黃巾賊的私人日記

2010年4月23日星期五

gcc cross compiler union compatible issue.

有些platform 的struct or union 預設為4個bytes(一般會預期應該要2個bytes)

目前可用

__attribute__((__packed__))來解決

其它的code要小心有沒有類似的問題

typedef union _MACHTTRANSMIT_SETTING { unsigned short word; union //short 2 bytes，但有些可能 assign 4 bytes { unsigned short MCS:7; // MCS unsigned short BW:1; //channel bandwidth 20MHz or 40 MHz unsigned short ShortGI:1; unsigned short STBC:2; //SPACE unsigned short rsv:3; unsigned short MODE:2; // Use definition MODE_xxx. } __attribute__((__packed__))field; }__attribute__((__packed__)) MACHTTRANSMIT_SETTING, PMACHTTRANSMIT_SETTING; int main(int argc, char argv[]) { MACHTTRANSMIT_SETTING m; printf("m: %d, m->word:%d@%p\n", sizeof(m), sizeof(m.word), &m.word); printf("m: %d, m->:%d@%p\n", sizeof(m), sizeof(m.word), &m.word); printf("ok: %d, m->:%d@%p\n", sizeof(m), sizeof(m.field), &m.field); }
X86	others
peter@team-server:~$ ./a.out m: 2, m->word:2@0xbff97a32 m: 2, m->:2@0xbff97a32 ok: 2, m->:1@0xbff97a32	/tmp/rootfs # ./a.out m: 2, m->word:2@0x4261fcd4 m: 2, m->:2@0x4261fcd4 ok: 2, m->:1@0x4261fcd4

2010年4月20日星期二

how to change default stack size...

方法一:

gcc -Wl,--defsym,__stacksize=0x80000 -o foo foo.c

方法二:

peter@team-server:sbin$ arm-elf-readelf -l foo

Elf file type is EXEC (Executable file)

Entry point 0x37fc

There are 6 program headers, starting at offset 52

Program Headers:

Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align

PHDR 0x000034 0x00000034 0x00000034 0x000c0 0x000c0 R E 0x4

INTERP 0x0000f4 0x000000f4 0x000000f4 0x00014 0x00014 R 0x1

[Requesting program interpreter: /lib/ld-uClibc.so.0]

LOAD 0x000000 0x00000000 0x00000000 0x1f668 0x1f668 R E 0x1000

LOAD 0x01f668 0x00020668 0x00020668 0x0b718 0x0ba98 RW 0x1000

DYNAMIC 0x01f67c 0x0002067c 0x0002067c 0x000c8 0x000c8 RW 0x4

GNU_STACK 0x000000 0x00000000 0x00000000 0x00000 0x20000 RWE 0x8 //原來的stack為256KB

Section to Segment mapping:

Segment Sections...

01 .interp

02 .interp .hash .dynsym .dynstr .rel.dyn .rel.plt .init .plt .text .fini .rofixup

03 .ctors .dtors .jcr .dynamic .data .got .bss

04 .dynamic

peter@team-server:sbin$

peter@team-server:sbin$ ../../../fdpichdr/fdpichdr -s 0x100000 foo

peter@team-server:sbin$ arm-elf-readelf -l foo

Elf file type is EXEC (Executable file)

Entry point 0x37fc

There are 6 program headers, starting at offset 52

Program Headers:

Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align

PHDR 0x000034 0x00000034 0x00000034 0x000c0 0x000c0 R E 0x4

INTERP 0x0000f4 0x000000f4 0x000000f4 0x00014 0x00014 R 0x1

[Requesting program interpreter: /lib/ld-uClibc.so.0]

LOAD 0x000000 0x00000000 0x00000000 0x1f668 0x1f668 R E 0x1000

LOAD 0x01f668 0x00020668 0x00020668 0x0b718 0x0ba98 RW 0x1000

DYNAMIC 0x01f67c 0x0002067c 0x0002067c 0x000c8 0x000c8 RW 0x4

GNU_STACK 0x000000 0x00000000 0x00000000 0x00000 0x100000 RWE 0x8 //現在有1MB

Section to Segment mapping:

Segment Sections...

01 .interp

02 .interp .hash .dynsym .dynstr .rel.dyn .rel.plt .init .plt .text .fini .rofixup

03 .ctors .dtors .jcr .dynamic .data .got .bss

04 .dynamic

05 .bss

2010年4月11日星期日

office 2007 快速鍵

http://www.ithome.com.tw/itadm/article.php?c=46929
http://bbs.mychat.to/reads.php?tid=781220
http://272586.blogspot.com/2008/05/excel_22.html

Keyboard Shortcut	Result in Excel 2000 - General
F1 Key	Help
F2 Key	Edit current Cell
F5 Key	Goto
F7 Key	Spell Check
F12 Key	Save file as
CTRL and A	Select entire worksheet.
CTRL and B	Toggle Bold Text.
CTRL and C	Copies the item or items selected to the Clipboard and can be pasted using CTRL and V.
CTRL and F	Displays the Find dialog box.
CTRL and H	Displays the Replace dialog box.
CTRL and I	Toggles Italic Text.
CTRL and N	New File.
CTRL and O	Open File.
CTRL and P	Print.
CTRL and S	Save File.
CTRL and U	Toggles Underlined Text.
CTRL and V	Paste the contents of the clipboard.
CTRL and X	Cut the selected item.
CTRL and Y	Redo the last undone action
CTRL and Z	Undoes the last action.
CTRL and 1	Displays Format Cells Dialogue Box
CTRL and 5	Toggles Strikethrough Text

Keyboard Shortcut	Result in Excel 2000 - Formulas
ALT and =	Autosum
ALT and F8	Macros
CTRL and ;	Insert Current Date
CTRL and :	Insert Current Time

Keyboard Shortcut	Result in Excel 2000 - Movement
Left Arrow	One Cell Left (also SHIFT and TAB)
Right Arrow	One Cell Right (also TAB)
Up Arrow	One Cell Up
Down Arrow	One Cell Down
Home	Go to End of row
CTRL and left Arrow	Go to End of Column
CTRL and Home	Go to Top of Worksheet (A1)
CTRL and End	Go to End of Worksheet
CTRL and PAGE-DOWN	Go to Next Worksheet

Keyboard Shortcut	Result in Excel 2000 - Cell Selection
CTRL and Spacebar	Select the entire Column
SHIFT and Spacebar	Select the entire Row
CTRL and A	Select Entire Worksheet
SHIFT and Left Cursor	Select all cells to the left of the active one
SHIFT and Right Cursor	Select all cells to the right of the active one

2010年4月8日星期四

l2tpd: rp-l2tpd
ipsec: openswan patched.

------------------------------------------
config:

peter@team-server:ppp$ cat l2tpd.conf

# comment

# Global section (by default, we start in global mode)
global

# Load handlers
load-handler "sync-pppd.so"
load-handler "cmd.so"

# Bind address
listen-port 1701

# Configure the sync-pppd handler. You MUST have a "section sync-pppd" line
# even if you don't set any options.
section sync-pppd
pppd-path /sbin/pppd
lns-pppd-opts "require-pap 10.0.0.1:10.0.0.2 lcp-echo-interval 30 lcp-echo-failure 6"
lac-pppd-opts "user exampe name example noipdefault ipcp-accept-local ipcp-accept-remote lcp-echo-interval 30 lcp-echo-failure 6"

# Peer section
section peer
peer 172.21.33.92 #-----(1)
#secret s3cr3t ---------(2)

port 1701

hide-avps no

section cmd

------------------------

(1). please modify remote client IP correctly.

(2). if uncomment it, an error message show as: stop_conntrol on L2TP tunnel phase.?

lns-handler sync-pppd 0.002 51449/0: Peer host name is 'test-55e98b2637'

0.003 l2tp_peer_find(172.21.33.92) examining peer 172.21.33.92/32

0.004 l2tp_peer_find(172.21.33.92) found 172.21.33.92/32

0.005 auth_gen_response(secret=s3cr3t) -> a49eacc864ed2f63d48973e8571f56d7

######################################

#cat options
#noipdefault
#defaultroute
#passive
debug
refuse-eap
lcp-echo-interval 30
lcp-echo-failure 4

require-pap
maxfail 3
#user "sw2_vpn_user" #---(1)
mtu 1400
mru 1400
auth #noauth #--(2)
noaccomp
nopcomp
noccp
-am

------------------------
(1). if uncomment options "user". it will shown blow message!

