[U-Boot] Pluto not work after log message : Errno 28: No space left on device

陈琳涛 chenlt at iceflow.cn
Mon Dec 15 06:40:50 CET 2008 

Hi , all :

Linux  kernel  2.6.19  , klips nat-t patched

Openswan  2.4.9 

 

pluto not work after  message

2008/12/14 16:36:10 INTERNET pluto[1415]: ERROR: "PROFILE_1"[676]
60.166.215.36 #21071: pfkey write() of SADB_ADD message 63711 for Add SA
tun.4593 at 60.166.215.36 failed. Errno 28: No space left on device

 

I defined only on roadwarrior connection , It worked well for quit a long
time under 500 peers (Linksys box).

Now clients increased to 700  and Pluto refused to work with lots of ERROR
messages below . I “GREPED” only the first error connection for short .

It happens at rekeying period . SADB buffer overflow ? … memory leak ??
Any suggestions , Thx 

 

 

/etc/ipsec.conf

version 2

config setup

                   interfaces=”ipsec0=eth0”

        pluto=yes

        plutowait=no

        plutodebug=none

        klipsdebug=none

        uniqueids=yes

        nat_traversal=no

        nhelpers=0

 

 

 

conn    %default

        type=tunnel

        keyingtries=0

        keyexchange=ike

        auto=start

        authby=secret

        auth=esp

        ikelifetime=1h

        rekeymargin=10m

        rekeyfuzz=20%

        keylife=8h

        compress=no

 

 

conn PROFILE_1

        pfs=yes

        keylife=3600s

        ikelifetime=86400s

        ike=des-md5-modp768,des-sha1-modp768,3des-md5,3des-sha1,3des-md5

        esp=3des-md5

        compress=no

        left=218.xx.xx.xx

        leftnexthop=218.xx.xx.xx

        leftsubnet=129.100.248.0/21

        leftsourceip=129.100.253.50

        auto=add

        right=%any

        rightsubnetwithin=0.0.0.0/0

 

#Disable Opportunistic Encryption

conn block

        auto=ignore

conn private

        auto=ignore

conn private-or-clear

        auto=ignore

conn clear-or-private

        auto=ignore

conn clear

        auto=ignore

conn packetdefault

        auto=ignore

 

Log ： 

2008/12/14 15:45:26 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#18338: initiating Main Mode to replace #15846

2008/12/14 15:45:26 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#18338: You should NOT use insecure IKE algorithms (OAKLEY_DES_CBC)!

2008/12/14 15:45:26 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#18338: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2

2008/12/14 15:45:26 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#18338: STATE_MAIN_I2: sent MI2, expecting MR2

2008/12/14 15:45:27 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#18338: I did not send a certificate because I do not have one.

2008/12/14 15:45:27 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#18338: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3

2008/12/14 15:45:27 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#18338: STATE_MAIN_I3: sent MI3, expecting MR3

2008/12/14 15:45:27 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#18338: Main mode peer ID is ID_IPV4_ADDR: '60.166.215.36'

2008/12/14 15:45:27 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#18338: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4

2008/12/14 15:45:27 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#18338: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY
cipher=oakley_des_cbc_64 prf=oakley_md5 group=modp768}

2008/12/14 15:45:27 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#18340: initiating Quick Mode PSK+ENCRYPT+TUNNEL+PFS to replace #15848
{using isakmp#18338}

2008/12/14 15:45:28 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#18340: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2

2008/12/14 15:45:28 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#18340: STATE_QUICK_I2: sent QI2, IPsec SA established {ESP=>0xbbe29168
<0x9c158064 xfrm=3DES_0-HMAC_MD5 NATD=none DPD=none}

2008/12/14 15:50:18 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#15846: received Delete SA(0xf432d9a4) payload: deleting IPSEC State #15848

2008/12/14 15:50:18 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#15846: received and ignored informational message

 

 

2008/12/14 16:33:43 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#20930: initiating Main Mode to replace #18338

2008/12/14 16:33:44 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#20930: You should NOT use insecure IKE algorithms (OAKLEY_DES_CBC)!

2008/12/14 16:33:44 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#20930: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2

2008/12/14 16:33:44 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#20930: STATE_MAIN_I2: sent MI2, expecting MR2

2008/12/14 16:33:44 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#20930: I did not send a certificate because I do not have one.

