thr3ads.net - LARTC - IPSEC FIRST LIGHT! (by non-kernel developer :-)) [Nov 2002]

If this information is useful, please help other people find it:
Share via:

bert hubert

2002-Nov-07 13:02 UTC

IPSEC FIRST LIGHT! (by non-kernel developer :-))

On Thu, Nov 07, 2002 at 02:52:50AM -0800, David S. Miller wrote:
> Really, if this one doesn''t apply, your 2.5 bitkeeper tree is not
> totally uptodate.
It works in transport mode! Both EH/ASP.

Hints:
	Use the latest bitkeeper sources as of Thurday morning MET

	Apply the last patch Alexey sent in the ''silly advise'' thread
		on linux kernel mailinglist

	Do not compile anything AH/ESP/CRYPTO as modules
		failed for me with bad oops

	Make very very sure that you are not filtering ipsec packets
		iptables needs to allow protocols 50 and 51

	Use the KAME tools port on ftp://ftp.inr.ac.ru/ip-routing/ipsec/
		racoon won''t compile, you don''t need it yet
		point it at your 2.5.46+bk+davem tree (edit GNUMakefiles)

	Use 3des-cbc
		examples online use blowfish-cbc but that gives an error
		in setkey

Configuration (needs the setkey tool) on 10.0.0.11:

#!./setkey -f
flush;
spdflush;

# AH
add 10.0.0.11 10.0.0.216 ah 15700 -A hmac-md5 "1234567890123456";
add 10.0.0.216 10.0.0.11 ah 24500 -A hmac-md5 "1234567890123456";

# ESP
add 10.0.0.11 10.0.0.216 esp 15701 -E 3des-cbc
"123456789012123456789012";
add 10.0.0.216 10.0.0.11 esp 24501 -E 3des-cbc
"123456789012123456789012";

spdadd 10.0.0.216 10.0.0.11 icmp -P out ipsec
           esp/transport//use
           ah/transport//use;

Configuration on 10.0.0.216:

#!./setkey -f 
flush;
spdflush;

# AH
add 10.0.0.11 10.0.0.216 ah 15700 -A hmac-md5 "1234567890123456";
add 10.0.0.216 10.0.0.11 ah 24500 -A hmac-md5 "1234567890123456";

# ESP
add 10.0.0.11 10.0.0.216 esp 15701 -E 3des-cbc
"123456789012123456789012";
add 10.0.0.216 10.0.0.11 esp 24501 -E 3des-cbc
"123456789012123456789012";

# this is reversed
spdadd 10.0.0.11 10.0.0.216 icmp -P out ipsec
           esp/transport//use
           ah/transport//use;

# ping 10.0.0.11
PING 10.0.0.11 (10.0.0.11) from 10.0.0.216 : 56(84) bytes of data.
64 bytes from 10.0.0.11: icmp_seq=1 ttl=64 time=1.11 ms

$ sudo tcpdump -n -i eth0 -p 
tcpdump: listening on eth0
13:55:42.381669 10.0.0.216 > 10.0.0.11: AH(spi=0x00005fb4,seq=0x39):
ESP(spi=0x00005fb5,seq=0x39) (DF)
13:55:42.382518 10.0.0.11 > 10.0.0.216: AH(spi=0x00003d54,seq=0x39):
ESP(spi=0x00003d55,seq=0x39)

Great work everybody! I''m very impressed.

Regards,

bert


-- 
http://www.PowerDNS.com          Versatile DNS Software & Services
http://lartc.org           Linux Advanced Routing & Traffic Control HOWTO
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

James Morris

2002-Nov-07 13:14 UTC

head link

Re: IPSEC FIRST LIGHT! (by non-kernel developer :-))

On Thu, 7 Nov 2002, bert hubert wrote:
> 	Use 3des-cbc
> 		examples online use blowfish-cbc but that gives an error
> 		in setkey
The kernel keying code doesn''t know about blowfish yet, but it soon
will.


- James
-- 
James Morris
<jmorris@intercode.com.au>

bert hubert

2002-Nov-07 13:18 UTC

head link

Re: IPSEC FIRST LIGHT! (by non-kernel developer :-))

On Thu, Nov 07, 2002 at 02:02:44PM +0100, bert hubert
wrote:> On Thu, Nov 07, 2002 at 02:52:50AM -0800, David S. Miller wrote:
> 
> > Really, if this one doesn''t apply, your 2.5 bitkeeper tree is
not
> > totally uptodate.
> 
> It works in transport mode! Both EH/ASP.
> 
> Hints:
> 	Use the latest bitkeeper sources as of Thurday morning MET
By the way, this is on ftp.nl.linux.org/pub/linux/bk2patch and then the
tagged-to-head.v2.5 file.

Regards,

bert

-- 
http://www.PowerDNS.com          Versatile DNS Software & Services
http://lartc.org           Linux Advanced Routing & Traffic Control HOWTO
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

David S. Miller

2002-Nov-07 13:21 UTC

head link

Re: IPSEC FIRST LIGHT! (by non-kernel developer :-))

From: bert hubert <ahu@ds9a.nl>
   Date: Thu, 7 Nov 2002 14:02:44 +0100
   
   Great work everybody! I''m very impressed.