Mar 18 19:56:43 DIR865 user.notice The remote system is required to authenticate itself
Mar 18 19:56:43 DIR865 daemon.err pppd[2848]: The remote system is required to authenticate itself
Mar 18 19:56:43 DIR865 user.notice pppd
Mar 18 19:56:43 DIR865 user.notice :
Mar 18 19:56:43 DIR865 user.notice but I couldn't find any suitable secret (password) for it to use to do so.
Mar 18 19:56:43 DIR865 daemon.err pppd[2848]: but I couldn't find any suitable secret (password) for it to use to do so.

(2). noauth is used to "said: I am server. and did need not PAP nor CHAP authentication, so you guy are allowed just get by IPCP.

2010年4月5日星期一

openswn porting

這回改到porting openswan的問題

在quick mode negotiate completed後要用netlink加sa到xfrm …

but出現以下問題(不能加入sa)...

kernel: 2.6.28.10

Openswan 2.4.12

| checking transid: 12 keylen: 16 auth: 1

| checking transid: 12 keylen: 16 auth: 2

"conn_psk" #2: ERROR: netlink response for Add SA esp.f44e8ed@172.21.33.70 included errno 93: Protocol not supported

003 "conn_psk" #2: ERROR: netlink response for Add SA esp.f44e8ed@172.21.33.70 included errno 93: Protocol not supported

| complete state transition with STF_INTERNAL_ERROR

032 "conn_psk" #2: STATE_QUICK_I1: internal error

| state transition function for STATE_QUICK_I1 had internal error

| next event EVENT_RETRANSMIT in 8 seconds for #2

pluto的程式在這裡加入sa (kernel_netlink.c) netlink_add_sa

kernel對應的應該是: (xfrm_user.c)xfrm_add_sa

但2.6應該是不用klips…

結論是…我少了一些module
insmod ./hmac.ko

2010年3月30日星期二

l2tpd over IPSec NAT-D in Win7

L2TP over IPSec + NAT-D 在win7上似乎有問題

除了要注意，在quick mode的QI1中esp是用null encryption algo外，還有protocol 1701/17

1701是指L2TP 的port，17是指udp protocol.

先在xp client在nat下連openswan看來是ok的…如下

ipsec.conf如下

conn conn_pptp_ipsec
   auto=add
   type=transport
   left=172.21.33.8
   right=%any
   leftnexthop=172.21.32.254
   ike="3des-md5-modp1024,3des-md5-modp1024,3des-md5-modp1024,3des-md5-modp
   pfs=no
   esp="null-md5,null-sha1,3des-md5,3des-md5"
   authby=secret
   leftprotoport=17/1701
   rightprotoport=17/0

# cat /etc/ppp/l2tpd.conf
[global]

[lns default]
ip range = 192.168.0.230-192.168.0.240
local ip = 192.168.0.220
refuse chap = yes
require pap = yes
require authentication = yes
name = pptp_ipsec
ppp debug = yes
pppoptfile = /tmp/ppp/options.l2tpd
length bit = yes

# cat /etc/ppp/options.l2tpd
refuse-chap
refuse-mschap
refuse-mschap-v2
require-pap
ipparam l2tpd
novj
nobsdcomp
novjccomp
nologfd
idle 1800
mtu 1410
mru 1410
debug
dump
lock
proxyarp
ms-dns 172.21.1.1
ms-dns 172.21.1.2

openswan NAT-D in XP client (L2TP over IPSec) OK.