2008/12/14 16:33:44 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#20930: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3

2008/12/14 16:33:44 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#20930: STATE_MAIN_I3: sent MI3, expecting MR3

2008/12/14 16:33:45 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#20930: Main mode peer ID is ID_IPV4_ADDR: '60.166.215.36'

2008/12/14 16:33:45 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#20930: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4

2008/12/14 16:33:45 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#20930: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY
cipher=oakley_des_cbc_64 prf=oakley_md5 group=modp768}

 

2008/12/14 16:34:09 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#20946: responding to Main Mode from unknown peer 60.166.215.36

2008/12/14 16:34:09 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#20946: You should NOT use insecure IKE algorithms (OAKLEY_DES_CBC)!

2008/12/14 16:34:09 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#20946: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1

2008/12/14 16:34:09 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#20946: STATE_MAIN_R1: sent MR1, expecting MI2

2008/12/14 16:34:09 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#20946: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2

2008/12/14 16:34:09 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#20946: STATE_MAIN_R2: sent MR2, expecting MI3

2008/12/14 16:34:10 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#20946: Main mode peer ID is ID_IPV4_ADDR: '60.166.215.36'

2008/12/14 16:34:10 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#20946: I did not send a certificate because I do not have one.

2008/12/14 16:34:10 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#20946: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3

2008/12/14 16:34:10 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#20946: STATE_MAIN_R3: sent MR3, ISAKMP SA established
{auth=OAKLEY_PRESHARED_KEY cipher=oakley_des_cbc_64 prf=oakley_sha
group=modp768}

2008/12/14 16:34:11 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#20947: responding to Quick Mode {msgid:fcd27e1e}

2008/12/14 16:34:11 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#20947: transition from state STATE_QUICK_R0 to state STATE_QUICK_R1

2008/12/14 16:34:11 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#20947: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2

2008/12/14 16:34:11 INTERNET pluto[1415]: ERROR: "PROFILE_1"[676]
60.166.215.36 #20947: pfkey write() of SADB_ADD message 63627 for Add SA
esp.d3719364 at 60.166.215.36 failed. Errno 28: No space left on device

2008/12/14 16:36:09 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#21069: responding to Main Mode from unknown peer 60.166.215.36

2008/12/14 16:36:09 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#21069: You should NOT use insecure IKE algorithms (OAKLEY_DES_CBC)!

2008/12/14 16:36:09 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#21069: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1

2008/12/14 16:36:09 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#21069: STATE_MAIN_R1: sent MR1, expecting MI2

2008/12/14 16:36:09 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#21069: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2

2008/12/14 16:36:09 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#21069: STATE_MAIN_R2: sent MR2, expecting MI3

2008/12/14 16:36:10 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#21069: Main mode peer ID is ID_IPV4_ADDR: '60.166.215.36'

2008/12/14 16:36:10 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#21069: I did not send a certificate because I do not have one.

2008/12/14 16:36:10 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#21069: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3

2008/12/14 16:36:10 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#21069: STATE_MAIN_R3: sent MR3, ISAKMP SA established
{auth=OAKLEY_PRESHARED_KEY cipher=oakley_des_cbc_64 prf=oakley_sha
group=modp768}

2008/12/14 16:36:10 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#21071: responding to Quick Mode {msgid:fdc82638}

2008/12/14 16:36:10 INTERNET pluto[1415]: ERROR: "PROFILE_1"[676]
60.166.215.36 #21071: pfkey write() of SADB_ADD message 63711 for Add SA
tun.4593 at 60.166.215.36 failed. Errno 28: No space left on device

2008/12/14 16:36:38 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#21113: responding to Main Mode from unknown peer 60.166.215.36

2008/12/14 16:36:38 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#21113: You should NOT use insecure IKE algorithms (OAKLEY_DES_CBC)!

2008/12/14 16:36:38 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#21113: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1

2008/12/14 16:36:39 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#21113: STATE_MAIN_R1: sent MR1, expecting MI2

2008/12/14 16:36:39 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#21113: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2

2008/12/14 16:36:39 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#21113: STATE_MAIN_R2: sent MR2, expecting MI3

2008/12/14 16:36:40 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#21113: Main mode peer ID is ID_IPV4_ADDR: '60.166.215.36'

2008/12/14 16:36:40 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#21113: I did not send a certificate because I do not have one.

2008/12/14 16:36:40 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#21113: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3

2008/12/14 16:36:40 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#21113: STATE_MAIN_R3: sent MR3, ISAKMP SA established
{auth=OAKLEY_PRESHARED_KEY cipher=oakley_des_cbc_64 prf=oakley_sha
group=modp768}

2008/12/14 16:36:40 INTERNET pluto[1415]: "PROFILE_1"[676] 60.166.215.36
#21118: responding to Quick Mode {msgid:04712648}

More information about the U-Boot mailing list