<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="text/html; charset=utf-8" http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 9.00.8112.16434">
<STYLE>@font-face {
font-family: 宋体;
}
@font-face {
font-family: Verdana;
}
@font-face {
font-family: @宋体;
}
@page Section1 {size: 595.3pt 841.9pt; margin: 72.0pt 90.0pt 72.0pt 90.0pt; layout-grid: 15.6pt; }
P.MsoNormal {
TEXT-JUSTIFY: inter-ideograph; TEXT-ALIGN: justify; MARGIN: 0cm 0cm 0pt; FONT-FAMILY: "Times New Roman"; FONT-SIZE: 10.5pt
}
LI.MsoNormal {
TEXT-JUSTIFY: inter-ideograph; TEXT-ALIGN: justify; MARGIN: 0cm 0cm 0pt; FONT-FAMILY: "Times New Roman"; FONT-SIZE: 10.5pt
}
DIV.MsoNormal {
TEXT-JUSTIFY: inter-ideograph; TEXT-ALIGN: justify; MARGIN: 0cm 0cm 0pt; FONT-FAMILY: "Times New Roman"; FONT-SIZE: 10.5pt
}
A:link {
COLOR: blue; TEXT-DECORATION: underline
}
SPAN.MsoHyperlink {
COLOR: blue; TEXT-DECORATION: underline
}
A:visited {
COLOR: purple; TEXT-DECORATION: underline
}
SPAN.MsoHyperlinkFollowed {
COLOR: purple; TEXT-DECORATION: underline
}
SPAN.EmailStyle17 {
FONT-STYLE: normal; FONT-FAMILY: Verdana; COLOR: windowtext; FONT-WEIGHT: normal; TEXT-DECORATION: none; mso-style-type: personal-compose
}
DIV.Section1 {
page: Section1
}
UNKNOWN {
FONT-SIZE: 10pt
}
BLOCKQUOTE {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px; MARGIN-LEFT: 2em
}
OL {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
UL {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
</STYLE>
</HEAD>
<BODY style="MARGIN: 10px; FONT-FAMILY: verdana; FONT-SIZE: 10pt">
<DIV><FONT size=2 face=Verdana>Hi Martin,</FONT></DIV>
<DIV> </DIV>
<DIV>Thanks for your timely reply,</DIV>
<DIV> </DIV>
<DIV><FONT color=#000080><FONT color=#000000>>A more complete log from the
board would really help.</FONT> </FONT></DIV>
<DIV><FONT color=#000080 size=2 face=Verdana></FONT> </DIV>
<DIV>I attached the board side log as below, it's not so detailed...</DIV>
<DIV>I hope it can do a little help.</DIV>
<DIV> </DIV>
<DIV>--------#bash output#</DIV>
<DIV>
<DIV>Starting strongSwan 4.5.3 IPsec [starter]...</DIV>
<DIV>!! Your strongswan.conf contains manual plugin load options for</DIV>
<DIV>!! pluto and/or charon. This is recommended for experts only, see</DIV>
<DIV>!! http://wiki.strongswan.org/projects/strongswan/wiki/PluginLoad</DIV>
<DIV>root@picopc7802:/usr/local/etc/ipsec.d/cacerts# ipsec up home</DIV>
<DIV>initiating IKE_SA home[1] to 10.21.1.150</DIV>
<DIV>generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP)
]</DIV>
<DIV>sending packet: from 10.21.1.210[500] to 10.21.1.150[500]</DIV>
<DIV>received packet: from 10.21.1.150[500] to 10.21.1.210[500]</DIV>
<DIV>parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP)
N(MULT_AUTH) ]</DIV>
<DIV>sending cert request for "C=CN, O=ict, CN=strongSwan CA"</DIV>
<DIV>establishing CHILD_SA home</DIV>
<DIV>generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) CERTREQ IDr SA TSi TSr
N(MOBIKE_SUP) N(NO_ADD_ADDR) N(MULT_AUTH) N(EAP_ONLY) ]</DIV>
<DIV>sending packet: from 10.21.1.210[4500] to 10.21.1.150[4500]</DIV>
<DIV>received packet: from 10.21.1.150[4500] to 10.21.1.210[4500]</DIV>
