<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Tunga;
panose-1:2 11 5 2 4 2 4 2 2 3;}
@font-face
{font-family:Tunga;
panose-1:2 11 5 2 4 2 4 2 2 3;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Hi,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I am trying to setup an IPSEC tunnel on a linux machine with kernel (3.0.101-0.15) with extended sequence numbers, but it seems Linux rejects the XFRM_MSG_UPDSA because ESN is on.<o:p></o:p></p>
<p class="MsoNormal">It works fine with ESN off. Has anyone seen this problem?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Dec 27 17:43:43 14[CFG] <dut-STP_H54|2> received proposals: ESP:AES_CBC_128/HMAC_MD5_96/EXT_SEQ/NO_EXT_SEQ<o:p></o:p></p>
<p class="MsoNormal">Dec 27 17:43:43 14[CFG] <dut-STP_H54|2> configured proposals: ESP:AES_CBC_128/HMAC_MD5_96/EXT_SEQ/NO_EXT_SEQ, ESP:AES_CBC_128/AES_CBC_192/AES_CBC_256/3DES_CBC/BLOWFISH_CBC_256/HMAC_SHA1_96/AES_XCBC_96/HMAC_MD5_96/NO_EXT_SEQ<o:p></o:p></p>
<p class="MsoNormal">Dec 27 17:43:43 14[CFG] <dut-STP_H54|2> selected proposal: ESP:AES_CBC_128/HMAC_MD5_96/EXT_SEQ<o:p></o:p></p>
<p class="MsoNormal">Dec 27 17:43:43 14[KNL] <dut-STP_H54|2> getting SPI for reqid {2}<o:p></o:p></p>
<p class="MsoNormal">Dec 27 17:43:43 14[KNL] <dut-STP_H54|2> got SPI c489df14 for reqid {2}<o:p></o:p></p>
<p class="MsoNormal">Dec 27 17:43:43 14[CFG] <dut-STP_H54|2> selecting traffic selectors for us:<o:p></o:p></p>
<p class="MsoNormal">Dec 27 17:43:43 14[CFG] <dut-STP_H54|2> config: 10.91.154.0/28, received: 0.0.0.0/0 => match: 10.91.154.0/28<o:p></o:p></p>
<p class="MsoNormal">Dec 27 17:43:43 14[CFG] <dut-STP_H54|2> selecting traffic selectors for other:<o:p></o:p></p>
<p class="MsoNormal">Dec 27 17:43:43 14[CFG] <dut-STP_H54|2> config: 10.91.54.66/32, received: 10.91.54.66/32 => match: 10.91.54.66/32<o:p></o:p></p>
<p class="MsoNormal">Dec 27 17:43:43 14[CHD] <dut-STP_H54|2> using AES_CBC for encryption<o:p></o:p></p>
<p class="MsoNormal">Dec 27 17:43:43 14[CHD] <dut-STP_H54|2> using HMAC_MD5_96 for integrity<o:p></o:p></p>
<p class="MsoNormal">Dec 27 17:43:43 14[CHD] <dut-STP_H54|2> adding inbound ESP SA<o:p></o:p></p>
<p class="MsoNormal">Dec 27 17:43:43 14[CHD] <dut-STP_H54|2> SPI 0xc489df14, src 10.91.54.82 dst 10.91.54.85<o:p></o:p></p>
<p class="MsoNormal">Dec 27 17:43:43 14[KNL] <dut-STP_H54|2> adding SAD entry with SPI c489df14 and reqid {2} (mark 0/0x00000000)<o:p></o:p></p>
<p class="MsoNormal">Dec 27 17:43:43 14[KNL] <dut-STP_H54|2> using encryption algorithm AES_CBC with key size 128<o:p></o:p></p>
<p class="MsoNormal">Dec 27 17:43:43 14[KNL] <dut-STP_H54|2> using integrity algorithm HMAC_MD5_96 with key size 128<o:p></o:p></p>
<p class="MsoNormal">Dec 27 17:43:43 14[KNL] <dut-STP_H54|2> using replay window of 32 packets<o:p></o:p></p>
<p class="MsoNormal"><span style="color:red">Dec 27 17:43:43 14[KNL] <dut-STP_H54|2> using extended sequence numbers (ESN)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:red">Dec 27 17:43:43 14[KNL] <dut-STP_H54|2> received netlink error: No such file or directory (2)<o:p></o:p></span></p>
<p class="MsoNormal">Dec 27 17:43:43 14[KNL] <dut-STP_H54|2> unable to add SAD entry with SPI c489df14<o:p></o:p></p>
<p class="MsoNormal">Dec 27 17:43:43 14[CHD] <dut-STP_H54|2> adding outbound ESP SA<o:p></o:p></p>
<p class="MsoNormal">Dec 27 17:43:43 14[CHD] <dut-STP_H54|2> SPI 0x393bf12c, src 10.91.54.85 dst 10.91.54.82<o:p></o:p></p>
<p class="MsoNormal">Dec 27 17:43:43 14[KNL] <dut-STP_H54|2> adding SAD entry with SPI 393bf12c and reqid {2} (mark 0/0x00000000)<o:p></o:p></p>