=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2010.03.30 18:29:23 =~=~=~=~=~=~=~=~=~=~=~=
killall syslogd
killall: syslogd: no process killed
# pluto[12392]: |
pluto[12392]: | *received 312 bytes from 172.21.33.79:500 on eth0
pluto[12392]: | **parse ISAKMP Message:
pluto[12392]: | initiator cookie:
pluto[12392]: | 92 f2 33 30 40 d3 8d 3a
pluto[12392]: | responder cookie:
pluto[12392]: | 00 00 00 00 00 00 00 00
pluto[12392]: | next payload type: ISAKMP_NEXT_SA
pluto[12392]: | ISAKMP version: ISAKMP Version 1.0
pluto[12392]: | exchange type: ISAKMP_XCHG_IDPROT
pluto[12392]: | flags: none
pluto[12392]: | message ID: 00 00 00 00
pluto[12392]: | length: 312
pluto[12392]: | The xchg type is ISAKMP_XCHG_IDPROT (2)
pluto[12392]: | ***parse ISAKMP Security Association Payload:
pluto[12392]: | next payload type: ISAKMP_NEXT_VID
pluto[12392]: | length: 200
pluto[12392]: | DOI: ISAKMP_DOI_IPSEC
pluto[12392]: | ***parse ISAKMP Vendor ID Payload:
pluto[12392]: | next payload type: ISAKMP_NEXT_VID
pluto[12392]: | length: 24
pluto[12392]: | ***parse ISAKMP Vendor ID Payload:
pluto[12392]: | next payload type: ISAKMP_NEXT_VID
pluto[12392]: | length: 20
pluto[12392]: | ***parse ISAKMP Vendor ID Payload:
pluto[12392]: | next payload type: ISAKMP_NEXT_VID
pluto[12392]: | length: 20
pluto[12392]: | ***parse ISAKMP Vendor ID Payload:
pluto[12392]: | next payload type: ISAKMP_NEXT_NONE
pluto[12392]: | length: 20
pluto[12392]: packet from 172.21.33.79:500: ignoring Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]
pluto[12392]: | VID: 1e 2b 51 69 05 99 1c 7d 7c 96 fc bf b5 87 e4 61
pluto[12392]: | 00 00 00 04
pluto[12392]: packet from 172.21.33.79:500: ignoring Vendor ID payload [FRAGMENTATION]
pluto[12392]: | VID: 40 48 b7 d5 6e bc e8 85 25 e7 de 7f 00 d6 c2 d3
pluto[12392]: packet from 172.21.33.79:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
pluto[12392]: | VID: 90 cb 80 91 3e bb 69 6e 08 63 81 b5 ec 42 7b 1f
pluto[12392]: packet from 172.21.33.79:500: ignoring Vendor ID payload [26244d38eddb61b3172a36e3d0cfb819]
pluto[12392]: | VID: 26 24 4d 38 ed db 61 b3 17 2a 36 e3 d0 cf b8 19
pluto[12392]: | ****parse IPsec DOI SIT:
pluto[12392]: | IPsec DOI SIT: SIT_IDENTITY_ONLY
pluto[12392]: | ****parse ISAKMP Proposal Payload:
pluto[12392]: | next payload type: ISAKMP_NEXT_NONE
pluto[12392]: | length: 188
pluto[12392]: | proposal number: 1
pluto[12392]: | protocol ID: PROTO_ISAKMP
pluto[12392]: | SPI size: 0
pluto[12392]: | number of transforms: 5
pluto[12392]: | *****parse ISAKMP Transform Payload (ISAKMP):
pluto[12392]: | next payload type: ISAKMP_NEXT_T
pluto[12392]: | length: 36
pluto[12392]: | transform number: 1
pluto[12392]: | transform ID: KEY_IKE
pluto[12392]: | ******parse ISAKMP Oakley attribute:
pluto[12392]: | af+type: OAKLEY_ENCRYPTION_ALGORITHM
pluto[12392]: | length/value: 5
pluto[12392]: | ******parse ISAKMP Oakley attribute:
pluto[12392]: | af+type: OAKLEY_HASH_ALGORITHM
pluto[12392]: | length/value: 2
pluto[12392]: | ******parse ISAKMP Oakley attribute:
pluto[12392]: | af+type: OAKLEY_GROUP_DESCRIPTION
pluto[12392]: | length/value: 14
pluto[12392]: | ******parse ISAKMP Oakley attribute:
pluto[12392]: | af+type: OAKLEY_AUTHENTICATION_METHOD
pluto[12392]: | length/value: 1
pluto[12392]: | ******parse ISAKMP Oakley attribute:
pluto[12392]: | af+type: OAKLEY_LIFE_TYPE
pluto[12392]: | length/value: 1
pluto[12392]: | ******parse ISAKMP Oakley attribute:
pluto[12392]: | af+type: OAKLEY_LIFE_DURATION (variable length)
pluto[12392]: | length/value: 4
pluto[12392]: | *****parse ISAKMP Transform Payload (ISAKMP):
pluto[12392]: | next payload type: ISAKMP_NEXT_T
pluto[12392]: | length: 36
pluto[12392]: | transform number: 2
pluto[12392]: | transform ID: KEY_IKE
pluto[12392]: | ******parse ISAKMP Oakley attribute:
pluto[12392]: | af+type: OAKLEY_ENCRYPTION_ALGORITHM
pluto[12392]: | length/value: 5
pluto[12392]: | ******parse ISAKMP Oakley attribute:
pluto[12392]: | af+type: OAKLEY_HASH_ALGORITHM
pluto[12392]: | length/value: 2
pluto[12392]: | ******parse ISAKMP Oakley attribute:
pluto[12392]: | af+type: OAKLEY_GROUP_DESCRIPTION
pluto[12392]: | length/value: 2
pluto[12392]: | ******parse ISAKMP Oakley attribute:
pluto[12392]: | af+type: OAKLEY_AUTHENTICATION_METHOD
pluto[12392]: | length/value: 1
pluto[12392]: | ******parse ISAKMP Oakley attribute:
pluto[12392]: | af+type: OAKLEY_LIFE_TYPE
pluto[12392]: | length/value: 1
pluto[12392]: | ******parse ISAKMP Oakley attribute:
pluto[12392]: | af+type: OAKLEY_LIFE_DURATION (variable length)
pluto[12392]: | length/value: 4
pluto[12392]: | *****parse ISAKMP Transform Payload (ISAKMP):
pluto[12392]: | next payload type: ISAKMP_NEXT_T
pluto[12392]: | length: 36
pluto[12392]: | transform number: 3
pluto[12392]: | transform ID: KEY_IKE
pluto[12392]: | ******parse ISAKMP Oakley attribute:
pluto[12392]: | af+type: OAKLEY_ENCRYPTION_ALGORITHM
pluto[12392]: | length/value: 5
pluto[12392]: | ******parse ISAKMP Oakley attribute:
pluto[12392]: | af+type: OAKLEY_HASH_ALGORITHM
pluto[12392]: | length/value: 1
pluto[12392]: | ******parse ISAKMP Oakley attribute:
pluto[12392]: | af+type: OAKLEY_GROUP_DESCRIPTION
pluto[12392]: | length/value: 2
pluto[12392]: | ******parse ISAKMP Oakley attribute:
pluto[12392]: | af+type: OAKLEY_AUTHENTICATION_METHOD
pluto[12392]: | length/value: 1
pluto[12392]: | ******parse ISAKMP Oakley attribute:
pluto[12392]: | af+type: OAKLEY_LIFE_TYPE
pluto[12392]: | length/value: 1
pluto[12392]: | ******parse ISAKMP Oakley attribute:
pluto[12392]: | af+type: OAKLEY_LIFE_DURATION (variable length)
pluto[12392]: | length/value: 4
pluto[12392]: | *****parse ISAKMP Transform Payload (ISAKMP):
pluto[12392]: | next payload type: ISAKMP_NEXT_T
pluto[12392]: | length: 36
pluto[12392]: | transform number: 4
pluto[12392]: | transform ID: KEY_IKE
pluto[12392]: | ******parse ISAKMP Oakley attribute:
pluto[12392]: | af+type: OAKLEY_ENCRYPTION_ALGORITHM
pluto[12392]: | length/value: 1
pluto[12392]: | ******parse ISAKMP Oakley attribute:
pluto[12392]: | af+type: OAKLEY_HASH_ALGORITHM
pluto[12392]: | length/value: 2
pluto[12392]: | ******parse ISAKMP Oakley attribute:
pluto[12392]: | af+type: OAKLEY_GROUP_DESCRIPTION
pluto[12392]: | length/value: 1
pluto[12392]: | ******parse ISAKMP Oakley attribute:
pluto[12392]: | af+type: OAKLEY_AUTHENTICATION_METHOD
pluto[12392]: | length/value: 1
pluto[12392]: | ******parse ISAKMP Oakley attribute:
pluto[12392]: | af+type: OAKLEY_LIFE_TYPE
pluto[12392]: | length/value: 1
pluto[12392]: | ******parse ISAKMP Oakley attribute:
pluto[12392]: | af+type: OAKLEY_LIFE_DURATION (variable length)
pluto[12392]: | length/value: 4
pluto[12392]: | *****parse ISAKMP Transform Payload (ISAKMP):
pluto[12392]: | next payload type: ISAKMP_NEXT_NONE
pluto[12392]: | length: 36
pluto[12392]: | transform number: 5
pluto[12392]: | transform ID: KEY_IKE
pluto[12392]: | ******parse ISAKMP Oakley attribute:
pluto[12392]: | af+type: OAKLEY_ENCRYPTION_ALGORITHM
pluto[12392]: | length/value: 1
pluto[12392]: | ******parse ISAKMP Oakley attribute:
pluto[12392]: | af+type: OAKLEY_HASH_ALGORITHM
pluto[12392]: | length/value: 1
pluto[12392]: | ******parse ISAKMP Oakley attribute:
pluto[12392]: | af+type: OAKLEY_GROUP_DESCRIPTION
pluto[12392]: | length/value: 1
pluto[12392]: | ******parse ISAKMP Oakley attribute:
pluto[12392]: | af+type: OAKLEY_AUTHENTICATION_METHOD
pluto[12392]: | length/value: 1
pluto[12392]: | ******parse ISAKMP Oakley attribute:
pluto[12392]: | af+type: OAKLEY_LIFE_TYPE
pluto[12392]: | length/value: 1
pluto[12392]: | ******parse ISAKMP Oakley attribute:
pluto[12392]: | af+type: OAKLEY_LIFE_DURATION (variable length)
pluto[12392]: | length/value: 4
pluto[12392]: "conn_pptp_ipsec"[1] 172.21.33.79 #1: responding to Main Mode from unknown peer 172.21.33.79
pluto[12392]: | ****parse IPsec DOI SIT:
pluto[12392]: | IPsec DOI SIT: SIT_IDENTITY_ONLY
pluto[12392]: | ****parse ISAKMP Proposal Payload:
pluto[12392]: | next payload type: ISAKMP_NEXT_NONE
pluto[12392]: | length: 188
pluto[12392]: | proposal number: 1
pluto[12392]: | protocol ID: PROTO_ISAKMP
pluto[12392]: | SPI size: 0
pluto[12392]: | number of transforms: 5
pluto[12392]: | *****parse ISAKMP Transform Payload (ISAKMP):
pluto[12392]: | next payload type: ISAKMP_NEXT_T
pluto[12392]: | length: 36
pluto[12392]: | transform number: 1
pluto[12392]: | transform ID: KEY_IKE
pluto[12392]: | ******parse ISAKMP Oakley attribute:
pluto[12392]: | af+type: OAKLEY_ENCRYPTION_ALGORITHM
pluto[12392]: | length/value: 5
pluto[12392]: | [5 is OAKLEY_3DES_CBC]
pluto[12392]: | ******parse ISAKMP Oakley attribute:
pluto[12392]: | af+type: OAKLEY_HASH_ALGORITHM
pluto[12392]: | length/value: 2
pluto[12392]: | [2 is OAKLEY_SHA]
