openswan的编译过程

1. 下载源码：

对于openswan源码，我们是从官网上下载的。这里提供两个不同的网站：

2. 在虚拟机上解压后编译：

我解压后的源码目录为：root@ubantu:/usr/src/openswan-2.6.51.5#

2.1 查看INSTALL文件

  1. root@ubantu:/usr/src/openswan-2.6.51.5# cat INSTALL 
  3. Please read the documentation in doc/ & docs/
  5. Building userland: 
  7. 	make programs install
  9. Building KLIPS kernel module on 2.4 (assuming your kernel source is /usr/src/linux-2.4)
  11. 	make KERNELSRC=/usr/src/linux-2.4 module minstall
  13. Building KLIPS kernel module on 2.6
  15. 	make KERNELSRC=/lib/modules/`uname -r`/build module minstall
  16. root@ubantu:/usr/src/openswan-2.6.51.5#

从这个文件可以看出直接运行make programs install命令即可。直接输入该命令进行编译：

  1. root@ubantu:/usr/src/openswan-2.6.51.5# make programs install
  2. OBJDIR: OBJ.linux.x86_64
  3. (cd /usr/src/openswan-2.6.51.5/OBJ.linux.x86_64 && OBJDIRTOP=/usr/src/openswan-2.6.51.5/OBJ.linux.x86_64 OBJDIR=/usr/src/openswan-2.6.51.5/OBJ.linux.x86_64 make programs )
  4. make[1]: Entering directory '/usr/src/openswan-2.6.51.5/OBJ.linux.x86_64'
  5. make[2]: Entering directory '/usr/src/openswan-2.6.51.5/OBJ.linux.x86_64/lib'
  6. make[3]: Entering directory '/usr/src/openswan-2.6.51.5/OBJ.linux.x86_64/lib/libopenswan'
  7. CC id.c
  8. In file included from /usr/src/openswan-2.6.51.5/include/certs.h:24:0,
  9.                  from /usr/src/openswan-2.6.51.5/lib/libopenswan/id.c:42:
  10. /usr/src/openswan-2.6.51.5/include/secrets.h:20:10: fatal error: gmp.h: No such file or directory
  11.  #include <gmp.h>    /* GNU MP library */
  12.           ^~~~~~~
  13. compilation terminated.
  14. /usr/src/openswan-2.6.51.5/lib/libopenswan/Makefile:175: recipe for target 'id.o' failed
  15. make[3]: *** [id.o] Error 1
  16. make[3]: Leaving directory '/usr/src/openswan-2.6.51.5/OBJ.linux.x86_64/lib/libopenswan'
  17. /usr/src/openswan-2.6.51.5/lib/Makefile:37: recipe for target 'programs' failed
  18. make[2]: *** [programs] Error 1
  19. make[2]: Leaving directory '/usr/src/openswan-2.6.51.5/OBJ.linux.x86_64/lib'
  20. Makefile:10: recipe for target 'programs' failed
  21. make[1]: *** [programs] Error 1
  22. make[1]: Leaving directory '/usr/src/openswan-2.6.51.5/OBJ.linux.x86_64'
  23. Makefile:185: recipe for target 'programs' failed
  24. make: *** [programs] Error 2
  25. root@ubantu:/usr/src/openswan-2.6.51.5#

提示有错误：/usr/src/openswan-2.6.51.5/include/secrets.h:20:10: fatal error: gmp.h: No such file or directory。

2.2 查看文件buildlin.sh文件

由于提示上述错误，且INSTALL文件中也没有相关说明，因此我看了下其他的文件，发现在buildlin.sh中有相关的依赖。从这个名字上就能看出这个是Linux下的自动编译脚本，因此我就尝试运行了下：

  1. root@ubantu:/usr/src/openswan-2.6.51.5# ./buildlin.sh
  2. You need to install libgmp-dev.
  3.     apt-get install libgmp-dev
  4. or  yum install gmp-dev
  6. You need to install bison.
  7.     apt-get install bison
  8. or  yum install bison
  9. You need to install flex.
  10.     apt-get install flex
  11. or  yum install flex
  12. root@ubantu:/usr/src/openswan-2.6.51.5#

提示的结果是：缺少相应的库，而第一个和我们上述的错误是相关的。因此一次安装提示的几个库：

  1. apt-get install libgmp-dev
  2. apt-get install bison
  3. apt-get install flex

安装成功后，重新执行make programs install(这实际上是两个命令make programs和make install，可以分开单独执行),结果成功编译安装：

  1. root@ubantu:/usr/src/openswan-2.6.51.5# make programs install
  2. OBJDIR: OBJ.linux.x86_64
  3. (cd /usr/src/openswan-2.6.51.5/OBJ.linux.x86_64 && OBJDIRTOP=/usr/src/openswan-2.6.51.5/OBJ.linux.x86_64 OBJDIR=/usr/src/openswan-2.6.51.5/OBJ.linux.x86_64 make programs )
  4. make[1]: Entering directory '/usr/src/openswan-2.6.51.5/OBJ.linux.x86_64'
  5. make[2]: Entering directory '/usr/src/openswan-2.6.51.5/OBJ.linux.x86_64/lib'
  6. make[3]: Entering directory '/usr/src/openswan-2.6.51.5/OBJ.linux.x86_64/lib/libopenswan'
  7. CC id.c
  8. CC initaddr.c
  9. CC initsaid.c
  10. CC initsubnet.c
  11. CC iprange.c
  12. CC keyblobtoid.c
  13. CC kernel_alg.c
  14. CC lex.c
  15. CC mpzfuncs.c
  16. CC optionsfrom.c
  17. CC oswconf.c
  18. ... ...
  19. make[3]: Leaving directory '/usr/src/openswan-2.6.51.5/OBJ.linux.x86_64/programs/tncfg'
  20. make[3]: Entering directory '/usr/src/openswan-2.6.51.5/OBJ.linux.x86_64/programs/klipsdebug'
  21. make[3]: Leaving directory '/usr/src/openswan-2.6.51.5/OBJ.linux.x86_64/programs/klipsdebug'
  22. make[3]: Entering directory '/usr/src/openswan-2.6.51.5/OBJ.linux.x86_64/programs/pf_key'
  23. make[3]: Leaving directory '/usr/src/openswan-2.6.51.5/OBJ.linux.x86_64/programs/pf_key'
  24. make[3]: Entering directory '/usr/src/openswan-2.6.51.5/OBJ.linux.x86_64/programs/_updown.mast'
  25. make[3]: Leaving directory '/usr/src/openswan-2.6.51.5/OBJ.linux.x86_64/programs/_updown.mast'
  26. make[3]: Entering directory '/usr/src/openswan-2.6.51.5/OBJ.linux.x86_64/programs/_startnetkey'
  27. make[3]: Leaving directory '/usr/src/openswan-2.6.51.5/OBJ.linux.x86_64/programs/_startnetkey'
  28. make[3]: Entering directory '/usr/src/openswan-2.6.51.5/OBJ.linux.x86_64/programs/_updown.netkey'
  29. make[3]: Leaving directory '/usr/src/openswan-2.6.51.5/OBJ.linux.x86_64/programs/_updown.netkey'
  30. make[2]: Leaving directory '/usr/src/openswan-2.6.51.5/OBJ.linux.x86_64/programs'
  31. make[1]: Leaving directory '/usr/src/openswan-2.6.51.5/OBJ.linux.x86_64'
  32. mkdir -p /usr/local/libexec/ipsec
  33. if [ -n '' ]; then echo ' ' >/usr/local/lib/ipsec/vendor.txt; fi
  34. root@ubantu:/usr/src/openswan-2.6.51.5#

