{"action":"created","issue":{"url":"https://api.github.com/repos/xelerance/Openswan/issues/116","labels_url":"https://api.github.com/repos/xelerance/Openswan/issues/116/labels{/name}","comments_url":"https://api.github.com/repos/xelerance/Openswan/issues/116/comments","events_url":"https://api.github.com/repos/xelerance/Openswan/issues/116/events","html_url":"https://github.com/xelerance/Openswan/issues/116","id":59829593,"number":116,"title":"Openswan behind NAT problem (only after 2.6.37)","user":{"login":"djgreg13","id":3840229,"avatar_url":"https://avatars.githubusercontent.com/u/3840229?v=3","gravatar_id":"","url":"https://api.github.com/users/djgreg13","html_url":"https://github.com/djgreg13","followers_url":"https://api.github.com/users/djgreg13/followers","following_url":"https://api.github.com/users/djgreg13/following{/other_user}","gists_url":"https://api.github.com/users/djgreg13/gists{/gist_id}","starred_url":"https://api.github.com/users/djgreg13/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/djgreg13/subscriptions","organizations_url":"https://api.github.com/users/djgreg13/orgs","repos_url":"https://api.github.com/users/djgreg13/repos","events_url":"https://api.github.com/users/djgreg13/events{/privacy}","received_events_url":"https://api.github.com/users/djgreg13/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-03-04T17:14:45Z","updated_at":"2015-03-04T22:00:10Z","closed_at":null,"body":"Hello, i have multiple NAT for attack my openswan server :+1: \r\n10.0.1.201(my server) <> WAN Adress 1 <------> WAN Client1 <> Client1( 192.168.1.10)\r\n\r\nOpenswan crash after upgrade to 2.6.38 or later, downgrade to 2.6.37 resolve problem\r\n\r\nOn OpenSwan 2.6.37 : \r\n```\r\nMar  4 17:38:09 DHCP pluto[1528]: packet from 109.221.173.1:500: received Vendor ID payload [RFC 3947] method set to=109 \r\nMar  4 17:38:09 DHCP pluto[1528]: packet from 109.221.173.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike] method set to=110 \r\nMar  4 17:38:09 DHCP pluto[1528]: packet from 109.221.173.1:500: ignoring unknown Vendor ID payload [8f8d83826d246b6fc7a8a6a428c11de8]\r\nMar  4 17:38:09 DHCP pluto[1528]: packet from 109.221.173.1:500: ignoring unknown Vendor ID payload [439b59f8ba676c4c7737ae22eab8f582]\r\nMar  4 17:38:09 DHCP pluto[1528]: packet from 109.221.173.1:500: ignoring unknown Vendor ID payload [4d1e0e136deafa34c4f3ea9f02ec7285]\r\nMar  4 17:38:09 DHCP pluto[1528]: packet from 109.221.173.1:500: ignoring unknown Vendor ID payload [80d0bb3def54565ee84645d4c85ce3ee]\r\nMar  4 17:38:09 DHCP pluto[1528]: packet from 109.221.173.1:500: ignoring unknown Vendor ID payload [9909b64eed937c6573de52ace952fa6b]\r\nMar  4 17:38:09 DHCP pluto[1528]: packet from 109.221.173.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] meth=108, but already using method 110\r\nMar  4 17:38:09 DHCP pluto[1528]: packet from 109.221.173.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] meth=107, but already using method 110\r\nMar  4 17:38:09 DHCP pluto[1528]: packet from 109.221.173.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106, but already using method 110\r\nMar  4 17:38:09 DHCP pluto[1528]: packet from 109.221.173.1:500: ignoring Vendor ID payload [FRAGMENTATION 80000000]\r\nMar  4 17:38:09 DHCP pluto[1528]: packet from 109.221.173.1:500: received Vendor ID payload [Dead Peer Detection]\r\nMar  4 17:38:09 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[1] 109.221.173.1 #1: responding to Main Mode from unknown peer 109.221.173.1\r\nMar  4 17:38:09 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[1] 109.221.173.1 #1: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1\r\nMar  4 17:38:09 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[1] 109.221.173.1 #1: STATE_MAIN_R1: sent MR1, expecting MI2\r\nMar  4 17:38:09 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[1] 109.221.173.1 #1: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike (MacOS X): both are NATed\r\nMar  4 17:38:09 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[1] 109.221.173.1 #1: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2\r\nMar  4 17:38:09 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[1] 109.221.173.1 #1: STATE_MAIN_R2: sent MR2, expecting MI3\r\nMar  4 17:38:09 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[1] 109.221.173.1 #1: ignoring informational payload, type IPSEC_INITIAL_CONTACT msgid=00000000\r\nMar  4 17:38:09 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[1] 109.221.173.1 #1: Main mode peer ID is ID_IPV4_ADDR: '192.168.1.18'\r\nMar  4 17:38:09 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[1] 109.221.173.1 #1: switched from \"L2TP-PSK-NAT\" to \"L2TP-PSK-NAT\"\r\nMar  4 17:38:09 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[2] 109.221.173.1 #1: deleting connection \"L2TP-PSK-NAT\" instance with peer 109.221.173.1 {isakmp=#0/ipsec=#0}\r\nMar  4 17:38:09 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[2] 109.221.173.1 #1: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3\r\nMar  4 17:38:09 