Thanks. The only thing I did was "ipsec start/ipsec stop". It does not seem possible that administrator or something else could delete the interface or IP (and thus the SA). Is it possible that the code race condition and tries to delete the SA twice? I can probably just ignore it for now.
Thanks, Xinwei On Tue, Jan 31, 2017 at 11:54 AM, Paul Wouters <[email protected]> wrote: > On Tue, 31 Jan 2017, Xinwei Hong wrote: > > My VPN works fine. I can start/stop it without problem and I can ping to >> the other side. However, I see some error >> message in /var/log/auth.log when I stop ipsec or bring down an >> interface. >> --- >> >> Jan 31 11:29:19 xenial33 pluto[20656]: "my_vpn": deleting connection >> Jan 31 11:29:19 xenial33 pluto[20656]: "my_vpn" #3: deleting state >> (STATE_QUICK_I2) >> Jan 31 11:29:19 xenial33 pluto[20656]: "my_vpn" #3: ESP traffic >> information: in=0B out=0B >> Jan 31 11:29:19 xenial33 pluto[20656]: "my_vpn" #3: ERROR: netlink >> response for Del SA [email protected] >> included errno 3: No such process >> Jan 31 11:29:19 xenial33 pluto[20656]: "my_vpn" #3: ERROR: netlink >> response for Del SA [email protected] >> included errno 3: No such process >> > > That means something, not pluto, deleted the IPsec SA. It could be the > administrator running "ip xfrm pol flush", or the kernel deciding to > kill the ipsec sa because the physical device or IP vanished. Ideally, > this should not happen, and the kernel should tell us. It seems we don't > always catch all of those events. > > Jan 31 11:28:03 xenial33 pluto[20656]: "my_vpn" #1: initiating Main Mode >> Jan 31 11:28:03 xenial33 pluto[20656]: reapchild failed with errno=10 No >> child processes >> > > That's unrelated and was fixed in 3.19. It causes no hardm whatsoever. > > Paul >
_______________________________________________ Swan mailing list [email protected] https://lists.libreswan.org/mailman/listinfo/swan