3. 查看是否安装成功：

3.1 查看版本信息：

  1. root@ubantu:/usr/src/openswan-2.6.51.5/docs# ipsec --version
  2. Linux Openswan U2.6.51.5/K(no kernel code presently loaded)
  3. See `ipsec --copyright' for copyright information.
  4. root@ubantu:/usr/src/openswan-2.6.51.5/docs#

可以看出我安装的是Linux Openswan U2.6.51.5/K版本

3.2 执行ipsec verify命令：

注意：下面可能只是我的虚拟环境配置导致的问题，不是没有给人会遇到(如果是纯净的环境可能会遇到)

执行ipsec verify命令后提示有错误：命令找不到

  1. root@ubantu:/etc/ipsec.d/examples# ipsec verify
  2. /usr/local/sbin/ipsec: 148: exec: /usr/local/libexec/ipsec/verify: not found
  3. root@ubantu:/etc/ipsec.d/examples#

然后我进入到此目录，查看verify命令是否存在：

  1. root@ubantu:/usr/local/libexec/ipsec# ls *verify*
  2. verify  verify.old
  3. root@ubantu:/usr/local/libexec/ipsec#

结果是存在此文件(命令)，然后我查看了下是否有执行权限：

  1. root@ubantu:/usr/local/libexec/ipsec# ll
  2. total 24112
  3. drwxr-xr-x 2 root root    4096 4月  30 09:03 ./
  4. drwxr-xr-x 3 root root    4096 4月  30 08:10 ../
  5. -rwxr-xr-x 1 root root 1473304 4月  30 09:03 addconn*
  6. -rwxr-xr-x 1 root root 1473304 4月  30 09:02 addconn.old*
  7. -rwxr-xr-x 1 root root    5122 4月  30 09:03 auto*
  8. -rwxr-xr-x 1 root root    5122 4月  30 09:02 auto.old*
  9. -rwxr-xr-x 1 root root   11297 4月  30 09:03 barf*
  10. -rwxr-xr-x 1 root root   11297 4月  30 09:02 barf.old*
  11. -rwxr-xr-x 1 root root  498600 4月  30 09:03 eroute*
  12. -rwxr-xr-x 1 root root  498600 4月  30 09:02 eroute.old*
  13. -rwxr-xr-x 1 root root  442432 4月  30 09:03 ikeping*
  14. -rwxr-xr-x 1 root root  442432 4月  30 09:02 ikeping.old*
  15. -rwxr-xr-x 1 root root    1028 4月  30 09:03 initnss*
  16. -rwxr-xr-x 1 root root    1028 4月  30 09:02 initnss.old*
  17. -rwxr-xr-x 1 root root  430320 4月  30 09:03 klipsdebug*
  18. -rwxr-xr-x 1 root root  430320 4月  30 09:02 klipsdebug.old*
  19. -rwxr-xr-x 1 root root    2783 4月  30 09:03 look*
  20. -rwxr-xr-x 1 root root    2783 4月  30 09:02 look.old*
  21. -rwxr-xr-x 1 root root    2480 4月  30 09:03 newhostkey*
  22. -rwxr-xr-x 1 root root    2480 4月  30 09:02 newhostkey.old*
  23. -rwxr-xr-x 1 root root  400136 4月  30 09:03 pf_key*
  24. -rwxr-xr-x 1 root root  400136 4月  30 09:02 pf_key.old*
  25. -rwxr-xr-x 1 root root 5405512 4月  30 09:03 pluto*
  26. -rwxr-xr-x 1 root root 5405512 4月  30 09:02 pluto.old*
  27. -rwxr-xr-x 1 root root   12349 4月  30 09:03 policy*
  28. -rwxr-xr-x 1 root root   12349 4月  30 09:02 policy.old*
  29. -rwxr-xr-x 1 root root   35784 4月  30 09:03 ranbits*
  30. -rwxr-xr-x 1 root root   35784 4月  30 09:02 ranbits.old*
  31. -rwxr-xr-x 1 root root  106800 4月  30 09:03 rsasigkey*
  32. -rwxr-xr-x 1 root root  106800 4月  30 09:02 rsasigkey.old*
  33. -rwxr-xr-x 1 root root     704 4月  30 09:03 secrets*
  34. -rwxr-xr-x 1 root root     704 4月  30 09:02 secrets.old*
  35. lrwxrwxrwx 1 root root      17 4月  30 09:03 setup -> /etc/init.d/ipsec*
  36. -rwxr-xr-x 1 root root    1126 4月  30 09:03 showdefaults*
  37. -rwxr-xr-x 1 root root    1126 4月  30 09:02 showdefaults.old*
  38. -rwxr-xr-x 1 root root 1296672 4月  30 09:03 showhostkey*
  39. -rwxr-xr-x 1 root root 1296672 4月  30 09:02 showhostkey.old*
  40. -rwxr-xr-x 1 root root  670080 4月  30 09:03 spi*
  41. -rwxr-xr-x 1 root root  464944 4月  30 09:03 spigrp*
  42. -rwxr-xr-x 1 root root  464944 4月  30 09:02 spigrp.old*
  43. -rwxr-xr-x 1 root root  670080 4月  30 09:02 spi.old*
  44. -rwxr-xr-x 1 root root    1064 4月  30 09:03 status*
  45. -rwxr-xr-x 1 root root    1064 4月  30 09:02 status.old*
  46. -rwxr-xr-x 1 root root  426232 4月  30 09:03 tncfg*
  47. -rwxr-xr-x 1 root root  426232 4月  30 09:02 tncfg.old*
  48. -rwxr-xr-x 1 root root   16879 4月  30 09:03 verify*
  49. -rwxr-xr-x 1 root root   16879 4月  30 09:02 verify.old*
  50. -rwxr-xr-x 1 root root  579136 4月  30 09:03 whack*
  51. -rwxr-xr-x 1 root root  579136 4月  30 09:02 whack.old*
  52. root@ubantu:/usr/local/libexec/ipsec#

第48行显示是有执行权限的，那么是怎么回事呢？

我又查看了下verify这个文件的类型：

  1. root@ubantu:/usr/local/libexec/ipsec# file verify
  2. verify: Python script, ASCII text executable
  3. root@ubantu:/usr/local/libexec/ipsec#

结果显示：verify是一个python脚本

然后我又看了先我的虚拟机是否有安装python工具：通过输入python命令或者直接输入刚才要执行的命令python verify都可以看到以下提示信息：

  1. root@ubantu:/usr/local/libexec/ipsec# python
  3. Command 'python' not found, but can be installed with:
  5. apt install python3
  6. apt install python
  7. apt install python-minimal
  9. You also have python3 installed, you can run 'python3' instead.