pluto[12392]: | ******parse ISAKMP Oakley attribute:
pluto[12392]: | af+type: OAKLEY_GROUP_DESCRIPTION
pluto[12392]: | length/value: 14
pluto[12392]: | [14 is OAKLEY_GROUP_MODP2048]
pluto[12392]: | ******parse ISAKMP Oakley attribute:
pluto[12392]: | af+type: OAKLEY_AUTHENTICATION_METHOD
pluto[12392]: | length/value: 1
pluto[12392]: | [1 is OAKLEY_PRESHARED_KEY]
pluto[12392]: | ******parse ISAKMP Oakley attribute:
pluto[12392]: | af+type: OAKLEY_LIFE_TYPE
pluto[12392]: | length/value: 1
pluto[12392]: | [1 is OAKLEY_LIFE_SECONDS]
pluto[12392]: | ******parse ISAKMP Oakley attribute:
pluto[12392]: | af+type: OAKLEY_LIFE_DURATION (variable length)
pluto[12392]: | length/value: 4
pluto[12392]: | long duration: 28800
pluto[12392]: | Oakley Transform 1 accepted
pluto[12392]: "conn_pptp_ipsec"[1] 172.21.33.79 #1: transition from state (null) to state STATE_MAIN_R1
pluto[12392]: |
pluto[12392]: | *received 360 bytes from 172.21.33.79:500 on eth0
pluto[12392]: | **parse ISAKMP Message:
pluto[12392]: | initiator cookie:
pluto[12392]: | 92 f2 33 30 40 d3 8d 3a
pluto[12392]: | responder cookie:
pluto[12392]: | b7 30 09 f8 0e 4a 6e c6
pluto[12392]: | next payload type: ISAKMP_NEXT_KE
pluto[12392]: | ISAKMP version: ISAKMP Version 1.0
pluto[12392]: | exchange type: ISAKMP_XCHG_IDPROT
pluto[12392]: | flags: none
pluto[12392]: | message ID: 00 00 00 00
pluto[12392]: | length: 360
pluto[12392]: | The xchg type is ISAKMP_XCHG_IDPROT (2)
pluto[12392]: | ***parse ISAKMP Key Exchange Payload:
pluto[12392]: | next payload type: ISAKMP_NEXT_NONCE
pluto[12392]: | length: 260
pluto[12392]: | ***parse ISAKMP Nonce Payload:
pluto[12392]: | next payload type: ISAKMP_NEXT_NAT-D
pluto[12392]: | length: 24
pluto[12392]: | ***parse ISAKMP NAT-D Payload:
pluto[12392]: | next payload type: ISAKMP_NEXT_NAT-D
pluto[12392]: | length: 24
pluto[12392]: | ***parse ISAKMP NAT-D Payload:
pluto[12392]: | next payload type: ISAKMP_NEXT_NONE
pluto[12392]: | length: 24
pluto[12392]: "conn_pptp_ipsec"[1] 172.21.33.79 #1: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: peer is NATed
pluto[12392]: "conn_pptp_ipsec"[1] 172.21.33.79 #1: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
pluto[12392]: |
pluto[12392]: | *received 76 bytes from 172.21.33.79:4500 on eth0
pluto[12392]: | **parse ISAKMP Message:
pluto[12392]: | initiator cookie:
pluto[12392]: | 92 f2 33 30 40 d3 8d 3a
pluto[12392]: | responder cookie:
pluto[12392]: | b7 30 09 f8 0e 4a 6e c6
pluto[12392]: | next payload type: ISAKMP_NEXT_ID
pluto[12392]: | ISAKMP version: ISAKMP Version 1.0
pluto[12392]: | exchange type: ISAKMP_XCHG_IDPROT
pluto[12392]: | flags: ISAKMP_FLAG_ENCRYPTION
pluto[12392]: | message ID: 00 00 00 00
pluto[12392]: | length: 76
pluto[12392]: | The xchg type is ISAKMP_XCHG_IDPROT (2)
pluto[12392]: | ***parse ISAKMP Identification Payload:
pluto[12392]: | next payload type: ISAKMP_NEXT_HASH
pluto[12392]: | length: 23
pluto[12392]: | ID type: ID_FQDN
pluto[12392]: | DOI specific A: 0
pluto[12392]: | DOI specific B: 0
pluto[12392]: | ***parse ISAKMP Hash Payload:
pluto[12392]: | next payload type: ISAKMP_NEXT_NONE
pluto[12392]: | length: 24
pluto[12392]: | removing 1 bytes of padding
pluto[12392]: "conn_pptp_ipsec"[1] 172.21.33.79 #1: Main mode peer ID is ID_FQDN: '@test-55e98b2637'
pluto[12392]: "conn_pptp_ipsec"[2] 172.21.33.79 #1: deleting connection "conn_pptp_ipsec" instance with peer 172.21.33.79
pluto[12392]: "conn_pptp_ipsec"[2] 172.21.33.79 #1: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3
pluto[12392]: | NAT-T: new mapping 172.21.33.79:500/4500)
pluto[12392]: "conn_pptp_ipsec"[2] 172.21.33.79:4500 #1: sent MR3, ISAKMP SA established
pluto[12392]: |
pluto[12392]: | *received 228 bytes from 172.21.33.79:4500 on eth0
pluto[12392]: | **parse ISAKMP Message:
pluto[12392]: | initiator cookie:
pluto[12392]: | 92 f2 33 30 40 d3 8d 3a
pluto[12392]: | responder cookie:
pluto[12392]: | b7 30 09 f8 0e 4a 6e c6
pluto[12392]: | next payload type: ISAKMP_NEXT_HASH
pluto[12392]: | ISAKMP version: ISAKMP Version 1.0
pluto[12392]: | exchange type: ISAKMP_XCHG_QUICK
pluto[12392]: | flags: ISAKMP_FLAG_ENCRYPTION
pluto[12392]: | message ID: 9d 06 2e 20
pluto[12392]: | length: 228
pluto[12392]: | The xchg type is ISAKMP_XCHG_QUICK (32)
pluto[12392]: | ***parse ISAKMP Hash Payload:
pluto[12392]: | next payload type: ISAKMP_NEXT_SA
pluto[12392]: | length: 24
pluto[12392]: | ***parse ISAKMP Security Association Payload:
pluto[12392]: | next payload type: ISAKMP_NEXT_NONCE
pluto[12392]: | length: 104
pluto[12392]: | DOI: ISAKMP_DOI_IPSEC
pluto[12392]: | ***parse ISAKMP Nonce Payload:
pluto[12392]: | next payload type: ISAKMP_NEXT_ID
pluto[12392]: | length: 24
pluto[12392]: | ***parse ISAKMP Identification Payload (IPsec DOI):
pluto[12392]: | next payload type: ISAKMP_NEXT_ID
pluto[12392]: | length: 23
pluto[12392]: | ID type: ID_FQDN
pluto[12392]: | Protocol ID: 17
pluto[12392]: | port: 1701
pluto[12392]: | ***parse ISAKMP Identification Payload (IPsec DOI):
pluto[12392]: | next payload type: ISAKMP_NEXT_NAT-OA
pluto[12392]: | length: 12
pluto[12392]: | ID type: ID_IPV4_ADDR
pluto[12392]: | Protocol ID: 17
pluto[12392]: | port: 1701
pluto[12392]: | ***parse ISAKMP NAT-OA Payload:
pluto[12392]: | next payload type: ISAKMP_NEXT_NONE
pluto[12392]: | length: 12
pluto[12392]: | ID type: ID_IPV4_ADDR
pluto[12392]: | removing 1 bytes of padding
pluto[12392]: | our client is 172.21.33.8/32
pluto[12392]: | our client protocol/port is 17/1701
pluto[12392]: | NAT-OA: 00 00 00 0c 01 00 00 00 c0 a8 0a 64
pluto[12392]: | ****parse IPsec DOI SIT:
pluto[12392]: | IPsec DOI SIT: SIT_IDENTITY_ONLY
pluto[12392]: | ****parse ISAKMP Proposal Payload:
pluto[12392]: | next payload type: ISAKMP_NEXT_NONE
pluto[12392]: | length: 92
pluto[12392]: | proposal number: 1
pluto[12392]: | protocol ID: PROTO_IPSEC_ESP
pluto[12392]: | SPI size: 4
pluto[12392]: | number of transforms: 2
pluto[12392]: | parsing 4 raw bytes of ISAKMP Proposal Payload into SPI
pluto[12392]: | SPI ca 19 61 99
pluto[12392]: | *****parse ISAKMP Transform Payload (ESP):
pluto[12392]: | next payload type: ISAKMP_NEXT_T
pluto[12392]: | length: 40
pluto[12392]: | transform number: 1
pluto[12392]: | transform ID: ESP_NULL
pluto[12392]: | ******parse ISAKMP IPsec DOI attribute:
pluto[12392]: | af+type: SA_LIFE_TYPE
pluto[12392]: | length/value: 1
pluto[12392]: | [1 is SA_LIFE_TYPE_SECONDS]
pluto[12392]: | ******parse ISAKMP IPsec DOI attribute:
pluto[12392]: | af+type: SA_LIFE_DURATION (variable length)
pluto[12392]: | length/value: 4
pluto[12392]: | long duration: 3600
pluto[12392]: | ******parse ISAKMP IPsec DOI attribute:
pluto[12392]: | af+type: SA_LIFE_TYPE
pluto[12392]: | length/value: 2
pluto[12392]: | [2 is SA_LIFE_TYPE_KBYTES]
pluto[12392]: | ******parse ISAKMP IPsec DOI attribute:
pluto[12392]: | af+type: SA_LIFE_DURATION (variable length)
pluto[12392]: | length/value: 4
pluto[12392]: | long duration: 250000
pluto[12392]: | ******parse ISAKMP IPsec DOI attribute:
pluto[12392]: | af+type: ENCAPSULATION_MODE
pluto[12392]: | length/value: 61444
pluto[12392]: | [61444 is ENCAPSULATION_MODE_UDP_TRANSPORT]
pluto[12392]: | ******parse ISAKMP IPsec DOI attribute:
pluto[12392]: | af+type: AUTH_ALGORITHM
pluto[12392]: | length/value: 2
pluto[12392]: | [2 is AUTH_ALGORITHM_HMAC_SHA1]
pluto[12392]: "conn_pptp_ipsec"[2] 172.21.33.79:4500 #2: You should NOT use insecure ESP algorithms [ESP_NULL (0)]!
pluto[12392]: "conn_pptp_ipsec"[2] 172.21.33.79:4500 #2: responding to Quick Mode
pluto[12392]: | compute_proto_keymat:needed_len (after ESP enc)=0
pluto[12392]: | kernel_alg_esp_auth_keylen(auth=2, sadb_aalg=3): a_keylen=20
pluto[12392]: | compute_proto_keymat:needed_len (after ESP auth)=20
pluto[12392]: "conn_pptp_ipsec"[2] 172.21.33.79:4500 #2: transition from state (null) to state STATE_QUICK_R1
pluto[12392]: |
pluto[12392]: | *received 52 bytes from 172.21.33.79:4500 on eth0
pluto[12392]: | **parse ISAKMP Message:
pluto[12392]: | initiator cookie:
pluto[12392]: | 92 f2 33 30 40 d3 8d 3a
pluto[12392]: | responder cookie:
pluto[12392]: | b7 30 09 f8 0e 4a 6e c6
pluto[12392]: | next payload type: ISAKMP_NEXT_HASH
pluto[12392]: | ISAKMP version: ISAKMP Version 1.0
pluto[12392]: | exchange type: ISAKMP_XCHG_QUICK
pluto[12392]: | flags: ISAKMP_FLAG_ENCRYPTION
pluto[12392]: | message ID: 9d 06 2e 20
pluto[12392]: | length: 52
pluto[12392]: | The xchg type is ISAKMP_XCHG_QUICK (32)
pluto[12392]: | ***parse ISAKMP Hash Payload:
pluto[12392]: | next payload type: ISAKMP_NEXT_NONE
pluto[12392]: | length: 24
pluto[12392]: "conn_pptp_ipsec"[2] 172.21.33.79:4500 #2: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2
pluto[12392]: "conn_pptp_ipsec"[2] 172.21.33.79:4500 #2: IPsec SA established