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[2] 109.221.173.1 #1: new NAT mapping for #1, was 109.221.173.1:500, now 109.221.173.1:4500\r\nMar  4 17:38:09 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[2] 109.221.173.1 #1: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=aes_256 prf=oakley_sha group=modp1024}\r\nMar  4 17:38:09 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[2] 109.221.173.1 #1: Dead Peer Detection (RFC 3706): enabled\r\nMar  4 17:38:10 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[2] 109.221.173.1 #1: Applying workaround for Mac OS X NAT-OA bug, ignoring proposed subnet\r\nMar  4 17:38:10 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[2] 109.221.173.1 #1: the peer proposed: 62.210.127.211/32:17/1701 -> 109.221.173.1/32:17/0\r\nMar  4 17:38:10 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[2] 109.221.173.1 #2: responding to Quick Mode proposal {msgid:55d80291}\r\nMar  4 17:38:10 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[2] 109.221.173.1 #2:     us: 10.0.1.201<10.0.1.201>[+S=C]:17/1701---10.0.1.1\r\nMar  4 17:38:10 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[2] 109.221.173.1 #2:   them: 109.221.173.1[192.168.1.18,+S=C]:17/58317\r\nMar  4 17:38:10 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[2] 109.221.173.1 #2: transition from state STATE_QUICK_R0 to state STATE_QUICK_R1\r\nMar  4 17:38:10 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[2] 109.221.173.1 #2: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2\r\nMar  4 17:38:10 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[2] 109.221.173.1 #2: Dead Peer Detection (RFC 3706): enabled\r\nMar  4 17:38:10 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[2] 109.221.173.1 #2: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2\r\nMar  4 17:38:10 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[2] 109.221.173.1 #2: STATE_QUICK_R2: IPsec SA established transport mode {ESP=>0x0bc96274 <0x6ef7c556 xfrm=AES_256-HMAC_SHA1 NATOA=none NATD=109.221.173.1:4500 DPD=enabled}\r\n```\r\n\r\nOn OpenSwan 2.6.38 :\r\n```\r\nMar  4 17:34:17 DHCP pluto[1381]: packet from 109.221.173.1:500: received Vendor ID payload [RFC 3947] method set to=115 \r\nMar  4 17:34:17 DHCP pluto[1381]: packet from 109.221.173.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike] meth=114, but already using method 115\r\nMar  4 17:34:17 DHCP pluto[1381]: packet from 109.221.173.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-08] meth=113, but already using method 115\r\nMar  4 17:34:17 DHCP pluto[1381]: packet from 109.221.173.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-07] meth=112, but already using method 115\r\nMar  4 17:34:17 DHCP pluto[1381]: packet from 109.221.173.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-06] meth=111, but already using method 115\r\nMar  4 17:34:17 DHCP pluto[1381]: packet from 109.221.173.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-05] meth=110, but already using method 115\r\nMar  4 17:34:17 DHCP pluto[1381]: packet from 109.221.173.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-04] meth=109, but already using method 115\r\nMar  4 17:34:17 DHCP pluto[1381]: packet from 109.221.173.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] meth=108, but already using method 115\r\nMar  4 17:34:17 DHCP pluto[1381]: packet from 109.221.173.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] meth=107, but already using method 115\r\nMar  4 17:34:17 DHCP pluto[1381]: packet from 109.221.173.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106, but already using method 115\r\nMar  4 17:34:17 DHCP pluto[1381]: packet from 109.221.173.1:500: ignoring Vendor ID payload [FRAGMENTATION 80000000]\r\nMar  4 17:34:17 DHCP pluto[1381]: packet from 109.221.173.1:500: received Vendor ID payload [Dead Peer Detection]\r\nMar  4 17:34:17 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[3] 109.221.173.1 #3: responding to Main Mode from unknown peer 109.221.173.1\r\nMar  4 17:34:17 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[3] 109.221.173.1 #3: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1\r\nMar  4 17:34:17 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[3] 109.221.173.1 #3: STATE_MAIN_R1: sent MR1, expecting MI2\r\nMar  4 17:34:17 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[3] 109.221.173.1 #3: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike (MacOS X): both are NATed\r\nMar  4 17:34:17 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[3] 109.221.173.1 #3: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2\r\nMar  4 17:34:17 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[3] 109.221.173.1 #3: STATE_MAIN_R2: sent MR2, expecting MI3\r\nMar  4 17:34:17 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[3] 109.221.173.1 #3: ignoring informational payload, type IPSEC_INITIAL_CONTACT msgid=00000000\r\nMar  4 17:34:17 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[3] 109.221.173.1 #3: Main mode peer ID is ID_IPV4_ADDR: '192.168.1.18'\r\nMar  4 17:34:17 