结果自然是没有安装python环境，于是乎我按提示安装最小的python环境apt install python-minimal

  1. root@ubantu:/usr/local/libexec/ipsec# apt install python-minimal
  2. Reading package lists... Done
  3. Building dependency tree
  4. Reading state information... Done
  5. The following packages were automatically installed and are no longer required:
  6.   linux-headers-4.18.0-15 linux-headers-4.18.0-15-generic linux-image-4.18.0-15-generic linux-modules-4.18.0-15-generic
  7.   linux-modules-extra-4.18.0-15-generic
  8. Use 'sudo apt autoremove' to remove them.
  9. The following additional packages will be installed:
  10.   libpython-stdlib python python2.7 python2.7-minimal
  11. Suggested packages:
  12.   python-doc python-tk python2.7-doc binfmt-support
  13. The following NEW packages will be installed:
  14.   libpython-stdlib python python-minimal python2.7 python2.7-minimal
  15. 0 upgraded, 5 newly installed, 0 to remove and 265 not upgraded.
  16. Need to get 1,717 kB of archives.
  17. After this operation, 4,990 kB of additional disk space will be used.
  18. Do you want to continue? [Y/n] y
  19. Get:1 http://cn.archive.ubuntu.com/ubuntu bionic-updates/main amd64 python2.7-minimal amd64 2.7.17-1~18.04ubuntu1 [1,294 kB]
  20. Get:2 http://cn.archive.ubuntu.com/ubuntu bionic/main amd64 python-minimal amd64 2.7.15~rc1-1 [28.1 kB]
  21. Get:3 http://cn.archive.ubuntu.com/ubuntu bionic-updates/main amd64 python2.7 amd64 2.7.17-1~18.04ubuntu1 [248 kB]
  22. Get:4 http://cn.archive.ubuntu.com/ubuntu bionic/main amd64 libpython-stdlib amd64 2.7.15~rc1-1 [7,620 B]
  23. Get:5 http://cn.archive.ubuntu.com/ubuntu bionic/main amd64 python amd64 2.7.15~rc1-1 [140 kB]
  24. Fetched 1,717 kB in 6s (278 kB/s)
  25. Selecting previously unselected package python2.7-minimal.
  26. (Reading database ... 208792 files and directories currently installed.)
  27. Preparing to unpack .../python2.7-minimal_2.7.17-1~18.04ubuntu1_amd64.deb ...
  28. Unpacking python2.7-minimal (2.7.17-1~18.04ubuntu1) ...
  29. Selecting previously unselected package python-minimal.
  30. Preparing to unpack .../python-minimal_2.7.15~rc1-1_amd64.deb ...
  31. Unpacking python-minimal (2.7.15~rc1-1) ...
  32. Selecting previously unselected package python2.7.
  33. Preparing to unpack .../python2.7_2.7.17-1~18.04ubuntu1_amd64.deb ...
  34. Unpacking python2.7 (2.7.17-1~18.04ubuntu1) ...
  35. Selecting previously unselected package libpython-stdlib:amd64.
  36. Preparing to unpack .../libpython-stdlib_2.7.15~rc1-1_amd64.deb ...
  37. Unpacking libpython-stdlib:amd64 (2.7.15~rc1-1) ...
  38. Setting up python2.7-minimal (2.7.17-1~18.04ubuntu1) ...
  39. Linking and byte-compiling packages for runtime python2.7...
  40. Setting up python-minimal (2.7.15~rc1-1) ...
  41. Selecting previously unselected package python.
  42. (Reading database ... 208849 files and directories currently installed.)
  43. Preparing to unpack .../python_2.7.15~rc1-1_amd64.deb ...
  44. Unpacking python (2.7.15~rc1-1) ...
  45. Processing triggers for mime-support (3.60ubuntu1) ...
  46. Processing triggers for desktop-file-utils (0.23-1ubuntu3.18.04.2) ...
  47. Setting up python2.7 (2.7.17-1~18.04ubuntu1) ...
  48. Setting up libpython-stdlib:amd64 (2.7.15~rc1-1) ...
  49. Processing triggers for man-db (2.8.3-2ubuntu0.1) ...
  50. Processing triggers for gnome-menus (3.13.3-11ubuntu1.1) ...
  51. Setting up python (2.7.15~rc1-1) ...
  52. root@ubantu:/usr/local/libexec/ipsec#

成功安装上python后，重新执行ipsec verify，结果如下：

  1. root@ubantu:/usr/local/libexec/ipsec# ipsec verify
  2. /usr/local/libexec/ipsec/verify
  3. Checking if IPsec got installed and started correctly:
  5. Version check and ipsec on-path                   	[OK]
  6. Openswan U2.6.51.5/K5.3.0-46-generic (netkey)
  7. See `ipsec --copyright' for copyright information.
  8. Checking for IPsec support in kernel              	[OK]
  9.  NETKEY: Testing XFRM related proc values
  10.          ICMP default/send_redirects              	[NOT DISABLED]
  12.   Disable /proc/sys/net/ipv4/conf/*/send_redirects or NETKEY will cause act on or cause sending of bogus ICMP redirects!
  14.          ICMP default/accept_redirects            	[NOT DISABLED]
  16.   Disable /proc/sys/net/ipv4/conf/*/accept_redirects or NETKEY will cause act on or cause sending of bogus ICMP redirects!
  18.          XFRM larval drop                         	[OK]
  19. Hardware random device check                      	[N/A]
  20. Checking rp_filter                                	[ENABLED]
  21.  /proc/sys/net/ipv4/conf/all/rp_filter            	[ENABLED]
  22.  /proc/sys/net/ipv4/conf/default/rp_filter        	[ENABLED]
  23. Checking that pluto is running                    	[OK]
  24.  Pluto listening for IKE on udp 500               	[OK]
  25.  Pluto listening for IKE on tcp 500               	[NOT IMPLEMENTED]
  26.  Pluto listening for IKE/NAT-T on udp 4500        	[OK]
  27.  Pluto listening for IKE/NAT-T on tcp 4500        	[NOT IMPLEMENTED]
  28.  Pluto listening for IKE on tcp 10000 (cisco)     	[NOT IMPLEMENTED]
  29. Checking NAT and MASQUERADEing                    	[TEST INCOMPLETE]
  30. Checking 'ip' command                             	[OK]
  31. Checking 'iptables' command                       	[OK]
  33. ipsec verify: encountered errors
  34. root@ubantu:/usr/local/libexec/ipsec#

算是解决了ipsec verify无法显示的问题。

3.3 启动IPSec服务：

通过命令/etc/init.d/ipsec start命令来启动IPSec服务（为啥我的服务打印了这么多信息我还不清楚，原来大的环境记得没这么多内容，但是应该不是出错的原因）：