#
#

接下來我將client改成WIN7

=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2010.03.30 18:42:39 =~=~=~=~=~=~=~=~=~=~=~=
pluto[13156]: |
pluto[13156]: | *received 384 bytes from 172.21.33.79:500 on eth0
pluto[13156]: | **parse ISAKMP Message:
pluto[13156]: | initiator cookie:
pluto[13156]: | c1 b5 e9 73 75 61 93 46
pluto[13156]: | responder cookie:
pluto[13156]: | 00 00 00 00 00 00 00 00
pluto[13156]: | next payload type: ISAKMP_NEXT_SA
pluto[13156]: | ISAKMP version: ISAKMP Version 1.0
pluto[13156]: | exchange type: ISAKMP_XCHG_IDPROT
pluto[13156]: | flags: none
pluto[13156]: | message ID: 00 00 00 00
pluto[13156]: | length: 384
pluto[13156]: | The xchg type is ISAKMP_XCHG_IDPROT (2)
pluto[13156]: | ***parse ISAKMP Security Association Payload:
pluto[13156]: | next payload type: ISAKMP_NEXT_VID
pluto[13156]: | length: 212
pluto[13156]: | DOI: ISAKMP_DOI_IPSEC
pluto[13156]: | ***parse ISAKMP Vendor ID Payload:
pluto[13156]: | next payload type: ISAKMP_NEXT_VID
pluto[13156]: | length: 24
pluto[13156]: | ***parse ISAKMP Vendor ID Payload:
pluto[13156]: | next payload type: ISAKMP_NEXT_VID
pluto[13156]: | length: 20
pluto[13156]: | ***parse ISAKMP Vendor ID Payload:
pluto[13156]: | next payload type: ISAKMP_NEXT_VID
pluto[13156]: | length: 20
pluto[13156]: | ***parse ISAKMP Vendor ID Payload:
pluto[13156]: | next payload type: ISAKMP_NEXT_VID
pluto[13156]: | length: 20
pluto[13156]: | ***parse ISAKMP Vendor ID Payload:
pluto[13156]: | next payload type: ISAKMP_NEXT_VID
pluto[13156]: | length: 20
pluto[13156]: | ***parse ISAKMP Vendor ID Payload:
pluto[13156]: | next payload type: ISAKMP_NEXT_VID
pluto[13156]: | length: 20
pluto[13156]: | ***parse ISAKMP Vendor ID Payload:
pluto[13156]: | next payload type: ISAKMP_NEXT_NONE
pluto[13156]: | length: 20
pluto[13156]: packet from 172.21.33.79:500: ignoring Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000008]
pluto[13156]: | VID: 1e 2b 51 69 05 99 1c 7d 7c 96 fc bf b5 87 e4 61
pluto[13156]: | 00 00 00 08
pluto[13156]: packet from 172.21.33.79:500: received Vendor ID payload [RFC 3947]
pluto[13156]: | VID: 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f
pluto[13156]: packet from 172.21.33.79:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
pluto[13156]: | VID: 90 cb 80 91 3e bb 69 6e 08 63 81 b5 ec 42 7b 1f
pluto[13156]: packet from 172.21.33.79:500: ignoring Vendor ID payload [FRAGMENTATION]
pluto[13156]: | VID: 40 48 b7 d5 6e bc e8 85 25 e7 de 7f 00 d6 c2 d3
pluto[13156]: packet from 172.21.33.79:500: ignoring Vendor ID payload [fb1de3cdf341b7ea16b7e5be0855f120]
pluto[13156]: | VID: fb 1d e3 cd f3 41 b7 ea 16 b7 e5 be 08 55 f1 20
pluto[13156]: packet from 172.21.33.79:500: ignoring Vendor ID payload [26244d38eddb61b3172a36e3d0cfb819]
pluto[13156]: | VID: 26 24 4d 38 ed db 61 b3 17 2a 36 e3 d0 cf b8 19
pluto[13156]: packet from 172.21.33.79:500: ignoring Vendor ID payload [e3a5966a76379fe707228231e5ce8652]
pluto[13156]: | VID: e3 a5 96 6a 76 37 9f e7 07 22 82 31 e5 ce 86 52
pluto[13156]: | ****parse IPsec DOI SIT:
pluto[13156]: | IPsec DOI SIT: SIT_IDENTITY_ONLY
pluto[13156]: | ****parse ISAKMP Proposal Payload:
pluto[13156]: | next payload type: ISAKMP_NEXT_NONE
pluto[13156]: | length: 200
pluto[13156]: | proposal number: 1
pluto[13156]: | protocol ID: PROTO_ISAKMP
pluto[13156]: | SPI size: 0
pluto[13156]: | number of transforms: 5
pluto[13156]: | *****parse ISAKMP Transform Payload (ISAKMP):
pluto[13156]: | next payload type: ISAKMP_NEXT_T
pluto[13156]: | length: 40
pluto[13156]: | transform number: 1
pluto[13156]: | transform ID: KEY_IKE
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_ENCRYPTION_ALGORITHM
pluto[13156]: | length/value: 7
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_KEY_LENGTH
pluto[13156]: | length/value: 256
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_HASH_ALGORITHM
pluto[13156]: | length/value: 2
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_GROUP_DESCRIPTION
pluto[13156]: | length/value: 20
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_AUTHENTICATION_METHOD
pluto[13156]: | length/value: 1
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_LIFE_TYPE
pluto[13156]: | length/value: 1
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_LIFE_DURATION (variable length)
pluto[13156]: | length/value: 4
pluto[13156]: | *****parse ISAKMP Transform Payload (ISAKMP):
pluto[13156]: | next payload type: ISAKMP_NEXT_T
pluto[13156]: | length: 40
pluto[13156]: | transform number: 2
pluto[13156]: | transform ID: KEY_IKE
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_ENCRYPTION_ALGORITHM
pluto[13156]: | length/value: 7
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_KEY_LENGTH
pluto[13156]: | length/value: 128
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_HASH_ALGORITHM
pluto[13156]: | length/value: 2
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_GROUP_DESCRIPTION
pluto[13156]: | length/value: 19
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_AUTHENTICATION_METHOD
pluto[13156]: | length/value: 1
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_LIFE_TYPE
pluto[13156]: | length/value: 1
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_LIFE_DURATION (variable length)
pluto[13156]: | length/value: 4
pluto[13156]: | *****parse ISAKMP Transform Payload (ISAKMP):
pluto[13156]: | next payload type: ISAKMP_NEXT_T
pluto[13156]: | length: 40
pluto[13156]: | transform number: 3
pluto[13156]: | transform ID: KEY_IKE
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_ENCRYPTION_ALGORITHM
pluto[13156]: | length/value: 7
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_KEY_LENGTH
pluto[13156]: | length/value: 256
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_HASH_ALGORITHM
pluto[13156]: | length/value: 2
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_GROUP_DESCRIPTION
pluto[13156]: | length/value: 14
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_AUTHENTICATION_METHOD
pluto[13156]: | length/value: 1
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_LIFE_TYPE
pluto[13156]: | length/value: 1
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_LIFE_DURATION (variable length)
pluto[13156]: | length/value: 4
pluto[13156]: | *****parse ISAKMP Transform Payload (ISAKMP):
pluto[13156]: | next payload type: ISAKMP_NEXT_T
pluto[13156]: | length: 36
pluto[13156]: | transform number: 4
pluto[13156]: | transform ID: KEY_IKE
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_ENCRYPTION_ALGORITHM
pluto[13156]: | length/value: 5
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_HASH_ALGORITHM
pluto[13156]: | length/value: 2
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_GROUP_DESCRIPTION
pluto[13156]: | length/value: 14
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_AUTHENTICATION_METHOD
pluto[13156]: | length/value: 1
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_LIFE_TYPE
pluto[13156]: | length/value: 1
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_LIFE_DURATION (variable length)
pluto[13156]: | length/value: 4
pluto[13156]: | *****parse ISAKMP Transform Payload (ISAKMP):
pluto[13156]: | next payload type: ISAKMP_NEXT_NONE
pluto[13156]: | length: 36
pluto[13156]: | transform number: 5
pluto[13156]: | transform ID: KEY_IKE
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_ENCRYPTION_ALGORITHM
pluto[13156]: | length/value: 5
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_HASH_ALGORITHM
pluto[13156]: | length/value: 2
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_GROUP_DESCRIPTION
pluto[13156]: | length/value: 2
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_AUTHENTICATION_METHOD
pluto[13156]: | length/value: 1
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_LIFE_TYPE
pluto[13156]: | length/value: 1
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_LIFE_DURATION (variable length)
pluto[13156]: | length/value: 4
pluto[13156]: "conn_pptp_ipsec"[1] 172.21.33.79 #1: responding to Main Mode from unknown peer 172.21.33.79
pluto[13156]: | ****parse IPsec DOI SIT:
pluto[13156]: | IPsec DOI SIT: SIT_IDENTITY_ONLY
pluto[13156]: | ****parse ISAKMP Proposal Payload:
pluto[13156]: | next payload type: ISAKMP_NEXT_NONE
pluto[13156]: | length: 200
pluto[13156]: | proposal number: 1
pluto[13156]: | protocol ID: PROTO_ISAKMP
pluto[13156]: | SPI size: 0
pluto[13156]: | number of transforms: 5
pluto[13156]: | *****parse ISAKMP Transform Payload (ISAKMP):
pluto[13156]: | next payload type: ISAKMP_NEXT_T
pluto[13156]: | length: 40
pluto[13156]: | transform number: 1
pluto[13156]: | transform ID: KEY_IKE
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_ENCRYPTION_ALGORITHM
pluto[13156]: | length/value: 7
pluto[13156]: | [7 is OAKLEY_AES_CBC]
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_KEY_LENGTH
pluto[13156]: | length/value: 256
pluto[13156]: "conn_pptp_ipsec"[1] 172.21.33.79 #1: enckey:256