Thanks for testing :-)

As James said, pfkeyv2 just needs to be taught how to use
the more recently added crypto algorithms.

Mike Diehl

2002-Nov-08 01:59 UTC

head link

Re: [LARTC] IPSEC FIRST LIGHT! (by non-kernel developer :-))

So the IPSec in the 2.5 kernel actually works!!!  I had heard it was mostly 
nonfunctional.

This is good news.  FreeSwan has some quirky political policys.

On Thursday 07 November 2002 08:02 am, bert hubert wrote:
     > On Thu, Nov 07, 2002 at 02:52:50AM -0800, David S. Miller wrote:
     > > Really, if this one doesn''t apply, your 2.5 bitkeeper
tree is not
     > > totally uptodate.
     >
     > It works in transport mode! Both EH/ASP.
     >
     > Hints:
     > 	Use the latest bitkeeper sources as of Thurday morning MET
     >
     > 	Apply the last patch Alexey sent in the ''silly
advise'' thread
     > 		on linux kernel mailinglist
     >
     > 	Do not compile anything AH/ESP/CRYPTO as modules
     > 		failed for me with bad oops
     >
     > 	Make very very sure that you are not filtering ipsec packets
     > 		iptables needs to allow protocols 50 and 51
     >
     > 	Use the KAME tools port on ftp://ftp.inr.ac.ru/ip-routing/ipsec/
     > 		racoon won''t compile, you don''t need it yet
     > 		point it at your 2.5.46+bk+davem tree (edit GNUMakefiles)
     >
     > 	Use 3des-cbc
     > 		examples online use blowfish-cbc but that gives an error
     > 		in setkey
     >
     > Configuration (needs the setkey tool) on 10.0.0.11:
     >
     > #!./setkey -f
     > flush;
     > spdflush;
     >
     > # AH
     > add 10.0.0.11 10.0.0.216 ah 15700 -A hmac-md5
"1234567890123456";
     > add 10.0.0.216 10.0.0.11 ah 24500 -A hmac-md5
"1234567890123456";
     >
     > # ESP
     > add 10.0.0.11 10.0.0.216 esp 15701 -E 3des-cbc
     > "123456789012123456789012"; add 10.0.0.216 10.0.0.11 esp
24501 -E
     > 3des-cbc "123456789012123456789012";
     >
     > spdadd 10.0.0.216 10.0.0.11 icmp -P out ipsec
     >            esp/transport//use
     >            ah/transport//use;
     >
     > Configuration on 10.0.0.216:
     >
     > #!./setkey -f
     > flush;
     > spdflush;
     >
     > # AH
     > add 10.0.0.11 10.0.0.216 ah 15700 -A hmac-md5
"1234567890123456";
     > add 10.0.0.216 10.0.0.11 ah 24500 -A hmac-md5
"1234567890123456";
     >
     > # ESP
     > add 10.0.0.11 10.0.0.216 esp 15701 -E 3des-cbc
     > "123456789012123456789012"; add 10.0.0.216 10.0.0.11 esp
24501 -E
     > 3des-cbc "123456789012123456789012";
     >
     > # this is reversed
     > spdadd 10.0.0.11 10.0.0.216 icmp -P out ipsec
     >            esp/transport//use
     >            ah/transport//use;
     >
     > # ping 10.0.0.11
     > PING 10.0.0.11 (10.0.0.11) from 10.0.0.216 : 56(84) bytes of data.
     > 64 bytes from 10.0.0.11: icmp_seq=1 ttl=64 time=1.11 ms
     >
     > $ sudo tcpdump -n -i eth0 -p
     > tcpdump: listening on eth0
     > 13:55:42.381669 10.0.0.216 > 10.0.0.11:
AH(spi=0x00005fb4,seq=0x39):
     > ESP(spi=0x00005fb5,seq=0x39) (DF)
     > 13:55:42.382518 10.0.0.11 > 10.0.0.216:
AH(spi=0x00003d54,seq=0x39):
     > ESP(spi=0x00003d55,seq=0x39)
     >
     > Great work everybody! I''m very impressed.
     >
     > Regards,
     >
     > bert

-- 
Mike Diehl
PGP Encrypted E-mail preferred.
Public Key via: http://dominion.dyndns.org/~mdiehl/mdiehl.asc

LARTC - Nov 2002 - IPSEC FIRST LIGHT! (by non-kernel developer :-))

IPSEC FIRST LIGHT! (by non-kernel developer :-))

Re: IPSEC FIRST LIGHT! (by non-kernel developer :-))

Re: IPSEC FIRST LIGHT! (by non-kernel developer :-))

Re: IPSEC FIRST LIGHT! (by non-kernel developer :-))

Re: [LARTC] IPSEC FIRST LIGHT! (by non-kernel developer :-))