Messages in this thread | | | Date | Tue, 6 Jan 2004 20:23:07 +0100 | From | martin f krafft <> | Subject | (2.6 IPsec) tcpdump: "truncated-ip - 12 bytes missing!" |
| |
Hi all,
I've not been told off with IPsec questions, so here's another one. Using the Kame tools, I managed to get a network-to-host tunnel set up: -------------------------- -------------- 10.1.2.0/24 --- | 10.1.2.1 gateway 4.5.6.7 | --- | 4.3.2.1 host | -------------------------- ^ -------------- |IPsec
In words: everything between the 4.3.2.1 host and the network 10.1.2.0/24 is encrypted, with the (masquerading) gateway and the host serving as tunnel endpoints.
This is working with the following configuration on the gateway:
add 4.5.6.7 4.3.2.1 ah 0x200 -m tunnel -A hmac-sha1 "key1"; add 4.3.2.1 4.5.6.7 ah 0x300 -m tunnel -A hmac-sha1 "key2";
add 4.5.6.7 4.3.2.1 esp 0x201 -m tunnel -E twofish-cbc "key3"; add 4.3.2.1 4.5.6.7 esp 0x301 -m tunnel -E twofish-cbc "key4";
spdadd 10.1.2.0/24 4.3.2.1 any -P out ipsec esp/tunnel/4.5.6.7-4.3.2.1/require ah/tunnel/4.5.6.7-4.3.2.1/require;
spdadd 4.3.2.1 10.1.2.0/24 any -P in ipsec esp/tunnel/4.3.2.1-4.5.6.7/require ah/tunnel/4.3.2.1-4.5.6.7/require;
and the same on the single host, with the policies switched.
Connectivity is fine, but as I checked the packets arriving at the single host with tcpdump, I was kinda startled and don't know anymore what's going on. Here's the output of one timestep (they are all at the same time), line by line:
1. 4.5.6.7 > 4.3.2.1: AH(spi=0x00000200,seq=0xcd): 4.5.6.7 > 4.3.2.1: ESP(spi=0x00000201,seq=0xcd) (DF) [tos 0x10] (ipip-proto-4)
perfect! the packet arrived from the gateway, the AH and ESP SPIs are what I told them to be.
2. 4.5.6.7 > 4.3.2.1: AH(spi=0x45100080,seq=0x67be4000): 4.5.6.7 > 4.3.2.1: ESP(spi=0x00000201,seq=0xcd) (DF) [tos 0x10] (ipip-proto-4)
what's this? i only sent one packet, and even though the ESP SPI is correct, the AH SPI is totally random. tcpdump now says:
truncated-ip - 12 bytes missing! 4.5.6.7 > 4.3.2.1: AH(spi=0x45100080,seq=0x67be4000): 4.5.6.7 > 4.3.2.1: [|ip] (ipip-proto-4) (ipip-proto-4)
and then (a fraction of a second later):
3. 4.3.2.1 > 4.5.6.7: AH(spi=0x00000300,seq=0xfc6): 4.3.2.1 > 4.5.6.7: ESP(spi=0x00000301,seq=0xfc6) (DF) [tos 0x10] (ipip-proto-4)
this is the answer, using the appropriate SPIs for AH and ESP.
So then, where did the second packet come from?
Thanks for any input!
-- martin; (greetings from the heart of the sun.) \____ echo mailto: !#^."<*>"|tr "<*> mailto:" net@madduck invalid/expired pgp subkeys? use subkeys.pgp.net as keyserver! there is no place like ~ [unhandled content-type:application/pgp-signature] | |