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_HASH_ALGORITHM
pluto[13156]: | length/value: 2
pluto[13156]: | [2 is OAKLEY_SHA]
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_GROUP_DESCRIPTION
pluto[13156]: | length/value: 20
pluto[13156]: "conn_pptp_ipsec"[1] 172.21.33.79 #1: only OAKLEY_GROUP_MODP768,1024,1536,2048,3072,4096,6144,8192 supported. Attribute OAKLEY_GROUP_DESCRIPTION
pluto[13156]: | *****parse ISAKMP Transform Payload (ISAKMP):
pluto[13156]: | next payload type: ISAKMP_NEXT_T
pluto[13156]: | length: 40
pluto[13156]: | transform number: 2
pluto[13156]: | transform ID: KEY_IKE
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_ENCRYPTION_ALGORITHM
pluto[13156]: | length/value: 7
pluto[13156]: | [7 is OAKLEY_AES_CBC]
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_KEY_LENGTH
pluto[13156]: | length/value: 128
pluto[13156]: "conn_pptp_ipsec"[1] 172.21.33.79 #1: enckey:128
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_HASH_ALGORITHM
pluto[13156]: | length/value: 2
pluto[13156]: | [2 is OAKLEY_SHA]
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_GROUP_DESCRIPTION
pluto[13156]: | length/value: 19
pluto[13156]: "conn_pptp_ipsec"[1] 172.21.33.79 #1: only OAKLEY_GROUP_MODP768,1024,1536,2048,3072,4096,6144,8192 supported. Attribute OAKLEY_GROUP_DESCRIPTION
pluto[13156]: | *****parse ISAKMP Transform Payload (ISAKMP):
pluto[13156]: | next payload type: ISAKMP_NEXT_T
pluto[13156]: | length: 40
pluto[13156]: | transform number: 3
pluto[13156]: | transform ID: KEY_IKE
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_ENCRYPTION_ALGORITHM
pluto[13156]: | length/value: 7
pluto[13156]: | [7 is OAKLEY_AES_CBC]
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_KEY_LENGTH
pluto[13156]: | length/value: 256
pluto[13156]: "conn_pptp_ipsec"[1] 172.21.33.79 #1: enckey:256
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_HASH_ALGORITHM
pluto[13156]: | length/value: 2
pluto[13156]: | [2 is OAKLEY_SHA]
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_GROUP_DESCRIPTION
pluto[13156]: | length/value: 14
pluto[13156]: | [14 is OAKLEY_GROUP_MODP2048]
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_AUTHENTICATION_METHOD
pluto[13156]: | length/value: 1
pluto[13156]: | [1 is OAKLEY_PRESHARED_KEY]
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_LIFE_TYPE
pluto[13156]: | length/value: 1
pluto[13156]: | [1 is OAKLEY_LIFE_SECONDS]
pluto[13156]: | ******parse ISAKMP Oakley attribute:
pluto[13156]: | af+type: OAKLEY_LIFE_DURATION (variable length)
pluto[13156]: | length/value: 4
pluto[13156]: | long duration: 28800
pluto[13156]: | Oakley Transform 3 accepted
pluto[13156]: "conn_pptp_ipsec"[1] 172.21.33.79 #1: transition from state (null) to state STATE_MAIN_R1
pluto[13156]: |
pluto[13156]: | *received 388 bytes from 172.21.33.79:500 on eth0
pluto[13156]: | **parse ISAKMP Message:
pluto[13156]: | initiator cookie:
pluto[13156]: | c1 b5 e9 73 75 61 93 46
pluto[13156]: | responder cookie:
pluto[13156]: | f4 91 b1 f7 4b b0 5c 11
pluto[13156]: | next payload type: ISAKMP_NEXT_KE
pluto[13156]: | ISAKMP version: ISAKMP Version 1.0
pluto[13156]: | exchange type: ISAKMP_XCHG_IDPROT
pluto[13156]: | flags: none
pluto[13156]: | message ID: 00 00 00 00
pluto[13156]: | length: 388
pluto[13156]: | The xchg type is ISAKMP_XCHG_IDPROT (2)
pluto[13156]: | ***parse ISAKMP Key Exchange Payload:
pluto[13156]: | next payload type: ISAKMP_NEXT_NONCE
pluto[13156]: | length: 260
pluto[13156]: | ***parse ISAKMP Nonce Payload:
pluto[13156]: | next payload type: ISAKMP_NEXT_NAT-D
pluto[13156]: | length: 52
pluto[13156]: | ***parse ISAKMP NAT-D Payload:
pluto[13156]: | next payload type: ISAKMP_NEXT_NAT-D
pluto[13156]: | length: 24
pluto[13156]: | ***parse ISAKMP NAT-D Payload:
pluto[13156]: | next payload type: ISAKMP_NEXT_NONE
pluto[13156]: | length: 24
pluto[13156]: "conn_pptp_ipsec"[1] 172.21.33.79 #1: NAT-Traversal: Result using RFC 3947: peer is NATed
pluto[13156]: "conn_pptp_ipsec"[1] 172.21.33.79 #1: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
pluto[13156]: |
pluto[13156]: | *received 76 bytes from 172.21.33.79:4500 on eth0
pluto[13156]: | **parse ISAKMP Message:
pluto[13156]: | initiator cookie:
pluto[13156]: | c1 b5 e9 73 75 61 93 46
pluto[13156]: | responder cookie:
pluto[13156]: | f4 91 b1 f7 4b b0 5c 11
pluto[13156]: | next payload type: ISAKMP_NEXT_ID
pluto[13156]: | ISAKMP version: ISAKMP Version 1.0
pluto[13156]: | exchange type: ISAKMP_XCHG_IDPROT
pluto[13156]: | flags: ISAKMP_FLAG_ENCRYPTION
pluto[13156]: | message ID: 00 00 00 00
pluto[13156]: | length: 76
pluto[13156]: | The xchg type is ISAKMP_XCHG_IDPROT (2)
pluto[13156]: | ***parse ISAKMP Identification Payload:
pluto[13156]: | next payload type: ISAKMP_NEXT_HASH
pluto[13156]: | length: 12
pluto[13156]: | ID type: ID_IPV4_ADDR
pluto[13156]: | DOI specific A: 0
pluto[13156]: | DOI specific B: 0
pluto[13156]: | ***parse ISAKMP Hash Payload:
pluto[13156]: | next payload type: ISAKMP_NEXT_NONE
pluto[13156]: | length: 24
pluto[13156]: | removing 12 bytes of padding
pluto[13156]: "conn_pptp_ipsec"[1] 172.21.33.79 #1: Main mode peer ID is ID_IPV4_ADDR: '192.168.10.100'
pluto[13156]: "conn_pptp_ipsec"[2] 172.21.33.79 #1: deleting connection "conn_pptp_ipsec" instance with peer 172.21.33.79
pluto[13156]: "conn_pptp_ipsec"[2] 172.21.33.79 #1: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3
pluto[13156]: | NAT-T: new mapping 172.21.33.79:500/4500)
pluto[13156]: "conn_pptp_ipsec"[2] 172.21.33.79:4500 #1: sent MR3, ISAKMP SA established
pluto[13156]: |
pluto[13156]: | *received 220 bytes from 172.21.33.79:4500 on eth0
pluto[13156]: | **parse ISAKMP Message:
pluto[13156]: | initiator cookie:
pluto[13156]: | c1 b5 e9 73 75 61 93 46
pluto[13156]: | responder cookie:
pluto[13156]: | f4 91 b1 f7 4b b0 5c 11
pluto[13156]: | next payload type: ISAKMP_NEXT_HASH
pluto[13156]: | ISAKMP version: ISAKMP Version 1.0
pluto[13156]: | exchange type: ISAKMP_XCHG_QUICK
pluto[13156]: | flags: ISAKMP_FLAG_ENCRYPTION
pluto[13156]: | message ID: 00 00 00 01
pluto[13156]: | length: 220
pluto[13156]: | The xchg type is ISAKMP_XCHG_QUICK (32)
pluto[13156]: | ***parse ISAKMP Hash Payload:
pluto[13156]: | next payload type: ISAKMP_NEXT_SA
pluto[13156]: | length: 24
pluto[13156]: | ***parse ISAKMP Security Association Payload:
pluto[13156]: | next payload type: ISAKMP_NEXT_NONCE
pluto[13156]: | length: 64
pluto[13156]: | DOI: ISAKMP_DOI_IPSEC
pluto[13156]: | ***parse ISAKMP Nonce Payload:
pluto[13156]: | next payload type: ISAKMP_NEXT_ID
pluto[13156]: | length: 52
pluto[13156]: | ***parse ISAKMP Identification Payload (IPsec DOI):
pluto[13156]: | next payload type: ISAKMP_NEXT_ID
pluto[13156]: | length: 12
pluto[13156]: | ID type: ID_IPV4_ADDR
pluto[13156]: | Protocol ID: 17
pluto[13156]: | port: 1701
pluto[13156]: | ***parse ISAKMP Identification Payload (IPsec DOI):
pluto[13156]: | next payload type: ISAKMP_NEXT_NAT-OA
pluto[13156]: | length: 12
pluto[13156]: | ID type: ID_IPV4_ADDR
pluto[13156]: | Protocol ID: 17
pluto[13156]: | port: 1701
pluto[13156]: | ***parse ISAKMP NAT-OA Payload:
pluto[13156]: | next payload type: ISAKMP_NEXT_NAT-OA
pluto[13156]: | length: 12
pluto[13156]: | ID type: ID_IPV4_ADDR
pluto[13156]: | ***parse ISAKMP NAT-OA Payload:
pluto[13156]: | next payload type: ISAKMP_NEXT_NONE
pluto[13156]: | length: 12
pluto[13156]: | ID type: ID_IPV4_ADDR
pluto[13156]: | removing 4 bytes of padding
pluto[13156]: | peer client is 192.168.10.100/32
pluto[13156]: | peer client protocol/port is 17/1701
pluto[13156]: | our client is 172.21.33.8/32
pluto[13156]: | our client protocol/port is 17/1701
pluto[13156]: "conn_pptp_ipsec"[2] 172.21.33.79:4500 #1: cannot respond to IPsec SA request because no connection is known for 172.21.33.8:4500:17/1701...172.21.33.79:4500[192.168.10.100]:17/1701===192.168.10.100/32
pluto[13156]: "conn_pptp_ipsec"[2] 172.21.33.79:4500 #1: sending encrypted notification INVALID_ID_INFORMATION to 172.21.33.79:4500
pluto[13156]: |
pluto[13156]: | *received 220 bytes from 172.21.33.79:4500 on eth0
pluto[13156]: | **parse ISAKMP Message:
pluto[13156]: | initiator cookie:
pluto[13156]: | c1 b5 e9 73 75 61 93 46
pluto[13156]: | responder cookie:
pluto[13156]: | f4 91 b1 f7 4b b0 5c 11
pluto[13156]: | next payload type: ISAKMP_NEXT_HASH
pluto[13156]: | ISAKMP version: ISAKMP Version 1.0
pluto[13156]: | exchange type: ISAKMP_XCHG_QUICK
pluto[13156]: | flags: ISAKMP_FLAG_ENCRYPTION
pluto[13156]: | message ID: 00 00 00 01
pluto[13156]: | length: 220
pluto[13156]: | The xchg type is ISAKMP_XCHG_QUICK (32)
pluto[13156]: "conn_pptp_ipsec"[2] 172.21.33.79:4500 #1: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x01000000 (perhaps this is a duplicated packet)
pluto[13156]: "conn_pptp_ipsec"[2] 172.21.33.79:4500 #1: sending encrypted notification INVALID_MESSAGE_ID to 172.21.33.79:4500