  1. root@ubantu:/usr/local/libexec/ipsec# /etc/init.d/ipsec start
  2. export IPSECconfreadstatus=''
  3. export IPSECklipsdebug=''
  4. export IPSECplutodebug=''
  5. export IPSECplutostderrlogtime='no'
  6. export IPSECplutorestartoncrash='yes'
  7. export IPSECdumpdir='/var/run/pluto/'
  8. export IPSECplutowait='no'
  9. export IPSECoe='no'
  10. export IPSECfragicmp='yes'
  11. export IPSEChidetos='yes'
  12. export IPSECuniqueids='yes'
  13. export IPSECnocrsend='no'
  14. export IPSECstrictcrlpolicy='no'
  15. export IPSECforce_busy='no'
  16. export IPSECvirtual_private='%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10'
  17. export IPSECnat_traversal='yes'
  18. export IPSECdisable_port_floating='no'
  19. export IPSECforce_keepalive='no'
  20. export IPSECprotostack='auto'
  21. export IPSECnhelpers='-1'
  22. export IPSECsecctx_attr_value='32001'
  23. # obsolete option 'IPSECforwardcontrol' ignored
  24. # obsolete option 'IPSECrp_filter' ignored
  25. # obsolete option 'IPSECplutofork' ignored
  26. <27>Apr 30 10:09:19 ipsec_setup: /usr/local/lib/ipsec/_realsetup start
  27. <27>Apr 30 10:09:19 ipsec_setup: Starting Openswan IPsec 2.6.51.5...
  28. <27>Apr 30 10:09:19 ipsec_setup: /usr/local/lib/ipsec/_startklips --info /var/run/pluto/ipsec.info --debug  --omtu  --fragicmp  --hidetos  --log daemon.error %defaultroute
  29. <27>Apr 30 10:09:19 ipsec_setup: No KLIPS support found while requested, desperately falling back to netkey
  30. <27>Apr 30 10:09:20 ipsec_setup: NETKEY support found. Use protostack=netkey in /etc/ipsec.conf to avoid attempts to use KLIPS. Attempting to continue with NETKEY
  31. <27>Apr 30 10:09:20 ipsec_setup: /usr/local/lib/ipsec/_startnetkey
  32. <27>Apr 30 10:09:20 ipsec_setup: MANUALSTART_confreadstatus=
  33. <27>Apr 30 10:09:20 ipsec_setup: MANUALSTART_confreadnames=""
  34. <27>Apr 30 10:09:20 ipsec_setup: /usr/local/lib/ipsec/_plutorun --debug  --uniqueids yes --force_busy  --nocrsend  --strictcrlpolicy  --nat_traversal  --keep_alive  --protostack auto --force_keepalive  --disable_port_floating no --virtual_private  --listen  --crlcheckinterval 0 --ocspuri  --nhelpers  --secctx_attr_value  --dump  --opts  --stderrlog  --wait no --plutostderrlogtime no --pre  --post  --log daemon.error --pid /var/run/pluto/pluto.pid
  35. root@ubantu:/usr/local/libexec/ipsec#

然后重新通过ipsec verify查看启动情况：

  1. root@ubantu:/usr/local/libexec/ipsec# ipsec verify
  2. /usr/local/libexec/ipsec/verify
  3. Checking if IPsec got installed and started correctly:
  5. Version check and ipsec on-path                   	[OK]
  6. Openswan U2.6.51.5/K5.3.0-46-generic (netkey)
  7. See `ipsec --copyright' for copyright information.
  8. Checking for IPsec support in kernel              	[OK]
  9.  NETKEY: Testing XFRM related proc values
  10.          ICMP default/send_redirects              	[NOT DISABLED]
  11.   Disable /proc/sys/net/ipv4/conf/*/send_redirects or NETKEY will cause act on or cause sending of bogus ICMP redirects!
  12.          ICMP default/accept_redirects            	[NOT DISABLED]
  13.   Disable /proc/sys/net/ipv4/conf/*/accept_redirects or NETKEY will cause act on or cause sending of bogus ICMP redirects!
  15.          XFRM larval drop                         	[OK]
  16. Hardware random device check                      	[N/A]
  17. Checking rp_filter                                	[ENABLED]
  18.  /proc/sys/net/ipv4/conf/all/rp_filter            	[ENABLED]
  19.  /proc/sys/net/ipv4/conf/default/rp_filter        	[ENABLED]
  20. Checking that pluto is running                    	[OK]
  21.  Pluto listening for IKE on udp 500               	[OK]
  22.  Pluto listening for IKE on tcp 500               	[NOT IMPLEMENTED]
  23.  Pluto listening for IKE/NAT-T on udp 4500        	[DISABLED]
  24.  Pluto listening for IKE/NAT-T on tcp 4500        	[NOT IMPLEMENTED]
  25.  Pluto listening for IKE on tcp 10000 (cisco)     	[NOT IMPLEMENTED]
  26. Checking NAT and MASQUERADEing                    	[TEST INCOMPLETE]
  27. Checking 'ip' command                             	[OK]
  28. Checking 'iptables' command                       	[OK]
  30. ipsec verify: encountered errors
  31. root@ubantu:/usr/local/libexec/ipsec#

该启动的基本成功启动。

3.4 修改配置文件：

3.4 修改配置文件：

由于使用ipsec verify命令查询模块信息时会提示Disable /proc/sys/net/ipv4/conf/*/send_redirects or NETKEY will cause act on or cause sending of bogus ICMP redirects!类似的信息,因此需要修改配置禁用ICMP的重定向功能。我根据网上的资料，整理了一个shell脚本。直接运行脚本即可：

  1. #########################################################################
  2. # File Name: openswan_redirects.sh
  3. # Author: Toney Sun
  4. # mail: vip_13031075266@163.com
  5. # Created Time: 2020年05月01日 星期五 10时33分15秒
  6. #########################################################################
  7. #!/bin/bash
  9. for each in /proc/sys/net/ipv4/conf/*
  10. do
  11. 	echo ${each##*/}
  12.     #echo 0 > $each/send_redirects
  13.     #echo 0 > $each/accept_redirects
  14.     echo "net.ipv4.conf.${each##*/}.send_redirects=0" >> /etc/sysctl.conf
  15.     echo "net.ipv4.conf.${each##*/}.accept_redirects=0" >> /etc/sysctl.conf
  16. done
  17. sysctl -p

3.5 重新启动ipsec功能：

再次输入命令重启ipsec功能：/etc/init.d/ipsec restart

  1. root@ubantu:/etc/ipsec.d#
  2. root@ubantu:/etc/ipsec.d# /etc/init.d/ipsec restart
  3. <27>May  1 14:43:01 ipsec_setup: Stopping Openswan IPsec...
  4. <27>May  1 14:43:02 ipsec_setup: Starting Openswan IPsec U2.6.51.5/K5.3.0-51-generic...
  5. root@ubantu:/etc/ipsec.d#

注意：我在3.3时，启动ipsec服务，打印了很多内容，这里确实是有问题的，可能是配置文件有错误导致的。我花费了一个上午的时间也没有找到是什么原因。后来更换了一个配置文件（自己写的ipsec隧道连接信息）就好了:(。我想说的是正常的启动只有上述两行打印信息。。。

3.6 添加自己的隧道环境配置

这里我添加上自己的配置信息，这是个最基本的隧道协商配置，可以协商成功：

  • /etc/ipsec.conf

    这个文件是openswan安装后的一个配置文件，可以在这个文件里添加隧道配置信息，但是我不推荐，因为我想尽可能的保留它的原有信息。只添加了最后一行，引入自己的配置文件(ipsec_vpn.conf)

