[strongSwan] Android Client - issue on long running connection

Wed Sep 25 16:32:36 CEST 2013

Hi!

I testet the new android app in the market. I did not have the error 
like before, but today I noticed the following on the server:

Sep 25 07:44:54 router charon: 06[ENC] parsed IKE_AUTH request 1 [ IDi CERT N(INIT_CONTACT) CERTREQ AUTH CP(ADDR ADDR6 DNS DNS6) N(ESP_TFC_PAD_N) SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(MULT_AUTH) N(EAP_ONLY)
Sep 25 07:44:54 router charon: 06[IKE] received cert request for "C=DE, O=test.loc, CN=test.loc"
Sep 25 07:44:54 router charon: 06[IKE] received 1 cert requests for an unknown ca
Sep 25 07:44:54 router charon: 06[IKE] received end entity cert "C=DE, O=test.loc, CN=avalentin-nexus"
Sep 25 07:44:54 router charon: 06[CFG] looking for peer configs matching 1.2.3.65[%any]...2.206.1.9[C=DE, O=test.loc, CN=avalentin-nexus]
Sep 25 07:44:54 router charon: 06[CFG] selected peer config 'rw-android-ikev2-cert'
Sep 25 07:44:54 router charon: 06[CFG]   using certificate "C=DE, O=test.loc, CN=avalentin-nexus"
Sep 25 07:44:54 router charon: 06[CFG]   using trusted ca certificate "C=DE, O=test.loc, CN=test.loc"
Sep 25 07:44:54 router charon: 06[CFG] checking certificate status of "C=DE, O=test.loc, CN=avalentin-nexus"
Sep 25 07:44:54 router charon: 06[CFG] certificate status is not available
Sep 25 07:44:54 router charon: 06[CFG]   reached self-signed root ca with a path length of 0
Sep 25 07:44:54 router charon: 06[IKE] signature validation failed, looking for another key
Sep 25 07:44:54 router charon: 06[CFG]   using certificate "C=DE, O=test.loc, CN=avalentin-nexus"
Sep 25 07:44:54 router charon: 06[CFG]   using trusted ca certificate "C=DE, O=test.loc, CN=test.loc"
Sep 25 07:44:54 router charon: 06[CFG] checking certificate status of "C=DE, O=test.loc, CN=avalentin-nexus"
Sep 25 07:44:54 router charon: 06[CFG] certificate status is not available
Sep 25 07:44:54 router charon: 06[CFG]   reached self-signed root ca with a path length of 0
Sep 25 07:44:54 router charon: 06[IKE] signature validation failed, looking for another key
Sep 25 07:44:54 router charon: 06[IKE] received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding
Sep 25 07:44:54 router charon: 06[IKE] peer supports MOBIKE

The client shows this:

09-25 09:44:17.330 I/charon  ( 4328): 11[IKE] no route found to reach 1.2.3.65, MOBIKE update deferred
09-25 09:44:20.695 I/charon  ( 4328): 13[IKE] retransmit 3 of request with message ID 0
09-25 09:44:20.695 I/charon  ( 4328): 13[NET] sending packet: from 10.60.145.9[32782] to 1.2.3.65[500] (756 bytes)
09-25 09:44:26.190 I/charon  ( 4328): 09[IKE] giving up after 3 retransmits
09-25 09:44:26.190 I/charon  ( 4328): 09[IKE] peer not responding, trying again (2/0)
09-25 09:44:26.190 I/charon  ( 4328): 09[IKE] initiating IKE_SA android[3] to 1.2.3.65
09-25 09:44:26.190 I/charon  ( 4328): 09[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]
09-25 09:44:26.200 I/charon  ( 4328): 09[NET] sending packet: from 0.0.0.0[32782] to 1.2.3.65[500] (756 bytes)
09-25 09:44:28.205 I/charon  ( 4328): 16[IKE] retransmit 1 of request with message ID 0
09-25 09:44:28.205 I/charon  ( 4328): 16[NET] sending packet: from 0.0.0.0[32782] to 1.2.3.65[500] (756 bytes)
09-25 09:44:32.980 I/charon  ( 4328): 13[IKE] retransmit 2 of request with message ID 0
09-25 09:44:32.980 I/charon  ( 4328): 13[NET] sending packet: from 0.0.0.0[32782] to 1.2.3.65[500] (756 bytes)
09-25 09:44:35.835 I/charon  ( 4328): 09[IKE] old path is not available anymore, try to find another
09-25 09:44:35.835 I/charon  ( 4328): 09[IKE] looking for a route to 1.2.3.65 ...
09-25 09:44:35.835 I/charon  ( 4328): 09[IKE] reauthenticating IKE_SA due to address change
09-25 09:44:35.835 I/charon  ( 4328): 09[IKE] reauthenticating IKE_SA android[3]
09-25 09:44:36.910 I/charon  ( 4328): 12[IKE] retransmit 3 of request with message ID 0
09-25 09:44:36.915 I/charon  ( 4328): 12[NET] sending packet: from 0.0.0.0[32782] to 1.2.3.65[500] (756 bytes)
09-25 09:44:38.315 I/charon  ( 4328): 13[NET] received packet: from 1.2.3.65[500] to 10.60.145.9[32782] (465 bytes)
09-25 09:44:38.315 I/charon  ( 4328): 13[ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(MULT_AUTH) ]
09-25 09:44:38.415 I/charon  ( 4328): 13[IKE] local host is behind NAT, sending keep alives
09-25 09:44:38.415 I/charon  ( 4328): 13[IKE] received cert request for "C=DE, O=test.loc, CN=test.loc"
09-25 09:44:38.415 I/charon  ( 4328): 13[IKE] sending cert request for "C=DE, CN=test.loc"
09-25 09:44:38.415 I/charon  ( 4328): 13[IKE] sending cert request for "C=DE, O=test.loc, CN=test.loc"
09-25 09:44:38.465 I/charon  ( 4328): 13[IKE] authentication of 'C=DE, O=test.loc, CN=avalentin-nexus' (myself) with RSA signature successful
09-25 09:44:38.465 I/charon  ( 4328): 13[IKE] sending end entity cert "C=DE, O=test.loc, CN=avalentin-nexus"
09-25 09:44:38.465 I/charon  ( 4328): 13[IKE] establishing CHILD_SA android
09-25 09:44:38.465 I/charon  ( 4328): 13[ENC] generating IKE_AUTH request 1 [ IDi CERT N(INIT_CONTACT) CERTREQ AUTH CPRQ(ADDR ADDR6 DNS DNS6) N(ESP_TFC_PAD_N) SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(MULT_AUTH)
09-25 09:44:38.470 I/charon  ( 4328): 13[NET] sending packet: from 10.60.145.9[43171] to 1.2.3.65[4500] (1916 bytes)
09-25 09:44:40.480 I/charon  ( 4328): 15[IKE] retransmit 1 of request with message ID 1
09-25 09:44:40.480 I/charon  ( 4328): 15[NET] sending packet: from 10.60.145.9[43171] to 1.2.3.65[4500] (1916 bytes)
09-25 09:44:42.125 I/charon  ( 4328): 16[NET] received packet: from 1.2.3.65[500] to 10.60.145.9[32782] (465 bytes)
09-25 09:44:42.130 I/charon  ( 4328): 16[ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(MULT_AUTH) ]
09-25 09:44:42.130 I/charon  ( 4328): 16[IKE] received message ID 0, expected 1. Ignored
09-25 09:44:42.130 I/charon  ( 4328): 16[NET] received packet: from 1.2.3.65[500] to 10.60.145.9[32782] (465 bytes)
09-25 09:44:42.135 I/charon  ( 4328): 16[ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(MULT_AUTH) ]
09-25 09:44:42.135 I/charon  ( 4328): 16[IKE] received message ID 0, expected 1. Ignored
09-25 09:44:42.455 I/charon  ( 4328): 10[NET] received packet: from 1.2.3.65[500] to 10.60.145.9[32782] (465 bytes)
09-25 09:44:42.455 I/charon  ( 4328): 10[ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(MULT_AUTH) ]
09-25 09:44:42.455 I/charon  ( 4328): 10[IKE] received message ID 0, expected 1. Ignored
09-25 09:44:43.285 I/charon  ( 4328): 12[IKE] retransmit 2 of request with message ID 1
09-25 09:44:43.300 I/charon  ( 4328): 12[NET] sending packet: from 10.60.145.9[43171] to 1.2.3.65[4500] (1916 bytes)
09-25 09:44:46.990 I/charon  ( 4328): 15[NET] received packet: from 1.2.3.65[4500] to 10.60.145.9[43171] (76 bytes)
09-25 09:44:46.990 I/charon  ( 4328): 15[ENC] parsed IKE_AUTH response 1 [ N(AUTH_FAILED) ]
09-25 09:44:46.990 I/charon  ( 4328): 15[IKE] received AUTHENTICATION_FAILED notify error

Some minutes before it worked fine:

Sep 25 07:41:17 router charon: 13[IKE] received 1 cert requests for an unknown ca
Sep 25 07:41:17 router charon: 13[IKE] received end entity cert "C=DE, O=test.loc, CN=avalentin-nexus"
Sep 25 07:41:17 router charon: 13[CFG] looking for peer configs matching 1.2.3.65[%any]...2.206.1.9[C=DE, O=test.loc, CN=avalentin-nexus]
Sep 25 07:41:17 router charon: 13[CFG] selected peer config 'rw-android-ikev2-cert'
Sep 25 07:41:17 router charon: 13[CFG]   using certificate "C=DE, O=test.loc, CN=avalentin-nexus"
Sep 25 07:41:17 router charon: 13[CFG]   using trusted ca certificate "C=DE, O=test.loc, CN=test.loc"
Sep 25 07:41:17 router charon: 13[CFG] checking certificate status of "C=DE, O=test.loc, CN=avalentin-nexus"
Sep 25 07:41:17 router charon: 13[CFG] certificate status is not available
Sep 25 07:41:17 router charon: 13[CFG]   reached self-signed root ca with a path length of 0
Sep 25 07:41:17 router charon: 13[IKE] authentication of 'C=DE, O=test.loc, CN=avalentin-nexus' with RSA signature successful
Sep 25 07:41:17 router charon: 13[IKE] received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding
Sep 25 07:41:17 router charon: 13[IKE] peer supports MOBIKE

Do you have an idea why the signature validation fails? Is it a MTU 
problem, but why only sometimes...

Kind regards,

André

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.strongswan.org/pipermail/users/attachments/20130925/eccb7d99/attachment.html>