trace code到了這裡 ipsec_doi.c

quick_inI1_outR1(struct msg_digest *md) --->
   quick_inI1_outR1_tail --->
   find_client_connection

static stf_status
quick_inI1_outR1_tail(struct msg_digest *md
, struct p2id *my, struct p2id *his
, unsigned int new_iv_len
, const u_char new_iv[MAX_DIGEST_LEN])
{
   struct state *const p1st = md->st;
   struct connection *c = p1st->st_connection;
   struct payload_digest *const id_pd = md->chain[ISAKMP_NEXT_ID];
   ip_subnet *our_net = &my->net
   , *his_net = &his->net;

   u_char /* set by START_HASH_PAYLOAD: */
   *r_hashval, /* where in reply to jam hash value */
   *r_hash_start; /* from where to start hashing */

   /* Now that we have identities of client subnets, we must look for
   * a suitable connection (our current one only matches for hosts).
   */
   {
   struct connection *p = find_client_connection(c
   , our_net, his_net, my->proto, my->port, his->proto, his->port);

   if (p == NULL) //win 7 會等於null，xp不會…

看來是在這裡有問題: connections.c

struct connection *
find_client_connection(struct connection *c
, const ip_subnet *our_net, const ip_subnet *peer_net
, const u_int8_t our_protocol, const u_int16_t our_port
, const u_int8_t peer_protocol, const u_int16_t peer_port)
{

....

   if (samesubnet(&c->this.client, our_net)
   && samesubnet(&c->that.client, peer_net) //win7會fail
   && (c->this.protocol == our_protocol)
   && (!c->this.port || (c->this.port == our_port))
   && (c->that.protocol == peer_protocol)
   && (!c->that.port || (c->that.port == peer_port)))
   {
   passert(oriented(*c));
   if (routed(c->routing))
   return c;

   unrouted = c;//在nat-d下xp會找到connection，xp的QI1的id是fqdn，win7是ipv4…所以找不到connection
   }