    1. # /etc/ipsec.conf - Openswan IPsec configuration file
    3. # This file:  /usr/local/share/doc/openswan/ipsec.conf-sample
    4. #
    5. # Manual:     ipsec.conf.5
    7. version	2.0	# conforms to second version of ipsec.conf specification
    9. # basic configuration
    10. config setup
    11. 	# Do not set debug options to debug configuration issues!
    12. 	# plutodebug / klipsdebug = "all", "none" or a combination from below:
    13. 	# "raw crypt parsing emitting control klips pfkey natt x509 dpd private"
    14. 	# eg:
    15. 	# plutodebug="control parsing"
    16. 	# Again: only enable plutodebug or klipsdebug when asked by a developer
    17. 	#
    18. 	# enable to get logs per-peer
    19. 	# plutoopts="--perpeerlog"
    20. 	#
    21. 	# Enable core dumps (might require system changes, like ulimit -C)
    22. 	# This is required for abrtd to work properly
    23. 	# Note: incorrect SElinux policies might prevent pluto writing the core
    24. 	dumpdir=/var/run/pluto/
    25. 	#
    26. 	# NAT-TRAVERSAL support, see README.NAT-Traversal
    27. 	nat_traversal=yes
    28. 	# exclude networks used on server side by adding %v4:!a.b.c.0/24
    29. 	# It seems that T-Mobile in the US and Rogers/Fido in Canada are
    30. 	# using 25/8 as "private" address space on their 3G network.
    31. 	# This range has not been announced via BGP (at least upto 2010-12-21)
    32. 	virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10
    33. 	# OE is now off by default. Uncomment and change to on, to enable.
    34. 	oe=off
    35. 	# which IPsec stack to use. auto will try netkey, then klips then mast
    36. 	#protostack=auto
    37. 	protostack=netkey
    38. 	# Use this to log to a file, or disable logging on embedded systems (like openwrt)
    39. 	plutostderrlog=/var/log/pluto.log
    41. # Add connections here
    43. # sample VPN connection
    44. # for more examples, see /etc/ipsec.d/examples/
    45. #conn sample
    46. #		# Left security gateway, subnet behind it, nexthop toward right.
    47. #		left=10.0.0.1
    48. #		leftsubnet=172.16.0.0/24
    49. #		leftnexthop=10.22.33.44
    50. #		# Right security gateway, subnet behind it, nexthop toward left.
    51. #		right=10.12.12.1
    52. #		rightsubnet=192.168.0.0/24
    53. #		rightnexthop=10.101.102.103
    54. #		# To authorize this connection, but not actually start it,
    55. #		# at startup, uncomment this.
    56. #		#auto=add
    57. include /etc/ipsec.d/ipsec_vpn.conf

  • /etc/ipsec.d/ipsec_vpn.conf

这个文件完全是自己的(当然是参考给的demo)隧道配置信息：

  1. conn test
  3.         auto=start
  4.         pfs=no                  # PFS(Perfect Forward Secrecy)
  5.         compress=no             # IP Compression
  6.         type=tunnel
  7.         keyingtries=0
  8.         disablearrivalcheck=no
  10.         ## phase 1 ##
  11.         ike=aes128-sha1;modp1024  # 第一阶段参数
  12.         ikelifetime=86400s        # 第一阶段的生存时间
  13.         keyexchange=ike
  14.         ## phase 2 ##
  15.         phase2alg=aes128-sha1     # 第二阶段参数
  16.         salifetime=3600s          # 第二阶段参数
  17.         phase2=esp
  19.         left=192.168.1.3
  20.         leftid=@left
  21.         leftsubnet=10.28.1.0/24
  22.         leftsourceip=192.168.1.3
  23.         leftnexthop=%defaultroute
  25.         right=192.168.1.13
  26.         rightid=@right
  27.         rightsubnet=10.28.2.0/24
  28.         rightsourceip=192.168.1.13
  29.         rightnexthop=%defaultroute
  31. 	# rsakey AQPGLAfkE
  32. 	leftrsasigkey=0sAQPGLAfkEfGISg4FfXZqRe47LMX5sGyG+0ec1b5FWDriEpy4tiOvjusVzx2eyP3PTM+J9uKW93GxRugxpqa82O/aegGpnUpWGHBnEBBIvjpiMawrv3RhtCYeXodMKKqI6jhdEYzU69AYHkbPI3jOtk8TVYhaoSEkDRoBkbUzasAXOCrxL6a61G8C8XwOaW0qz+yEaoYwh/Nhc0fz1li/vQWofwXuR7ZQ5FlfDUY+JCgqbIhpmUfA9mRtawqIupYxQO3j55lhX4yUT9mBcRl9dlUNZnNEXL3hvoIABm/O+xMTwM695JBF0lVM5MJ/zizy7TsbHFJlNEPuGMI/An4FseHK0pQwe4BUZ08A8izIiI9ZT4Lp
  33. 	# rsakey AQOzIeXfR
  34. 	rightrsasigkey=0sAQOzIeXfRPL5ODGw97Y6wwotc9LExdihgdfxprYLKukKSpe3oH9G6smILqqkU+8INImuHwpL7mDPqKxDWb/YiYxRgRciXAMkuhq8c/IjcVIbK9EXSmWyPkC1Rn5+cD+2FDUd85FtQWMlEObwLJDC0UxqN5ZoFr7sR0Kur9LqZFS1FlD72E/x3RckY1R/LiR27R83Zv2EXEi1lhYf/ZstKPsGuzlEAzSnyV6jRz9Urz/SFrnyL8vGapiq5p6q+PkBEqsw97Wp8taj8tzK+lH1oxMB4+ArUKhGNk/w+tKPgKrLI8AR2nh2892P6cN0dta83t67k8Mf0ZrOCpxWLcZUnjLkFBvs9fJca3ONXH2RA+jMjn1l