<p class="MsoNormal">Dec 27 17:43:43 14[KNL] <dut-STP_H54|2> using encryption algorithm AES_CBC with key size 128<o:p></o:p></p>
<p class="MsoNormal">Dec 27 17:43:43 14[KNL] <dut-STP_H54|2> using integrity algorithm HMAC_MD5_96 with key size 128<o:p></o:p></p>
<p class="MsoNormal">Dec 27 17:43:43 14[KNL] <dut-STP_H54|2> using replay window of 32 packets<o:p></o:p></p>
<p class="MsoNormal"><span style="color:red">Dec 27 17:43:43 14[KNL] <dut-STP_H54|2> using extended sequence numbers (ESN)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:red">Dec 27 17:43:43 14[KNL] <dut-STP_H54|2> received netlink error: No such file or directory (2)<o:p></o:p></span></p>
<p class="MsoNormal">Dec 27 17:43:43 14[KNL] <dut-STP_H54|2> unable to add SAD entry with SPI 393bf12c<o:p></o:p></p>
<p class="MsoNormal">Dec 27 17:43:43 14[IKE] <dut-STP_H54|2> unable to install inbound and outbound IPsec SA (SAD) in kernel<o:p></o:p></p>
<p class="MsoNormal">Dec 27 17:43:43 14[ENC] <dut-STP_H54|2> added payload of type NOTIFY to message<o:p></o:p></p>
<p class="MsoNormal">Dec 27 17:43:43 14[IKE] <dut-STP_H54|2> failed to establish CHILD_SA, keeping IKE_SA<o:p></o:p></p>
<p class="MsoNormal">Dec 27 17:43:43 14[KNL] <dut-STP_H54|2> deleting SAD entry with SPI c489df14 (mark 0/0x00000000)<o:p></o:p></p>
<p class="MsoNormal">Dec 27 17:43:43 14[KNL] <dut-STP_H54|2> deleted SAD entry with SPI c489df14 (mark 0/0x00000000)<o:p></o:p></p>
<p class="MsoNormal">Dec 27 17:43:43 14[KNL] <dut-STP_H54|2> deleting SAD entry with SPI 393bf12c (mark 0/0x00000000)<o:p></o:p></p>
<p class="MsoNormal">Dec 27 17:43:43 14[ENC] <dut-STP_H54|2> added payload of type ID_RESPONDER to message<o:p></o:p></p>
<p class="MsoNormal">Dec 27 17:43:43 14[ENC] <dut-STP_H54|2> added payload of type AUTHENTICATION to message<o:p></o:p></p>
<p class="MsoNormal">Dec 27 17:43:43 14[ENC] <dut-STP_H54|2> added payload of type NOTIFY to message<o:p></o:p></p>
<p class="MsoNormal">Dec 27 17:43:43 14[ENC] <dut-STP_H54|2> generating IKE_AUTH response 1 [ IDr AUTH N(NO_PROP) ]<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Contents of ipsec.conf<o:p></o:p></p>
<p class="MsoNormal">==================<o:p></o:p></p>
<p class="MsoNormal">rth15:/boot # cat /usr/local/etc/ipsec.conf<o:p></o:p></p>
<p class="MsoNormal">conn %default<o:p></o:p></p>
<p class="MsoNormal"> ikelifetime=1440m<o:p></o:p></p>
<p class="MsoNormal"> lifetime=1440m<o:p></o:p></p>
<p class="MsoNormal"> margintime=4320s<o:p></o:p></p>
<p class="MsoNormal"> reauth=no<o:p></o:p></p>
<p class="MsoNormal"> rekey=yes<o:p></o:p></p>
<p class="MsoNormal"> rekeyfuzz=0%<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">conn dut-STP_H54<o:p></o:p></p>
<p class="MsoNormal"> ike=aes128-aesxcbc-aesxcbc-modp1024<o:p></o:p></p>
<p class="MsoNormal"> esp=aes128-md5-esn-noesn<o:p></o:p></p>
<p class="MsoNormal"> authby=secret<o:p></o:p></p>
<p class="MsoNormal"> left=10.91.54.85<o:p></o:p></p>
<p class="MsoNormal"> leftsubnet=10.91.154.0/28<o:p></o:p></p>
<p class="MsoNormal"> leftfirewall=yes<o:p></o:p></p>
<p class="MsoNormal"> right=10.91.54.82<o:p></o:p></p>
<p class="MsoNormal"> rightsubnet=10.91.54.66/32<o:p></o:p></p>
<p class="MsoNormal"> dpdaction=clear<o:p></o:p></p>
<p class="MsoNormal"> dpddelay=0s<o:p></o:p></p>
<p class="MsoNormal"> auto=add<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">rth15:/usr/local/etc # uname -a<o:p></o:p></p>
<p class="MsoNormal">Linux rth15 3.0.101-0.15-xen #1 SMP Wed Jan 22 15:49:03 UTC 2014 (5c01f4e) i686 i686 i386 GNU/Linux<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">BR,<o:p></o:p></p>
<p class="MsoNormal">/Sriram<o:p></o:p></p>
</div>
</body>
</html>