   /* exact match? */
   d = fc_try(FALSE, c, c->host_pair, NULL, our_net, peer_net
   , our_protocol, our_port, peer_protocol, peer_port);

-----------------------------
再試一下xp和win7的nat-d

// WIN7 NAT-D
pluto[8303]: "conn_pptp_ipsec"[1] 172.21.33.79 #1: enckey:256
pluto[8303]: "conn_pptp_ipsec"[1] 172.21.33.79 #1: transition from state (null) to state STATE_MAIN_R1
pluto[8303]: "conn_pptp_ipsec"[1] 172.21.33.79 #1: NAT-Traversal: Result using RFC 3947: peer is NATed
pluto[8303]: "conn_pptp_ipsec"[1] 172.21.33.79 #1: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
pluto[8303]: "conn_pptp_ipsec"[1] 172.21.33.79 #1: Main mode peer ID is ID_IPV4_ADDR: '192.168.10.100'
pluto[8303]: "conn_pptp_ipsec"[2] 172.21.33.79 #1: deleting connection "conn_pptp_ipsec" instance with peer 172.21.33.79
pluto[8303]: "conn_pptp_ipsec"[2] 172.21.33.79 #1: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3
pluto[8303]: | NAT-T: new mapping 172.21.33.79:500/4500)
pluto[8303]: "conn_pptp_ipsec"[2] 172.21.33.79:4500 #1: sent MR3, ISAKMP SA established
pluto[8303]: "conn_pptp_ipsec"[2] 172.21.33.79:4500 #1: find_client_connection:2431\012
pluto[8303]: "conn_pptp_ipsec"[2] 172.21.33.79:4500 #1: that client:172.21.33.79/32\012
pluto[8303]: "conn_pptp_ipsec"[2] 172.21.33.79:4500 #1: peer net:192.168.10.100/32\012
pluto[8303]: "conn_pptp_ipsec"[2] 172.21.33.79:4500 #1: find_client_connection,2447\012
pluto[8303]: "conn_pptp_ipsec"[2] 172.21.33.79:4500 #1: find_client_connection:2481: d:unroute\012
pluto[8303]: "conn_pptp_ipsec"[2] 172.21.33.79:4500 #1: find_client_connection:2485\012
pluto[8303]: "conn_pptp_ipsec"[2] 172.21.33.79:4500 #1: find_client_connection:2517: d:unroute\012

//XP NAT-D
pluto[8303]: "conn_pptp_ipsec"[3] 172.21.33.79 #2: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: peer is NATed
pluto[8303]: "conn_pptp_ipsec"[3] 172.21.33.79 #2: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
pluto[8303]: "conn_pptp_ipsec"[3] 172.21.33.79 #2: Main mode peer ID is ID_FQDN: '@cameo-80e9e70cd'
pluto[8303]: "conn_pptp_ipsec"[4] 172.21.33.79 #2: deleting connection "conn_pptp_ipsec" instance with peer 172.21.33.79
pluto[8303]: "conn_pptp_ipsec"[4] 172.21.33.79 #2: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3
pluto[8303]: | NAT-T: new mapping 172.21.33.79:500/4500)
pluto[8303]: "conn_pptp_ipsec"[4] 172.21.33.79:4500 #2: sent MR3, ISAKMP SA established
pluto[8303]: "conn_pptp_ipsec"[4] 172.21.33.79:4500 #2: find_client_connection:2431\012
pluto[8303]: "conn_pptp_ipsec"[4] 172.21.33.79:4500 #2: that client:172.21.33.79/32\012
pluto[8303]: "conn_pptp_ipsec"[4] 172.21.33.79:4500 #2: peer net:172.21.33.79/32\012

看來真的是xp和win7的id_doi的問題…但還不能下定論…
而以下的文章應該和我猜的沒錯…
重點是說…vista基於nat-d 的security考量，而沒有辦法和openswan的nat-d連線

http://www.jacco2.dds.nl/networking/vista-openswan.html

7.1.1 Issue with Windows Vista and server-side NAT
Windows Vista has the same issue as Windows XP with ServicePack 2. This issue was discovered by George Ou. Vista does not support establishing IPsec connections to servers behind NAT. Apparently Microsoft considers this a security risk because of an (uncommon) scenario which is described here. Microsoft even says that a VPN server behind NAT is "not recommended" (see also KB Q885348), although the NAT-T RFC describes it as a normal setup that should be supported. The problem occurs with both Windows Server 2003 and Openswan, so it is an issue in Vista, not Openswan.

7.1.2 PSK and NAT-T in Vista
In most (production) cases you will want to use certificate authentication instead of a Preshared Key (PSK). Certificates provide better security and work better when NAT is involved. However, in some cases you may be forced to use a PSK.
Windows Vista is very similar to the L2TP/IPsec client included with Windows XP/2003, but there is an additional requirement when a PSK is used and NAT is involved. You have to add this line to your L2TP-PSK section:
rightsubnet=vhost:%no,%priv
Windows XP/2003 support PSKs and NAT-T but they are based on draft-02 of the NAT-T standard ("draft-ietf-ipsec-nat-t-ike-02"). Vista also supports this draft-02 but when connecting to recent versions of Openswan it prefers RFC 3947 over draft-02. Apparently these implementations use different identifiers when NAT is involved: when a Windows XP/2003 client connects, Openswan reports the following:
Main mode peer ID is ID_FQDN: '@blabla.example.com'
But when a Vista client connects (or probably any other RFC 3947 compliant client), the following is reported:
Main mode peer ID is ID_IPV4_ADDR: 'x.x.x.x'
(Where x.x.x.x is the IP address that the client has on the NATed network).

這是ms的說法…但我沒去看…呼~~~希望我不用fix這個bug
http://technet.microsoft.com/zh-tw/library/bb878119(en-us).aspx#ECAA

我再回頭看M1的vendor ID好像是真的沒錯…

: packet from 172.21.33.79:500: ignoring Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]
: packet from 172.21.33.79:500: ignoring Vendor ID payload [FRAGMENTATION]
: packet from 172.21.33.79:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
: packet from 172.21.33.79:500: ignoring Vendor ID payload [26244d38eddb61b3172a36e3d0cfb819]

: packet from 172.21.33.79:500: ignoring Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000008]
: packet from 172.21.33.79:500: received Vendor ID payload [RFC 3947]
: packet from 172.21.33.79:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
: packet from 172.21.33.79:500: ignoring Vendor ID payload [FRAGMENTATION]
: packet from 172.21.33.79:500: ignoring Vendor ID payload [fb1de3cdf341b7ea16b7e5be0855f120]
: packet from 172.21.33.79:500: ignoring Vendor ID payload [26244d38eddb61b3172a36e3d0cfb819]
: packet from 172.21.33.79:500: ignoring Vendor ID payload [e3a5966a76379fe707228231e5ce8652]

訂閱：文章 (Atom)

黃巾賊的私人日記

2010年4月23日星期五

gcc cross compiler union compatible issue.

2010年4月20日星期二

how to change default stack size...

2010年4月11日星期日

office 2007 快速鍵

Keyboard Shortcut

Result in Excel 2000 - General

Keyboard Shortcut

Result in Excel 2000 - Formulas

Keyboard Shortcut

Result in Excel 2000 - Movement

Keyboard Shortcut

Result in Excel 2000 - Cell Selection

2010年4月8日星期四

LAB L2TPD + IPSec in NONE-MMU

2010年4月5日星期一

openswn porting

2010年3月30日星期二

l2tpd over IPSec NAT-D in Win7

網頁

關於我自己

2010年4月23日 星期五

gcc cross compiler union compatible issue.

2010年4月20日 星期二

how to change default stack size...

2010年4月11日 星期日

office 2007 快速鍵

Keyboard Shortcut

Result in Excel 2000 - General

Keyboard Shortcut

Result in Excel 2000 - Formulas

Keyboard Shortcut

Result in Excel 2000 - Movement

Keyboard Shortcut

Result in Excel 2000 - Cell Selection

2010年4月8日 星期四

LAB L2TPD + IPSec in NONE-MMU

2010年4月5日 星期一

openswn porting

2010年3月30日 星期二

l2tpd over IPSec NAT-D in Win7

2010年4月23日星期五

2010年4月20日星期二

2010年4月11日星期日

2010年4月8日星期四

2010年4月5日星期一

2010年3月30日星期二