隧道两端可以使用同一个配置文件(已经区分开了左右的配置)。

隧道协商过程抓包如下：

使用命令行查看状态信息如下：

  1. root@ubantu:/home# ipsec auto status
  2. ipsec auto: warning: obsolete command syntax used
  3. 000 using kernel interface: netkey
  4. 000 interface ens33/ens33 2409:8a00:18eb:2b00:69e6:ab5c:116a:da03 (AF_INET6)
  5. 000 interface ens33/ens33 2409:8a00:18eb:2b00:cdca:7d9:32ac:4d08 (AF_INET6)
  6. 000 interface lo/lo ::1 (AF_INET6)
  7. 000 interface lo/lo 127.0.0.1 (AF_INET)
  8. 000 interface lo/lo 127.0.0.1 (AF_INET)
  9. 000 interface ens33/ens33 192.168.1.3 (AF_INET)
  10. 000 interface ens33/ens33 192.168.1.3 (AF_INET)
  11. 000 using secrets file: /etc/ipsec.secrets
  12. 000 %myid = (none)
  13. 000 debug none
  14. 000
  15. 000 virtual_private (%priv):
  16. 000 - allowed 6 subnets: 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 25.0.0.0/8, fd00::/8, fe80::/10
  17. 000 - disallowed 0 subnets:
  18. 000 WARNING: Disallowed subnets in virtual_private= is empty. If you have
  19. 000          private address space in internal use, it should be excluded!
  20. 000
  21. 000 algorithm ESP encrypt: id=2, name=ESP_DES, ivlen=8, keysizemin=64, keysizemax=64
  22. 000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=8, keysizemin=192, keysizemax=192
  23. 000 algorithm ESP encrypt: id=6, name=ESP_CAST, ivlen=8, keysizemin=40, keysizemax=128
  24. 000 algorithm ESP encrypt: id=7, name=ESP_BLOWFISH, ivlen=8, keysizemin=40, keysizemax=448
  25. 000 algorithm ESP encrypt: id=11, name=ESP_NULL, ivlen=0, keysizemin=0, keysizemax=0
  26. 000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=8, keysizemin=128, keysizemax=256
  27. 000 algorithm ESP encrypt: id=13, name=ESP_AES_CTR, ivlen=8, keysizemin=160, keysizemax=288
  28. 000 algorithm ESP encrypt: id=14, name=ESP_AES_CCM_A, ivlen=8, keysizemin=128, keysizemax=256
  29. 000 algorithm ESP encrypt: id=15, name=ESP_AES_CCM_B, ivlen=8, keysizemin=128, keysizemax=256
  30. 000 algorithm ESP encrypt: id=16, name=ESP_AES_CCM_C, ivlen=8, keysizemin=128, keysizemax=256
  31. 000 algorithm ESP encrypt: id=18, name=ESP_AES_GCM_A, ivlen=8, keysizemin=160, keysizemax=288
  32. 000 algorithm ESP encrypt: id=19, name=ESP_AES_GCM_B, ivlen=12, keysizemin=160, keysizemax=288
  33. 000 algorithm ESP encrypt: id=20, name=ESP_AES_GCM_C, ivlen=16, keysizemin=160, keysizemax=288
  34. 000 algorithm ESP encrypt: id=22, name=ESP_CAMELLIA, ivlen=8, keysizemin=128, keysizemax=256
  35. 000 algorithm ESP encrypt: id=252, name=ESP_SERPENT, ivlen=8, keysizemin=128, keysizemax=256
  36. 000 algorithm ESP encrypt: id=253, name=ESP_TWOFISH, ivlen=8, keysizemin=128, keysizemax=256
  37. 000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5, keysizemin=128, keysizemax=128
  38. 000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1, keysizemin=160, keysizemax=160
  39. 000 algorithm ESP auth attr: id=5, name=AUTH_ALGORITHM_HMAC_SHA2_256, keysizemin=256, keysizemax=256
  40. 000 algorithm ESP auth attr: id=6, name=AUTH_ALGORITHM_HMAC_SHA2_384, keysizemin=384, keysizemax=384
  41. 000 algorithm ESP auth attr: id=7, name=AUTH_ALGORITHM_HMAC_SHA2_512, keysizemin=512, keysizemax=512
  42. 000 algorithm ESP auth attr: id=8, name=AUTH_ALGORITHM_HMAC_RIPEMD, keysizemin=160, keysizemax=160
  43. 000 algorithm ESP auth attr: id=9, name=AUTH_ALGORITHM_AES_CBC, keysizemin=128, keysizemax=128
  44. 000 algorithm ESP auth attr: id=251, name=AUTH_ALGORITHM_NULL_KAME, keysizemin=0, keysizemax=0
  45. 000
  46. 000 algorithm IKE encrypt: id=0, name=(null), blocksize=16, keydeflen=131
  47. 000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8, keydeflen=192
  48. 000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16, keydeflen=128
  49. 000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16
  50. 000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20
  51. 000 algorithm IKE hash: id=4, name=OAKLEY_SHA2_256, hashsize=32
  52. 000 algorithm IKE hash: id=6, name=OAKLEY_SHA2_512, hashsize=64
  53. 000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024
  54. 000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536
  55. 000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048
  56. 000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072
  57. 000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096
  58. 000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144
  59. 000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192
  60. 000 algorithm IKE dh group: id=22, name=OAKLEY_GROUP_DH22, bits=1024
  61. 000 algorithm IKE dh group: id=23, name=OAKLEY_GROUP_DH23, bits=2048
  62. 000 algorithm IKE dh group: id=24, name=OAKLEY_GROUP_DH24, bits=2048
  63. 000
  64. 000 stats db_ops: {curr_cnt, total_cnt, maxsz} :context={0,2,64} trans={0,2,3072} attrs={0,2,2048}
  65. 000
  66. 000 "test": 10.28.1.0/24===192.168.1.3[@left]---192.168.1.1...192.168.1.1---192.168.1.13[@right]===10.28.2.0/24; erouted; eroute owner: #4
  67. 000 "test":     myip=192.168.1.3; hisip=192.168.1.13;
  68. 000 "test":   keys: 1:8F4C 47D1 466A 6F7C C469 B04C 9525 1F9B E69A E022 2:none...
  69. 000 "test":        ....1:AD25 3E8F B131 F1DB 5926 B2C9 CCF1 2D3E A9D7 858D 2:none
  70. 000 "test":   ike_life: 86400s; ipsec_life: 3600s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0
  71. 000 "test":   policy: RSASIG+ENCRYPT+TUNNEL+UP+IKEv2ALLOW+SAREFTRACK; prio: 24,24; interface: ens33; kind=CK_PERMANENT
  72. 000 "test":   newest ISAKMP SA: #1; newest IPsec SA: #4; eroute owner: #4;
  73. 000 "test":   IKE algorithms wanted: AES_CBC(7)_128-SHA1(2)_000-MODP1024(2); flags=-strict
  74. 000 "test":   IKE algorithms found:  AES_CBC(7)_128-SHA1(2)_160-MODP1024(2)
  75. 000 "test":   IKE algorithm newest: AES_CBC_128-SHA1-MODP1024
  76. 000 "test":   ESP algorithms wanted: AES(12)_128-SHA1(2)_000; flags=-strict
  77. 000 "test":   ESP algorithms loaded: AES(12)_128-SHA1(2)_160
  78. 000 "test":   ESP algorithm newest: AES_128-HMAC_SHA1; pfsgroup=<N/A>
  79. 000
  80. 000 #3: "test":500 IKEv1.0 STATE_QUICK_R2 (IPsec SA established); EVENT_SA_REPLACE in 3207s; isakmp#2; idle; import:not set
  81. 000 #3: "test" esp.4476710a@192.168.1.13 esp.aaa03819@192.168.1.3 tun.0@192.168.1.13 tun.0@192.168.1.3 ref=0 refhim=4294901761
  82. 000 #2: "test":500 IKEv1.0 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 86007s; lastdpd=-1s(seq in:0 out:0); idle; import:not set
  83. 000 #4: "test":500 IKEv1.0 STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 2940s; newest IPSEC; eroute owner; isakmp#1; idle; import:admin initiate
  84. 000 #4: "test" esp.5863f7d3@192.168.1.13 esp.f2d719f9@192.168.1.3 tun.0@192.168.1.13 tun.0@192.168.1.3 ref=0 refhim=4294901761
  85. 000 #1: "test":500 IKEv1.0 STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 85579s; newest ISAKMP; lastdpd=-1s(seq in:0 out:0); idle; import:admin initiate
  86. 000
  87. root@ubantu:/home#

