<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="text/html; charset=iso-8859-1" http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 8.00.6001.19019">
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT size=2 face="MS Sans Serif">Greetings,</FONT></DIV>
<DIV> </DIV>
<DIV><FONT size=2 face="MS Sans Serif">I am a newbie in IPSEC. My situation is
that charon would crash from time to time and the tunnels would stay down until
manual intervention (either "ipsec restart" or "ipsec reload"). What I want to
do is to make a change in the code to similate the "ipsec restart/reload"
effect. Appreciate if someone can point me to the source file and what function
to call, passing what parameters etc.</FONT></DIV>
<DIV> </DIV>
<DIV><FONT size=2 face="MS Sans Serif">The settings on my VPN gateway:<BR>-
StrongSwan 4.5.1<BR>- Ubuntu 11.04 server 64-bit<BR>- two IKEv1 tunnels<BR>-
eight IKEv2 tunnels</FONT></DIV>
<DIV> </DIV>
<DIV><FONT size=2 face="MS Sans Serif">This crash has happened 4 times in the
last 2 months. This last time I had loglevel cranked up waiting for it. The
captured log is identical to the one in this thread:</FONT></DIV>
<DIV> </DIV>
<DIV><FONT size=2 face="MS Sans Serif"><A
href="http://www.mail-archive.com/users@lists.strongswan.org/msg02447.html">http://www.mail-archive.com/users@lists.strongswan.org/msg02447.html</A></FONT></DIV>
<DIV> </DIV>
<DIV><FONT size=2 face="MS Sans Serif">Thus the recovery problem can be
reproduced easily with "kill -11".</FONT></DIV>
<DIV> </DIV>
<DIV><FONT size=2 face="MS Sans Serif">Overview of the crash-recovery
sequence:<BR>1. Thread 5 received signal 11 and charon killed itself.<BR>2.
starter started charon again.<BR>3. xx[CFG] received stroke: route 'conn_x'
which failed with "unable to add policy". Then xx[CFG] installing trap
failed<BR>4. Step 3 above repeated for each connection with same
fate.</FONT></DIV>
<DIV> </DIV>
<DIV><FONT size=2 face="MS Sans Serif">Following the above sequence, all my
IKEv2 connections would stay down. Either "ipsec restart" or "ipsec reload"
would revive the v2 connections.</FONT></DIV>
<DIV> </DIV>
<DIV><FONT size=2 face="MS Sans Serif">Right after the "unable to add policy"
there's log about "deleting policy". I am hopeful that if I add code to call add
policy again after the delete then the policies may be added
successfully.</FONT></DIV>
<DIV> </DIV>
<DIV><FONT size=2 face="MS Sans Serif">But then at the beginning of "ipsec
reload" I saw these log entries:<BR>xx[CFG] received stroke: delete connection
'site_XY'.<BR>May be is the delete connection that clean things up?</FONT></DIV>
<DIV> </DIV><FONT size=2 face="MS Sans Serif">
<DIV><BR>The actual log pertaining to the crash
follows.<BR>-----------------------------------------------------------------<BR>Aug
11 04:24:35 central charon: 06[KNL] creating rekey job for ESP CHILD_SA with SPI
cbe46239 and reqid {458}<BR>Aug 11 04:24:49 central charon: 05[DMN] thread 5
received 11<BR>Aug 11 04:24:49 central charon: 05[DMN] killing ourself, received
critical signal<BR>Aug 11 04:24:54 central charon: 00[DMN] Starting IKEv2 charon
daemon (strongSwan 4.5.1)<BR>. . .<BR>- start up stuff such as listen on
interfaces, load certs, secrets, plugins etc <BR>. . .<BR>Aug 11 04:24:54
central charon: 00[JOB] spawning 16 worker threads<BR>Aug 11 04:24:54 central
charon: 06[CFG] received stroke: add connection 'site_07'<BR>Aug 11 04:24:54
central charon: 06[KNL] getting interface name for y7.y7.y7.y7<BR>Aug 11
04:24:54 central charon: 06[KNL] y7.y7.y7.y7 is not a local address<BR>Aug 11
04:24:54 central charon: 06[KNL] getting interface name for x5.x5.x5.x5<BR>Aug
11 04:24:54 central charon: 06[KNL] x5.x5.x5.x5 is on interface eth1<BR>Aug 11
04:24:54 central charon: 06[CFG] added configuration 'site_07'<BR>Aug 11
04:24:54 central charon: 12[CFG] received stroke: route 'site_07'<BR>Aug 11
04:24:54 central charon: 12[KNL] adding policy 192.168.5.0/24 === 192.168.7.0/24
out<BR>Aug 11 04:24:54 central charon: 12[KNL] unable to add policy
192.168.5.0/24 === 192.168.7.0/24 out<BR>Aug 11 04:24:54 central charon: 12[KNL]
adding policy 192.168.7.0/24 === 192.168.5.0/24 in<BR>Aug 11 04:24:54 central
charon: 12[KNL] unable to add policy 192.168.7.0/24 === 192.168.5.0/24 in<BR>Aug
11 04:24:54 central charon: 12[KNL] adding policy 192.168.7.0/24 ===
192.168.5.0/24 fwd<BR>Aug 11 04:24:54 central charon: 12[KNL] unable to add
policy 192.168.7.0/24 === 192.168.5.0/24 fwd<BR>Aug 11 04:24:54 central charon:
12[KNL] deleting policy 192.168.5.0/24 === 192.168.7.0/24 out<BR>Aug 11 04:24:54
central charon: 12[KNL] deleting policy 192.168.7.0/24 === 192.168.5.0/24
in<BR>Aug 11 04:24:54 central charon: 12[KNL] deleting policy 192.168.7.0/24 ===
192.168.5.0/24 fwd<BR>Aug 11 04:24:54 central charon: 12[CFG] installing trap
failed</DIV>
<DIV> </DIV>
<DIV>Aug 11 04:24:54 central charon: 13[CFG] received stroke: add connection
'site_08'<BR>. . .</FONT></DIV></BODY></HTML>