<DIV>parsed IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/AKA ]</DIV>
<DIV>received end entity cert "C=CN, O=ict-gw, CN=peer"</DIV>
<DIV>using certificate "C=CN, O=ict-gw, CN=peer"</DIV>
<DIV>using trusted ca certificate "C=CN, O=ict, CN=strongSwan CA"</DIV>
<DIV>checking certificate status of "C=CN, O=ict-gw, CN=peer"</DIV>
<DIV>certificate status is not available</DIV>
<DIV>reached self-signed root ca with a path length of 0</DIV>
<DIV>authentication of 'C=CN, O=ict-gw, CN=peer' with RSA signature
successful</DIV>
<DIV>server requested EAP_AKA authentication (id 0xBC)</DIV>
<DIV>generating IKE_AUTH request 2 [ EAP/RES/AKA ]</DIV>
<DIV>sending packet: from 10.21.1.210[4500] to 10.21.1.150[4500]</DIV>
<DIV>received packet: from 10.21.1.150[4500] to 10.21.1.210[4500]</DIV>
<DIV>parsed IKE_AUTH response 2 [ EAP/REQ/AKA ]</DIV>
<DIV>EAP_AKA MAC verification failed</DIV>
<DIV>sending client error 'unable to process packet'</DIV>
<DIV>generating IKE_AUTH request 3 [ EAP/RES/AKA ]</DIV>
<DIV>sending packet: from 10.21.1.210[4500] to 10.21.1.150[4500]</DIV>
<DIV>received packet: from 10.21.1.150[4500] to 10.21.1.210[4500]</DIV>
<DIV>parsed IKE_AUTH response 3 [ EAP/FAIL ]</DIV>
<DIV>received EAP_FAILURE, EAP authentication failed</DIV></DIV>
<DIV><FONT color=#000080></FONT> </DIV>
<DIV><FONT color=#000080>----------#log on board#</FONT></DIV>
<DIV><FONT color=#000080>
<DIV><FONT size=2 face=Verdana>
<DIV>Sep 6 19:47:00 picopc7802 authpriv.warn ipsec_starter[426]: chaRnot flush
IPsec state/policy database</DIV>
<DIV>Sep 6 19:47:00 picopc7802 authpriv.warn ipsec_ authpriv.warn
ipsec_starter[451]: !!
http://wiki.rongswan.org/projects/strongswan/wiki/PluginLoad</DIV>
<DIV>Sep 6 19:47:03 picopc7802 daemon.info charon: 00[DMN] Starting IKEv2 charon
daemon (strongSwan 4.5.3)</DIV>
<DIV>Sep 6 19:47:03 picopc7802 daemon.info charon: 00[LIB] plugin 'curl' failed
to load: /usr/local/lib/ipsec/plugin
'/usr/l/etc/ipsec.d/cacerts/caCert.pem'</DIV>
<DIV>Sep 6 19:47:04 picopc7802 daemon.info charon: 00[CFG] loading aa
certificates from '/usr/local/etc/ipsec.d/aacerts'</DIV>
<DIV>Sep 6 19:47:04 picopc7802 daemon.info charon: 00[CFG] loading ocsp signer
certificates from '/usr/local/etc/ipsec.dpts'</DIV>
<DIV>Sep 6 19:47:04 picopc7802 daemon.info charon: 00[CFG] loaded EAP secret for
%any</DIV>
<DIV>Sep 6 19:47:04 picopc7802 daemon s: 19:47:04 picopc7802 daemon.info charon:
00[KNL] eth0</DIV>
<DIV>Sep 19:47:04 picopc7802 daemon.info charon: 00[NET] could not open IPv6
socket, IPv6 disabled</DIV>
<DIV>Sep 6 19:47:04 picopc7802 daemon.info charon: 00[DMN] loaded plugins: aes
des sha1 sha2 md5 pem pkcs1 gmp random x509 revocation hmac xcbc stroke
kernel-netlink socket-default fips-prf eap-aka eap-aka:06 picopc7802 daemon.info
charon: 1 receistroke: initiate 'home'</DIV>
<DIV>Sep 6 19:47:06 picopc7802 daemon.info charon: 13[IKE] initiating IKE_SA
home[1] to 10.21.1.150</DIV>
<DIV>Sep 6 19:47:06 picopc7802 authpriv.info charon: 130.21.500] to
10.21.1.210[500]</DIV>
<DIV>Sep 6 19:47:07 picopc7802 daemon.info charon: 15[ENC] parsed IKE_SA_INIT