从80行开始便是隧道协商信息。

日志信息如下：

  1. root@ubantu:/var/log# cat pluto.log
  2. Plutorun started on Fri May 1 15:06:45 CST 2020
  3. adjusting ipsec.d to /etc/ipsec.d
  4. Labelled IPsec not enabled; value 32001 ignored.
  5. Starting Pluto (Openswan Version 2.6.51.5; Vendor ID OSW~|tYiWYsW) pid:25601
  6. LEAK_DETECTIVE support [disabled]
  7. OCF support for IKE [disabled]
  8. SAref support [disabled]: Protocol not available
  9. SAbind support [disabled]: Protocol not available
  10. NSS support [disabled]
  11. HAVE_STATSD notification support not compiled in
  12. Setting NAT-Traversal port-4500 floating to on
  13.    port floating activation criteria nat_t=1/port_float=1
  14.    NAT-Traversal support  [enabled]
  15. using /dev/urandom as source of random entropy
  16. ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0)
  17. ike_alg_register_hash(): Activating OAKLEY_SHA2_512: Ok (ret=0)
  18. ike_alg_register_hash(): Activating OAKLEY_SHA2_256: Ok (ret=0)
  19. starting up 1 cryptographic helpers
  20. started helper pid=25603 (fd:7)
  21. Using Linux XFRM/NETKEY IPsec interface code on 5.3.0-51-generic
  22. ike_alg_register_enc(): Activating aes_ccm_8: Ok (ret=0)
  23. ike_alg_add(): ERROR: algo_type '0', algo_id '0', Algorithm type already exists
  24. ike_alg_register_enc(): Activating aes_ccm_12: FAILED (ret=-17)
  25. ike_alg_add(): ERROR: algo_type '0', algo_id '0', Algorithm type already exists
  26. ike_alg_register_enc(): Activating aes_ccm_16: FAILED (ret=-17)
  27. ike_alg_add(): ERROR: algo_type '0', algo_id '0', Algorithm type already exists
  28. ike_alg_register_enc(): Activating aes_gcm_8: FAILED (ret=-17)
  29. ike_alg_add(): ERROR: algo_type '0', algo_id '0', Algorithm type already exists
  30. ike_alg_register_enc(): Activating aes_gcm_12: FAILED (ret=-17)
  31. ike_alg_add(): ERROR: algo_type '0', algo_id '0', Algorithm type already exists
  32. ike_alg_register_enc(): Activating aes_gcm_16: FAILED (ret=-17)
  33. using /dev/urandom as source of random entropy
  34. loaded key: 8F4C 47D1 466A 6F7C C469 B04C 9525 1F9B E69A E022
  35. loaded key: AD25 3E8F B131 F1DB 5926 B2C9 CCF1 2D3E A9D7 858D
  36. use keyid: 1:8F4C 47D1 466A 6F7C C469 B04C 9525 1F9B E69A E022 / 2:<>
  37. use keyid: 1:AD25 3E8F B131 F1DB 5926 B2C9 CCF1 2D3E A9D7 858D / 2:<>
  38. adding connection: "test"
  39. listening for IKE messages
  40. adding interface ens33/ens33 192.168.1.3:500 (AF_INET)
  41. adding interface ens33/ens33 192.168.1.3:4500
  42. adding interface lo/lo 127.0.0.1:500 (AF_INET)
  43. adding interface lo/lo 127.0.0.1:4500
  44. adding interface lo/lo ::1:500 (AF_INET6)
  45. adding interface ens33/ens33 2409:8a00:18eb:2b00:cdca:7d9:32ac:4d08:500 (AF_INET6)
  46. adding interface ens33/ens33 2409:8a00:18eb:2b00:69e6:ab5c:116a:da03:500 (AF_INET6)
  47. loading secrets from "/etc/ipsec.secrets"
  48. loaded private key for keyid: PPK_RSA:AQPGLAfkE/8F4C 47D1 466A 6F7C C469 B04C 9525 1F9B E69A E022
  49. | creating SPD to 192.168.1.3->spi=00000104@0.0.0.0 proto=61
  50. | creating SPD to 192.168.1.3->spi=00000104@0.0.0.0 proto=61
  51. "test" #1: initiating Main Mode
  52. "test" #1: ERROR: asynchronous network error report on ens33 (sport=500) for message to 192.168.1.13 port 500, complainant 192.168.1.13: Connection refused [errno 111, origin ICMP type 3 code 3 (not authenticated)]
  53. "test" #1: ERROR: asynchronous network error report on ens33 (sport=500) for message to 192.168.1.13 port 500, complainant 192.168.1.13: Connection refused [errno 111, origin ICMP type 3 code 3 (not authenticated)]
  54. "test" #1: ERROR: asynchronous network error report on ens33 (sport=500) for message to 192.168.1.13 port 500, complainant 192.168.1.13: Connection refused [errno 111, origin ICMP type 3 code 3 (not authenticated)]
  55. "test" #1: ERROR: asynchronous network error report on ens33 (sport=500) for message to 192.168.1.13 port 500, complainant 192.168.1.13: Connection refused [errno 111, origin ICMP type 3 code 3 (not authenticated)]
  56. "test" #1: ERROR: asynchronous network error report on ens33 (sport=500) for message to 192.168.1.13 port 500, complainant 192.168.1.13: Connection refused [errno 111, origin ICMP type 3 code 3 (not authenticated)]
  57. pending Quick Mode with 192.168.1.13 "test" took too long -- replacing phase 1
  58. "test" #1: ERROR: asynchronous network error report on ens33 (sport=500) for message to 192.168.1.13 port 500, complainant 192.168.1.13: Connection refused [errno 111, origin ICMP type 3 code 3 (not authenticated)]
  59. packet from 192.168.1.13:500: received Vendor ID payload [Openswan (this version) 2.6.51.5 ]
  60. packet from 192.168.1.13:500: received Vendor ID payload [Dead Peer Detection]
  61. packet from 192.168.1.13:500: received Vendor ID payload [RFC 3947] method set to=115
  62. packet from 192.168.1.13:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] meth=108, but already using method 115
  63. packet from 192.168.1.13:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106, but already using method 115
  64. packet from 192.168.1.13:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] meth=107, but already using method 115
  65. packet from 192.168.1.13:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]
  66. "test" #2: responding to Main Mode
  67. "test" #2: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1
  68. "test" #2: STATE_MAIN_R1: sent MR1, expecting MI2
  69. "test" #2: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike (MacOS X): no NAT detected
  70. "test" #2: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
  71. "test" #2: STATE_MAIN_R2: sent MR2, expecting MI3
  72. | WARNING: /usr/src/openswan-2.6.51.5/programs/pluto/crypt_start_dh.c:160: encryptor 'aes' expects keylen 16/128, SA #2 INITIATOR keylen is 20
  73. | WARNING: /usr/src/openswan-2.6.51.5/programs/pluto/crypt_start_dh.c:160: encryptor 'aes' expects keylen 16/128, SA #2 RESPONDER keylen is 0
  74. | WARNING: /usr/src/openswan-2.6.51.5/programs/pluto/ikev1_main.c:1206: encryptor 'aes' expects keylen 16/128, SA #2 INITIATOR keylen is 20
  75. | WARNING: /usr/src/openswan-2.6.51.5/programs/pluto/ikev1_main.c:1206: encryptor 'aes' expects keylen 16/128, SA #2 RESPONDER keylen is 0
  76. "test" #2: Main mode peer ID is ID_FQDN: '@right'
  77. "test" #2: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3
  78. "test" #2: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_RSA_SIG oursig= theirsig=AQOzIeXfR cipher=aes_128 prf=oakley_sha group=modp1024}
  79. "test" #2: the peer proposed: 10.28.1.0/24:0/0 -> 10.28.2.0/24:0/0
  80. "test" #3: responding to Quick Mode proposal {msgid:d7a7bc25}
  81. "test" #3:     us: 10.28.1.0/24===192.168.1.3[@left]---192.168.1.1
  82. "test" #3:   them: 192.168.1.1---192.168.1.13[@right]===10.28.2.0/24
  83. | creating SPD to 192.168.1.13->spi=00010000@192.168.1.3 proto=4
  84. "test" #3: transition from state STATE_QUICK_R0 to state STATE_QUICK_R1
  85. "test" #3: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2
  86. | creating SPD to 192.168.1.3->spi=00000000@192.168.1.13 proto=4
  87. "test" #3: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2
  88. "test" #3: STATE_QUICK_R2: IPsec SA established tunnel mode {ESP=>0x4476710a <0xaaa03819 xfrm=AES_128-HMAC_SHA1 NATOA=none NATD=none DPD=none}
  89. "test" #1: received Vendor ID payload [Openswan (this version) 2.6.51.5 ]
  90. "test" #1: received Vendor ID payload [Dead Peer Detection]
  91. "test" #1: received Vendor ID payload [RFC 3947] method set to=115
  92. "test" #1: enabling possible NAT-traversal with method RFC 3947 (NAT-Traversal)
  93. "test" #1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2
  94. "test" #1: STATE_MAIN_I2: sent MI2, expecting MR2
  95. | WARNING: /usr/src/openswan-2.6.51.5/programs/pluto/crypt_start_dh.c:160: encryptor 'aes' expects keylen 16/128, SA #1 INITIATOR keylen is 20
  96. | WARNING: /usr/src/openswan-2.6.51.5/programs/pluto/crypt_start_dh.c:160: encryptor 'aes' expects keylen 16/128, SA #1 RESPONDER keylen is 0
  97. "test" #1: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike (MacOS X): no NAT detected
  98. "test" #1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3
  99. "test" #1: STATE_MAIN_I3: sent MI3, expecting MR3
  100. "test" #1: received Vendor ID payload [CAN-IKEv2]
  101. "test" #1: Main mode peer ID is ID_FQDN: '@right'
  102. "test" #1: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4
  103. "test" #1: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_RSA_SIG oursig= theirsig=AQOzIeXfR cipher=aes_128 prf=oakley_sha group=modp1024}
  104. "test" #4: initiating Quick Mode RSASIG+ENCRYPT+TUNNEL+UP+IKEv2ALLOW+SAREFTRACK {using isakmp#1 msgid:e65ec697 proposal=AES(12)_128-SHA1(2)_160 pfsgroup=no-pfs}
  105. | creating SPD to 192.168.1.3->spi=00000000@192.168.1.13 proto=4
  106. "test" #4: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2
  107. "test" #4: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP=>0x5863f7d3 <0xf2d719f9 xfrm=AES_128-HMAC_SHA1 NATOA=none NATD=none DPD=none}
  108. root@ubantu:/var/log#

