP_H54|2> added payload of type AUTHENTICATION to message<u></u><u></u></p>
<p class="MsoNormal">Dec 27 17:43:43 14[ENC] <dut-STP_H54|2> added payload of type NOTIFY to message<u></u><u></u></p>
<p class="MsoNormal">Dec 27 17:43:43 14[ENC] <dut-STP_H54|2> generating IKE_AUTH response 1 [ IDr AUTH N(NO_PROP) ]<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Contents of ipsec.conf<u></u><u></u></p>
<p class="MsoNormal">==================<u></u><u></u></p>
<p class="MsoNormal">rth15:/boot # cat /usr/local/etc/ipsec.conf<u></u><u></u></p>
<p class="MsoNormal">conn %default<u></u><u></u></p>
<p class="MsoNormal"> ikelifetime=1440m<u></u><u></u></p>
<p class="MsoNormal"> lifetime=1440m<u></u><u></u></p>
<p class="MsoNormal"> margintime=4320s<u></u><u></u></p>
<p class="MsoNormal"> reauth=no<u></u><u></u></p>
<p class="MsoNormal"> rekey=yes<u></u><u></u></p>
<p class="MsoNormal"> rekeyfuzz=0%<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">conn dut-STP_H54<u></u><u></u></p>
<p class="MsoNormal"> ike=aes128-aesxcbc-aesxcbc-modp1024<u></u><u></u></p>
<p class="MsoNormal"> esp=aes128-md5-esn-noesn<u></u><u></u></p>
<p class="MsoNormal"> authby=secret<u></u><u></u></p>
<p class="MsoNormal"> left=10.91.54.85<u></u><u></u></p>
<p class="MsoNormal"> leftsubnet=<a href="http://10.91.154.0/28" target="_blank">10.91.154.0/28</a><u></u><u></u></p>
<p class="MsoNormal"> leftfirewall=yes<u></u><u></u></p>
<p class="MsoNormal"> right=10.91.54.82<u></u><u></u></p>
<p class="MsoNormal"> rightsubnet=<a href="http://10.91.54.66/32" target="_blank">10.91.54.66/32</a><u></u><u></u></p>
<p class="MsoNormal"> dpdaction=clear<u></u><u></u></p>
<p class="MsoNormal"> dpddelay=0s<u></u><u></u></p>
<p class="MsoNormal"> auto=add<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">rth15:/usr/local/etc # uname -a<u></u><u></u></p>
<p class="MsoNormal">Linux rth15 3.0.101-0.15-xen #1 SMP Wed Jan 22 15:49:03 UTC 2014 (5c01f4e) i686 i686 i386 GNU/Linux<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">BR,<u></u><u></u></p>
<p class="MsoNormal">/Sriram<u></u><u></u></p>
</div>
</div>
<br>_______________________________________________<br>
Dev mailing list<br>
<a href="mailto:Dev@lists.strongswan.org">Dev@lists.strongswan.org</a><br>
<a href="https://lists.strongswan.org/mailman/listinfo/dev" rel="noreferrer" target="_blank">https://lists.strongswan.org/mailman/listinfo/dev</a><br></blockquote></div>