Subject: IPSEC/racoon: double SAs
To: None <tech-net@netbsd.org>
From: Matthias Drochner <M.Drochner@fz-juelich.de>
List: tech-net
Date: 09/12/2002 13:46:44
Hi -
it just happened for me that an ESP tunnel mode negotiation lead
to two SAs in each direction on one side. Because the SA unknown
to the other end was used, the other side complained a lot:
"IPv4 ESP input: no key association found for spi 111506327"
in its kernel output.
Anyone seen this? The box with the double SAs is -current from a
couple of weeks ago, the other side almost up-to-date.
(After a "setkey -F" on the former one everything went normal.)
retry misbehavior, race condition??? already fixed???
best regards
Matthias
# setkey -D
134.94.206.1 134.94.206.11
esp mode=tunnel spi=41368665(0x02773c59) reqid=0(0x00000000)
E: 3des-cbc 8a1f754a 5dedaf54 9e2db65f 752752fb 37a6a4bd 3c17dc17
A: hmac-sha1 dc393d53 ef2948e2 ab727c38 33970be6 ae4e5848
seq=0x00000000 replay=4 flags=0x00000000 state=mature
created: Sep 12 13:17:13 2002 current: Sep 12 13:31:35 2002
diff: 862(s) hard: 43200(s) soft: 34560(s)
last: hard: 0(s) soft: 0(s)
current: 0(bytes) hard: 0(bytes) soft: 0(bytes)
allocated: 0 hard: 0 soft: 0
sadb_seq=3 pid=5345 refcnt=1
134.94.206.1 134.94.206.11
esp mode=tunnel spi=111506327(0x06a57397) reqid=0(0x00000000)
E: 3des-cbc d569e046 8f4e83fc 58cd5286 cbe159d0 2593158e 97a1e3f9
A: hmac-sha1 deed4883 127cf508 bd1006b4 aff13ec8 ce52eb0f
seq=0x0000005d replay=4 flags=0x00000000 state=mature
created: Sep 12 13:17:12 2002 current: Sep 12 13:31:35 2002
diff: 863(s) hard: 43200(s) soft: 34560(s)
last: Sep 12 13:31:33 2002 hard: 0(s) soft: 0(s)
current: 18968(bytes) hard: 0(bytes) soft: 0(bytes)
allocated: 93 hard: 0 soft: 0
sadb_seq=2 pid=5345 refcnt=2
134.94.206.11 134.94.206.1
esp mode=tunnel spi=15371803(0x00ea8e1b) reqid=0(0x00000000)
E: 3des-cbc 989330a5 51d315af 7f3ee00d 72501f71 1c0d318a 244708f9
A: hmac-sha1 21ccb459 c5c4cb19 b34869c2 2c9f0da3 cce0644e
seq=0x00000056 replay=4 flags=0x00000000 state=mature
created: Sep 12 13:17:13 2002 current: Sep 12 13:31:35 2002
diff: 862(s) hard: 43200(s) soft: 34560(s)
last: Sep 12 13:31:33 2002 hard: 0(s) soft: 0(s)
current: 6026(bytes) hard: 0(bytes) soft: 0(bytes)
allocated: 86 hard: 0 soft: 0
sadb_seq=1 pid=5345 refcnt=1
134.94.206.11 134.94.206.1
esp mode=tunnel spi=207047846(0x0c574ca6) reqid=0(0x00000000)
E: 3des-cbc 8d486b8d 88efbded 0cebb29c caaeac43 161c143b 88f35529
A: hmac-sha1 94ed4eb7 73ad0d5a 7752a73e 2e84c0ad 286ca7f4
seq=0x00000004 replay=4 flags=0x00000000 state=mature
created: Sep 12 13:17:12 2002 current: Sep 12 13:31:35 2002
diff: 863(s) hard: 43200(s) soft: 34560(s)
last: Sep 12 13:17:13 2002 hard: 0(s) soft: 0(s)
current: 304(bytes) hard: 0(bytes) soft: 0(bytes)
allocated: 4 hard: 0 soft: 0
sadb_seq=0 pid=5345 refcnt=1