response 0 [ SA p07 pico802 .info charon: 15[IKE] sending cert request for
"C=CN07 picopc7802 daemon.info charon: 15[NET] sending packet: from
10.21.1.210[4500] to 10.21.1.150[4500]</DIV>
<DIV>Sep 6 19:47:07 picopc7802 daemon.info charon: 07[NET] received packet: from
10.21.1.150[4500] to 10.21.1.210[4500]</DIV>
<DIV>Sep 6 19:47:07 picopc7802 daemon.info charon: 07[ENC] parsed IKE_AUTH
response 1 [ IDr CERT AUTH EAP/REQ/AKA ]</DIV>
<DIV>Sep 6 19:47:07 picop 19:picopc7802 daemon.info charon: 07[CFG]
checkingifaCgw, CN=r"</DIV>
<DIV>Sep 6 19:47:07 picopc7802 daemon.info charon: 07[CFG] certificate status is
not available</DIV>
<DIV>Sep 6 19:47:07 picopc7802 daemon.info charon: 07[CFG] reached self-signed
root ca with a path length of 0</DIV>
<DIV>Seaemon.charon: 07[NET] sending packet: from 10.21.1.2t.21.1.1500] to
10.21.1.210[4500]</DIV>
<DIV>7ceived pet: from 10.21.1.150[4500] to 10.21.1.210[4500]</DIV>
<DIV>Sep 0802 daemoninfo charon: 12[ENC] parsed IKE_AUTH response 3 [ EAP/FAIL
]</DIV>
<DIV>Sep 6 19:47:07 picopc7802 daemon.info charon: 12[IKE] received EAP_FAILURE,
EAP authentication failed</DIV></FONT></DIV>
<DIV><FONT size=2 face=Verdana></FONT></DIV></FONT></DIV>
<DIV><FONT color=#000080></FONT> </DIV>
<DIV><FONT color=#000080 size=2 face=Verdana></FONT> </DIV>
<DIV><FONT color=#c0c0c0 size=2 face=Verdana>2011-09-06 </FONT></DIV><FONT
color=#000080 size=2 face=Verdana>
<HR style="WIDTH: 100px" align=left color=#b5c4df SIZE=1>
</FONT>
<DIV><FONT color=#c0c0c0 size=2 face=Verdana><SPAN>qiqi143</SPAN> </FONT></DIV>
<HR color=#b5c4df SIZE=1>
<DIV><FONT size=2 face=Verdana><STRONG>发件人：</STRONG> Martin Willi </FONT></DIV>
<DIV><FONT size=2 face=Verdana><STRONG>发送时间：</STRONG> 2011-09-06 17:19:33
</FONT></DIV>
<DIV><FONT size=2 face=Verdana><STRONG>收件人：</STRONG> qiqi143 </FONT></DIV>
<DIV><FONT size=2 face=Verdana><STRONG>抄送：</STRONG> users </FONT></DIV>
<DIV><FONT size=2 face=Verdana><STRONG>主题：</STRONG> Re: [strongSwan] received
EAP-AKA client error 'unable to processpacket' </FONT></DIV>
<DIV><FONT size=2 face=Verdana></FONT> </DIV>
<DIV><FONT size=2 face=Verdana>
<DIV>Hi,</DIV>
<DIV></DIV>
<DIV>> daemon log shows "client error 'unable to process packet'", board side</DIV>
<DIV>> cann't log, it outputs something like 'MAC' error...</DIV>
<DIV></DIV>
<DIV>The error condition occurs on your board, probably because the MAC</DIV>
<DIV>calculated for authentication does not match. A more complete log from</DIV>
<DIV>the board would really help. Either your secrets don't match or maybe</DIV>
<DIV>there is a bug in the AKA algorithm on your platform.</DIV>
<DIV></DIV>
<DIV>> I used cross-compilation to install strongswan onto the arm board, and</DIV>
<DIV>> didn't enable padlock option, could that be the reason?</DIV>
<DIV>> however, it's a pity that it'll show error message "impossible</DIV>
<DIV>> constraint in 'asm'" during 'Make' phase if padlock option enabled.</DIV>
<DIV></DIV>
<DIV>Padlock is a crypto plugin for VIA x86 processors, it does not work on</DIV>
<DIV>ARM.</DIV>
<DIV></DIV>
<DIV>Regards</DIV>
<DIV>Martin</DIV>
<DIV></DIV>
<DIV></DIV>
<DIV>.</DIV></FONT></DIV></BODY></HTML>