至此，openswan才是真的编译、安装、环境搭建完毕。

openswan源码ubantu下编译、安装、基本环境搭建的更多相关文章

  1. CentOS6.5下编译安装LAMP环境

    LAMP(Linux-Apache-MySQL-PHP)网站架构是目前国际流行的Web框架.该框架能够满足大流量.大并发量的网站需求:当然.也可以直接使用高性能的服务器.高性能的负载均衡硬件以及CDN ...

  2. centos中软件源码简单的编译安装./configure,make ,make install

    参考 Linux下源码编译安装详解 源码编译安装分三个步骤 1. 编译参数配置 2. 编译 3. 安装 1. 源码编译安装环境检查以及编译参数配置 编译器在开始工作之前,需要知道当前的系统环境,比如标 ...

  3. 下载Dubbo源码后的编译安装启动

    1:安装jdk,maven       配制环境变量: 2:安装zookeeper      配制zookeeper环境变量 3:把dubbo源码编译成war包 启动cmd黑窗口  ,进入  源码文件 ...

  4. linux学习笔记-lrmi源码包的编译安装方法

    我的邮箱地址:zytrenren@163.com欢迎大家交流学习纠错! 官方的lrmi包没有人更新了,如果碰到需要这个编译安装这个包,可以参考我的解决思路,如下: https://pkgs.org/这 ...

  5. centos6.7下编译安装lamp环境

    编译C源代码: 前提:提供开发工具及开发环境 通过“包组”提供开发组件,CentOS 6: "Development Tools", "Server Platform D ...

  6. CentOS 6.4 linux下编译安装 LNMP环境

    1.nginx编译安装 2.PHP编译安装 3.mysql编译安装 4.NGINX配置模板 5.CentOS 6.4 php-fpm 添加service 添加平滑启动/重启

  7. eos源码分析和应用(一)调试环境搭建

    转载自 http://www.limerence2017.com/2018/09/02/eos1/#more eos基于区块链技术实现的开源引擎,开发人员可以基于该引擎开发DAPP(分布式应用).下面 ...

  8. 2019-9-16：渗透测试，基础学习,Linux下软件安装，环境搭建，笔记

    Centos linux下软件安装yum 通过分析rpm包头数据后,自动解决依赖关系,直接云端下载软件,根据不同版本系统获取不同软件信息,按顺序下载rpm包,安装软件yum search 软件名:搜索 ...

  9. 曹工说Redis源码（1）-- redis debug环境搭建，使用clion，达到和调试java一样的效果

    概要 最近写了spring系列,这个系列还在进行中,然后有些同学开始叫我大神,然后以为我各方面都比较厉害,当然了,我是有自知之明的,大佬大神什么的,当作一个称呼就好,如果真的以为自己就是大神,那可能就 ...

随机推荐

  1. 字节跳动、快手等大厂Android面试刨根问底之内存泄露篇

    现在快手字节跳动等公司都在大量招人,薪资优厚,但是想进去却没那么简单,面过的人都知道,这些公司的面试官巴不得把你会的东西都给你挖出来,所以要深入复习知识点,让自己耐问一点.一下是针对内存泄露真实面试过 ...

  2. Windows根据端口号查找对应的进程和服务

    需求 1,我们在Win10安装一些Web服务时,会发现默认端口被占用,比如443端口被占用,808端口被占用,那么如何找出占用这些默认端口的进程和对应的服务呢? 2,系统安装完成后,会有一些应用对外开 ...

  3. [SQL]基本表的定义及其完整性约束

    在使用数据库时,绝大多数时间都是在使用基本表. SQL Server数据类型 截图来源: https://www.w3school.com.cn/sql/sql_datatypes.asp 创建基本表 ...

  4. 十六进制转十进制 BASIC-12

    十六进制转十进制 代码 import java.math.BigInteger; import java.util.Scanner; /* * 从键盘输入一个不超过8位的正的十六进制数字符串, * 将 ...

  5. Switch User Command in Linux

    Switch user command (su) has the following forms: su Switch to , without loading environment variabl ...

  6. 刚学spark

    https://blog.csdn.net/u013019431/article/details/80776662   在jupyter notebook import pysparkhttps:// ...

  7. 安鸾CTF Writeup PHP代码审计01

    PHP代码审计 01 题目URL:http://www.whalwl.xyz:8017 提示:源代码有泄露 既然提示有源代码泄露,我们就先扫描一遍. 精选CTF专用字典: https://github ...

  8. HCNA Routing&Switching之地址转换技术NAT

    前文我们了解了包过滤工具ACL相关话题,回顾请参考https://www.cnblogs.com/qiuhom-1874/p/15156308.html:今天我们来聊一聊地址转换技术NAT相关话题: ...

  9. Windows提权小结

    摸鱼的时候,想想内网这部分还有什么地方适合水一下,翻翻往期,开始填坑 总结一下Windows提权的部分,以后有时间再补一下Linux提权 这仍然是一篇思路总结类的随笔,具体细节内容不展开,也展开不了. ...

  10. CTFre-getit-WP

    攻防世界getit-WP 日子忙起来人也就忙,CTF慢慢刷,慢就是快. 下载之后,也没管别的直接就IDA打开:下载之后,也没管别的直接就IDA打开: 随便点点看得到三个可以字符串.F5看看: 懂个大概 ...