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[3] 109.221.173.1 #3: switched from \"L2TP-PSK-NAT\" to \"L2TP-PSK-NAT\"\r\nMar  4 17:34:17 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[4] 109.221.173.1 #3: deleting connection \"L2TP-PSK-NAT\" instance with peer 109.221.173.1 {isakmp=#0/ipsec=#0}\r\nMar  4 17:34:17 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[4] 109.221.173.1 #3: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3\r\nMar  4 17:34:17 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[4] 109.221.173.1 #3: new NAT mapping for #3, was 109.221.173.1:500, now 109.221.173.1:4500\r\nMar  4 17:34:17 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[4] 109.221.173.1 #3: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=aes_256 prf=oakley_sha group=modp1024}\r\nMar  4 17:34:17 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[4] 109.221.173.1 #3: Dead Peer Detection (RFC 3706): enabled\r\nMar  4 17:34:18 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[4] 109.221.173.1 #3: the peer proposed: 62.210.127.211/32:17/1701 -> 192.168.1.18/32:17/0\r\nMar  4 17:34:18 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[4] 109.221.173.1 #3: NAT-Traversal: received 2 NAT-OA. using first, ignoring others\r\nMar  4 17:34:18 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[4] 109.221.173.1 #4: responding to Quick Mode proposal {msgid:da98c9fd}\r\nMar  4 17:34:18 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[4] 109.221.173.1 #4:     us: 10.0.1.201<10.0.1.201>:17/1701---10.0.1.1\r\nMar  4 17:34:18 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[4] 109.221.173.1 #4:   them: 109.221.173.1[192.168.1.18]:17/58376===192.168.1.18/32\r\nMar  4 17:34:18 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[4] 109.221.173.1 #4: transition from state STATE_QUICK_R0 to state STATE_QUICK_R1\r\nMar  4 17:34:18 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[4] 109.221.173.1 #4: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2\r\nMar  4 17:34:18 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[4] 109.221.173.1 #4: Dead Peer Detection (RFC 3706): enabled\r\nMar  4 17:34:18 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[4] 109.221.173.1 #4: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2\r\nMar  4 17:34:18 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[4] 109.221.173.1 #4: STATE_QUICK_R2: IPsec SA established transport mode {ESP=>0x0fb072ef <0xc19dc813 xfrm=AES_256-HMAC_SHA1 NATOA=192.168.1.18 NATD=109.221.173.1:4500 DPD=enabled}\r\nMar  4 17:34:38 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[4] 109.221.173.1 #3: received Delete SA(0x0fb072ef) payload: deleting IPSEC State #4\r\nMar  4 17:34:38 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[4] 109.221.173.1 #3: ERROR: netlink XFRM_MSG_DELPOLICY response for flow eroute_connection delete included errno 2: No such file or directory\r\nMar  4 17:34:38 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[4] 109.221.173.1 #3: received and ignored informational message\r\nMar  4 17:34:38 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[4] 109.221.173.1 #3: received Delete SA payload: deleting ISAKMP State #3\r\nMar  4 17:34:38 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[4] 109.221.173.1: deleting connection \"L2TP-PSK-NAT\" instance with peer 109.221.173.1 {isakmp=#0/ipsec=#0}\r\nMar  4 17:34:38 DHCP pluto[1381]: packet from 109.221.173.1:4500: received and ignored informational message\r\n```"},"comment":{"url":"https://api.github.com/repos/xelerance/Openswan/issues/comments/77259141","html_url":"https://github.com/xelerance/Openswan/issues/116#issuecomment-77259141","issue_url":"https://api.github.com/repos/xelerance/Openswan/issues/116","id":77259141,"user":{"login":"simondeziel","id":545509,"avatar_url":"https://avatars.githubusercontent.com/u/545509?v=3","gravatar_id":"","url":"https://api.github.com/users/simondeziel","html_url":"https://github.com/simondeziel","followers_url":"https://api.github.com/users/simondeziel/followers","following_url":"https://api.github.com/users/simondeziel/following{/other_user}","gists_url":"https://api.github.com/users/simondeziel/gists{/gist_id}","starred_url":"https://api.github.com/users/simondeziel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/simondeziel/subscriptions","organizations_url":"https://api.github.com/users/simondeziel/orgs","repos_url":"https://api.github.com/users/simondeziel/repos","events_url":"https://api.github.com/users/simondeziel/events{/privacy}","received_events_url":"https://api.github.com/users/simondeziel/received_events","type":"User","site_admin":false},"created_at":"2015-03-04T22:00:10Z","updated_at":"2015-03-04T22:00:10Z","body":"I'm not debating if my patch is good or bad, I'm just saying that it can hardly be it because it is not part of 2.6.38. That said, my patch seems to pass our automated test suite but that doesn't involve clients that are not OSW.\r\n\r\nOf course, before including it in a stable release, we'll test it with iPhone/OSX clients."}}